Can the Online Safety Act be fixed?

Three years after the UK's Online Safety Act received Royal Assent, no-one is happy and the air is thick with complaints.

Supporters say that implementation has been too slow, too cautious, and that the Act hasn’t made any real difference. Enforcement is said to be a paper tiger: Ofcom is too risk-averse, interprets the Act too narrowly, doesn’t have strong enough powers, or all three. Ofcom stands accused of failing to meet the expectations of Parliamentarians.

Critics of the Act complain (among many other things) of lack of clarity on scope, baked-in over-removal of user content, chilling effects on small low risk forums, privacy impacts, and overreaching age-gating of user content.

In parallel we have the forthcoming under-16 social media ban. That, according to the DCMS Minister in a recent e-petition debate, will “capture user-to-user platforms whose purpose is to enable online interaction and which allow users to post material, alongside having an algorithm.” The Culture Secretary has recently suggested that that might extend to online marketplaces with messaging functionality.

All this is taking place against a background of US political perception that UK and EU online safety laws are guilty of extraterritorial overreach. 

Proposals for change

In its written evidence to the Lords Communications and Digital Committee Ofcom said: 

“We hear the critique that the pace of change is too slow. Our legal duties and the regulatory process do place constraints on the pace of our work – we need to consult stakeholders on policies, ensure our decision-making is based on robust evidence, take account of human rights law and give firms the opportunity to make representations on our decisions, among other things.” [5.3]

That fairly summarises the encumbrances that tend to attach to a “regulation by regulator” scheme such as the OSA. A defensible compromise between certainty and regulatory flexibility inevitably involves wrapping the legislation in substantive and procedural safeguards on exercise of the regulator’s functions and powers. A wide-ranging regulatory structure that required Ofcom to write and consult on dozens of statutory documents was always likely to take years to implement.

Ofcom continued:

“However, we are committed to finding ways to work faster, while continuing to focus relentlessly on better outcomes for users. We would welcome the opportunity to discuss this further with the Committee once our review is published.” (ibid)

The current clamour for amendments begs the question whether legislation built (as I have argued) on defectively designed foundations can ever be fixed by drawing up a snagging list. If not, we may be destined to go through this exercise over and again: a regulatory boom and bust cycle veering between flexibility and prescription, delegation and legislative control, something like this:

(AI visual assistance acknowledged)

Putting that existential question to one side, we can look at some of the proposals that have been made for amendment of the Act. This selection is gleaned mostly from evidence, mainly but not exclusively from Ofcom, currently being given to the Lords Communications and Digital Committee Inquiry into implementation and impact of the Act. 

These are by no means all the proposals for change that have been floated. The Online Safety Network, for instance, has published a more extensive 10 point list of revisions. On the critics’ side, in May 2025 the Open Rights Group published a 41 point report ‘How to Fix the Online Safety Act: A Rights First Approach’.

Nor does this post discuss plans to extend the ambit of the Act by, for instance, bringing AI services into scope in their own right. For AI-generated illegal content, powers to do that by means of secondary legislation have already been inserted into the Act.

One note of caution: there is a temptation to equate in-scope user-to-user services with large, algorithmically-driven data-hungry social media platforms. The Act covers a far greater variety of platforms, large and small. Ofcom’s overview of in-scope U2U services identifies not only social media services but video-sharing, messaging, online marketplaces and listing sites, dating services, review services, online games, file-sharing, audio-sharing, discussion forums, chat rooms, information sharing services (including collaborative encyclopaedias such as Wikipedia) and fundraising sites. There are more, such as collaborative software development and sharing platforms.

The government’s Bill Impact Assessment estimated that 100,000 service providers world-wide would be in scope. Of 25,000 in-scope UK providers, 80% were estimated to be micro-businesses (less than 10 employees). The Act applies to non-commercial providers such as volunteer-led forums.

If legislation is designed on the premise that the target is algorithmic social media services, it is unlikely to be a good fit for what in reality may constitute the vast numerical majority of services covered by the Act.

Legal certainty and foreseeability

Some might like simply to hand Ofcom a litigation-proof cudgel with which to beat up any tech company that incurs their displeasure. But that will not do. Foreseeability is a basic rule of law and European Convention on Human Rights (ECHR) tenet: subjects of statutory regulation should be able to predict in advance, with reasonable certainty, what they have to do to comply with their obligations. The Online Safety Act, either itself or as implemented by Ofcom, has to provide sufficiently clear and precise rules. Even the Devil, as Robert Bolt wrote in A Man for All Seasons, should be given the benefit of law.

In evidence to the Lords Communications and Digital Committee the Children’s Commissioner complained about Ofcom’s Children’s Code of Practice:

“When I read the children’s code, I was so disappointed. It felt like it was a technical document written for the companies, not a document written to every child in this country about how Ofcom was going to try to keep them safe. That is what it should have been.” (Dame Rachel de Souza, Oral evidence Q7, 1 September 2026)

An OSA Code of Practice, however, is not meant to be a children’s guidebook. Its function is to enable platforms to know what they have to do to comply. Schedule 4 of the Act spells it out: Code of Practice measures must be sufficiently clear, and at a sufficiently detailed level, that providers understand what those measures entail in practice.

In addition, for the Online Safety Act foreseeability is not just about platforms themselves. It is also about users. The Act sets up a triangular relationship between legislation/regulator, platform and user. A user’s freedom of expression rights under Article 10 ECHR are engaged when a platform, in order to discharge its OSA duties, takes steps that may affect a user’s posts.

So Ofcom’s recommendations for platforms have to be crafted with an eye to enabling a user to foresee, with reasonable certainty, whether what they want to post is liable to be affected by the platform’s compliance with an Ofcom Code of Practice. Even if it clearly sets out what a platform has to do to comply, an Ofcom recommended measure may yet be insufficiently foreseeable in its effects on users. An example of this is noted below, under Proactive technology.

The contribution that Ofcom’s Codes of Practice can make to foreseeability is seen in the government’s ECHR Memorandum on the draft Bill. When discussing the Article 10 rights of platforms and users it said:

“Prescribed by law: The Bill establishes an overarching regulatory framework governing the treatment of content online. In addition to the detailed provisions contained in the primary legislation, its application in specific cases will be given a higher degree of legal certainty through the exercise of delegated powers by the Secretary of State and the issuing of codes of practice by OFCOM.” [27]

Even if Schedule 4 of the Act did not stipulate for clear and detailed measures, the ECHR “prescribed by law” threshold would still require a reasonable level of clarity and precision to be achieved. The more broadly drawn the duties in the Act itself, the greater the need for Ofcom to provide that clarity and precision.

Is legal certainty really a problem?

It might be suggested that if common law duties of care like negligence and occupier’s liability can be articulated in broad terms such as a duty to take reasonable care, why cannot the Online Safety Act and Ofcom do the same? It is a good question. But a hidden danger lies in building a regulatory structure on the foundation of analogies that, although appealing at first sight, prove to be more different than they are similar.

Lack of congruence with existing duties of care feeds into requirements of legal certainty. The further the Online Safety Act goes beyond incremental development of established duties, the greater the need - if its duties are to pass the ECHR or rule of law foreseeability test – for their content to be clearly and precisely spelt out.

Established duties of care based on the common law can pass the ECHR and rule of law foreseeability test, first because they draw on a substantial volume of existing caselaw; and second, because any development of that law by the courts is incremental and thus within the bounds of reasonable foreseeability.

The Online Safety Act illegality duties, however, venture into new territory. They bear little resemblance to the subject matter or content of established safety-related duties of care (or, for that matter, health and safety regulation) with which analogies have been drawn.

Two aspects, in particular, undermine the comparison.

First, the subject-matter of the illegality duties is different. Instead of readily understood and identifiable notions of safety - personal injury and damage to property - the OSA applies its illegality duties to complex legal constructs: over 140 criminal offences and their inchoate corollaries (encouraging, assisting etc). It does not take 442 pages of Ofcom Illegal Content Judgements Guidance to understand what a broken leg or a property fire is.

Second, perhaps most fundamentally, the OSA’s duties on platforms typically engage the ECHR Article 10 freedom of expression rights of visitors to the platform. That brings into play requirements of clarity and precision, necessity and proportionality as they apply to speech.

That is not the case for typical offline safety-related duties of care. No visitor’s right of freedom of expression is affected by an occupier’s duty to take reasonable care not to leave a nail protruding from a floorboard, a building site operator’s duty to ensure that scaffolding is not laid on oil drums supported by piles of loose bricks (an example from the 1972 Robens Report on Safety and Health at Work), or a workshop owner’s duty to place a guard on a circular saw.

In short, speech is not a tripping hazard and it is asking for trouble to design this kind of legislation as if it were. The regulatory quicksand awaits those who try.

In addition, to the extent that a valid comparison can be drawn with established safety-related duties of care, only exceptionally do those impose a duty to prevent visitors injuring each other; and the content of any such duty tends to be limited.

The tripping hazard analogy appears to have gained traction by the time of the White Paper and Bill and evidently continues to do so. Indeed it featured in a recent Lords Committee oral evidence session. Lord Holmes asked whether, as then Culture Secretary Nadine Dorries had said to the draft Bill Committee in November 2021, an overarching duty of care could not get past parliamentary counsel. Sir Jeremy Wright KC MP, Culture Secretary at the time of publication of the White Paper, said:

“… if you go back—Lorna [Woods] will correct me if I have misremembered this—the original thought was that we can do something in the online space similar to the operation of the Health and Safety at Work etc. Act 1974. The Act does not require you to do something specific with the buckets on the floor or the shelving, specifically. What it says is that you have to create a safe environment. The objective here was to do the same online, and I am not persuaded that that would not have worked. (Oral evidence Q97, 3 November 2026, Uncorrected transcript.)

Professor Woods commented:

“Unless someone comes up with a specific problem, I am struggling to think what the problem is because we have other sectors where a similarly broad approach has been taken. There may be problems but they are just not leaping to my mind at the moment.” (Oral evidence Q98, 3 November 2026, Uncorrected transcript.)

The problem is that a bucket left untidily on the floor is - at least to my mind - categorically different from site visitors talking to each other.

If adult “legal but harmful” duties, such as for misinformation, were proposed to be reintroduced to the Act, the lack of congruence with existing safety-related duties of care would be even more pronounced, the subject-matter more nebulous and subjective and the problems of ECHR and rule of law compatibility yet more vexing.

Codes of Practice

Ofcom Codes of Practice are central to the OSA legislative scheme. When a Code of Practice is issued, a service provider is deemed to fulfil the duty if it complies with the Code of Practice. A service provider can choose to comply with the duty in an alternative way, if it is able to justify that to Ofcom. 

