Thriving in the age of platform regulation
Natalia Greene, Online Safety Expert, PA Consulting provides five ‘no regrets’ steps for online service providers.
Following the lead of pioneers like Australia’s eSafety Commissioner, the Digital Services Act is now in effect in Europe.
Meanwhile the UK’s Online Safety Act is in the process of being implemented.
Across the world, more governments continue to draft and enact legislation that will transform the way online services operate and the shape of the internet as we know it.
While the businesses in regulatory scope vary within each jurisdiction, most laws primarily target ‘platforms’ – online services that connect users, whether that be e-commerce and gaming or forums and social media.
In the private sector, preparing to comply with new online safety regimes is a complex task.
But, proactively meeting the challenge will help service providers avoid costly sanctions and, most importantly, identify opportunities that will enable them to thrive in the age of internet regulation.
There are five ‘no regrets’ steps platforms can take to ensure readiness for incoming online safety regimes.
Businesses with platform clients, such as producers of safety or security tech, should also be aware of these likely changes, so they too can adapt as appropriate.
Assess the impact on your commercial model
A reliance on advertising as the sole or primary source of platform revenue is a risky strategy in the era of internet regulation.
By relying on advertising, the risk of maintaining user engagement at any cost emerges – something which has ostensibly fuelled many harmful dynamics that new regulators want to reverse.
Under the Digital Services Act, it is illegal for providers to target children with adverts based on profiling or personal data or any user on the basis of sensitive data.
The legislation also bans deceptive or nudging techniques.
The UK Online Safety Act requires platforms to mitigate risks of algorithms and recommender systems increasing exposure to harmful or illegal content.
A study published by Ofcom in 2023 revealed that investors are now more aware of the risks of advertising business models.
But, in spite of this, most platforms still make most of their money from adverts, signalling a seismic shift on the horizon.
Service providers that thrive in the future will be those who have evaluated the impact of new laws on their commercial model and who adapt and diversify as appropriate – for example, by introducing subscription models as an alternative means of revenue generation, something many of the major platforms are already doing.
Define your global minimum safety standard
In 2022, Australia’s eSafety Commissioner, Fiji’s Online Safety Commission and Ofcom teamed up to launch the Global Online Safety Regulators’ Network (GOSN), a collaboration aimed at enabling an aligned international approach to platform regulation.
The group’s membership has since expanded to include representatives from France, Ireland, the Republic of Korea, Slovakia and South Africa, as global momentum towards regulation has continued.
However, while there is alignment across regimes, differences persist. Examples include the harms, crimes and categories of providers in regulatory scope.
Such differences can multiply compliance challenges for global platforms.
They create a need to execute local compliance programs in different jurisdictions, to respond to different laws.
But, as the international regulatory landscape continues to evolve, ensuring general preparedness across markets is equally important.
Defining a minimum global safety standard for your business by mapping the requirements common to existing online safety frameworks is a good place to start.
This will help to minimise the disruptive impact as new regulation is enacted in additional jurisdictions, while preserving the consistency of users’ experiences and therefore international brand reputation.
Consider assuring or verifying the age of users
Most online safety laws include requirements designed to afford enhanced protections to children.
Examples include duties to safeguard minors from harmful and ‘age inappropriate’ – as well as illegal – content, and the requirement to integrate parental control systems.
Knowing how old your users are is the only sure way of confirming whether child safety requirements are in play. A user’s ‘self-declaration’ will not suffice as proof of age under most new regimes.
Common reservations about age assurance and verification include the cost and accuracy of tools, and the additional friction they can inject at the point of sign-up or login.
These considerations should be weighed against the benefit of knowing with certainty how old your users are. In the real world, you don’t need to look far for evidence of the opportunities unlocked by age-based product differentiation.
An example is the expanding market for teen banking and budgeting apps designed specifically to improve poor financial literacy.
Replicated for the online realm, this could be a transformative change that, in addition to making services safer, enhances the online experiences of children and adults alike.
UX professionals will play a key role in the delivery of this change and the sector will receive a big boost as a result:
New online safety laws are creating sustained demand for child-centred design experts, including specialists in the development of inclusive offerings for children with additional or differentiated needs.
Identify the changes needed to promote compliance
A decade ago, most workplaces were not doing enough to promote inclusion and diversity. Although it’s still a journey, many are now doing better.
The UK Equalities Act – the basis for workplace non-discrimination training – was enacted in 2010. So why has it taken so long for inclusion and diversity to become properly embedded in workplace culture?
The answer is that it’s taken many companies a long time to implement the changes needed to deliver the transformation the legislation intended.
In 2011, the number of UK employment tribunals had declined by 14%. By 2020, it had halved.
The lessons for online service providers are clear. If preparations for regulation are limited to process and technology changes, you might never move beyond surface level compliance and therefore continue to risk breaches and sanctions.
Examining strategy, governance, structure and culture will be vital. As a minimum, organisations should ensure that named individuals are accountable for safety duties and that the structure affords that individual a voice, or at the very least, sponsorship at the highest levels.
If trust/safety teams don’t work with product and policy, the adjustments should be made to enable safety-first design.
Investing in compliance as a business function
Online safety laws seek to tackle nascent and complex issues.
As a result, approaches vary and some are contentious. In March 2024, the US state of Florida made the decision to ban social media for children under the age of fourteen.
The context in which laws are implemented can also generate controversy: India’s framework – the Digital India Act – is on its way to becoming law, but in the past five years, the government has imposed more internet blackouts than any other country, generating accusations of censorship.
Standards are useful in any sector, because they help companies understand ‘what good looks like’.
But a blinkered approach to implementing them, without weighing the wider global and ethical context, could undermine your status as a responsible corporate citizen and negatively impact your brand.
To avoid this, make compliance into an enduring function, staffed with policy and regulation experts capable of assessing laws and evolving situational factors.
As more governments across the world draft and enact legislation to change the way online services operate, impacted organisations need to look beyond immediate laws and prepare for a new reality.
This will be a complex task, but meeting the challenge head on will be crucial.
Those who invest to get ahead of new online safety regimes will be equipped to thrive and chart a path to future growth.