Online Safety Act 2023 (Qualifying Worldwide Revenue) Regulations 2025
Lord Leong
That the Grand Committee do consider the Online Safety Act 2023 (Qualifying Worldwide Revenue) Regulations 2025.
Relevant document: 31st Report from the Secondary Legislation Scrutiny Committee
Lord in Waiting/Government Whip (Lord Leong) (Lab)
My Lords, as set out in the Online Safety Act 2023, Ofcom is empowered to make regulations that define how the qualifying worldwide revenue—QWR—of a provider of a regulated service is to be determined, along with the relevant qualifying period. The Act requires Ofcom to send the draft regulations to the Secretary of State, whose role is to then lay them before Parliament. In accordance with this process, the Secretary of State for DSIT laid the draft QWR regulations on 26 June 2025.
Defining QWR is critical to establishing the fee regime whereby providers of regulated services pay a fee to Ofcom to fund the costs of online safety regulation. The regulations are also a key part of informing a penalties regime that will act as a suitable deterrent to non-compliance among providers in scope of the Online Safety Act.
The regulations define QWR in relation to fees as the total revenue of a provider referable to the provision of regulated services—that is, revenue generated from relevant parts of a service, including parts where user to user, search or certain pornographic content may be encountered from anywhere in the world.
The regulations account for the apportionment of qualifying revenue in cases where direct attribution to relevant parts is not possible. In these cases, providers must apportion revenue to relevant parts using a “just and reasonable” method.
The qualifying period for calculating QWR is defined in the regulations as the calendar year two years prior to the fee-charging year. For example, for the 2026-27 charging year, the qualifying period will be 1 January to 31 December 2024.
The Act empowers Ofcom to issue penalties to non-compliant providers up to £18 million or 10% of their qualifying worldwide revenue, whichever is higher. In cases where Ofcom has found joint and several liability for a contravention of the Act within a group of entities, the regulations define QWR as the total of all worldwide revenues received by the provider and its group undertakings, whether or not that revenue is referable to a regulated service. Ofcom’s view is that the approach set out in regard to penalties will act as a suitable deterrent to non-compliance.
For both fees and penalties, in defining QWR Ofcom’s view is that the use of worldwide revenue reflects the global nature of online services and ensures fairness across providers—and, further, that this is consistent with the Act, which applies to any service with links to the United Kingdom, regardless of whether the service in question is a UK company.
During the passage of the Act through Parliament, it was agreed that the taxpayer should not be liable for paying for online safety regulation but rather that the providers of regulated services in scope of the Act should fund the regulatory regime. Following a public consultation between October 2024 and January 2025, Ofcom has recommended that the Secretary of State consider setting the QWR threshold at £250 million. In practice, this means that providers whose QWR meets or exceeds the threshold will be liable to pay fees to Ofcom unless they are exempt. Ofcom believes that this recommendation balances proportionality and workability, while limiting the impact on SMEs. As set out in the Act, the Secretary of State must now consider this advice and set the final threshold in a separate statutory instrument later this year. Ofcom will then consult on guidance relating to its Statement of Charging Principles, publish the final statement and begin invoicing providers in the 2026-27 financial year.
In accordance with its duties under the Act, Ofcom has drafted these regulations, and it is now for both Houses to consider them.
Lord Stevenson of Balmacara (Lab)
My Lords, I welcome this SI, although I have some questions about it. I would be grateful if the Minister could respond to them and, if not, write to me about them.
It is good to see progress being made on these issues. This was an area of considerable discussion and debate during the passage of the Bill, which some present will remember, mainly because we had no real certainty about the ambitions regarding whether those who were benefiting from Ofcom’s work would actually be prepared to pay for it. Even if they were prepared to pay for it, there was no certainty that they could be made to pay for it. Even so, despite the wording and deep thought that has gone into this particular piece of paper before us today, I still have some doubts about whether it will get the effect it wants.
