Clean Up The Internet—written evidence (DRG0002)

House of Lords Communications and Digital Committee inquiry into Digital Regulation

1. Summary

Clean Up The Internet is an independent, UK-based, not-for-profit organisation concerned about the degradation in online discourse and its implications for democracy. We campaign for evidence-based action to increase civility and respect online, to safeguard freedom of expression, and to reduce online bullying, trolling, intimidation, and misinformation.

We are delighted to have the opportunity to submit evidence to your committee. Our submission focuses on your second question, “Do regulators have the powers and capabilities, including expertise, to keep pace with developments? What is the appropriate balance between giving regulators flexibility and providing clarity in legislation?”, but also touches upon the other questions you raise.

We don’t believe that regulators do currently have the powers, capabilities, or staff capacity to regulate effectively. This is reflected in the proliferation of online harms to UK citizens including abuse, misinformation, and fraud. However, we recognise that progress is currently being made towards the development of effective digital regulation.

The draft Online Safety Bill, whilst inadequate in its current form, is a significant step towards effective regulation of social media platforms. The Age Appropriate Design Code, if properly enforced, has the potential to improve children’s ability to access the internet safely. Plans to support growth in the use of digital identity, through the “digital identity and attributes trust framework”, governance framework, and governing body, could underpin improvements in levels of trust and authenticity online.

We strongly support the government’s proposed principle, in their July 2021 policy paper Digital Regulation: Driving growth and unlocking innovation, that “regulatory interventions should address underlying drivers of harm rather than symptoms”, and agree that adherence to this principle would help future-proof regulation. Furthermore, a focus on “underlying drivers” is likely to be a much more efficient use of regulatory resources. However, we are not convinced that current regulatory initiatives, in particular the draft Online Safety Bill in its current form, fully adhere to this principle.

Much of Clean Up The Internet’s work to date has focused on the role which anonymity plays in harmful online behaviour, including both abuse and disinformation. This is an important example of an “underlying driver of harm” which could be greatly mitigated through improvements to platforms’ design, systems and processes. It’s also a helpful prism through which to assess the adequacy of regulation of “underlying drivers of harm” more broadly.

We are concerned that as currently drafted the Online Safety Bill may not drive any improvements to how anonymity is managed. This is both because it fails to specify anonymity as a design risk factor to be addressed, and because Ofcom is not given sufficient powers to audit and challenge platforms’ own risk assessments and insist they address issues which they have a track record of avoiding. We do not think it is realistic to expect improvements to platforms’ approaches to anonymity or verification without effective regulatory intervention. Up to this point social media platforms have obfuscated the role which anonymity plays in fuelling online harms, and resisted all calls for voluntary action. The large social media platforms’ advertising business model provides a strong incentive against voluntary action on anonymity.

We are also concerned that potential synergies are being missed between improving how social media platforms address anonymity, and the work to grow the use of digital identity. Finally, we are concerned that plans to relax the UK’s data protection laws could create uncertainty about how users’ privacy will be protected should they have an option of verifying their identity, and that this could have a negative impact on confidence in, and uptake of, verification processes.

This submission therefore makes the case for tackling the misuse of anonymity, and explains how this requires both changes to the draft Online Safety Bill and greater join-up with other parts of the government’s regulatory agenda. We suggest that the Online Safety Bill should explicitly define anonymity as a risk-factor which platforms are required to act to mitigate, and which Ofcom should be required to address within its Codes of Practice. In addition to an overall duty to manage anonymity as a risk factor, we propose that the Bill could introduce specific requirements for platforms to offer their users a “right to verify”, a “right to block interaction from unverified accounts”, and for transparency about the verification status of all users.

These proposals for a new approach to anonymity, which seeks to mitigate its role in fuelling online harms whilst safeguarding legitimate uses, are consistent with the recommendations made in your recent report Free for all? Freedom of expression in the digital age. We include some suggestions for how the draft Bill could be accordingly amended.