Somewhat confusingly, this “comply or explain” approach has come to be described as a “safe harbour”. That label has long been used for the qualified liability shields that derive from the Electronic Commerce Directive, and which operate in parallel with the OSA. To be clear, those have nothing to do, practically or conceptually, with the function and status of Ofcom’s Codes of Practice under the Act.

The objections now made to the Act’s system of Codes of Practice are first, that it provides insufficient connection between the risk assessment that a service provider is required to carry out and the steps that it should then take to mitigate identified risks; and second, that it places the burden on Ofcom to prescribe how a risk should be mitigated; unless and until Ofcom does so, there is no duty to take mitigation steps.

Ultimately, those are two facets of the same objection: that since Ofcom’s Codes of Practice authoritatively define how a duty can be complied with, that leaves no room for any residual obligation to take further steps to fulfil the Act’s broadly stated safety duties – even if a risk is not addressed in a Code of Practice but has been identified in the platform’s risk assessment.

The Online Safety Network, it should be noted, has questioned that interpretation of the Act. In any event, its Ten Point Plan proposes that the Act’s “safe harbour” provision should be removed and that the “clear and precise” and accompanying “technically feasible” conditions in Schedule 4 should be revised to allow for “more stretching, outcome-focused measures” in the OSA Codes of Practice.

Mark Bunting, Ofcom's Director of Online Safety Strategy Delivery, summarised the arguments in oral evidence to the Lords Communications and Digital Committee, answering a question from Viscount Colville about whether Ofcom would like to see the safe harbour taken out of the Act:

“This is a really important issue and not one that I can give you a simple answer to. There are some complicated issues to weigh up. The original legislation in effect created two parallel frameworks, almost. There is the risk-based component where companies have to assess risks and take steps to mitigate them. Then there are the codes of practice and the safe harbour. The challenge that we see—and a number of stakeholders highlighted the same challenge—is that, if companies do all the things in our codes of practice, they are deemed to be compliant with the Act, even if they still have risks that have not been adequately addressed through those measures.” (Oral Evidence, Q.30; 15 September 2026.)

Touching on the issues of legal certainty already mentioned, he also argued that a duty that is not sufficiently clear and precise is unenforceable:

“The reason that I cannot give you a very straight answer is because that system was put in place to give companies legal certainty about what they needed to do in order to comply. That legal certainty is also important to our ability to enforce against them. If we are not clear with companies about what they need to do to come into compliance, it is very hard for us to successfully bring investigations against them. The Act was trying to have its cake and eat it, so to have this very broad risk-based framework that also creates legal certainty for companies.” (ibid)

Ofcom’s written evidence to the Committee observed:

“[W]e cannot put in place a generic measure that providers should mitigate all risks identified in their risk assessments. Such a measure would not be consistent with the OSA or be enforceable by Ofcom.” [5.6]

The 2019 Online Harms White Paper did propose (subsequently confirmed in the government’s formal consultation response) an overarching and residual duty of care:

“Companies will still need to be compliant with the overarching duty of care even where a specific code does not exist, for example assessing and responding to the risk associated with emerging harms or technology.” [3.6]

The idea of an overarching or residual duty of care did not make it into the legislation. Lord Clement-Jones, during the Bill’s Lords Second Reading debate in February 2023, noted that “we have diverged a long way from the 2019 White Paper with its concept of the overarching duty of care.”

The issue identified by Ofcom and others is not so much that a specific code may not exist, but that an existing code may not stipulate steps to address a specific harm identified in a risk assessment.

Ofcom’s written evidence, although hinting that the government may wish to revisit this topic, is evidently alive to the potential issues with broader and less specific requirements:

“5.9 … [T]here are clear limits to what we can achieve via enforcement using formal powers given the safe harbour, and ‘clear and detailed’ requirements of the OSA.

5.10 In considering options in this area, Government and Parliament would need to consider how to balance broader requirements (for example ensuring that some or all firms address all reasonably foreseeable risks, or take all proportionate steps to address such risks) with the risk that such requirements are too vague to be enforceable, and fail to provide firms with adequate legal certainty.”

To reiterate, it is not only service providers that have to be provided with sufficient legal certainty, but users whose online posts are liable to be affected by steps taken by platforms to comply with a requirement to address risks.

Proactive technology

Ofcom’s recent evidence to Parliamentary committees displays some enthusiasm for a greater ability to recommend use of proactive technology (i.e. automated content filtering). 

Damian Collins, briefly a DCMS Minister during passage of the Bill and before that chair of the draft Bill joint scrutiny Committee, in evidence to the Lords Committee singled out proactive scanning for content as a particular area in which he thought Ofcom had failed to meet expectations. He questioned Ofcom’s interpretation of the preventative illegal content duty in Section 10 of the Act.

In her evidence to a regular Commons Digital, Culture, Media and Sport Committee session on 20 October 2026, Dame Melanie Dawes (Ofcom’s Chief Executive) said this:

“When it comes to things we would like to be able to do in our code, it would be to require platforms to use AI to search for illegal content more than is currently allowed by the Act. The bar for us to require that is very high. We think the technology is there and that it should be deployed more on illegal harms in particular, so that platforms can find this stuff proactively rather than relying on members of the public to report it to them.” (Q. 54)

The new Ofcom chair, Sir Ian Cheshire, added:

“It is a great example of something where, if you had said that three years ago, the tech probably was not up to scratch, but the latest releases are.” (Q.54)

Schedule 4 of the Act sets out the bars that Ofcom has to surmount before recommending proactive technology for publicly communicated user content. Paragraph (5) addresses proportionality. Paragraph (6) says that in deciding whether to include a proactive technology measure in a code of practice, OFCOM must have regard to the degree of accuracy, effectiveness and lack of bias achieved by the technology in question. It may refer to industry or technical standards for the technology (where they exist); and it may set out principles designed to ensure that the technology or its use is (so far as possible) accurate, effective and free of bias.

Pausing there, it would seem odd if Ofcom did not have to have regard to the accuracy, effectiveness and lack of bias achieved by the technology.

At any rate, proactive technology came up in Ofcom’s evidence to the Lords Communications and Digital Committee. Commenting on paragraph (6), Ofcom’s written evidence said:

“This means that we need robust evidence on these points before we can propose such measures, and this tends to favour codes measures prescribing specific existing technologies – such as hash-matching – over broader measures requiring firms to innovate or consider a range of possible technical solutions.” [5.14]

It noted, however:

“In considering options in this area, it is important to acknowledge that the current restrictions on use of proactive technology are a response to the significant impacts of such tools on privacy and freedom of expression. The prospect of firms routinely scanning all content uploaded to their platforms, even if they are doing so in order to weed out illegal material or content harmful to children, rightly requires careful consideration, as requirements to do so – if not carefully designed – could represent disproportionate infringements of human rights. Ofcom is required to act in line with human rights law, and we will continue to do so in reaching decisions on what measures we can and cannot impose in this area.” [5.16]

That point was reinforced by Mark Bunting in oral evidence:

“Because of concerns about privacy and freedom of expression, the Act set out that we could require those tools only when we were convinced that they met certain thresholds for accuracy and effectiveness. We are gathering evidence to try to stack up that case and will be saying more about that once we have finalised our consultation this autumn.

            …

We think it is right that we should have to think carefully before we require use of these tools, because they are very intrusive in that they require all material to be scanned by social media firms as it is uploaded. However, we think that the case for that is strong and, as I say, we are working on our proposals in this area at the moment. I think we will have more to say about it before the inquiry is concluded.” (Oral evidence Q34, 15 September 2026)

In its Additional Measures consultation last year Ofcom did propose to go beyond existing technologies such as hash-matching. It proposed a broader ‘principles-based’ measure that would involve platforms researching or developing proactive technologies and deciding for themselves what level of accuracy was acceptable.

I have argued that it is doubtful whether such an approach could satisfy the “prescribed by law” foreseeability threshold for users’ ECHR Article 10 rights. We await seeing whether Ofcom will pursue that measure when it publishes its final recommendations.

Quantifying proportionality

The potential for recommended proactive technology to inflict collateral damage on legitimate user speech has obvious consequences for freedom of expression. That would go to proportionality as well as foreseeability. 

In its Code of Practice recommendations and also in its accuracy recommendations for technology notices under S.121, Ofcom has avoided setting minimum accuracy standards such as acceptable levels of false positives.

In a recent journal article Content Moderation, the UK Online Safety Act, and the European Convention on Human Rights¹ Ricki-Lee Gerbrandt has proposed that “As Ofcom’s regulation progresses, it should provide far more nuanced requirements concerning acceptable and proportionate error rates (“performance targets”) and make sure that platforms meet them.” She suggests that acceptable error rates could vary depending on context such as kind of illegality, the kind of speech involved (evaluated according to the ECtHR speech hierarchy), and the external situation (such as a crisis or an election).

As it stands neither Ofcom nor Parliament has got to grips with the question of how much legitimate user content it is acceptable to sacrifice in the pursuit of illegal content or activity.

Council of Europe

It is noteworthy that the UK has signed the Council of Europe’s April 2026 Committee of Ministers Recommendation on Online Safety and User Empowerment. Although the Recommendation is in many ways an unsatisfactory document, it does state that:

“42. State authorities should not directly or indirectly impose a general obligation on intermediaries to monitor content which they merely give access to or which they transmit or store, be it by automated means or not.”

The Explanatory Memorandum is more specific:

“Paragraph 42 reiterates a principle enshrined in the Recommendation CM/Rec(2018)2 on the role and responsibilities of internet intermediaries. States should not impose any action that may lead to the obligation of intermediaries to systematically monitor user activity or to actively seek facts or circumstances that would indicate illegal activity, for instance by requiring the use of automated systems to proactively scan user data or content for legal infringements.”

On its face that reads directly on to proactive technology duties.

Safety by design

Safety by design is a recurring theme. It is now almost the motherhood and apple pie of online safety. Nevertheless there is evidence of a lack of consensus as to how it should and should not translate into concrete measures.

Safety by design is, in some versions at any rate, predicated on the proposition that online harm is, at least primarily, a product of the design of the platform. If the platform is designed from the outset so as to remove or adapt the features that create or exacerbate the risk of harm, then (so the theory goes) harm can eventually be designed out or at least minimised.  

The problem, at least within the context of the OSA illegality safety duties, is with identifying such risk-creating features. When the theory is applied beyond algorithmically-driven social media, or beyond features considered risky for children, general purpose computing functionality ends up being categorised as risky - such as when Ofcom designated as a risk factor (for terrorism, CSAM URLs and foreign interference offences) the ability to use hyperlinks.