Can the Minister say whether there is a back-up plan should the fees not meet the requirements of Ofcom in its vital role, which increases day by day? What would happen then? If the main companies involved—99% of them are at least operating outside the UK, and most of them are established outside the UK—refuse to play ball and are able to find a way around this process, we may face a bit of a difficulty, and quite an expensive one at that. So, my first point is to congratulate the department on bringing this forward, but I worry a little about whether it will be able to achieve its aims and objectives in a way that will be satisfactory for those of us who are concerned about the generality of this issue and also for those who are directly affected by some of the work done by these companies.
My second point is a bit technical, but that may just be because I am an accountant. The choice that has been made here in assessing the QWR is that it should be “just and reasonable”. These are fine words, but they are not very common. The words used in most accounting systems across most of the world—unless there are areas that I have yet to experience—are “true and fair”. Accountants have not loved those words, have often argued about them and constantly disagree about what they mean, but they are what works in assessing the effective financial position of any publicly owned company: most companies that wish to receive investment have to prove to a “true and fair” standard that their accounts reflected the true situation in that company.
Why have the Government agreed with Ofcom in going for these other words, which must be deliberately chosen? If they are deliberately chosen, will the Minister explain why “just and reasonable” is in any way equivalent to “true and fair” and, if it is not, as I suspect, why that choice was made? I do not say that it is wrong; whether the calculations on which financial results are being made are just and reasonable is a perfectly good way into any discussion with any organisation or company. It would be a good way of testing whether contributions to be made by companies in scope of Ofcom are just, in the sense, I suppose, of being justified, and reasonable in the sense of being able to be made to an apportionment that is sensibly aligned to the actions that will be taken by Ofcom against that company, very often against its economic interests. But I am intrigued by it. There is a perfectly good system that operates in the accounting world; “true and fair” has been used for years and years. We do not like it, but we have learned to live with it. Why have they not taken it forward in this sense?
Baroness Humphreys (LD)
My Lords, we on these Benches support the draft regulations. They represent a crucial step in implementing the Online Safety Act, aiming to foster a safer online environment. The principle that the financial burden of regulating the vast and complex online landscape should fall on those service providers that generate substantial qualifying worldwide revenues, rather than the UK taxpayer, is one that we wholeheartedly endorse.
In our view, Ofcom has articulated a robust and pragmatic rationale for basing fees and penalties on global rather than UK-only revenues. This approach, defining qualifying worldwide revenue as the total revenue referable to the regulated parts of a service, is designed to ensure that major multinational operators are appropriately deterred from non-compliance and contribute their fair share to user safety. We believe that such a model strengthens enforcement and promotes regulatory fairness.
However, we also acknowledge the concerns raised by industry stakeholders and examined by the Secondary Legislation Scrutiny Committee. Issues such as the aggregation of revenues across complex business groups, while providing consistency, may create anomalies for certain providers. Questions persist regarding the calculation and apportionment of revenue, especially when services are bundled or operated internationally, and how Ofcom will assess the provider’s just and reasonable approach to apportionment.
Furthermore, the practical impact on smaller providers if fee thresholds are set too low is a significant consideration, despite the current expectation that small and micro-businesses, charities and public sector bodies are unlikely to be affected. I therefore seek assurance from the Minister regarding the practical impact of these regulations. Specifically, is he satisfied that, when setting the crucial fee thresholds for providers required to notify their qualifying worldwide revenue, the regime will remain proportionate and workable so the burden falls primarily on major enterprises and not disproportionately on smaller providers? Furthermore, is he satisfied by Ofcom’s core rationale for adopting a worldwide revenue approach as vital for effective deterrence and regulatory fairness?
I also urge the Government to commit to ongoing review of this framework, particularly given Ofcom’s intention to provide further guidance on just and reasonable apportionment. We support these regulations but expect further scrutiny, coupled with the Government’s commitment to address these assurances.
Viscount Camrose (Con)
My Lords, this statutory instrument forms a key part of the regulatory framework underpinning the Online Safety Act 2023, a significant and necessary piece of legislation that forms part of my party’s legacy in government. I am very proud of the small contribution that I made to its passage through your Lordships’ House. That Act’s core aim is to make the online world safer, particularly for children and vulnerable users—an aim that all of us in this Committee support fully.
