Dear Dame Chi Onwurah MP,

We are a coalition of 20 civil society groups and experts, active in the fields of immigration policy, data protection, and human rights. We wish to thank the Science, Innovation and Technology Select Committee for raising the issue of eVisa problems during a hearing on data security in government, held on 10 February, 2026.

Due to ongoing instability in the Home Office digital programme, eVisa holders face challenges accessing and proving their immigration status. In a letter sent on 27 November, 2025, we asked the Information Commissioner’s Office to intervene against the numerous infringements of UK data protection law that underpin the eVisa scheme.

Thus, we urge the Select Committee for Science Innovation and Technology to support the previous letter received by your Committee, and urge you to open an inquiry into the ICO oversight failures. 

Since its rollout, the eVisa scheme has been affected by glitches and data security issues. 

UK residents trying to prove their status with eVisas have been facing data entanglement issues- when personal data of an eVisa holder and another, unrelated third party end up being mixed up – as well as denial in accessing the service, generating proof of immigration status, or rectifying or updating incorrect or outdated personal data. As you have correctly pointed out in your intervention during the February 10 hearing, eVisa issues include  data breaches,  the integrity, availability and confidentiality of personal data. We also commend that the “operational and security problems relating to the eVisa system” were recognised in your Committee’s recent report on Digital ID. 

As a study by the3million has found, these issues are systemic and rooted in design and architectural choices. Further, data collected by the Report.it! platform shows that eVisa holders have been encountering these issues consistently over the past six years. 

However, the Home Office has refused to disclose how many of such incidents they recorded, or how many people have complained or sought assistance. We acknowledge that the Home Office has recognised that mistakes are being made and have indicated their intention to resolve them. Nevertheless, it is essential to understand the timescales involved, what transparency they intend to offer on systemic issues and in what forums, and whether they plan to publish a roadmap against which the Select Committee could hold them to account. 

We identified and listed numerous failures to comply with UK data protection law by the Home Office. These include failures to adhere to baseline data protection principles, or to conduct and publish Data Protection Impact Assessments (DIPAs) before rollout and throughout the eVisa lifecycle. In light of the above, we also urged the Information Commissioner to open an investigation.

Indeed, we were not the first to raise such issues with the ICO. The press reported that, following a complaint made by a member of the public, the ICO had already determined in June 2025 that the Home Office breached UK data protection law. That complaint was not an isolated case: as disclosed in response to a Freedom of Information request, the ICO received 851 complaints against the Home Office only within the last two years. The volume of complaints against the Home Office is so significant that the ICO would exceed the cost threshold of the FOIA regime if they were to review and identify which complaints relate specifically to eVisa failures. Against this background, the Information Commissioner’s Office is yet to take any action to remedy eVisa data protection infringements. 

Unfortunately, this follows a pattern that emerged within the evidence discussed in your inquiry into data security in government. As your committee has heard during the February 10 hearing, the government is still working on implementing the recommendations from the Information Security Review, which should have been implemented in full by the end of 2024. Despite these delays, and the very consequential incidents that followed, the ICO has yet to take action, and have so far only sent a letter to “urge” the government to move faster.

While the ICO delays action to remedy these issues, it is eVisa holders who pay the price. 

As the “Exclusion by design” report shows, eVisa failures prevent individuals from proving their status when they need it to enter the country, from applying for jobs or getting a pay rise, from o enrollingin education, from claiming benefits. The human price of non-compliance is high and unjustifiable: UK data protection law already provides for rules that ought to prevent these harms from occurring. It also gives the ICO the role to remedy such infringements and hold public authorities like the Home Office to account.

In fact, the Administrative Court found, in their recent judgement, that the Home Office is able to fix eVisa failures when sufficient pressure is applied. The ICO is the authority with the statutory powers and the Parliamentary mandate to apply such pressure. Further, Parliament has also given individuals the power to raise complaints to the ICO for free, and to seek remedial action without the costs and procedural burdens associated with Judicial Reviews.

There is a risk of reduced scrutiny towards public bodies and diminished responsiveness to public complaints by the ICO.

The ICO has recently signed a memorandum of understanding with the government which was described, by government officials, as a shift away from a relationship of opposition to a relationship of partnership. Likewise, the ICO adopted a new complaints policy, according to which individual complaints would be routinely disregarded unless they reach an unspecified numeric threshold.

