Checks on social media use for children

Checks on social media use for children

¶32. It is not possible to identify the source of all the material that was found on AR’s laptop and tablets. However, it is clear that AR was able to use social media to seek graphic and violent content, at the very least in so far as he searched for the Bishop Mar Mari Emmanuel stabbing in the minutes before he left the house to carry out the attack.

¶33. At the time of those searches, on 29 July 2024, platforms were required to act quickly to remove any illegal content that they hosted, if they were notified that such content was on their site.⁶¹²⁶¹² T/S: 31/197/2-18. However, platforms were not under any obligation actively to identify illegal content and there was no regulation to protect children from accessing legal but harmful content online in the UK. The Inquiry heard from Ms Sarah Connolly of the Department for Science, Innovation and Technology (DSIT), who accepted that the regulation in place in 2024 was “fragmented”.⁶¹³⁶¹³ Witness Statement of Ms Connolly DSIT000004/§12; T/S: 31/196/21-24. Among the regulations in place was regulation of video service platforms by the Office of Communications (Ofcom).⁶¹⁴⁶¹⁴ Pursuant to the EU’s Audio-Visual Media Services Directive, available at: www.legislation. gov.uk/uksi/2020/1062 and Part 4B of the Communications Act 2003, as amended on 1 November 2020, available at: www.legislation.gov.uk/ukpga/2003/21/part/4B/2024-01-10 The regime required video service providers to protect users of all ages from relevant harmful material and required further protections for under-18s.⁶¹⁵⁶¹⁵ Witness Statement of Mr Higham OFC000002/§25. However, the regulation did not apply to some of the biggest and most well-known services which were not within the UK’s jurisdiction for the purposes of these regulations, including X and Meta.

¶34. This has since changed through the Online Safety Act 2023 (OSA). The OSA received Royal Assent on 26 October 2023. However, it was not enforceable against regulated platforms until Ofcom had published Codes of Practice and those codes were not published until 2025. As a result of the OSA and Ofcom’s Code of Practice, regulated platforms, including social media platforms, are required to assess whether children are likely to access the service and, if likely to be accessed by children, then to assess the risk of children encountering harmful content. Social media platforms likely to be accessed by children are under a duty to:

¶a. Put in place proportionate systems and processes designed to prevent children of any age from encountering certain types of content, for example content relating to suicide and self-harm or material relating to eating disorders;

¶b. Put in place proportionate systems and processes to protect children from other types of content that is harmful to children. This includes content which encourages, promotes or provides instructions for acts of serious violence and/or content which depicts real or realistic serious violence or injury against a person in graphic detail; and⁶¹⁶⁶¹⁶ T/S: 31/218/15-221/3.

¶c. Platforms that host the above content are required to have in place highly effective age assurance. Ofcom has set out detailed guidance on what this requires but it could include the use of credit card data, driving licences or age estimation based on facial recognition software.⁶¹⁷⁶¹⁷ T/S: 31/224/6-225/3.

¶35. Ms Deanna Romina Khananisho, X’s Head of Global Government Affairs, described X’s age verification requirements. Users of X must be over 13 years old. Prior to the OSA, users were required to enter their date of birth. If the date of birth rendered them over the age of 13 but under 18 then they were precluded from viewing content that X deemed sensitive.⁶¹⁸⁶¹⁸ T/S: 32/81/19-82/15. At that time, there were no checks carried out on the date of birth provided or further requirements such as the provision of a government ID. As a result, Ms Khananisho accepted that a 13-year-old could simply enter a false date of birth and therefore gain access to sensitive material.⁶¹⁹⁶¹⁹ T/S: 32/83/19-84/9.

¶36. X has introduced further age verification measures in 2025 to comply with the duties set out in the OSA. X now assesses a user’s age using a number of measures including: if a user has previously declared that they are under 18, if a user has a blue badge (which would have required them to prove that they were an adult), if the account was created in 2012 or earlier, if the account was from a government or verified organisation, estimations based on email addresses or social connections, and, in the UK, facial age estimation based on a live ‘selfie’ or government-issued ID.⁶²⁰⁶²⁰ Witness Statement of Ms Khananisho XIUC000030/§14. Ms Khananisho did not deny that X could have put these measures in place prior to the OSA coming into force.⁶²¹⁶²¹ T/S: 32/87/20-89/13.

¶37. The time that the OSA took to come into force was explored in evidence with Ms Connolly. It took four years from the Online Safety White Paper, dated April 2019, until the OSA received Royal Assent. Ms Connolly frankly accepted that the passage of the Bill was long and slightly fraught because of the deeply contentious balance between online protections and freedom of expression. In addition, there was the impact of political churn, with seven Secretaries of State between 2016 and 2023. I have no reason to doubt Ms Connolly’s evidence that there was nothing that could have been done from the perspective of officials at DSIT to speed up the passage of the Bill. In addition, there was further time taken for Ofcom to publish its Codes of Practice after the Act received Royal Assent. This took almost a year and a half for the first Code. Nevertheless, the OSA required Ofcom to go through a series of steps to publish the Codes of Practice, including laying them before Parliament. The end result is that it was around six years from the White Paper to the Codes of Practice being enforced.

¶38. Those time periods are unfortunate because if the OSA had been in force almost exactly a year earlier, it might have impacted on AR’s searches on X for the Bishop Emmanuel video.⁶²²⁶²² T/S: 31/215/3-218/9. However, I can put this no higher than ‘might’ because AR was a prolific user of Virtual Private Networks (VPN) and it would have been possible to use a VPN to bypass any UK specific age verification checks on X (see recommendations in relation to this below).⁶²³⁶²³ T/S: 11/21/25-22/3.