That said, let me make a brief point; it does not go directly to this instrument but it is, I think, a point worth making. I am concerned by how controversial the Bill seems to have become in certain quarters—indeed, much more controversial than it deserves to be. Part, though not all, of that is perhaps due to the previous Secretary of State’s rather aggressive rebuttal of some of the claims made about it. So I express my hope and wish that the new Secretary of State will be more emollient in his debate in order to carry people with him, because it is so important that the public come along with the Bill.
This instrument sets out how Ofcom will calculate the qualifying worldwide revenue of regulated service providers. As the Minister has outlined, this matters for two reasons: first, to determine Ofcom’s fees and, secondly, to establish maximum penalties for breaches of up to 10% of global revenue or £18 million, whichever is higher.
Most notable, of course, is the use of worldwide revenue as the basis for both fees and penalties. Although this ensures consistency and deters underreporting, the concern was raised during the public consultation that it can prove disproportionate for providers with only limited UK operations. I hope that, when he comes to speak, the Minister can give a bit more clarity on this point. Has a formal assessment been carried out in this specific area? What safeguards exist to prevent excessive penalties in cases of genuine error?
There is also the question—the noble Lord, Lord Stevenson of Balmacara, set this out clearly so I will not go into it much—of the interpretation of terms such as “just and reasonable”, particularly in revenue apportionment and currency conversion. Consistent application will of course be critical. How will disagreements be resolved and what guidance will providers receive?
I would also be grateful for clarification on Regulation 4(3)(b), which refers to
“parts where search content may be encountered (in the case of search services and combined services)”.
Ofcom has indicated that both “search” and “user to user” can include the functionality of AI chatbots. I am pleased that it has clarified this point but, if that is so, it raises an important issue: in cases where an entity is to be fined for an unsafe AI chatbot, which service is considered referable? Is it the chatbot service itself, or is the chatbot to be considered an amalgam of a user-to-user service and a search service?
If it is to be just the chatbot service—these are, of course, increasingly being used as search services—many of them generate very little revenue. In fact, AI is frequently loss making for many of the large organisations operating in this space. Could their qualifying worldwide revenue, at least as defined, be negative in such cases? If so, how would that be treated under the regime?
Of course, we welcome the exemption for services with under £10 million in UK referable revenue—we feel that that is a sensible threshold—but are the Government willing to review it if evidence shows that it is deterring legitimate or public interest platforms from entering or remaining in the UK market?
These regulations are a necessary step. They must be implemented fairly, not just for the global giants but for those trying to do the right thing. In closing, I thank the Minister for stepping in at short notice to guide us through this—it was no doubt a not wholly welcome surprise. I hope that the Government will have plans in place to monitor the regime’s impact actively and closely to ensure that Ofcom’s guidance is transparent and consistent and that they will remain open to adjusting thresholds or definitions if unintended consequences should arise.
Lord Leong (Lab)
I thank all noble Lords, especially my noble friend Lord Stevenson, the noble Baroness, Lady Humphreys, and the noble Viscount, Lord Camrose, for their valuable contributions to this debate. The noble Viscount, Lord Camrose, should be really proud of his legacy in taking the Online Safety Act through Parliament. It is due to him that we are now implementing these regulations.
I shall now respond to the various questions raised by noble Lords and to the Secondary Legislation Scrutiny Committee in its report on this instrument. The total amount of fees collected must not exceed the annual cost of Ofcom’s exercise of its online safety regulation functions. The cost may vary from year to year. Ofcom’s expected annual costs for online safety services for 2025-26 are close to £92 million, which includes regulatory activities and what Ofcom calls common costs, which are its running costs, allocated to all sectors that it regulates. Ofcom’s annual costs will vary depending on the level of regulatory activity undertaken in any given year, and those for online safety for 2026-27 will be published in the 2027 tables. Ofcom’s duties under the Act are extensive, and this will allow it to deliver effectively.