As the Home Affairs Select Committee have pointed out in their recent report about digital identity, restoring public trust and ensuring strong safeguards are necessary to deliver digital identity schemes. As the issues surrounding the eVisa scheme demonstrate, these important recommendations risk remaining unmet insofar as the ICO refrains from holding the government to account, to intervene when they get it wrong, and to protect the public from harm.

In light of the above, we urge the Select Committee for Science, Innovation and Technology to:

• Open a comprehensive inquiry into the Information Commissioner’s Office and their failure to carry out their oversight duties under the law.
• Investigate what institutional changes are needed to strengthen the ICO ability to oversee the government and other public bodies, also to support the implementation of the recommendations of the Home Affairs Committee’s Report on digital identity.
• Further investigate eVisa data practices, governance and failures, to inform the broader inquiry into data security in government.
• Ask the Home Office to disclose the data they hold concerning the amount of data security incidents, complaints and requests for support they received from the public in relation to the eVisa scheme. We note that on 1 July, the Home Office published error correction volumes from the online webform, but this does not show the volume of requests for support.

Signatures:

BARAC UK
ILPA
Imkaan
Liverpool Advocates For Windrush (LAW)
Medact
Middle Eastern Women and Society Organisation (MEW)
Migrant Democracy Project
Migrant Voice
Migrants’ Rights Network
No Borders in Climate Justice
Open Rights Group
POMOC
Reunite Families UK
Reset Communities for Refugees
Sherrards Solicitors LLP
South East and East Asian Women’s Association
Status Now 4 All
Steve Newman
the3million
The William Gomes Podcast

Digital Privacy

Stop the e-Visa scandal

Find Out More

20 immigration, data protection, and human rights organisations have asked the Chair of the Science, Innovation and Technology Select Committee to investigate the Information Commissioner’s Office’s failure to uphold data protection law in relation to the Home Office’s eVisa scheme.

In their letter to Dame Chi Onwurah MP, they have also called on the Committee to examine the eVisa scheme as part of its inquiry into government data security. They are also urging the Committee to require that the Home Office is transparent about the number of data security incidents and public complaints in relation to the scheme, and to set out how and when these issues will be addressed.

Data protection failings of the eVisa scheme

The eVisa scheme, has been plagued by widely known problems during the six years since it was first rolled out in 2020. People trying to prove their immigration status have reported mistakes in the Home Office’s records, while in some cases personal data has been incorrectly linked to others’ accounts. Many people have faced substantial difficulties in correcting these errors, leaving some unable to access their accounts or show their right to be in the UK.

These failures have had serious consequences. People have been prevented from proving their right to enter the UK, secure jobs, enrol in colleges, or access essential benefits and services. ORG heard of one man who was made homeless as the result of a data error in his eVisa. The ongoing problems with the scheme mean continued uncertainty for many people.

In November 2025, ORG and 18 other civil society organisations called on the ICO to open an investigation into the data protection breaches and accessibility issues arising as a result of the eVisa scheme. Seven months later, the ICO has failed to take any remedial action to address these infrigements. However, it did reveal in an FOI response, that they had already received 851 complaints about the Home Office as a whole between Dec 2023 and December 2025. The volume of complaints was so significant, the ICO was unable to identify how many were about the eVisa scheme specifically.

The need for institutional change at the ICO

The signatories are now calling on the Select Committee to investigate and get answers. However, they recognise that these failings are not just in relation to the eVisa scheme but a wider issue with the ICO’s enforcement. They are also calling for the Committee to investigate “what institutional changes are needed to strengthen the ICO ability to oversee the government and other public bodies, also to support the implementation of the recommendations of the Home Affairs Committee’s Report on digital identity”.

Following John Edwards’ resignation as Information Commissioner last week, Open Rights Group has called on the Government to “appoint a regulator with teeth, and reset the regulators’ approach of providing data protection in name only”.

Mariano delli Santi, Legal and Policy Officer at the Open Rights Group, has said:

“The ICO’s reasoning that it cannot be transparent about complaints relating to eVisas because there are simply too many Home Office complaints to review points to a government department and data regulator that are failing the public on many levels.”

“The ICO has a new policy, where complaints are logged for information purposes only, and action only taken if the volume of complaints against an organisation becomes substantial. The facts, however, speak for themselves: the ICO is ignoring the public’s complaints regardless of their volume. As the ICO’s FOI response revealed, they don’t even keep track of what you are complaining about.”

“We urge the Select Committee to take action to help those who have been impacted by data breaches but also to ensure that steps are taken so that data protection is taken seriously by the Home Office and upheld by the ICO.”