Ofcom was able to do that by dint of abandoning safety by design’s core predicate of risk-creating or risk-enhancing design features, in favour of functionality – even if inherently innocuous – of which bad actors make use:

“We recognise that not all characteristics are inherently harmful; we therefore use the term ‘risk factor’ to describe a characteristic for which there is evidence of a risk of harm to individuals. For example, a functionality like livestreaming is not inherently risky but evidence has shown that it can be abused by perpetrators; when considering specific offences such as terrorism or CSEA, a functionality like livestreaming can give rise to risk of harm or the commission or facilitation of an offence.” [5.26]

Safety by design and content moderation

Safety by design proponents tend to favour content-neutral safety measures, avoiding or minimising the need for content moderation. The Online Safety Network Ten Point Plan complained that Ofcom has produced:

“ a suite of unambitious ex-post measures to reduce the impact of harm that has already occurred rather than upstream, content-neutral, “by-design” interventions to seek to prevent it occurring in the first place.”

It suggests that a definition of safety by design should be added to the Act to make clear to Ofcom and services what it was that Parliament intended.

The corollary of content-neutral safety by design is that content moderation is a fallback, not a safety by design feature. Although safety by design is focused on a platform’s systems and processes, it should not (so it is said) be equated to systems for content moderation. That ought to exclude proactive technology and automated content filtering.

That view, however, is not universally accepted. The government’s Statement of Strategic Priorities, for instance, regards automated content filtering as a safety by design measure. 

OSN complained in a submission to the Ofcom Additional Measures consultation that while Ofcom had framed some proposed measures, including automated content moderation, as being “safer by design”:

“these are primarily about ex-post mitigations for harmful content (reporting content, or relying on user action after harm has occurred) or introducing a form of safety tech (proactive tech measures) rather than embedding safe design at the level of systems and processes.” (emphasis added)

However, OSN’s companion detailed submission to the same consultation said:

“We broadly support the move towards requiring proactive technology as a safety-by-design approach to user safety”.”

Ofcom has linked safety by design to the role of Codes of Practice. Mark Bunting’s oral evidence to the Lords Communications and Digital Committee viewed safety by design in terms of the onus being not on Ofcom to identify emerging harms and address them in a Code of Practice, but on platforms to identify harms in their risk assessments and mitigate them:

“Safety by design is right at the heart [of the Act], but it is limited by this point about the safe harbour. The concept of safety by design is exactly as you have described it: it is about designing a service to remove risk as far as possible. It is never going to be possible to remove all risk from the types of services that we are talking about here, but we think that, in the end, the codes of practice and the approach to them put all the weight on Ofcom to identify what companies need to change. The sentiment of safety by design, which I completely agree with, is that the onus should be on the companies to identify what they need to do to address risk.” (Oral Evidence Q33, 15 September 2026)

That, however, says nothing about whether there are certain kinds of risk removal steps that do or do not amount to a safety by design measure – specifically whether those steps should be content-neutral or whether they encompass systems for content moderation such as automated content filtering.

Enforcement

Ofcom’s attempts to apply the Act to uncooperative overseas platforms with no assets or physical presence in the UK have been well publicised. Fines have been levied and most remain unpaid. Ofcom has not yet sought to obtain any of the Act’s last resort court orders, such as to require ISPs to block the platform.

In one case Ofcom has said that it has exhausted the remedies that are available to it under the Act. That seems to have been due to the site voluntarily geo-blocking UK users. The spectacle of another site, 4Chan, publicly thumbing its nose at the UK regulator has drawn media and political attention.  

Ofcom has suggested expanding its powers to seek business disruption orders from the court, of which more below.

Underlying all this are two questions:

-         How far can or should a regulator in any country go in enforcing its local laws against foreign sites, either as a matter of principle or in practice?

-         What is the aim of the Act’s fallback business disruption powers? Is it to punish foreign sites for disrespecting the UK regulator and ignoring its fines? Or is it to protect UK users? Or a combination of the two?

How far can extraterritoriality go?

There will be different answers to the question of principle posed in the first question, depending on how far one thinks that the UK (or any other country)’s writ should run internationally. Traditionally, limits on extraterritoriality are considered as a matter of territorial sovereignty (refrain from encroaching on a foreign state’s own territorial jurisdiction) and mutual comity (do as you would be done by - foreign countries can be expected to respect our sovereignty only if we respect theirs).

How those principles should translate to the inherently cross-border medium of the internet has long been discussed and still falls short of consensus. However, asserting jurisdiction over internet sites worldwide on the basis of their mere accessibility is likely to provoke criticism as exorbitant.

Whatever view may be taken on points of principle, what can be achieved in practice is another matter.

Ofcom comment in their supplementary written evidence to the Lords Committee that:

“We have initiated work regarding the pursuit of debt from all companies that have not paid their fines by their deadlines.”

They also observe:

“Whether we are able to recover debt through assets in another country can also depend on whether a court in that country will recognise a UK court judgment…”

The OSA does enable Ofcom penalties to be registered as civil judgments in the High Court or county courts. Although in principle a UK civil judgment may be pursuable via a foreign court, an Ofcom penalty is likely to encounter the objection that, in substance, it is a penal law. The US court in the proceedings brought by 4Chan against Ofcom noted that:

“…to the extent any foreign judgment against Plaintiffs [i.e. 4Chan] were penal in nature, Plaintiffs may find a receptive audience before American courts regardless of the judgment’s compatibility with the United States Constitution.”

The leading English law textbook, Dicey, Morris and Collins, comments that:

“There is a well-established and almost universal principle that the courts of one country will not enforce the penal and revenue laws of another country.”

This principle will have been well known to the drafters of the OSA. It is, no doubt, why the Act empowers Ofcom to apply to a UK court for various kinds of business disruption measure (BDM), designed to cut off a site’s UK advertising and revenue or, in the last resort, to require ISPs to block access to the site by UK users.

An Ofcom application for a BDM can be brought only in respect of a regulated service.  In order to be regulated, a site must have UK links. These can be one of three kinds: a significant number of UK users, the UK as a target market, or it is capable of being used in the UK by individuals, and there are reasonable grounds to believe that user-generated content on the service presents a material risk of significant physical or psychological harm to UK individuals.

If, therefore, a site voluntarily geo-blocks UK users, and if as a result it is no longer ‘UK-linked’, it is not a regulated service and Ofcom has no basis on which to apply for business disruption measures.

The size of the task that awaits a regulator seeking to persuade a court to block an entire platform should not be underestimated. While the Act certainly contemplates that such an order may be proportionate, the court would have to be persuaded that for the site in question it is appropriate to make the order for the purpose of preventing significant harm (meaning physical or psychological harm) to individuals in the UK, and that the order is proportionate to the risk of such harm.

What is the aim of business disruption orders?

Is voluntary geo-blocking an indication of regulatory success or failure?

Notably, in evidence to the Commons DCMS Committee, Dame Melanie Dawes remarked that a particular forum:

“… has been geo-blocked in the UK. No other jurisdiction has achieved that, and we were unable to go any further. There was nothing more that a court could have done to block the service beyond the way it has already been blocked.” (Oral evidence Q32, 20 October 2026)

In an interview with LBC about unpaid fines she said:

“Let me tell you the really good news here, because of those 11 companies, actually nine have introduced the changes we wanted or they have left the UK. They’ve just said ‘right, OK, we don’t want to comply with these laws, but we won’t offer our service to the British public anymore’, which is a good result as far as I’m concerned. …

There are going to be foreign courts that support small companies that aren’t based in the UK in not paying fines, but we will chase it down as far as we can. But what we’re really chasing here is the outcomes and we are starting to see that.”

From a practical perspective, if a site has geo-blocked the UK would a purpose be served in obtaining a site-blocking order against ISPs? If a voluntary geo-block can be circumvented by use of VPNs, would the same be true of an ISP site block?

Ofcom has provided the Lords Communications and Digital Committee with a list of changes that it would like to see made to its ability to apply to court for BDM orders. The first is to remove the requirement to show that a site is in continuing breach of its duties. This would enable Ofcom to apply for a BDM order if a site was no longer in breach, for instance as a result of geo-blocking UK users or taking the site down. Ofcom notes that, unlike a voluntary geo-block or take-down, a court-ordered ISP block cannot be reversed by the site.

Ofcom also suggests that it should be able to apply for a BDM for failure to pay a fine alone. This would apply to a site that had come into compliance with OSA requirements or has voluntarily geo-blocked, but had not paid a previous fine. That has the sense of a shift away from a pure focus on protecting UK users towards encompassing a means of publicly punishing the site.

Ofcom would also like to lower the threshold for securing interim business disruption orders. It proposes that the threshold should be reduced from likelihood of failure to comply with an enforceable requirement, to grounds to suspect a breach, coupled with reasons of urgency and risk of serious harm to the public interest.

It would also like the legislation to clarify that it is possible to get ‘dynamic orders’ that can be expanded to cover new sites with the same content/branding (such as mirror sites) without having to go back to the Court. This would be akin to a practice that the courts have developed for copyright ISP blocking injunctions.

Remarking that court-led BDMs do not enable particularly speedy action, Ofcom also asks the Committee to consider a new power that would enable Ofcom to require a regulated service provider to take action on an interim basis in an urgent case. As a direction to a regulated service provider rather than an order against a third party provider of business or internet access services, this would appear to be a different kind of power. Ofcom say that such a power would need to be designed with ‘appropriate limits and safeguards’. As an order against a regulated service provider, it would no doubt encounter practical limits to extraterritorial enforcement.

Ofcom, it should be noted, has at the request of the government conducted a review of whether Ofcom has the right capabilities in place to enforce the OSA. It remains to be seen whether it will contain more than what it has already indicated to the Lords Committee.

1. [2026] Public Law October, 717.

[10 November 2026. Added reference to Damian Collins evidence to Lords Committee; corrected ICJG link and reference to current version.]

An enabling environment for online regulation

In a previous post (The Vibe of the ECHR) I explored ways in which a regulatory policy agenda could acquire the halo effect of association with the European Convention on Human Rights. Whilst that was focused on a hypothetical project aimed at marginalising or outflanking Article 10 of the Convention (freedom of expression), some of the themes (referenced thusly below) are more generally applicable.

In April this year the Council of Europe Committee of Ministers issued a Recommendation on Online Safety and Empowerment of Users and Content Creators (CM/Rec(2026)4). It sets out a series of Principles that it recommends Member States, platforms and content creators should observe. 

For Member States it consists of about 50 specific recommendations.  About 40 of them are regulatory measures that Member States should consider implementing. They resemble much of the EU Digital Services Act and, to a lesser extent, some of the UK Online Safety Act. Others are recommendations to abstain from certain kinds of intervention, for instance weakening or undermining encryption or imposing general monitoring obligations on online intermediaries. The Recommendation also endorses a notice and takedown-based platform liability regime.