We explain why strengthening the Online Safety Bill’s focus on “underlying drivers”, such as anonymity, would reduce the amount of harmful behaviour and content which occurred on the platforms. This would reduce the extent to which regulators, or platforms, need to rely on content-focused interventions such as moderation or take-down, which are inherently more labour-intensive and involve more challenging trade-offs. It would also reduce the burden on the police and criminal justice system. We also explain how such measures require effective coordination between Ofcom and the ICO, and how the government’s plans to support an expansion in the use of Digital Identity products should explicitly consider identity verification on social media as a potential use case. We set out why any changes to UK Data Protection laws should retain or enhance protections for any personal date required in the course of identity verification.

2. What’s the problem with anonymity on social media?

The ease with which social media can be used anonymously, or with pseudonyms, combined with a lack of protections and controls for other users, is currently a key driver of harmful behaviour.

It’s a major factor in the spread of disinformation, conspiracy theories and extremism. Organised disinformation networks exploit the ability to create fake accounts, and false identities, at scale. They use networks of these accounts to create false and misleading content, to spread and amplify this content, and to distort and disrupt online conversations. A recent study[1] by Clean Up The Internet found that in March and April 2020 anonymous Twitter accounts played a significant role in the spread of conspiracy theories about coronavirus and 5G in the early days of the pandemic. A recent NATO Stratcom study[2] from November 2020 confirmed it remains extremely easy and cheap to buy fake engagement from fake accounts for the purposes of disinformation on platforms including Facebook, Instagram, Twitter, YouTube, and TikTok.

Anonymity is also a major factor in bullying, harassment and trolling. A recent poll of UK social media users,[3] conducted by Opinium for Compassion in Politics, found that of those who had experienced online abuse, 72% had received abuse from anonymous accounts. When social media users are anonymous, they feel much more able to behave badly and abuse other users, a phenomenon known as the “Online Disinhibition Effect”. Anonymity also makes it much harder to enforce rules against such behaviour. If an anonymous troll does eventually get banned, they can easily create a fresh anonymous account with a new pseudonym and continue their trolling or abuse. Finally, anonymous threats can be more frightening for victims, because it is much harder to assess or mitigate the level of threat if it is unclear who is making it.

3. How could platforms improve their design, systems and processes to reduce harms associated with anonymity?

It is understandable, given the harms associated with anonymity, that some have proposed simply to ban it and require mandatory account verification for all users. A parliament.uk petition calling for such a ban[4] has received almost 700,000 signatures. However, Clean Up The Internet does not support such a ban. There are many well recognised cases where anonymity is very important for freedom of expression – for example in the case of a whistle-blower, a member of the LGBTQ+ community who is not “out” to their family, or someone fleeing domestic abuse.

We instead support changes to the operation of social media platforms aimed at restricting misuse of anonymity, whilst continuing to permit its legitimate use. Three practical and deliverable changes to how anonymity is managed by social media platforms would drive a huge reduction in the amount of harm it fuels:

1. Give all social media users the right to verify their identity if they choose. Every social media user should be given the option of a robust, secure means of verifying that the identity they are using on social media is authentic. Users who wish to continue unverified should be free to continue to do so.

2. Make it easy for everyone to see whether or not a user is verified. The verification status of an individual user should be clearly visible to all other users. Each user would then be able to bring their own judgement as to what a verification status might say about the credibility and reliability of another user's content.

3. Give users the option to block interaction with unverified users. Some users will be happy to hear from, and interact with, unverified users. Others will not. This should be a matter of individual user choice. Every social media user should be offered options to manage their level of interaction with unverified users, including an option to block communication, comments and other interaction from all unverified users, as a category and pre-emptively.

4. Why is regulation necessary to address the role of anonymity in fuelling online harms?

In theory, it would be perfectly possible for social media platforms to implement voluntary changes to their design, systems and processes to address the role of anonymity in fuelling online harms. However, in practice they have consistently failed to do so, and when challenged on the subject have expressed a great deal of resistance to changing their current laissez-faire approach.