Digital Privacy

Stop the e-Visa scandal

Find Out More

The Supreme Court held that President of the United States can remove members of public offices at will. The judgment overturns well-established case-law that protected the independence of federal agencies, and has serious consequences for personal data transfers, digital rights, and the digital economy at large.

Personal data transfers between the EU and the US are made possible by the EU-US Data Privacy Framework (EU-US DPF), under which the US committed to protect personal data transferred to the US from its mass surveillance programmes. Data flows between the UK and the US depend on this scheme as well. The oversight of the framework rested on a number of US federal agencies, whose independence has now been gutted by the Supreme Court ruling.

The practical implications of this judgment are hard to understate for a country such as the UK, whose government and digital economy are highly dependent on US tech firms. It doesn’t only undermine the EU-US DPF, whose judicial invalidation is now guaranteed. US federal agencies have become structurally unable to act as meaningful legal guardians, making any future agreement with the US unworkable. Short-term fixes that were relied on in previous crises, such as Standard Contractual Clauses, would now prove ineffective: contracts are no solution against arbitrary State power, and there is no realistic prospect of a structural agreement being reached.

Likewise, the UK has recently reformed its data protection law to, potentially, allow personal data transfers to take place even if such protections are missing. If the UK were to pursue this path, however, it would lose adequacy status with the EU, and the consequences would be dramatic. In 2020, it was estimated “that the aggregate cost to UK firms of no adequacy decision would likely be between £1 billion and £1.6 billion” in legal and compliance costs alone. This does not account for the impact loss of adequacy would have on the EU-UK Trade and Cooperation Agreement, nor for its incompatibility with the non-diminution principle which Northern Ireland enjoys under the Good Friday Agreement and the Windsor Framework.

Hard truths require real solutions. The UK needs to depart from the failed path of technological dependency from the US and appeasement to US corporate interests. The new Labour leadership will have a difficult task at hand: charting a clear roadmap to digital sovereignty.

The Supreme Court Judgment Explained

In 2025, the Trump administration proceeded to replace democratic-affiliated members of several federal agencies with their own political allies. This purge reached both the US Federal Trade Commission (FTC) and the Privacy and Civil Liberties Oversight Board (PCLOB). Rebecca Slaughter, one of the FTC members who were fired, sued the US government, on the basis of well-established case-law that protected the independence of federal agencies. The case reached the US Supreme Court, which overturned such precedents and gave the President unfettered power to remove officials from public offices.

In the words of the US Office for Legal Counsel, independence is a means to “maintaining the separation of powers”, and a shield against legal decisions being reflective of partisan political agenda rather than the preservation of Justice. Sonia Sotomayor, a dissenting Justice within the Supreme Court, pointed out that the unfettered Presidential authority handed over by this judgment will “destroy the structure of government and […] take away from Congress its ability to protect” independent agencies. She continued by noting that, even under colonial rule, “Neither the king, nor parliament nor prime ministers in England at the time of the founding [of the United States] ever had an unqualified removal power”.

Thus, the Supreme Court has just undermined the integrity of the US regulatory environment as a whole. Tech companies who are based or operate in the US are now exposed to a new reality, where their legal obligations can be manipulated arbitrarily by the US administration.

A Death Warrant for Data Transfers to the US

Transfers of personal data to the US are at the centre of a decades-long legal controversy over the impact of US mass surveillance programmes on the security of European personal data. In 2022, the Biden administration signed an Executive Order that established a mechanism to protect personal data transfers to the US, and restrictions to the President’s authority to conduct surveillance programmes. This was the culmination of a long political process, started with the Data Free Flow with Trust initiative and the OECD declaration on government access to data, which sought to create baseline rule of law safeguards for the secure transfer of personal data among democratic countries.

On the basis of these commitments, the European Commission adopted the an adequacy decision for the so-called EU-US Data Privacy Framework (EU-US DPF), which legalises transfers of personal data between the EU and the US. However, the oversight of this framework rested on the FTC, the PCLOB, and the Data Protection Review Court. Article 8 of the Charter of Fundamental Rights of the EU requires oversight to be independent, to protect the overseers’ ability to enforce legal standards. By empowering the Trump administration to remove their members at will, the US Supreme Court undermined oversight, and thus the workability of the framework as a whole.

Max Schrems, a renowned privacy activist, has already pointed out that the invalidation of the US adequacy decision is not a matter of if but when, and called “on the European Commission to orderly withdraw the adequacy decision on the US”. Max Schrems already obtained the judicial invalidation of the previous US adequacy decisions twice, and the letter states that he is ready to seek a third judicial invalidation if the Commission does not act.