The Recommendation contains various exhortations to Member States to comply with Article 10 when legislating in this area. Conversely, many of the Recommendation’s specific regulatory measures are said not to interfere with the Article 10 rights of users. The Explanatory Memorandum opens by stressing that:

"a human rights-based approach, with the principles of legality, necessity and proportionality at its core and safety by empowerment as a central tenet, is essential to ensuring that measures [that member States] take for the safety of users and content creators do not inadvertently or disproportionately restrict freedom of expression and other rights." (EM 3)

This piece is not about the substantive merits of the specific recommendations. It is also far from a discussion of everything in the Recommendation. The point of interest here is the connection with the Convention. The Council of Europe is the custodian of the Convention. Other than by dint of its genesis in the Committee of Ministers, can this shopping list of regulatory measures claim the Halo Effect of a link to the Convention? If so, on what basis? The Explanatory Memorandum (EM 4) says that the recommended Principles are “grounded in” the Convention.  

To be sure, the Convention has long since outstripped any lingering impression that it was limited to policing the boundaries of state coercion in a civilised society. Increasingly it has come to be seen as a positive instrument of social policy. As such, it is no surprise to find it being associated with proposals for state action: a sword as well as a shield.

Nevertheless, the Council of Europe occupies a unique position. It is not an NGO seeking to enlist the Convention in support of a policy agenda. Committee of Ministers Recommendations are likely to be recited in ECtHR judgments. The Recommendation will be seen as a product of the Convention.

All of that, I would suggest, behoves adherence to two related precepts: a Recommendation should distinguish actuality from aspiration in its descriptions of Convention rights and Strasbourg jurisprudence; and it should be clear about which individual recommendations are properly founded on Convention rights and Strasbourg jurisprudence, as against which are bare policy proposals. The need for clarity is perhaps accentuated by the statement in the Explanatory Memorandum (EM 4) that the Principles "build on" ECtHR caselaw on the enjoyment and exercise of human rights in the online environment.

The Committee of Ministers Recommendation – Principles for Member States 

The Recommendation sets out a series of Principles, starting with Principles against which Member States are recommended to review their legislative frameworks, policies and practices. 

The Annex to this post lists the most concrete recommendations addressed to Member States, organised into ‘Refrain/Constrained’ (about 10 specific recommendations) and ‘Act’ (about 40). That taxonomy reflects the Convention, in that a negative Convention obligation prohibits or constrains Member State action whereas a positive obligation may require it to act. (The potential for positive obligations to marginalise Article 10 rights was discussed in the previous post.)

The 40 or so recommendations for state action constitute a detailed regulatory policy shopping list. How, in principle, could those recommendations be connected to Convention rights? That requires more than using the language of human rights:  

-     Might the claim be that the recommendations, if enacted, would not breach the Convention? That would be a slender basis on which to claim a positive association with the Convention.

-     Might it be that a Convention positive obligation requires the 40 recommendations to be enacted, so that a Member State would be in breach of the Convention if it did not? On the face of it that would be an adventurous claim, to say the least.

-     Might the claim be that the recommendations share some high level values or aims in common with the Convention? That would be a Vibe of the Convention claim, not a matter of implementing Convention rights.

-     Might they reflect an aspiration as to how Strasbourg caselaw may develop in the future? If so, that places a premium on distinguishing between Strasbourg caselaw as it is and how some might wish it to be.

There is another, more technical, way in which a connection to the Convention might be claimed. Where the ECtHR has found that a positive obligation exists, it tends to articulate it in a way that leaves Member States a wide choice (‘margin of appreciation’) of concrete steps that they should take to fulfil it. The role of the ECtHR is supervisory: to determine (after the event) whether in the particular case a Member State has (if the matter falls within the scope of the obligation) not only done something, but done enough.

On that basis, it could be suggested that the Committee of Ministers is simply recommending its preferred way in which Member States can go about fulfilling a mooted positive Convention obligation to do something.  However, especially for Article 10, that argument for connection with Convention rights can only go so far – for three reasons:

-     First, precisely because the recommended measures are only one way of fulfilling any positive obligation that may exist, it cannot be said that that particular set of concrete measures is required by the Convention. For the same reason, the more specific the recommended measures the more tenuous becomes any posited connection of those measures with the Convention: a version of Vibe of the Convention.

-     Second, although the ECtHR tends to frame positive obligations in non-concrete terms, their scope and content has to be understood in the light of the factual contexts in which the ECtHR articulated them.

-     Third, since for a qualified right the ECtHR’s initial step is to decide whether a positive obligation of the kind asserted exists at all (see for Article 10: Appleby, Gaši, Side by Side International), care has to be taken not to generalise so as to expand an existing positive obligation into territory where the ECtHR has not (yet) held a positive obligation to exist.

The final version of the Recommendation has made some changes compared with the draft Recommendation released for consultation in June 2025. Additionally, illuminating the thinking behind the Recommendation, there is now a 33,000 word Explanatory Memorandum prepared by the Steering Committee on Media and Information Society and noted by the Committee of Ministers.

The draft Recommendation, in my estimation, had a number of problems. My submission to the June 2025 consultation suggested that, generally speaking, it tended to muddy vital distinctions between:

- Interferences by member States that are impermissible under the Convention

- Interferences by member States that are permissible under the Convention

- Interferences by member States that are required under the Convention as a matter of positive obligation

- Suggested responsibilities on private persons that give rise to no Convention obligation either on private persons to comply with them, or on member States to legislate for them.

It suggested that the document would benefit throughout from tightening up and clarification in that regard.

Despite the changes, to my mind the final Recommendation remains problematic in some of its descriptions of Convention rights and in how it makes connections between the Convention and many of the policy proposals.

The aspects of the Recommendation that are most difficult to connect to the Convention are its recommendations for responsibilities of private persons (platforms and content creators) and the mooted Member State positive obligations that appear to underlie much of its regulatory shopping list. Those include a positive obligation to effectively address the risk of harm (undefined) online and various invocations of the need to foster an enabling online environment.

The following picks up on some of the themes identified in my previous blogpost.

Person to person extrapolation – platform and content creator responsibilities

The Convention is addressed to Member States. It places obligations on Member States. It places no Convention obligations on private persons. The rights that it confers on private persons are rights against Member States. 

The Recommendation, in addition to recommending Member State actions and abstentions from action, addresses platforms and content creators (a sub-set of users) on their responsibilities. Since, juridically, the Convention cannot impose obligations on private persons, it provides no obvious basis on which to address private persons as to their “responsibilities”.

The Committee of Ministers can of course, if it thinks appropriate, give private persons the benefit of its views on how they should behave online. Those, however, should not benefit from the Halo effect: the authority and credibility gained by association with the Convention.

The Explanatory Memorandum notes that platform responsibilities “may become legal duties under domestic law” (EM 20). The asserted responsibilities overlap to an extent with the recommended legislation for platform accountability and user empowerment, which encompass design-related, transparency-related, fair process and collective action-related empowerment duties. [66]

To the extent that Member States do not make empowerment measures obligatory (for instance because of micro and small platform exemptions from legislation), the Recommendation encourages platforms to implement them voluntarily as part of their responsibilities. [69]

Unlike for platform responsibilities, the Recommendation does not expressly state that content creator responsibilities may be contemplated for legislation, although the Explanatory Memorandum notes various Member State legislative initiatives in relation to online influencers (EM 72 to 75). There is also some overlap with separate recommendations for legislative action ([53]).

What, then, is the basis for suggesting that a private actor responsibility (whether or not it is contemplated to lead to some kind of legal obligation enacted by a Member State) is connected with the Convention?

A long-standing UN international human rights project to articulate non-binding human rights responsibilities of businesses (the Ruggie Principles) was endorsed in a previous Council of Europe Recommendation (2016/3). However, it does not follow that recommended business responsibilities are part of the Convention or can be derived from it. They are not and cannot.

In any event the Recommendation makes no reference to Recommendation (2016/3). The reader has to delve into the Explanatory Memorandum ([20]) to find it, and to be told that the notion of private actor responsibilities comes from international human rights law.

EM 20 also quotes the ECtHR judgment in Google v Russia at [79] on the duties and responsibilities of platforms.  However, the Court was specifically considering the 'necessary in a democratic society' condition for state interference under Article 10(2). That does not give rise to a self-standing Convention duty (see also below under Content Creator responsibilities - Article 10 compatibility).

Moreover, platforms and content creators as defined in the Recommendation extend beyond businesses. What basis is there, even in the extended Ruggie view of human rights responsibilities, for proposing responsibilities applicable to individual, non-business users? Such users, of course, do not exist in a legal vacuum. They are subject to the general laws of their countries.

A previous Committee of Ministers Recommendation (CM/Rec(2022)13 on the Impacts of digital technologies on freedom of expression) contained a preamble drawing attention to the fact that private persons are not directly subject to Convention obligations. The Online Safety Recommendation contains no equivalent.

My submission to the consultation on the draft Recommendation drew attention to these points, suggesting that the Recommendation should make clear that the proposed ‘responsibilities’ do not give rise to any Convention obligation - either on private actors to observe them or on member States to legislate for them. That was especially so, given that a reader who was not familiar with the nuances of human rights law could be led by the human rights language and context into thinking that the suggested ‘responsibilities’ embody Convention obligations.

Content creator responsibilities – Article 10 compatibility

Although, for the most part, this piece is not about the content of the recommendations, an exception has to be made for the proposed content creator responsibilities, since they are of doubtful (to say the least) compatibility with Article 10.

Strictly speaking, since the Convention cannot impose obligations on private persons and the suggested responsibilities are voluntary, no question of Article 10 interference arises. Nevertheless the Committee of Ministers should not propose, even as a voluntary responsibility, something that would violate Article 10 if a Member State were to legislate it as framed.

Content creators are addressed as to how they should communicate online:

“Content creators have a responsibility to contribute to a healthy, informed and democratic public discourse which is respectful of the rights of others. ...” [30]

The Recommendation defines content creators as:

“users who are regularly or professionally engaged in the production and dissemination via a platform of information and ideas, in text, audio, visual, audiovisual or other form, with the intention of reaching an audience beyond their private circle”. [11]

The Recommendation goes on to say that the level of responsibility may vary according to various factors: nature and form of content, contribution to debate on matters of public interest, and age of intended audience; with content creators who reach a significant audience or claim professional expertise bearing a heightened duty to act in good faith, uphold principles of accuracy, fairness and integrity and to respect the rights of others. [30]

Content creators whose main purpose is to inform the public or influence their opinion on matters of public interest would have additional responsibilities to uphold the principles of journalism, be transparent about sources of income and clearly label paid and sponsored content, and, for a corporate content creator be transparent about ownership. Specific responsibilities are suggested for parents or legal representatives of children who are content creators. [31] and [32]

This recommendation is about more than social media influencers. It covers amateur bloggers and ordinary regular users of social media and discussion platforms. The ‘private circle’ limitation would not exclude bloggers. How it might apply to social media users is unclear, but is unlikely to assist a regular user who (for instance) adds hashtags to their online posts.

