Online safety and "vulnerable" consumers: the new OFCOM's draft codes of practice

The English Office of Communications (OFCOM) has recently released its new draft "Children's safety online" codes of practice in line with the Online Safety Act (OSA) the main act providing for online safety in the UK, which became law in October 2023. 

OFCOM is responsible for enforcing the OSA. Its draft codes of conduct are meant to complement it and to suggest platforms (especially, social media) how to shape a safer environment, with a focus on underage consumers. Accordingly, the guidelines encourage platforms to be stricter in setting up adequate procedures for age-checking, to provide users with the due instruments to report harmful content, to remove it when necessary, and to clarify the systems used to monitor and moderate online content, particularly with respect to young people.

Platforms ought to take measures based on their size, the purpose of their services, and the risk of harm to children. Thus, the Online Safety Act adopts a risk-based approach, similar to the European Digital Services Act (Regulation EU, 2022/2065). The purpose is indeed the same: ensuring that online service providers implement procedures that are able to tackle the threats to online safety while safeguarding users’ privacy rights and freedom of expression. The two acts therefore cover issues such as content moderation, and other generative AI outputs, such as deep fakes. They both show the increasing attention placed by lawmakers on new forms of digital vulnerability, and how to address them.

OFCOM’s choice to enact codes of conduct is in line with the European approach, too; in fact, the EU lawmaker has also emphasized the relevance of codes of conduct and soft laws in shaping a safer digital environment. The draft codes of conduct provide for transparency, placing on platforms the duty to make available to the public their risk-assessment findings, and providing systems to easily report illegal content. 

And the Agency has gone even further. Indeed, it has declared that it could even impose a ban on people under the age of 18 to access platforms that fail to comply with its guidelines. 

However, some questions arise from reading the new OFCOM document. Will the procedures for ascertaining the age of users lead to the collection of an excessive amount of personal data, violating the data minimization principle under the GDPR? Are OFCOM’s codes too restrictive if compared to the DSA, forcing platforms to adopt a “double standard” between users based in the UK, and those that are based in the rest of Europe? Is the Online Safety Act “technologically neutral” enough when differentiating platforms’ obligations on the basis of the content type or the most comprehensive approach adopted by the DSA, based on equal risk mitigation for all the illegal content, is to be preferred?

Despite these concerns, which undoubtedly will be further examined by many scholars and privacy advocates in the coming months, the guidelines seem promising for improving the online safety of English users, especially children. The true test will be their implementation and enforcement.

Transparency about online payments even if they are conditional - CJEU in Conny (C-400/22)

Last week, on May 30, the CJEU gave its judgment in the Conny case (C-400/22) elaborating on the requirement from Article 8 of the Consumer Rights Directive to clearly label an online obligation to pay on a website on a relevant button with the words 'order with obligation to pay' (or an equivalent of this).

Photo by Alice Pasqual on Unsplash

The facts of this case are interesting as it was a trader that tried to argue that the lack of clear wording on a website about an order with an obligation to pay should lead to the voidness of the concluded contract. The contract in case was a lease contract, concluded between a landlord and a tenant. Pursuant to German law, this lease contract had a ceiling on the rent that consumers had to pay and if this ceiling was exceeded, consumers could claim reimbursement of overpayments. Conny - a debt collection company - offered to collect the rent overpayments as an assignee of consumers rights. The contract between Conny and consumers was concluded online, via its website. Consumers had to approve T&Cs and click on a button to place the order, which button was not labelled with the required wording. The reason given for this was that the payment was conditional on Conny successfully securing the debt collection. Only at that time consumer would have had to pay a third of the annual rent saved, pursuant to T&Cs. The landlord used the lack of the proper labelling on Conny's website as an argument that the assignment of consumer rights was void and, that therefore, Conny could not have been successful in claiming repayment of rent from the landlord. 

Order with an obligation to pay - whether payment is conditional or unconditional

The CJEU clarifies, as expected, that the trader's obligation to transparently inform consumers concluding a contract through its website about an obligation to pay, just before a consumer binds themselves to this payment, does not change if the payment is dependent on satisfying a subsequent condition (para 56). This allows the consumer to explicitly acknowledge his consent to be bound by an online order with an obligation to pay (paras 43, 50). The CJEU points to the lack of distinction in the CRD between conditional and unconditional payments, as well as the duty to inform placed on traders when an order 'implies' an obligation to pay (paras 46-47). A different interpretation would have led to traders being able to explicitly inform consumers about their obligation to pay not at the ordering process, when consumers may still avoid the order and the subsequent payment obligation, but only at a time when the payment becomes due (para 52). Traders could then circumvent their duty to inform by placing in their T&Cs an objective condition, fulfilment of which would be required to lead to a payment obligation (para 53).

Sanction of voidability

An important clarification follows in paras 54-55 of the judgment. The CJEU emphasises the CRD's wording, which only states that a consumer is not bound by the contract in case the above-mentioned trader's duty has been breached. This does not need to indicate that a contract is void, but rather that a consumer has an opportunity to avoid it. This would make a significant difference in cases such as the one referred to the CJEU, when it is a trader who is trying to use an infringement of consumer protection rules as a 'weapon' against, ultimately, a consumer.