The UK is in a Tough Spot

In the UK, transfers of personal data to and from the US are underpinned by a so-called UK extension of the EU-US DPF: if or when the EU framework goes down, the “UK extension” will follow, making transfers of personal data to the US unlawful. To cope with the disruption this will cause, there are a few “easy fixes” that organisations and the UK government may try to pursue. Such options would, at best, be short-sighted and inadequate responses to the upcoming crisis. At worst, they would risk invalidating the UK adequacy decision.

UK organisations may try to rely on alternative mechanisms, such as Standard Contractual Clauses, that allow international data transfers to countries that lack acceptable data protection standards. However, the Schrems II judgment has already established that contractual arrangements are useless against US surveillance powers, and thus inadequate in this instance. This would leave UK organisations with the option to rely on encryption and key management. This is a technically-complex workaround that may work for some, but will be unfeasible for many.

The UK government could be tempted to use the new powers, introduced by the Data Use and Access Act (DUAA) 2025, to re-legalise transfers to the US. Contrary to the EU GDPR, the new UK international data transfers regime allows the Secretary of State to authorise personal data transfers to country that do not have independent or judicial oversight of data protection rules. Also, the DUAA lowered the standards that alternative transfer mechanisms, such as contractual clauses, need to reach in order to adequately protect personal data abroad.

If, however, the UK government were to take this path, the UK’s own adequacy decision would face repeal or judicial invalidation. The European Data Protection Board has already pointed out that adequacy “cannot be interpreted as not including the need for an independent supervisory authority and effective and enforceable data subjects’ rights”. Likewise, the UK adequacy decision sits on the commitment, made by UK authorities, to abide by these norms even if not listed in UK law. Notably, UK adequacy also establishes an unprecedented monitoring mechanism, where the Commission could require UK authorities to address any developments that undermine the level of protection afforded to EU personal data within three months – or else, face the repeal, suspension or amendment of the UK adequacy determination.

We need UK Digital Sovereignty

As it turns out, the General Data Protection Regulation deems transfers to the US to be unsafe not because of legal abstractions. It does, instead, capture the unsafe nature of these data transfers, and the high risk posed by technological infrastructure that can be weaponised by an unaccountable government.

The United Kingdom is highly dependent on US technology products and services. Its Invest2035 strategy has been centred around attracting foreign investments and firms. Its AI opportunities action plan encourages fast and loose adoption of AI products by the public sector, and heavy reliance on private (and, often, US based) companies for access to computing power. Peter Mandelson’s Tech Prosperity Deal aims to make the United States the principal technology partner for the UK.

This status quo now sits within the harsh reality that emerges from the US and its collapsing institutional environment, bringing up tough questions. How do you trust a “partner” which systematically evades constitutional check and balances? How reliable are US tech companies and service providers, when regulatory standards and contractual agreements have lost their meaning and enforceability? What will you do when you end up being locked you out of your email account or AI service, due to petty political motives pursued by the US administration of the day?

With ORG’s digital sovereignty report, we detailed how the UK needs a roadmap to de-risk its technological dependency: we must embrace open source and digital commons; strengthen competition and regulation in digital markets; and foster relationships with like-minded partners like the EU. The upcoming new Labour leadership will need to lay out a clear pathway to achieve this.

Demand UK Digital Sovereignty

Find Out More

The use of AI in asylum decisions is meant – according to the Home Office – to save time and money. But it is likely to be doing the opposite.

The use of AI in asylum decision-making

As the United Nations Refugee Agency recently noted, the UK’s asylum application system is under a great deal of stress. Staff morale is low, staff turnover is high, and there is a significant backlog of applications. In order to remedy the situation, the Home Office has introduced time targets (see 9.15) to speed up applications, and introduced the use of AI to create summaries of country information and of substantive interviews with asylum applicants. Just yesterday, the Independent Chief Inspector of Borders and Immigration reported that quantity was triumphing over quality, and showed deep problems with recruitment and training of asylum decision makers.

Our recent legal opinion argued that the use of AI is likely unlawful, especially as asylum applicants are not told about the use of AI in their applications. The problems with using AI is that summaries are likely to contain errors and miss critical information. It is also wholly possible that the case officer does not spend sufficient time engaging with the material. Producing a summary is not done for record keeping alone, but also as a means for the officer to order their thinking, so that they are confident in their decision.