A major obstacle to securing improvements through voluntary action is that the advertising business model of most large social media companies incentivises inaction. Most social media platforms make claims about total user numbers, advertising audience sizes, and ad impression statistics, which are inflated by inauthentic anonymous accounts. All “engagement” on the platform, whether authentic or inauthentic, healthy or harmful, generates data which can be used to target adverts, and “eyeballs” which can be sold to advertisers.

A recent illustration of how platforms, in the absence of strong regulation, respond when challenged about the role played by anonymity, was provided after racist abuse was directed at England footballers following the 2021 Euros final. Whilst the victims, and the Professional Footballers Association, highlighted the role of anonymous accounts, and polling[5] suggested significant public concern about the misuse of anonymity and support for measures to address it, the platforms refused to engage with this issue.

●        Instagram opted for avoidance.
It chose not to engage with public concern and debate about anonymity at all, or share any data about the role of anonymous accounts in the wave of abuse. When a few weeks later it announced[6] a “new set of new features to help protect people from abuse”, this announcement made no mention of anonymity and the “new features” did not offer users any new options to verify their identity, or any options to restrict interaction from unverified accounts.

●        Twitter chose denial and deceit.
It issued unsubstantiated claims[7] that ““ID verification would have been unlikely to prevent the abuse from happening” and claimed without presenting any evidence that a remarkable 99% of the offending accounts were not anonymous. The company refused to engage with our subsequent requests for it to provide evidence[8] or show its working to justify this claim.

Twitter’s UK Head of Policy, Katy Minshall, repeated these claims in an appearance before the Home Affairs Select Committee on 8th September. She claimed to the committee that “99% of the accounts were identifiable. That means they have provided at least one, in most cases two, pieces of personal information”. She then listed these pieces of “personal information” as “full name, Date of Birth, email address, phone number” and claimed that you ““have to verify to get on the service”.

This was in our view extremely misleading. Twitter does not verify the name or date of birth provided by a user when opening an account, and it’s extremely easy to provide an email address with no identifying information, or an unregistered/”burner” phone number. It appears that for the purposes of reaching the conclusion that “99% of the accounts were not anonymous”, Twitter chose a definition of “not anonymous” that would appear to include an account registered in the name of “Mickey Mouse”, claiming a date of birth of April 1st 1921, and linked to the email address mickeymouseisnotreallymyname@gmail.com.

The platforms have shown themselves repeatedly to be willing to deny, obfuscate and mislead about the problems associated with anonymity – even in the face of considerable public concern, and including when appearing before Parliament. It seems reasonable to assume that without regulatory intervention they will remain stubbornly attached to their current approach.

5. What would the current draft of the Online Safety Bill do to reduce harms associated with anonymity?

In December 2020, in their full response to the White Paper Consultation, the government stated very clearly that they intended to “not put any new limits on online anonymity”. When challenged in Parliament about this position on 15th December 2020, the then Secretary of State Oliver Dowden defended it by saying “On anonymity, we have not taken powers to remove anonymity because it is very important for some people—for example, victims fleeing domestic violence and children who have questions about their sexuality that they do not want their families to know they are exploring. There are many reasons to protect that anonymity.” Incidentally we agree with those reservations, and have carried very similar wording on our public website since 2019, but a desire to protect anonymity does not need to conflict with measures to prevent its abuse. When pressed further by several other MPs, Mr Dowden then pledged to “genuinely keep an open mind, and if we can find a way of doing this that is proportionate, we will continue to consider whether there are measures we can take as we go through pre-legislative scrutiny.”

Notwithstanding Mr Dowden’s “open mind”, the wording of the draft Bill reflects the intention set out in December 2020 of not putting any “new limits” on anonymity, of wishing to leave platforms’ current approach to anonymity untouched. This is consistent with the Bill’s broader silence on specific design-level problems or risk factors. It’s worth noting that the lack of specificity on design-level risk factors stands in contrast with greater specificity regarding content, including between categories of content, (“content harmful to children”; “content harmful to adults”), specifying some priority forms of illegal content (Terrorist content; CSEA) and a process to designate others, and specific other content which enjoys special exemptions (“journalistic content”; “content of democratic importance”).