In Convention terms the content of the responsibilities, especially when the full ambit of ‘content creator’ is taken into account, is troubling. If the first sentence of paragraph 30 were legislated as drafted, it would surely fail for vagueness at the first hurdle of “prescribed by law”. 

Moreover, what exactly does it mean? If it means that a content creator should only speak in a way that positively contributes to a healthy, informed and democratic public discourse, that would be an astonishing restriction on their freedom of expression for which there could be no justification under the Convention. It would be patently open to subjective interpretation and abuse by Member States. Alternatively, if the Principle permits content creators to engage in other kinds of expression, but also requires them to make that kind of contribution, that would be objectionable compelled speech. 

These points were made in my submission to the consultation on the draft Recommendation.

The Explanatory Memorandum’s justification for paragraph 30 is an example of the Duties and Responsibilities theme discussed in my previous blogpost:

“In line with the text of Article 10, paragraph 2, of the Convention, content creators, like everyone who exercises their right to freedom of expression, have duties and responsibilities.” (EM 72)

It goes on the describe the different responsibilities attributed in Strasbourg caselaw to journalists and others. It observes that the protection afforded by Article 10 to bloggers and popular social media users acting as public watchdogs is subject to the condition that they comply with the duties and responsibilities traditionally connected with the function of journalist.

However, none of that is to the point. First, the fact that some bloggers and popular social media users may choose to comment on matters of public interest does not mean that they can or should be required to do so. If they do so, their Article 10 protection may be judged by the standards applicable to journalists.

Second, the ‘duties and responsibilities’ language in Article 10 comes into play only in the context of assessing the proportionality of a state restriction on someone’s right of freedom of expression. It is not, and cannot be translated into, a self-standing Convention responsibility of any kind, let alone one that might be reflected in state action such as legislation. To do so would be to turn Article 10 against itself and Destroy the village in order to save it.

That point was made in the Dissenting (but on this point unimpeachable) Opinion of Judges Sajó and Tsotsoria in Delfi:

“The protection of freedom of expression cannot be turned into an exercise in imposing duties. The “duties and responsibilities” clause of Article 10§2 is not a stand-alone provision: it is inserted there to explain why the exercise of the freedom in question may be subject to restrictions, which must be necessary in a democratic society. It is only part of the balance that is required by Article 10§2.”

Person to person extrapolation – online risks

Paragraphs 13 and 14 of the Convention describe various online risks (supplemented by a lengthier list of examples in the Explanatory Memorandum (EM 38 to 44)):

“13. However, some online risks may adversely affect users and content creators by infringing on their rights or otherwise inhibiting their willingness, ability and determination to freely express themselves, out of concern for their well-being and safety.

Online risks can also restrict the public’s ability to access reliable information, encounter a diversity of perspectives and develop informed opinions on matters of public interest. They may also have wider societal consequences, including the erosion of social cohesion, trust in institutions, threats to public health and the weakening of democratic processes.

14. Online risks that are related to freedom of expression include:

a. risks to personal and community safety and well-being associated with content and communication that users may be exposed to, interact with or be targeted by;

b. risks to the democratic process, information integrity and informed public discourse;

c. risks associated with the systems deployed by providers which may interfere with the rights to freedom of expression, privacy and personal data protection and other rights of users.”

Paragraph 13 is self-evidently about the risks associated with behaviour of private persons online, including users. The Explanatory Memorandum contends that the recommended Principles, “while reaffirming robust protection for expression, recognise that the online environment also generates risks that can undermine or deter the very exercise of this right, as well as other rights.” [39]

It goes on to give examples (coordinated harassment of journalists, doxxing of activists’ personal details and posting of non-consensual intimate images) of person-to-person behaviour that may result in people being intimidated and pulling back from expressing themselves on issues of public interest in the future. It concludes that: “The fear of reputational or physical harm, legal trouble or sheer emotional exhaustion can stifle their willingness and capacity to speak openly, especially on controversial topics.”

The point here is not to debate whether any given kind of behaviour provides reasons for a Member State to legislate against it in a Convention-compliant manner. The issue, from the point of view of establishing a connection between the Recommendation and the Convention, is that a private person’s behaviour towards someone else is not juridically capable of infringing someone’s Convention rights. At most a positive obligation on a Member State could exist and be triggered.

As to the possibility of such a positive obligation, when the Recommendation refers to online risks in the abstract it appears to mean risks of consequent harm:

“… there is growing concern over risks to the online safety of users and content creators that can result in serious harm to individuals, groups, society or societal interests such as democracy, the rule of law and the free flow of information.” (Paragraph 1)

As such, paragraphs 13 and 14 could bring into play the problematic generalised positive obligation to effectively address risks of online harm (undefined and unbounded), discussed below. If so, the implication would be not just that Member States are free to take Convention-compliant steps in relation to the kinds of online risk set out in paragraphs 13 and 14, but that the Convention obliges them to do so. On the face of it that would seem to be a bold proposition. If that is not what is meant, then paragraphs 13 and 14 appear to be invoking freedom of expression as a value, not a Convention right (Vibe of the Convention).

As to the kind of Member State action contemplated, paragraph 18 of the Recommendation observes:

“18. Not all online risks necessitate the introduction of measures interfering with the exercise of human rights, in particular freedom of expression. Measures taken should be proportionate to the risk of harm.”

The Explanatory Memorandum takes the position that the proposed platform accountability and user empowerment measures do not interfere with users’ Article 10 rights (EM 85) (see below).

Person to person extrapolation – infringement of Convention rights

Under the scheme of the Convention only Member States are juridically capable of violating someone’s Convention rights. A private person is not capable of doing so. The distinction matters in this context because Person to person extrapolation of Convention rights is a juridically unsound basis on which to benefit from the Halo effect of association with the Convention.

The distinction can become lost in the universal practice of referring to private persons interfering with someone else’s enjoyment or exercise of their Convention right, or having an impact on their human rights. Occasionally it is asserted that someone infringes someone else’s human rights.  As a matter of a Convention right that is conceptually impossible.

The Recommendation occasionally ventures into this territory. For example, the Preamble says:

“Acknowledging that measures taken by platforms, including through content organisation, curation and moderation, may also interfere with the enjoyment of the right to freedom of expression, including the right to receive information and other rights, and disproportionally affect the exercise of these rights;”

The Explanatory Memorandum (EM 11) commentary on this passage does not refer to the Convention, citing only a previous Committee of Ministers Recommendation (Remember Lord Denning).

The ECtHR does occasionally create a horizontal positive obligation: a Convention duty on a Member State to intervene in relations between private persons by creating, in its domestic law, a particular kind of legal liability as between them. As with any other positive obligation in relation to a qualified right (as to which, see below), such a horizontal positive obligative does not exist automatically.

Horizontal positive obligations are frequently described as a means by which the Convention is applied indirectly as between private persons.  However, when the ECtHR does hold such an obligation to exist, the juridical relationship remains vertical. No Convention rights or obligations are created as between the private persons. If the Member State fails to intervene as required, the complaint is against that Member State.

If the Preamble were perhaps understood to contemplate that states have a horizontal positive obligation to legislate a user’s right to a forum, that would be contrary to the ECtHR decision in Appleby. The recent concurring judgment of Judge Pavli in Google v Russia, whilst suggesting that in his opinion the Court should ‘in the long run’ revisit Appleby, confirms that Appleby is the law today. Unless and until the ECtHR were to decide differently there is no Convention ‘right to a forum’.

Rule-exception inversion: the Convention status of positive obligations

One theme identified in my previous blogpost was rule-exception inversion: treating the exception as the rule and vice versa. That could result from generalisation: taking a limited exception or proposition and elevating it into a rule of general application.

Qualified Convention rights such as Article 10 are, first and foremost, negative: they require States to abstain from arbitrary or over-reaching action. Negative Convention obligations apply automatically. Exceptionally, however, the Strasbourg Court may find that in a particular kind of factual situation a positive state obligation to secure a Convention right exists. The effect of a Convention positive obligation is not just to permit a Member State to take action, but to require it to do so. Positive obligations are the means by which the Convention can be fashioned into a policy sword.

That hierarchy is reflected in a time-honoured ECtHR formula, one example of which is found in Tierfabriken (2001), an Article 10 case:

“… in addition to the primarily negative undertaking of a State to abstain from interference in Convention guarantees, “there may be positive obligations inherent” in such guarantees. The responsibility of a State may then be engaged as a result of not observing its obligation to enact domestic legislation.” [45] (quoting Marckx v Belgium (1979))

The words “may be” are significant. The ECtHR formula bears comparison with Preamble (e) of the draft Recommendation:

“Emphasising that member States have a positive obligation to guarantee the enjoyment of freedom of expression and other rights, both offline and online, but that they are also under a negative obligation…” 

My consultation submission identified two problems with Preamble (e): it asserted the existence of a general positive obligation in relation to freedom of expression (Generalise) and also reversed the Strasbourg hierarchy (Rule-exception inversion).

The final Recommendation has been amended, but still stops short of acknowledging the conceptual primacy of negative obligations versus the exceptional, non-automatic nature of positive obligations:

“Emphasising that member States have a positive obligation to guarantee the enjoyment of the right to freedom of expression (Article 10 of the Convention) and other Convention rights, such as the right to respect for private and family life (Article 8 of the Convention), both offline and online, and a negative obligation not to impose any restrictions on rights except those prescribed by law and necessary in a democratic society in pursuit of a legitimate aim;” (Preamble)

The Explanatory Memorandum comments:

“The Court has increasingly addressed the responsibilities of States in this respect, emphasising the obligations of States to protect users from harmful interference by both public authorities and private entities, as well as their obligations to refrain from imposing restrictions on rights other than those that are prescribed by law and necessary in a democratic society in pursuit of a legitimate aim.” [4]

The direction of the Court has certainly been towards finding that more positive obligations exist. That is not, however, the same as generalisation and elevation of positive obligations to equivalence with (or, in the draft Recommendation, primacy over) automatically applicable negative obligations.