The negative impact of time targets on staff morale is well documented. Layering time targets, AI summaries, poor morale and staff turnover, is an organisationally toxic mix. Furthermore, it pushes decisions into appeals systems, which is itself very expensive, and causes other costs to rise as people seeking asylum are prevented from working and must remain on benefits while a decision is reached.

Systems thinking in the UK asylum system

Thankfully, the government Office for Science has produced an excellent guide for unravelling complex, multi-department problems of this nature, with An introductory systems thinking toolkit for civil servants. This provides very useful mapping tools for policy problems of this nature. We have used one of the visual tools for systems mapping here, to describe the asylum application process.

This graph describes our view of how the different components of the current asylum system work together. We sketch out these inter-relationships:

• The use of AI summaries and time targets drives speed up, but reduces the quality of decisions

• The human toll on asylum applicants, who are the most vulnerable in the process, will itself be a demoralising factor for Home Office staff, if they are not allowed to treat them fairly

• Demoralised staff leave, further eroding the quality of decision-making

• The financial costs of waiting for asylum claims to be processed are also a human cost to those whose lives are put on hold, and placed in marginal conditions with limited support

Caught in a doom-loop

The asylum processing system is currently fixed in a doom-loop, where quality and efficiency keep falling. Yet fixing the incentives would be quite easy. The system needs to focus on capacity and the quality of the decision, rather than the speed. With greater capacity, if good decisions are made, the backlog could be reduced, staff retained, and the burden on the courts can be reduced. Rather than inducing highly costly “failure demand” placed on the courts, money spent on getting the decisions right at the start would save the system overall.

Unfortunately, the reason the government is averse to this may be as simple as not wanting to make the wrong “permissive” decision. Or perhaps they do not want to be seen to be allowing a greater proportion of successful claims.

Politically, it has been easier for the Home Office to place the responsibility on the courts. However, this is causing a different kind of political pain as it leads to a higher demand for subsidised accommodation, which has become the target of far right campaigning and violence. Worse, the Home Office responds to this by suggesting the use of military barracks, or other highly unsuitable ‘solutions’ to a problem it has created. And if courts make decisions the Home Office does not like, or admits more people than it would like, then the Home Office is unhappy.

The Home Office responds with more command and control

This desire to control all aspects of the process appears to explain the current proposal to add a new tier to the decision-making process, to replace the current independent Tribunal. As the new appeals process would be within the Home Office, it would be subject to the same political and institutional pressures to reject claimants. The Home Office intends to recruit ex-officers and other non-judicial people that it feels are likely to produce the desired results.

The Home Office’s desire for speed and control is likely to reproduce the same pressure for targets and use of unsuitable AI tools, which may well drive the same problems of lowering quality and sapping morale. Furthermore, the new process is designed to make challenging the decision at court much harder, by introducing judicial review as the standard, which is extremely difficult to challenge. For example, under Judicial Review, decisions are not challenged for being wrong, but incorrectly administered, or “so outrageous in its defiance of logic or of accepted moral standards that no sensible person who had applied his mind to the question could have arrived at it”. This is likely to reproduce conflict in the courts, as groups attempt to address the manifest unfairness of a purely administrative decision-making process. As unfair decisions may stand, the morale of the staff within the new Home Office appeals system may be further sapped. Most people want to believe that they are doing a good job and are helping rather than harming.

In order to address the fraught issue of the costs of the broken asylum process, the Home Office proposes at least some of these should be recouped from successful asylum seekers. That is, the Home Office seeks to charge asylum seekers for the costs of its own failures.

There is a better way forward

But there is another, better solution available. If the Home Office doesn’t want to make the decisions, but does want good administrative decisions, done at a reasonable speed, then it could give the whole process to someone else. In many countries, it is local councils that process asylum claims. In the UK context, a mix of councils, Wales, Northern Ireland and Scotland, and other devolved administrations, could be given these duties. It could invest in capacity to make good decisions, and ensure that decisions allocated resources to difficult cases, and measured success in terms of lower numbers of successful appeals at court.

It is clear that the Home Office could address problems with first stage applications pretty easily, simply by shifting the goal of the system from speed of processing to accuracy and fairness of processing, and applying appropriate resources. This would remove huge emotional costs to people seeking asylum, and to Home Office staff, while also massively reducing financial costs to the government.