Service providers whose qualifying worldwide revenue is at or above a revenue threshold that we are discussing, and which these regulations will allow Ofcom to consult on and set, will need to pay approximately 0.02% to 0.03% of their qualifying worldwide revenue in fees. The Secretary of State will determine the threshold figure, having taken advice from Ofcom, which recommends a threshold of £250 million. If implemented, that means that only the largest companies will be in scope of fee paying. For example, a company with a qualifying worldwide revenue of £250 million can expect fees to constitute something like £50,000 to £75,000, using the formula of 0.02% to 0.03%.
Ofcom has robust enforcement powers available to use against companies that fail to fulfil their duties and will be able to issue enforcement decisions. That is in response to a question posed by my noble friend Lord Stevenson. This includes non-payment of fees, which is explicitly covered under Section 141 of the Online Safety Act.
Ofcom’s authority to collect fees is set up, as I said earlier, under Section 84 of the Act. Its authority to collect penalties is also set up under Schedule 13. If a provider of a regulated service does not pay its fee to Ofcom in full, Ofcom may give the provider a penalty notice specifying the outstanding sum and a date on which it must be paid. It may also bring legal proceedings for the recovery of the whole or part of the amount due.
I will write to my noble friend Lord Stevenson on the issue of Ofcom’s future receipts being lower than its costs.
Lord Stevenson of Balmacara (Lab)
I am grateful to my noble friend for trying to explain the “just and reasonable” approach. Just to unpick what he said, what is Ofcom consulting about? There seems a disjuncture in what we are trying to do here. We are going to pass this regulation tomorrow—it will be in force in a couple of weeks, according to Ofcom—yet we still do not know whether Ofcom has completed its discussion about whether companies are prepared to accept “just and reasonable”. Is that a fair summary of where we are?
Lord Leong (Lab)
My noble friend makes a good point. Ofcom is consulting on the guidance to help providers understand the ways of apportioning revenue in a “just and reasonable” manner. Its guidance will hopefully be published in the last quarter of this year. Until such time, I am sure there will be further guidance for providers along the way.
To come back to the scrutinising of legislation, ongoing parliamentary scrutiny is crucial. Indeed, the Online Safety Act requires Ofcom’s codes to be laid in Parliament for scrutiny. The Secondary Legislation Scrutiny Committee continues to provide vital scrutiny of statutory instruments and has drawn special attention to several instruments that my department has laid in the past few months. It identified the instrument we are debating today as an instrument of interest. The Science, Innovation and Technology Select Committee and the Lords Communications and Digital Committee also play a vital role in scrutinising the regime.
Finally, the Secretary of State is required under Section 178 of the Act to review the effectiveness of its regulatory framework between two and five years after key provisions of the Act come into force. A report of the outcome of this review will be published and laid before Parliament.
Ofcom has said in response to the SLSC that it will review the information from providers and is able to use its powers to require further information under Section 100 of the Act should it need further details to scrutinise the approach taken by the provider—that is to do with the “just and reasonable” method. Ofcom has stated that it has access to sufficient expertise to make this assessment.
The noble Viscount, Lord Camrose, asked about exemptions. Under the Act, Ofcom has the power to make or revoke exemptions and this must be approved by the Secretary of State. Ofcom is proposing to exempt service providers whose UK referral revenue is less than £10 million. We will consider that carefully before deciding whether to approve the exemption. I am sure noble Lords will know that about 60 companies would probably fall within the bracket of the Ofcom fees regime—the majority of which are non-UK companies. I am sure noble Lords will also know that most of these companies have revenues in excess of £250 million. I would have thought that there are not many companies with revenue of less than £10 million.
In the last 12 months, we have seen key elements of the Online Safety Bill progressed and implemented. Many of Ofcom’s powers are now in effect. Platforms are now legally required to protect children from harmful content, including rolling out highly effective age assurance to tackle pornography, suicide, self-harm and eating disorder content. This instrument will bring us one step closer to a fully implemented online safety regime, ensuring that companies raising revenue from online services cover the cost of regulation—not taxpayers—and take responsibility for keeping our children safe online.