A similar generalisation of positive obligations and implied equal footing with automatically applicable negative obligations is apparent in paragraph 10 of the final Recommendation. It is essentially unchanged from the consultation draft:

“Empowerment and safety engage both the positive obligation of the State to take steps to secure the enjoyment of human rights and the negative obligation of the State not to interfere with them beyond what is necessary in a democratic society for the achievement of a legitimate aim. …”.

The Explanatory Memorandum (EM 23 et seq) clarifies that by human rights paragraph 10 means Convention rights. It concludes that, subject to proportionality: 

"In the context of online safety, this dual obligation implies that States must take active measures to appropriately respond to content that carries risk of harm, including abuse, intimidation and discrimination that may inhibit the full participation of individuals, in particular those belonging to categories at heightened risk..."

The lack of any definition or bounding of 'harm' is discussed in the next section.  

The positive obligation formulated in paragraph 10 implicitly alludes to Article 1 of the Convention: “The High Contracting Parties shall secure to everyone within their jurisdiction the rights and freedoms defined in Section I of this Convention”.

To be sure, on occasion the ECtHR will cite Article 1 in support of a decision to create a given positive obligation. It does not follow that, for qualified rights, Article 1 creates universal positive obligations of general application – least of all for Article 10.

Divide by zero: safety, harm and positive obligations

My previous blogpost suggested that the linguistic equivalent of an illegal mathematical ‘divide by zero’ operation was to insert an undefined, infinitely malleable term into a proposition of law.

Paragraph 33 of the Recommendation (in this respect unchanged from paragraph 27 of the draft Recommendation) commences:

“States have a positive obligation to effectively address the risk of harm online.”

The Recommendation declines to define or place any limit on either harm or safety. The result is that the scope of the asserted positive obligation is unascertainable. It fails in its own terms.

The lack of any definition or limitation on safety or harm has its origin in a decision taken by the Experts Committee in April 2024: 

“The draft recommendation will not aim to identify what constitutes illegal or harmful content/behaviour.” [11]

The malleability of concepts of ‘safety’ and ‘harm’ was recognised in the same meeting:

“It was observed that the issue of online safety is potentially all-encompassing, and there is a need for the Committee to narrow down the scope of the draft recommendation. The members generally recognised that concepts like “safety” and “harmful content/behaviour” are broad and culturally dependent and change over time.” [9]

Paragraph 14 of the Explanatory Memorandum comments:

“The Recommendation moves from the assumption that safety is not a static concept. It varies significantly across time and space, as it may be influenced by both technological development and societal values.”

Whilst the decision not to define or limit safety and harm may be understandable as a practical matter, it has consequences for scope and clarity that permeate throughout the Recommendation.

The asserted positive obligation is also problematic for two other reasons. One is the objection that a generalised positive obligation does not automatically exist (see e.g. Appleby [40], Halet [111] and Side by Side International [13] – [14]). Another is that even were a positive obligation to exist, it would be an obligation on a Member State to secure a Convention right, not to address some independent notion of harm.

The need to link a positive obligation to a Convention right reflects the text of Article 1 of the Convention (above). It ties the scope of any mooted positive obligation to the Strasbourg jurisprudence on the Convention right in question, such as the caselaw on positive obligations under Article 8.

The Explanatory Memorandum comments on paragraph 33:

“79. The positive obligation of States to address the risks of harm online arises from their broader duty to protect human rights, including the rights to private life and freedom of expression, all of which can be impacted by online activities. Increasingly, these risks are being addressed through national or supranational legislative frameworks, such as the EU Digital Services Act or the United Kingdom Online Safety Act.”

Assuming that the reference to human rights means Convention rights, this suggests that a generalised positive obligation to address risks of undefined, unbounded harm can be derived from identified Convention rights. That is Vibe of the Convention territory. It is exacerbated by the suggestion that Convention rights are juridically capable of being impacted by the online activities of another private person (Person to person extrapolation).

The reference to EU and UK legislation may be intended to illustrate how Member States are, in their very different ways, discharging the asserted positive obligation. However, the mere existence of that legislation does not create a positive obligation on other Member States to legislate, certainly when the Convention compatibility of such legislation has not been tested and cannot be assumed.

Devil-speech and No-value speech

My previous blogpost discussed how some speech could be excluded from the protection of Article 10 by virtue of Article 17 of the Convention (prohibition of abuse of rights) or the separate ECtHR caselaw on wanton denigration where the only intention is to insult. One avowed rationale for excluding speech of that kind from protection is that it has no essential role in the expression of ideas (Rujak (2012) [30]).

The Explanatory Memorandum discusses these in its comments on the Preamble to the Recommendation. Citing Rujak, it suggests that:

“A similar line of reasoning might be applied to the dissemination of content that bears no reasonable relationship to the expression of ideas, such as child sexual abuse material or non-consensual private sexual materials shared with the purpose of causing distress to a person. These restrictions, however, must be narrowly circumscribed and be used only in relation to speech that is clearly incompatible with the Convention system itself.” (EM 9)

However “no reasonable relationship to the expression of ideas” might be interpreted, the issue here is not whether a Member State would be justified in legislating against such material in a Convention-compliant manner (clear and precise rules, legitimate public aim, necessity and proportionality), or even obliged to do so (e.g. Volodina (No 2)), but whether the rule of law protections of Article 10 should be denied.

Generalise, Vibe of the Convention and Remember Lord Denning - enabling online environment

My previous blogpost discussed the theme of abstract principles being generalised from the Convention or Strasbourg jurisprudence and applied out of context. Where those principles are values or aims rather than Convention rights, that is a Vibe of the Convention claim to connection. Remember Lord Denning alludes to the famous judge’s habit of citing his own previous judgments in support of his view.

The Recommendation’s references to the need to foster an enabling online environment have elements of all three themes: generalisation from the ECtHR decision in Dink, enabling online environment treated as a desirable goal more than as a Convention right, and the Committee of Ministers relying for support on its own previous Recommendations.

It is noteworthy how many of the Recommendation’s regulatory policy prescriptions (six in the Recommendation itself, 14 in the Explanatory Memorandum) are hung on the hook of a species of enabling online or other environment. Some references are couched in the abstract, some in terms of enabling freedom of expression, others are tied to different goals.

Enabling online environment for freedom of expression

The Preamble to the Recommendation speaks of: “…creating an enabling environment for the online exercise of the right to freedom of expression and other rights;” which it then ties to safety (undefined): “…a safer online space can create an enabling environment for the enjoyment of freedom of expression” 

Similarly it stresses the need for: “…measures to protect both the right to freedom of expression of users sharing content and the safety of users at risk of being silenced by content carrying the risk of harm, allowing for the full participation of all;”

The Explanatory Memorandum identifies a Convention positive obligation as the source of the ‘enabling environment’ doctrine:

“The emphasis on creating an enabling online environment reflects a long-standing principle in the jurisprudence of the European Court of Human Rights and in documents of the Committee of Ministers: under Article 10 of the Convention, States have positive obligations to promote conditions in which freedom of expression can be exercised effectively and by all.” (EM 60)

The principle mooted in EM 60 has its origin in Strasbourg caselaw (such as Özgür Gündem (2000), Dink (2010),  Ismayilova (2019) and Gaši (2022)), developing a positive obligation on Member States under Article 10 to protect journalists and activists from violence, intimidation and harassment. It is an example of the ECtHR seeking to secure Practical, effective rights.

The Explanatory Memorandum (EM 63) notes that the Recommendation and its Principles “build on” the acquis represented not just by ECtHR caselaw, but also previous Committee of Ministers Recommendations.

My consultation submission suggested a need for caution when applying the language of an “enabling environment for the online exercise of the right to freedom of expression” to unbounded, undefined, notions of safety. That had the potential to go far beyond established notions of safety: violence to journalists being the main context (other than employment relations) in which Strasbourg caselaw had held this positive obligation to exist .

That formulation, the submission went on, could also carry an implication that one person’s reaction to another person’s speech which they find subjectively objectionable or repugnant should outweigh the freedom of expression rights not only of the speaker, but of other recipients of the same information whose subjective reactions were different; whereas Strasbourg caselaw emphasises that an enabling environment extends to enabling speech that may be irritating or shocking to a significant part of public opinion.

The Explanatory Memorandum (EM 60) cites Dink as the source of the Article 10 “enabling environment” positive obligation. However, the Dink formulation merits close attention:

“to create, while establishing an effective system of protection of journalists, a favourable environment for participation in public debate by all the persons concerned, enabling them to express their opinions and ideas without fear, even if they run counter to those defended by the official authorities or by a significant part of public opinion, or even irritating or shocking to the latter” (Ismayilova [158], citing the original French text of Dink.)

The qualifying words ‘without fear’ are important. If they are ignored, the scope of the positive obligation is radically increased. Moreover, the positive obligation is an integrated whole. Just as ‘without fear’ cannot be omitted, neither should the formulation’s components be separated and treated as self-standing (although the concurring Opinion of Judge Koskelo in Gaši comes close to doing so).

The significance of ‘without fear’ can be better appreciated within the factual context of Dink. 

The ECtHR held that the state had breached a positive Article 10 obligation as the result of its unjustified prosecution and conviction of a journalist in respect of a series of articles that angered Turkish ultra-nationalists (who instigated the prosecution), combined with failure to take steps to prevent his subsequent assassination when the authorities were aware of a plot. The Court also found a breach of the automatic Article 2 positive obligation to protect the right to life.

The Court considered that in the particular circumstances, the failure of the security forces to fulfil their duty to protect Dink's life against attack by members of an ultra-nationalist group, together with the guilty verdict handed down by the criminal courts in the absence of any pressing social need, led to the Government failing to comply with its positive obligations with regard to the applicant's freedom of expression.

Granted, the Dink court’s formulation of the positive obligation leaves something to be desired. It is not ideal to frame the positive duty in terms of ‘without fear’ without specifying ‘fear of what?’ A minority concurring Opinion in a later ECtHR case (OOO Memo v Russia) suggested that it could extend to fear of civil defamation proceedings brought by state entities.

Nevertheless, the factual context of Dink was assassination of a journalist. That can hardly be equated to fear of, for instance, reading a factually incorrect social media post.

The 2022 case of Gaši suggests that the ECtHR was conscious of the limits of the Dink positive obligation where, although the claimants said they had felt threatened following various media articles and broadcasts, there had been no actual physical violence. It also endorses the conventional non-automatic general approach to Article 10 positive obligations found in, for instance, Appleby: the Court will consider a series of factors in order to determine the existence or otherwise of a positive obligation. A positive obligation is not automatic.