However, instead of fixing the problem, the government is choosing to rig the system in favour of the Home Office’s preferred outcomes, by limiting the appeals system in order to reduce the numbers of successful appeals, and by loading some of the financial costs onto the people obliged to use the system. The initial decision process stays in place, broken and unfixed. The risks to asylum seekers from bad decisions, and to society at large of tolerating government bodging legal processes, towards particular unfair outcomes, is nowhere in sight. The same incentives for target-driven processes, AI for supposed efficiency, and failure are left in place and made worse. A worse way of addressing the problems the Home Office has generated would be hard to find.

Digital Privacy

Migrant Digital Justice

Find Out More

Andy Burnham’s likely succession to lead the current Labour government gives him the chance to reset digital policy. There is a lot to be gained from a new approach. Here is our advice to him and the Labour party about where they can make changes which would benefit the UK, our democracy and our economy.

Reset the digital economy

Let’s take Burnham’s start point that he wants to “end 40 years of neo-liberalism”, which he says has “siphoned wealth” out of northern communities, citing disasters such as rail and water privatisation.

This process of siphoning wealth from government and the economy is nowhere more alive than the digital sector. This is well-understood on the left and the right of politics. The last Conservative administration attempted to address deep dysfunction with IT providers to the state, in a series of policies starting with the creation of Government Digital Services, and including a failed attempt in 2016 to remove Capgemini, Fujitsu and BT from the Aspire contract that delivers the back end of the UK’s tax system. Contracts for these services currently extend to 2027.

There is a consensus that AWS and Microsoft have been ripping off both British businesses and the government to the tune of hundreds of millions of inflated cloud charges, according to investigations by the Competition and Markets Authority (CMA).

The difficulty of taxing companies like Amazon and Uber is also well understood. There is widespread knowledge that US multinationals are using tax efficiency measures to ensure that they do not pay their way towards the maintenance of basic state functions. Such companies, many of them being tech giants, now occupy a very large part of our economy, as detailed in Vassal State; whose author, Angus Hanton, can hardly be accused of being a radical leftist.

At this basic level, the idea of pursuing greater digital sovereignty, and building the UK’s domestic tech sector, especially through choosing open source state infrastructure, is a plain easy win. The ideas do not belong to the left or the right, they are simply necessary to avoid depletion of the UK’s state and economy.

Reset digital sovereignty

Governments of left and right across the EU are building back their state capacity to supervise and build software systems that they own and control. By using open source, they share resources, just like the tech giants do. By ensuring state leadership, through internal experts such as ZenDis in Germany, or DINUM in France, the state is able to manage contractors and own what they build, rather than allowing consultancies to be the experts and contractors owning software systems.

Companies like Palantir are a disaster from the perspective of autonomy and sovereignty. They aim to own the infrastructure and control government systems. Contracts with Palantir should be exited as fast as possible, as happened recently with the Ministry for Housing, Communities and Local Government, which developed their own open source replacement system for supporting Ukrainian refugees, noting that:

“We delivered Share on time in September 2025 and exited our contract with our supplier. Moving to this in-house model is already saving MHCLG millions of pounds a year in running costs”.

The NHS should be given the capacity to manage federated data systems itself. There are already multiple open source products that federate data for governments, and Manchester’s NHS have delivered their own federated data system for their region. That’s Manchesterism in action. This is not an impossible task.

Reset the regulators

The Starmer government had taken the view that to attract billions of US investment in data centres and AI, they should hold back the regulators. The ICO was given duties to balance rights and business growth, while the CMA was given a “strategic steer” to avoid doing things that could dissuade monopolists from investing. That is, to go easy on market abuse.

The CMA could take action to reduce the payments Apple force on UK app developers, to reduce the fees that Microsoft force companies to pay when deploying their software on competitors’ cloud products, and to reduce or remove “egress” (data export) fees when switching cloud provider. UK business throughout the economy would benefit from CMA action to increase cloud competition and reduce excessive charges.

The ICO’s failure to regulate both the private sector and government has been disastrous for the most vulnerable in our society. We have been tracking the ICO’s work on eVisas, which is a scheme that keeps denying people access to services, jobs and even entry to the UK, despite people having the right to live and work in the UK. The ICO, as with many other problems at government, has not taken action.

Regulate Artificial Intelligence and ban predictive policing

The UK lacks safeguards for the use of AI. There is no legal framework that makes sure that public or private sector use of AI does not breach our human rights and dignity. Yet biased and inaccurate decisions are a natural feature of technologies that are statistical and correlative in nature.