The closest the Bill comes to touching on anonymity is to list, in Section 135 (2) (a), “creating a user profile, including an anonymous or pseudonymous profile” as one of 13 “functionalities” which companies should consider when fulfilling their various safety duties, and which Ofcom should consider when conducting risk assessments. It is not clear how Ofcom is able to challenge platforms’ own risk assessments.

In our view this is a very weak provision, which sets no expectations that consideration of anonymity will be prioritised, or that any changes to their design or processes will be introduced.  More broadly, if Ofcom is unable to challenge platform’s own risk assessments, including with powers to direct them to address specific risks and to audit their conclusions, then we can expect platforms to avoid and gloss over risks which could challenge their business model.

Such weak and non-specific requirements seem unlikely to drive any significant change any time soon, particularly given that the platforms have repeatedly refused to even acknowledge, let alone address, the problems associated with anonymity. The platforms have a long track record of resisting changes to their design or systems, which could improve user safety, when such measures could sit in tension with their advertising business model and consequent focus on maximising engagement and minimising friction.

The final Bill needs to give Ofcom clear powers to force platforms to address such systemic drivers of online harms, and to audit and challenge platforms’ risk assessments if they fail to acknowledge or address them adequately. Otherwise we can expect that the platforms will continue to adopt strategies of avoidance or denial and produce section 7 risk assessments which gloss over problems associated with anonymity - and that Ofcom will be ill-equipped to audit the data on which such risk assessments are based, or challenge such omissions.

5. Why is the lack measures to tackle anonymity a key omission in the draft Bill?

Silence on anonymity is a key omission which risks weakening the rest of the Bill. This is for three main reasons:

1. The platforms’ current approach to anonymity is fuelling online harms

There’s a significant body of evidence that the major social media platforms’ approach to anonymity fuels both online abuse and the spread of disinformation. Research published in August 2021 by Compassion in Politics[9] found that 72% of UK social media users who have experienced online abuse believe they were targeted by anonymous or false accounts and that 38% have seen “fake news” posts or extremist content shared by anonymous accounts. These are two of the principal “harms” which the government’s Online Safety agenda seeks to reduce. Tackling the misuse of anonymity would reduce the amount of harmful activity on the platforms, and give users more options to protect themselves. Leaving such design flaws unaddressed by the Bill is inconsistent with the government's stated regulatory principle that “regulatory interventions should address underlying drivers of harm rather than symptoms”. It risks leading to over-reliance on ex post content moderation. This is much more labour-intensive as well as being much more challenging to get right and posing more difficult trade-offs regarding freedom of expression. We would urge a focus on prevention rather than cure wherever possible.

2. An absence of measures to tackle misuse of anonymity limits the effectiveness of other measures in the Bill, such as the reliance on Platforms’ own Terms & Conditions

The draft Bill envisages more consistent enforcement of the largest (“Category One”) platforms’ own Terms & Conditions as central to reducing content harmful to adults. However, at present users are able to exploit a lack of verification to evade T&Cs. The ultimate enforcement sanction in a platform’s T&Cs is banning an account. In the absence of any new measures regarding anonymity, it remains extremely simple for a banned user to start a new account and continue their harmful behaviour, including harassing other users. Many victims of abuse report efforts to block abusive accounts as a “whack-a-mole” exercise, because no sooner is one account blocked than a suspiciously similar account appears and continues the abuse where the blocked one had left off. Where behaviour crosses a criminal threshold, or is defamatory, the prevalence of anonymous accounts also makes it much harder for perpetrators to be brought to justice.

3. A lack of measures on anonymity will weaken the credibility of the legislation in the eyes of the general public

Numerous opinion polls have found that the public sees harm from anonymous accounts as a leading problem with social media platforms. Polling[10] conducted by Opinium this June found that 73% of adults “support government action to reduce the number of anonymous accounts on social media platforms”. Polling[11] conducted in 2020 by Demos and BT found that 65% of respondents agreed with the statement that “harmful behaviour conducted by anonymous internet users means that everyone should have to use their real names to access services”.  The public’s desire for action is informed by their own experience of using such platforms, and their awareness of high-profile figures who experience online abuse, such as celebrities or footballers. The public will struggle to understand why no measures have been introduced to reduce the harm from anonymous accounts, and will feel less confidence in the new Online Safety regime as a result.