Although the Explanatory Memorandum does not mention Gaši, it quotes the full Dink formulation and recognises that its positive obligation has some limits:

“The same principle [as for journalists] holds true for online safety: States have a duty to promote conditions for everyone to contribute to public discourse without fear of intimidation or reprisals.” (EM 62)

However, it goes on to recite previous Committee of Ministers Recommendations (Remember Lord Denning) and then to say that the present Recommendation and its principles “build on” the Committee of Ministers acquis, asserting that:

“safety, inclusiveness, pluralism and user empowerment are essential to a rights-compliant online environment.” (EM 63; see also EM 4)

While the Recommendation acknowledges the long-established Handyside principle regarding disturbing, offensive and shocking speech, it qualifies it in unbounded terms of safety and well-being:

“13. However, some online risks may adversely affect users and content creators by infringing on their rights or otherwise inhibiting their willingness, ability and determination to freely express themselves, out of concern for their well-being and safety.”

The point here is not that online harms do not exist, nor that Member States cannot legislate in an Article 10-compliant way. It is that a specific regulatory shopping list should not, via generalisations of a limited Article 10 positive obligation, combined with undefined, unbounded notions of safety, risk and harm, acquire a Halo effect of association with the Convention.

It would be an act of heroic generalisation to elevate the Dink positive obligation from the case of an assassinated journalist (or other ECtHR cases involving actual or threatened violence, or a campaign of unlawful harassment and intimidation, against journalists, authors or activists) into a broad principle applicable to undefined and unbounded online harms – at least, unless and until the Strasbourg Court chooses to do so.

User empowerment measures and an enabling online environment for freedom of expression

Much of the Recommendation is taken up with its list of legislative user empowerment and platform accountability measures. How are these connected to the Convention? The answer appears to be a mixture of the mooted generalised positive obligation to address risk of harm, together with emphasis on fostering an enabling environment for freedom of expression. The latter is said to have its source in the Dink positive obligation (discussed above), but is presented as an aim (Vibe of the Convention). Finally, the measures are said not to interfere with Article 10 rights of users.   

In its own terms, at paragraph 33(c), the Recommendation proposes that the measures are a way of acting on the Member State positive obligation to effectively address the risk of harm online. The problems with that asserted positive obligation are discussed above.

The Explanatory Memorandum, however, relates paragraph 33(c) to an enabling online environment:

“Paragraph 33, letter (c), comprises rules that follow a systemic rather than content-based approach to responsibilities of intermediaries in fostering an enabling online environment.” (EM 83)

EM 83 goes on to cite the Council of Europe’s previous work (CM/Rec(2022)11 and its Explanatory Memorandum, CM/Rec(2022)13, and the Council of Europe’s Guidance note on countering the spread of online mis- and disinformation).

Later on the Recommendation itself ties the legislative platform accountability and user empowerment recommendations to a generalised notion of promoting an enabling online environment for freedom of expression:

“Legislative frameworks for platform accountability and user empowerment are essential to promoting an enabling online environment that furthers freedom of expression.” [57]

The Explanatory Memorandum elaborates:

“An enabling online environment is one that supports meaningful user participation, protects individuals from harm, and provides users with agency and control over their online experiences. Such an environment is essential for the realisation of digital rights, including freedom of expression, access to information and participation in public discourse. ...” (EM 149)

As discussed above, the Explanatory Memorandum (EM 60) says that the source of the “enabling online environment” language is the Dink positive obligation. Perhaps conscious of the potential for a broadly constructed positive obligation to upend Article 10, the Explanatory Memorandum (EM 85) notes the recommendation at paragraph 35 that States should address lawful content only through risk mitigation, such as platform accountability and user empowerment measures. That, says the Explanatory Memorandum, reflects that such measures do not interfere with users’ Article 10 rights.

Enabling environment in the abstract

On occasion the Recommendation refers to an ‘enabling online environment’ in the abstract, disconnected from any more specific notion of a positive Convention obligation.

Thus para 20 (see above), introducing ‘Principles for States’, is cast in broader and more abstract terms than freedom of expression:

“The aim of governance of online safety and the empowerment of users by States and internet intermediaries, including platforms, should be to create an enabling online environment as described in paragraph 2.”

Paragraph 2 says:

“2. Online safety should be understood as a component of an enabling online environment. This environment should be accessible without discrimination, it should be safe, inclusive, pluralistic and trustworthy. It should allow users to enjoy and exercise their human rights without unjustified interference, and it should maximise their autonomy and ability to participate and engage.”

The Explanatory Memorandum (EM 14) comments that this means that:

“Online safety is a component of a wider concept of an enabling online environment that is conducive to human rights.”

Paragraph 7 of the Recommendation refers to guiding States in the adoption, implementation and enforcement of policy and legal frameworks, as well as other measures, that “foster an enabling online environment that promotes the enjoyment of human rights”.

Paragraph 58 of the Recommendation says that:

“Platform accountability and user empowerment legislation should focus on the systemic duties and responsibilities that platforms should assume in order to create an enabling online environment….”

The Explanatory Memorandum says, in its commentary on para 58, that:

“… legislation should establish overarching obligations addressing how the structural and operational features of platforms … contribute to various risks of online harm. Embedding systemic duties and responsibilities into the platform governance framework aligns with the principle of fostering an enabling online environment, as this approach places responsibility on them to proactively identify, assess and mitigate such risks, both current and evolving, including through measures that empower users and support their agency.” (EM 152)

From a Convention perspective this is well into Vibe of the Convention territory; perhaps beyond that, given the lack of specificity about whether the human rights being spoken of are Convention rights.

Other varieties of enabling environment

The Recommendation relies on four other varieties of enabling online environment, all distant from the Dink positive obligation: encryption; meaningful participation and scrutiny; online safety in a democratic society; establishment and professionalisation of independent user groups

For encryption, the Recommendation counsels Member States to abstain from measures that would “introduce new weaknesses or vulnerabilities into technical features of online services that constitute vital safeguards for the enjoyment of privacy and other human rights online”. [22] This reflects the Podchasov v. Russia decision based on the negative Article 8 Convention right. The Explanatory Memorandum (EM 64) sees it also as an aspect of a safe and enabling online environment. Whilst Podchasov refers to encryption as contributing to the enjoyment of freedom of expression, there was no discussion of a positive obligation to foster such an environment.

The Explanatory Memorandum refers to “the positive obligation of States to foster an enabling environment for meaningful participation and scrutiny.” (EM 162) This is said to underlie the recommendation in paragraph [63] that States should “support the public, experts and researchers in their effort to identify priority risk areas on various online services and effective risk mitigation strategies. States should proactively empower the public to be able to scrutinise, provide input and comment on how risk assessments and mitigation measures in such rules and regulations are implemented.”

Meaningful participation initiatives are to be found in, for instance, EU and OECD policy papers. Many will think that mandating or encouraging consultation with civil society is a good idea. It is a different matter to suggest (if EM 162 means to refer to a Convention positive obligation) that a Member State that does not provide for this is in breach of the Convention.

Paragraph 65 recommends that States “should aim to share responsibility over online safety by entrusting roles to non-state actors, such as researchers, user groups, professional notifiers and flaggers, out-of-court dispute settlement bodies and third-party labellers, in the public interest.” The Explanatory Memorandum (EM 166) ties this to a posited collective endeavour of promoting an enabling environment that is conducive to online safety in a democratic society, “in which civil society and other non-State actors acting in the public interest play a fundamental role.” The Explanatory Memorandum does not say if this is intended to reflect a Convention positive obligation.

Paragraph 96 recommends that States “should encourage the formation of professional user groups who can act as independent experts in defending the interests of users and content creators before platforms or public authorities. States can grant these user groups privileges such as priority appeals, financing, better access to technical interfaces or a right of collective action against infringement of the rights of users.”

The Explanatory Memorandum reformulates this recommendation in terms of an enabling environment: “States should also foster an enabling environment for the establishment and professionalisation of independent user groups or associations that can act collectively on behalf of users and content creators.” [224]

By this point it is difficult to see “enabling environment” language as much more than a hook for policy advocacy.

Halo effect

Where does all this leave the suggestion in the Explanatory Memorandum (EM 4) that the Recommendation’s Principles are "grounded in" the Convention? In my estimation, establishing a connection with Convention rights and corresponding obligations is problematic in a number of respects:

- Lack of Convention basis for responsibilities addressed to platforms and content creators.

- If such responsibilities could be based on international human rights Ruggie principles, that the asserted responsibilities extend beyond businesses.

- That the content creator responsibilities are, from an Article 10 perspective, questionable.

- Convention status of Member States versus private persons.

- Status and scope of Member State positive obligations.

- Unascertainable scope of a posited Convention positive obligation to address risks of (undefined and unbounded) harm online.

- Invocation of generalised and extended kinds of ‘enabling environment’.

Ultimately, much of the regulatory shopping list is in Vibe of the Convention territory. 

It might be objected that the starting point of this commentary – a strict focus on Convention rights – is somewhat rigid. After all, human rights law is nothing if not flexible and aspirational.

However, I would contend that it matters that Convention rights should not be confused with values. It matters that the Convention imposes obligations on states, not on private persons. It matters how far the ECtHR has and has not gone in creating positive state obligations. It matters that the Convention is not a UN, EU or OECD instrument, differently constituted and conceptualised. It matters that the halo should not just be the vibe of the thing.

Bibliography 

These texts were of particular assistance in preparing this and the previous blogpost (The Vibe of the ECHR):

Books

J. Gerards General Principles of the European Convention on Human Rights (C.U.P. 2nd ed, 2023)

A. Kucs Freedom of Expression and Positive Obligations of the State in Social Media Chapter in ‘Human Rights in the Digital Domain – Core Questions’ ed. T. Pajuste (C.U.P., 2025)

C. Loven Fundamental Rights Violations by Private Actors and the Procedure before the European Court of Human Rights (Intersentia, 2022)

V. Stoyanova Positive Obligations under the European Convention on Human Rights (O.U.P., 2023)

Papers

N. Alkiviadou Positive Obligations, Hate Speech, and the Reconfiguration of Free Expression at the European Court of Human Rights Journal of Free Speech Law, Volume 6, Issue 4 (2026) 1339.

K. Pentney States' positive obligation to create a favourable environment for participation in public debate: a principle in search of a practical effect? Journal of Media Law, 16:1, 146-177 (2024)

C. E. Lewis The European Court of Human Rights and its Search for Common Values European Convention on Human Rights Law Review 4, 179 - 219 (2023)

A. Nieuwenhuis  The Concept of Pluralism in the Case-Law of the European Court of Human Rights European Constitutional Law Review 3, 367-384 (2007)

Annex

List of recommendations addressed to Member States

The Recommendation urges Member States to take some actions and refrain from others. Some other actions are expressly permitted but constrained. The most specific recommendations to Member States, sorted into ‘Refrain/constrained’ and ‘Act’ are set out in below.