Regulation of AI was a Labour manifesto pledge, which curiously disappeared in the face of lobbing and trade agreements with the US. But it remains necessary. As AI is increasingly used in benefits, policing and borders, government and society needs to know whether it is actually safe. Without a legal framework, government will continue to deploy ill-judged systems like employing AI in immigration decision summaries, expanding facial recognition and rolling out predictive policing tech that targets and criminalises whole communities. These are technologies that cause real harms to real people, in the name of alleged (rather expensive) efficiency.

Roll back the digital hostile environment

The Home Office’s approach of creating hostility to migrants has had a deep and lasting impact on UK politics. It has fuelled the politics of hate. As we discuss in a forthcoming report, borders and migration policy is being digitised in a manner which is dehumanising, and creates systemic rights violations, by treating the most vulnerable people as potential threats. These changes are fuelling an AI and border surveillance industry that is dependent on political hostility to migrants. Simultaneously, the UK’s foreign and climate policy risks increasing the instability that pushes people to migrate. The UK needs to take a holistic view of migration, and stop targeting refugees and migrants.

Ditch Digital ID

It is still unclear why digital ID is government policy, or what it would really deliver. Digital ID appears to have been promoted because of the personal desires of Tony Blair, combined with the illusion that it could help with evasion of work permits. In our view, Digital ID remains a solution in search of a problem, that threatens to poison the next Labour prime minister’s relationship with the public. Combined with AI, Digital ID could be used to limit access to public services and automate decisions using AI; a recipe for reinforcing systemic discrimination.

Change our online safety approach

There is a lot of understandable pressure within Labour to make the online world safer for children. There ought to be a bigger discussion about the concentration of informational power in social media tech giants and AI companies.

However, as we outlined in our blog, safety policies keep falling flat because they are working against the grain of the social media attention economy. So far, safety measures have punished users rather than big tech. An under 16s ban on access to social media illustrates this: it is children, rather than big tech, that will impacted by a ban.

We need to tackle the power of social media directly, by empowering users to control the information they receive, and by building pro-social social media, like BlueSky and Mastodon. As a first step, government and Labour politicians should publish to these networks, so that voters and residents are not forced to use X or Facebook to receive government social media updates.

Social media companies that are undermining UK democracy continue to be funded by the UK government, through advertising. The next administration should shift government advertising budgets to local news sites, rather than funding Meta and Google.

Show us your thinking

As noted in our Digital Sovereignty report and our blog discussion of social media policy, the UK government say they promote systemic policy analysis, to understand the complicated interactions that take place in difficult areas of policy, using ‘systems thinking’ and ‘futures thinking’. This is exactly what is needed, so that we can have grown up policy discussions. However, little of this work seems to reach the public domain. Government needs to set out its understanding and analysis of the digital policy landscape.

Difficult but worth it

There is no doubt that changes to digital policy and economics are difficult. However they are fundamental in the current political situation. Our suggestions do not require breaking manifesto commitments, but would contribute to a reset of the UK economy and society, in favour of the UK economy and better value in government spending, improving social balance and protecting our democracy.

Open Rights Group’s Executive Director Jim Killock said:

“John Edward’s departure is a chance for the Government to appoint a regulator with teeth, and reset the regulators’ approach of providing data protection in name only.

“Parliament must ensure that the future Commission is run by professionals who want the law enforced, including against government data failures.”

“Edwards may now be offered jobs with Big Tech, the data industry and the very large legal firms who represent them, as many of his own senior staff and predecessors were. Edwards should set an example and refuse attractive salaries provided by this ‘revolving door’ – and the government should legislate to prevent this from happening so that the regulator is kept at arms length from Big Tech.”

Reset the ICO

Open Rights Group recently called for the ICO to be re-set after multiple failings while Edwards was at the helm. These included introducing the so-called public sector approach to enforcement, under which the ICO began to heavily rely on non-enforceable, written notices where the ICO point out that the law has been broken without taking any regulatory action to remedy an infringement or holding law-breakers to account.

As ORG’s alternative ICO annual report 2023-24 showed, reprimands lacked effectiveness and deterrence. The ICO’s own post-implementation review of the public sector approach would later reveal how the volume of complaints raised by UK residents about public sector organisations’ use of their data has increased substantially as a result.

Edwards failed to open an investigation into the Ministry of Defence following a data leak that reportedly, led to the death of at least 49 people in the aftermath of the Taliban’s takeover of Afghanistan. This decision led to a Parliamentary inquiry from the DSIT Select Committee, and an open letter from 70+ data protection experts lamenting a collapse in enforcement action. Dame Chi Onwurah, the Chair of the Committee, acknowledged the “institutional failure” that had led to the breach, which “raises serious questions for both the government and regulators like the ICO”.