6. How could such measures be added to the draft Online Safety Bill?

The legislation would do more to encourage platforms to make improvements at the level of design, systems and processes if it explicitly identified priority risk factors which it expected the platforms to address, and priority safety features which it expected them to introduce. The Bill could both name some priority risk factors, and create a process for further priority risk factors to be identified – as it does in the case of types of content.

Anonymous and unverified accounts would be an obvious candidate to be designated as such a risk factor, given both the clear evidence of the role of anonymity in enabling harm, and the public expectation that it be tackled. The Bill could require platforms to demonstrate to the regulator that through their design, systems and processes they have taken reasonable steps to mitigate the risks associated with anonymous accounts. It could further require that these mitigations included offering users a verification option, a means of seeing the verification status of other users, and a means of restricting or blocking contact from unverified accounts.

Further guidance could then be issued by Ofcom through a Code of Practice. This could include cross-referencing with other regulators and regulatory frameworks, such as the ICO and a future governing body for digital identity providers, to address considerations like ensuring that verification systems are secure, accessible to users in a diverse range of circumstances, and are not exploited by platforms as an additional opportunity to harvest data.

Such an approach would set clear expectations for platforms, whilst still allowing flexibility. Different platforms would be free to develop their own designs, processes and systems to mitigate the risks associated with anonymity, and in order to comply with the specific requirements around offering their users a verification option. Ofcom could update its Codes of Practice as new technologies and platforms emerged, or in the light of fresh evidence.

7. What could this look like in terms of changes to the wording of the draft Online Safety Bill?

We recognise that the current draft Bill may change, potentially significantly, following pre-legislative scrutiny, so what follows should be seen as seeking to demonstrate a potential approach rather than as our definitive proposal.

Working with the current draft Bill, a new clause could be added as a new section at the end of Ch2 (i.e. a new Section 17). We suggest it could look something like this:

(17) A duty to use proportionate systems and processes to mitigate and effectively manage the harm caused by anonymous accounts. This must include the development of systems and processes designed to ensure —

(a) all users of the service are provided with a simple and effective means of verifying their identity

(b) it is readily apparent to all users of the service which other users of the service have verified their identity and

(c) all users of the service are given simple and meaningful controls over the ability of all unverified users, whether individually or as a class, to contact them or interact with them using the service

See also, in relation to duties under this section, section 12(2) (duties about rights to freedom of expression and privacy)

Ch5, s29 regarding “Codes of practice” would then automatically apply to this new duty, as it would be defined as a “relevant duty” as per subsection (9).

An explicit reference to reducing harms from anonymous or unverified users could then be added into s30 which sets out “Online safety objectives” which Ofcom must consider when preparing Codes of Practice. A new s30(2)(ix) could be inserted as follows:

ix) there are adequate controls over access to, and use of, the service by anonymous users, taking into account the ways in which anonymity may increase the risk and/or impact of harmful behaviour and make it harder to hold perpetrators to account for their actions

An explicit requirement for Ofcom to assess the risks associated with anonymous and unverified users could also be added to Ch3, s61, “Risk assessments by Ofcom”. This could be done by amending Ch3, s61(6) to insert “approach to anonymous accounts and user verification”, so that it reads as follows:

(6) In this section the “characteristics” of a service include the functionalities of the service, its user base, business model, governance, approach to anonymous accounts and user verification, and other systems and processes.

An explicit reference to anonymity could also be added to Part 4 Chapter 8 Section 103 regarding media literacy. This section amends the Communications Act to update Ofcom’s “duty to promote media literacy” for digital media.  A new s11(1)(b)(iv) could be inserted regarding Ofcom encouraging the development of “technologies and systems which help improve media literacy”, as follows:

(iv) indicate to the recipient whether or not the identity of an account sharing the material has been verified as genuine

Another additional subclause could be added to the definition of media literacy, as s11(2)(b)(v):

(v) the authenticity and reliability of the account or user sharing such material

8. What other regulators and regulatory frameworks could contribute to tackling harms associated with anonymity?

Whilst the Online Safety Bill is the obvious legislative vehicle for addressing online harms associated with anonymity of social media, and Ofcom the obvious body to supervise the platforms’ actions, there are important linkages to other pieces of regulation, and other regulators.