In some instances resort has been had to the Explanatory Memorandum to clarify whether a recommendation is addressed to States for action or is merely an exhortation to the private actors concerned. Less specific recommendations and general exhortations to act in compliance with the Convention have been omitted.

Refrain/Constrained

1.      Avoid measures that would introduce new weaknesses or vulnerabilities into technical features of online services that constitute vital safeguards for the enjoyment of privacy and other human rights online (i.e. encryption). [23]

2.     Distinguish clearly between measures relating to legally restricted and lawful content. Lawful content should be addressed only through platform accountability and user empowerment measures. Those should not be used to circumvent rule of law requirements for legally restricted content. [35], [36]

3.      Blocking or banning of an entire online service, domain or website should be ordered only by a judicial authority or other independent public authority whose decisions are subject to judicial review. [37]

4.     Not to exert pressure on internet intermediaries and content creators to take action that could affect the availability of online content other than through means prescribed by law. [38]

5.      Not, directly or indirectly, to impose a general obligation on intermediaries to monitor content which they merely give access to or which they transmit or store, be it by automated means or not. [42]

6.     Content rules prescribed in law by Member States should be based on evidence gathered transparently. [45]

7.      The material, remedial and geographic scope of legally restricted content should be proportionate to avoid collateral removal of lawful content. [45]

8.     Member States may compel platforms to publish on their services specific information of public interest, but only in compliance with Article 10(2) of the Convention. [52]

9.     Refrain from imposing disproportionate liability on internet intermediaries for user content, which may incentivise or result in overblocking of lawful content. [54] States should adopt a knowledge-dependent notice and takedown model for hosting of legally restricted content. [55]

10.  Ensure that regulatory authorities tasked to supervise, implement or enforce the legislative framework for platform accountability and user empowerment are independent in law and practice, equipped with adequate resources and expertise, rely on evidence and always carefully consider the types of risks that they are supervising. Decisions of such regulatory bodies should be subject to judicial review. [64]

Act

11.   Adopt:

-         Educational initiatives to foster digital citizenship; strategies and policies to strengthen media literacy; community empowerment initiatives

-         Measures aimed at promoting free, independent, responsible and pluralistic media and quality journalism

-         Effective mechanisms to safeguard the physical and mental safety and well-being of users

-         Measures to investigate technology-facilitated criminal offences and ensure accountability with the law [22]

12.  To adopt and enforce legal frameworks that:

-         Specify what content is legally restricted and when such restrictions apply. ‘Legally restricted’ content includes both illegal content and ‘legal but regulated’ content (i.e. which is restricted to a particular kind of audience (e.g. children) or in a particular context (such as elections).

-         Specify the exceptional cases and conditions in which internet intermediaries may be held liable for users’ legally restricted content.

-         Impose systemic duties and responsibilities on intermediaries, such as platforms, to improve their accountability, online safety and user empowerment. [33]

o   Those should address systems and processes including overall design, procedures, governance and operation; and covering transparency, systems and processes of content organisation, curation and moderation, design practices and risk management.[57], [58].

o   Platforms should be required to design their services in a manner that incorporates user safety considerations by default and design. Risk mitigation measures include tackling amplification of content and behaviour which carry clear risks of harm. [59]

o   Platforms of significant influence should be required to carry out risk assessments, and to mitigate identified risks before introducing design changes. [60] States should ensure that those risk assessments are carried out in consultation with affected stakeholders and provide participation opportunities for the general public. [61], EM [158].

o   Platforms of significant influence should be required to produce and publish documentation on their assessment of risks and human rights and democracy impacts. [62]

13.  Adopt evidence-based legislative frameworks to impose on platforms the empowerment duties set out below (subject to proportionality and some exemptions for micro and small platforms): [66], [68], [69] Note: It is evident from these paragraphs that although some duties are expressed as if addressed to platforms, the recommendation is that these duties should be imposed on platforms. However, see also below as to platform ‘responsibilities’ where a platform is not obligated to implement empowerment measures.

Design-related

-         Design of automated systems for the organisation, curation or moderation of lawful content should allow users to personalise their online experience based on their preferences. This should be done through easily accessible and user-friendly tools allowing users to opt out of specific types of recommendations, hide types of content or block users.[71]

-         Platform design should enhance the ability of users to make informed choices about the content they engage with. This could include facilitating third-party labelling of lawful content by experts, factcheckers or communities. Users should then be allowed to further personalise their online experience by hiding or prioritising content corresponding to specific labels. [72] States should explore options for opening platforms of significant influence to third party tools. [73]

-         Platform design should proactively promote user empowerment and safety online for persons with impairments, including through third-party tools. [74]

-         States should, subject to various safeguards, require the use of effective systems of age assurance to ensure children are protected from products, services and content which are legally restricted with reference to specific ages. In particular, such systems should be required for platforms that predominantly provide services or content that is legally restricted to protect children. [75]

-         States should require the development, production and regular updating by platforms of other age appropriate and effective tools to mitigate risks for children in the online environment. [76]

-         Platforms of significant influence should ensure that content creators have the option to implement age labels for their content, where these creators choose or are under a legal obligation to do so. [77]

-         Platforms should not obstruct the ability of their users, including content creators, to move their online profiles to other complementary or competing platforms. States should require platforms to adopt design choices and technical standards that support profile portability. [79], EM [192]

Transparency-related

-         Platforms should meaningfully explain how they design their algorithmic systems for content organisation and curation so that users can understand what information is given priority or is demoted. [80]

-         Platforms should disclose to the public the details of their content moderation practices and periodically publish aggregate statistics about the number and types of content moderation decisions on their services. [81]

-         Platforms should describe the automated systems they rely on for content moderation and in which areas of content and publish qualitative reports on the accuracy of, and the safeguards applied to, such tools. [82]

-         Platforms should be transparent about the identity of their advertisers, the use of advertisement targeting techniques and spending for each advert. [83]

-         Platforms should be transparent about the user-generated content that is monetised on their services and by whom, and about the basic principles used to allocate resources to content creators. [84]

-         Platforms of significant influence should provide tools to content creators to ensure transparency about how their content is monetised. [85]

-         Independent researchers should (subject to vetting by an external independent body in some cases) have effective access to data held by platforms, without discrimination and in ways that are secure, legal and privacy compliant, to conduct, in an ethical and responsible way, research that pursues a public interest. [86]

-         Independent researchers should be technically and legally allowed, without discrimination, to use platforms to conduct research that is carried out within established principles of research integrity and ethics and in compliance with applicable data protection safeguards. [87]

Fair process (a.k.a. Procedural rights)

-         Platforms should state clearly and unambiguously, in meaningful and accessible terms, the contractual policies and rules under which they offer their services to the public. Any significant changes to such rules should be notified in advance to the affected users and the effects on their future activity meaningfully explained. [88]

-         Rules applicable to user content and behaviour, and changes thereto, should be sufficiently predictable to avoid arbitrariness of potential sanctions. [88]

-         Contractual policies and rules applicable to children should be explained in a way which children can understand, and which is appropriate to their age, maturity and circumstances. [88]

-         Users and content creators should be able to effectively challenge content moderation decisions of platforms that affect their right to freedom of expression, including their right to receive information, or other rights. [89]

-         Any content moderation decisions of platforms that target or affect specific users, including restrictions imposed on the visibility of user content, monetisation and account privileges, should be swiftly notified and explained to the users who have created the content or accounts affected by the decision. Such a notification must specify the grounds for the decision, explain the decision-making process and specify any possibilities of appeal, in a non-technical, clear and age-appropriate language. [90]

-         Platforms should notify also any other identifiable user who is directly concerned or affected by the content and who has opted to receive such notifications. [91]

-         Content moderation decisions of platforms that have a significant impact on users should be subject to external independent appeals, such as out-of-court dispute settlement bodies or another form of independent oversight. Such appeals should be accessible, transparent and heard swiftly within transparent time frames, and should provide effective remedies. This should not prevent users or platforms from having recourse to judicial or other legal remedies available under domestic law. [92]

Collective action-related

-         Platforms should ensure that users have the possibility to easily flag breaches of contractual policies and rules by other users and provide flaggers with sufficient feedback about follow-up to their flags. [93]

-         Platforms should ensure that users have the possibility to submit a notice relating to potentially legally restricted content and provide notifiers with sufficient feedback about follow-up to their notice. If the content moderation decision of a platform is not satisfactory, notifiers should be given the possibility to appeal the decision, including in accordance with paragraph 92. [94]

There then follows a set of ‘collective action’ recommendations which, although under the general heading of duties that should be imposed on platforms, are unclear as to the extent (if at all) to which they are intended to be obligatory:

-         States should encourage the identification of professionals to act as independent experts in notifying legally restricted content or flagging breaches of contractual policies and rules on platforms. States should incentivise the recognition of such professionals by granting them certain privileges, such as priority treatment of their flags, notices and appeals, financial support or better access to technical interfaces. [95]

-         States should encourage the formation of professional user groups who can act as independent experts in defending the interests of users and content creators before platforms or public authorities. [96]

-         States can grant these user groups privileges such as priority appeals, financing, better access to technical interfaces or a right of collective action against infringement of the rights of users. [96]

14.  Support the public, experts and researchers in their effort to identify priority risk areas on various online services and effective risk mitigation strategies.[63]

15.   Aim to share responsibility over online safety by entrusting roles to non-state actors, such as researchers, user groups, professional notifiers and flaggers, out-of-court dispute settlement bodies and third-party labellers, in the public interest. Such non-state actors should be subject to transparency and accountability mechanisms. States should explore ways to incentivise and compensate such non-state actors for their efforts through measures that do not depend on political or commercial discretion. [65]

16.  That accountability requirements on platforms and intermediary liability rules should be graduated according to technological capabilities and economic resources. [40]

17.   Ensure that platforms fully assess the impact of their contractual restrictions for lawful user-generated content and behaviour on the human rights of users. Such contractual policies and rules should be transparent, clearly communicated and drawn up in consultation with users and communities of users. They should be applied consistently and in a non-arbitrary manner [50], EM [120] – [121].

18.  Require professional content creators to be transparent about how their content is monetized; and encourage the development of transparent, inclusive and human rights-based self-regulatory frameworks for content creators for whom such frameworks do not yet exist.[53]

19.  Require platforms when implementing State instructions and lawful orders to provide users with sufficient information to challenge decisions. [56], EM [143], [144]]

20.  Require platforms by law to provide the necessary information for regulatory authorities’ monitoring activities in a timely manner, subject to proportionate sanctions for non-compliance with such obligations. [64]

[Citation corrected from [72] to (EM 72); grammatical error corrected (7 September 2026).]