The government’s plans to support the growth in the use of digital identity, through the “digital identity and attributes trust framework”, a governance framework, and governing body, does not currently identify social media verification as a potential use-case for digital identity products. We believe that this is an important but easily rectified oversight. A framework of governance and standards for digital identity products and processes would support the growth of a range of solutions, products, and providers of social media identity verification. Extending a “right to verify” to all social media users would boost take-up of digital identity products, and have the potential to encourage more entrants into the market.

Available research suggests that a substantial majority of UK social media users would be willing to undergo some form of identity verification process, but this in part will depend on confidence in the security and privacy of verification processes. Alongside the new governance framework for digital identity providers, the UK’s data protection regime will be crucial. The ICO will need to be proactive in ensuring that any data collected for the purposes of verifying a social media profile is kept to a minimum, held securely, not retained any longer than is necessary, and only used for purposes for which the user has meaningfully consented. Any changes to the UK’s data protection regime, post-Brexit, should aim to enhance, or at a minimum maintain, adherence to these principles.

Whilst there are important distinctions between verification of a user’s age, and verification of their social media identity (which would in most cases need to confirm their name and location), there are common principles which apply to both – particularly if the attributes-based approach envisaged by the government’s current digital identity frameworks thinking is followed. This will mean important points of overlap with the development of age verification processes, as Ofcom assumes regulation of video-sharing platforms, and for purposes related to compliance with the Age Appropriate Design Code. The Digital Policy Alliance explains these points of overlap in their briefing,[12] Age/Identity Verification – Challenges, Solutions and Benefits.

9. Addressing legitimate concerns about measures to restrict abuse of anonymity

There is strong evidence that at present anonymity fuels a significant amount of harm, and that the public support regulatory intervention to tackle this problem. However there are also instances of the ability to use social media anonymously protecting an individual’s freedom of expression - for example in the case of a whistle-blower account such as the Secret Barrister, or in the case of an individual fleeing domestic abuse. It’s also important to recognise that verification processes could act as a barrier to participation, particularly to users who may not have standard ID documents (e.g. a homeless person, or a trans person).

Three critical safeguards would ensure that our proposals bear down on anonymous abuse and the use of anonymous accounts to spread disinformation, without any undue negative impact on those for whom anonymity is important, or who just wish to continue unverified but aren’t engaged in negative behaviour.

1. Ensure that verification systems are developed with due regard to accessibility, diversity, and inclusion

Any verification system would inevitably introduce additional steps which a user would need to take in order to achieve verification, and may require them to have access to specific means of proving their identity such as official documents. The specific needs of different minority groups would need to be considered, for example to ensure people with no fixed abode were not excluded through not having a permanent address, or that there was a straightforward way for trans people to transition their accounts to their new name/gender. Care would need to be taken to avoid over-reliance on a narrow range of national identity documents, such as passports and driving licenses, which sizeable minorities of the population do not possess. Options such as using a bank account for identity verification (97% of the UK population have a bank account), or using “vouching” by a trusted individual for those without documents, would need to be developed.

To this end it is welcome that the proposed “digital identity governance framework” proposes that one of its top-level objectives is to “enable inclusion by promoting inclusive and accessible solutions especially for end-users”. In addition to this, Ofcom should be required to consult and involve a diverse range of users in the development of a Code of Practice for social media companies regarding verification, and to monitor and review the inclusivity of those processes on a regular basis. Social media companies should be required to demonstrate that all their terms and conditions, including those relating to verification, are compliant with relevant equalities legislation, and that they have been developed with due regard to diversity and inclusion.

2. Place strict limits on the use of data collected for purposes of verification

In general, social media companies have deservedly poor reputations for respecting their users’ privacy, and some users will therefore have concerns that identity verification could enable further privacy violations. It will be crucial to address such concerns, both  to protect individual users’ rights, and to ensure that a critical mass of users are willing to undergo verification.

Ofcom should work with the ICO to ensure that data gathered for the purposes of identity verification should be used only for that purpose, and only retained as long as is necessary for purposes of verification. For example, should a document or image be uploaded as part of a verification process, it should be destroyed once verification status is confirmed. Third party options from independent providers should be made available which would mean platforms had access only to tokenised identity credentials, rather than e.g. a full scan of a user's official documents. A number of independent identity verification provider companies already exist or are in the process of launching, for example OneID[13] and Yoti.[14]

Verification processes and outcomes should be communicated in plain English to the user. That should include making it clear to users that they have a genuine choice as to whether or not they verify - i.e. it should be made clear that it is possible to continue as a user of the platform (albeit with some limitations) without verification.

These principles of data minimisation, active consent and user choice are consistent with the principles of the GDPR. Strict enforcement of existing privacy rules as they relate to social media identity verification will therefore be a key pillar of protecting users’ rights and ensuring trust. Ofcom, as the online harms regulator, will need to work closely with the ICO, as the data and privacy regulator, and any new digital identity providers’ governing body, to ensure proper enforcement of privacy rules with regard to verification systems, and to identify (and fill) any regulatory gaps via a Code of Practice. Any changes to data protection laws post-Brexit will need to maintain these principles.

3. Make verification optional

Ensuring that verification is made as accessible as possible, and that privacy concerns are addressed, should mean that most social media users are both willing and able to verify their identities. Research conducted by Opinium in January 2021 found that 81% of UK social media users currently state they would be willing to verify their identity for social media. However, our proposal that verification be optional would significantly mitigate any remaining issues. Retaining the ability to access social media without verification - albeit with certain limitations, but limitations designed to restrict malign rather than legitimate use - would mean no user would be at risk of losing access to a platform through not taking part in verification, whether by choice or because they had some difficulty with the process.

A separate concern has been expressed that offering a “right to verify” would create a “two tier internet”, where those who opt to remain anonymous, including vulnerable users, would enjoy less credibility, less reach, and less protection from harm. It would not make sense to reject regulatory interventions which have the potential to benefit a substantial majority of legitimate social media users, simply because it would not benefit everyone to the same degree. However, given that some of those who may choose to remain anonymous on social media would likely be vulnerable and marginalised users, it is important to consider how the safety of users who have legitimately opted to use social media anonymously can also be improved.

Most importantly, platforms’ safety duties, as envisaged by the Online Safety Bill, should extend to all social media users, not just those who have opted to verify their identity. Effective regulation at the level of design, systems and processes should drive improvements which benefit all users, regardless of their verification processes. Some of the direct benefits of measures to reduce abuse of anonymity could also be enjoyed by legitimately anonymous users. In particular, unverified accounts would also be able to filter out communication from unverified accounts which they have not chosen to follow, providing greater protection from anonymous trolls.

We explore the practicalities of verification, and safeguards to ensure inclusivity and privacy, in more detail in our briefing.[15]

10. Other possible approaches to tackling anonymity

Our recommendations (explicitly define anonymity as a risk-factor which platforms are required to act to mitigate; introduce specific requirements for platforms to offer their users a “right to verify”, a “right to block interaction from unverified accounts”,  and for transparency about the verification status of all users) seek to strike a balance that recognises and minimises the trade-offs involved in seeking to tackle the harms associated  with anonymous accounts. In this section we briefly explore 2 alternative approaches which we are aware of.

a)    Make verification compulsory for all social media users

This proposal would require social media users to adopt a “know your user” approach for anyone using their platform. This could be coupled with vicarious liability for platforms were they unable to identify an end user.

The main advantage of this approach would be that it could entirely eliminate the problems associated with anonymous accounts - because it could entirely eliminate anonymity. In the case of criminal or defamatory activity it would ensure full traceability. It would also have the potential to provide a simpler user experience, by avoiding any scope for confusion amongst users about different verification statuses or the need for any user action to manage their level of interaction with unverified accounts (because there wouldn’t be any unverified accounts).

The main risk would be that it would eliminate legitimate uses of anonymity alongside eliminating its misuse. This would have implications for freedom of expression, so careful consideration would need to be given as to whether this was a proportionate intervention.

The negative implications for freedom of expression would be particularly significant were verification processes not fully accessible. Compulsory verification would therefore place a particularly high premium on ensuring that verification worked for vulnerable groups including those with more complex identification needs or lacking access to standard documentation.

b)   Require users to verify their identities to social media platforms, but allow users to remain incognito to other users

This approach would entail users providing identifying information to a platform, which the platform could retain against their account, but not sharing this with other users to whom they could remain anonymous or use a pseudonym. The platform would be obliged to make this identifying information available to law enforcement, and in the case of defamation proceedings. It would also be able to use it to enforce its terms and conditions more effectively by preventing users evading suspensions through the creation of a new account.

The principal advantage of this approach would be that it would potentially lower the bar to verification, by making it palatable to users who had concerns about other users identifying them (e.g. because they didn’t want an employer or their family to be able to identify them) but did not have qualms about being identifiable to a platform. This could potentially increase the uptake of verification - or if made mandatory, maintain scope for certain forms of benign anonymous (to other users) activity.

A major disadvantage would be that it would do less to increase trust, authenticity, or accountability in digital spaces because large numbers of users would remain anonymous to each other. Users would be traceable in criminal cases, but could remain anonymous for purposes of non-criminal trolling or bullying. There would therefore be less of a reduction in the “online disinhibition effect”.

Another disadvantage would be that it would centralise more information in the hands of platforms, rather than distributing more information and accountability amongst users. This data would need to be retained for as long as a user had an account with the platform, creating a new centralised dataset held by platforms, which could have privacy and security implications. An approach which independently verified publicly declared identity information would avoid such issues, as verification of a public profile could easily be provided by a third party, and there would be no need for any extra personal data to be retained by the platform once verification has been completed. Finally, whilst traceability data would exist, law enforcement agencies would remain dependent on platforms to disclose this data, a process often reported to be beset with bureaucracy and delay, and victims of defamation would continue to rely on Norwich Pharmacal orders to determine the identity of a user sharing defamatory content.

11. Conclusion

Clean Up The Internet sees much to welcome in the government’s direction of travel regarding digital regulation. We particularly welcome the Online Safety Bill’s moves away from the failed era of self-regulation for social media platforms, and the plan to appoint Ofcom as the independent regulator, underpinned by statute. We welcome the introduction of safety duties on platforms, and the associated requirements for platforms and Ofcom to conduct risk assessments which at least require some consideration of the impact of their design, systems and processes.

However, we are concerned that the current draft Bill’s failure to tackle design issues like anonymity, which are the “underlying drivers” of online harms, will reduce its effectiveness. We fear that the current weak wording in this area is unlikely to deliver the necessary changes to how platforms are designed and operated – and that without such changes, the regulatory regime will be over-reliant on measures focused at the level of individual content.

We do not take issue with the need for there to be regulation which focuses on how platforms treat harmful content, including legal-but-harmful content. We accept that some moderation of content is likely to be required even with the kind of design and systems level changes that we advocate. We certainly agree that such decisions should not be left entirely to private companies, given the important questions these decisions raise for freedom of expression. However, it’s desirable for the need for such content-level interventions to be minimised – to avoid the regulator being overwhelmed, to reduce the trade-offs regarding freedom of expression which inevitably arise, and to reduce the burden on the criminal justice system.

In our view the current draft Bill doesn’t yet strike the right balance between tackling symptoms and targeting causes. Regulating platforms’ approach to design, including their approach to anonymity, should take a bit more of the strain. This would mean regulating platforms’ approach to content, and prosecuting offenders in the case of criminal content, would then be able to take a little less. Tackling such “underlying drivers” effectively will on occasion require more coordination between relevant regulators and different threads of the government’s digital regulation strategy - but overall should make regulation more efficient as well as more effective.

November 2021

16