Edwards was also supportive of the Government’s data protection reforms, which weakened the public’s rights and ability to have control over their personal data. The ICO was became the only regulator to fully support the government’s proposals despite concerns raised by the Equality and Human Rights Commission, the National Data Guardian, the Biometrics Commissioner, the Scottish Biometrics Commissioner, and the Northern Ireland Human Rights Commission.

Read The ICO isn’t doing its job – why the data watchdog needs to be reset.

Digital Privacy

Reset the ICO

Find Out More

The Home Office is using two AI tools in asylum casework which could be unlawful. The Asylum Case Summarisation (ACS) tool uses GPT-4o to summarise asylum interview transcripts, and the Asylum Policy Search (APS) tool is a GPT-4o chat-based interface used to search country policy documents.

Both generate new text rather than simply retrieve existing information, meaning they can filter or omit facts relevant to a caseworker’s decision. APS was fully rolled out in July 2025; ACS followed in April 2026.

In response to a parliamentary question tabled in April 2026, the Home Office subsequently confirmed it did not follow the UK AI Playbook principles – even though the February 2025 Playbook preceded the full rollout of both. (The Home Office referenced the ‘project pilots’ in their explanation.)

In March 2026, the Open Rights Group had already published a legal opinion which concluded that the AI tools are likely unlawful.

Using these tools creates several problems, which include:

1. No transparency. Applicants are not told AI is being used in their case. They cannot see or correct AI-generated summaries of their own interviews. Neither tool appears in the Algorithmic Transparency Recording Standard (ATRS) repository. The Home Office has also refused to disclose the ‘prompt’ used in ACS. See also this Home Office response.

2. No published assessments or guidance. No Data Protection Impact Assessment (DPIA), no Equality Impact Assessment (EIA), and no Standard Operating Procedure (SOP) has been published for either tool. Without an EIA, the Home Office cannot demonstrate compliance with the Public Sector Equality Duty.

3. Training is inadequate. The minister cited a generic ‘AI for all’ learning package, giving no detail on content, duration, or assessment. Case-specific procedural guidance is imperative.

4. Oversight is internal and reactive. The only oversight mechanism is a feedback inbox set up after APS was already deployed. Caseworkers are not required to verify AI outputs against the original source material, so the quality of oversight depends entirely on each individual.

4. ‘Human-in-the-loop’ is inadequate. Both tools generate the text a caseworker reads before making a decision, so they shape the information that is seen. Stipulating that a human signs off the final decision does not address this. Pilot evaluations found that 9% of ACS summaries were too flawed to use, and 23% of caseworkers lacked full confidence in the outputs.

We recommend that the Government:

1. Suspends both tools immediately. The full DPIAs and EIAs must be published. Tools must be registered in the ATRS repository.

2. Stipulates full transparency. The office of the Chief Inspector of Borders and Immigration should conduct an independent investigation. The Independent Advisory Group on Country Information should consider the use of AI for country of origin information summaries. Remedies for affected applicants must be implemented.

3. Mandates civil society consultation before any future deployment of AI in the asylum system, with findings published and independently reviewed. Any future iteration must come with comprehensive caseworker guidance.

SOAS ICOP Policy Briefings to Inform Government and Parliamentary Debates. By Sara Alsherif (Open Rights Group), with Sanjana Deen (SOAS University of London) (02 June 2026)

For further information, contact the author at sara@openrightsgroup.org/ 07902823294. Contact Professor Alison Scott-Baumann for access to other experts at as150@soas.ac.uk, and visit our website for more information. The views expressed in SOAS ICOP Briefings are those of the authors and do not necessarily represent those of SOAS University of London.

Digital Privacy

Migrant Digital Justice

Find Out More

Stop Killing Games has teamed up with global rights respecting organisations, including Open Rights Group, to form Stop Killing the Internet, a global movement defending the open Internet. A livestream of the launch is available here.

What is Stop Killing the Internet?

Stop Killing the Internet is an international campaign defending the open internet against policies and practices that impose surveillance, exclusion and excessive centralised control in the name of online safety. The campaign supports rights-respecting approaches to child protection, privacy, democratic accountability and platform responsibility. 

The global movement brings together different groups impacted by new restrictions come together to defend the open web, and promote alternative rights-respecting policies to tackle online harms. 

It was formed following a meeting where campaigners heard how proposals such as social media bans, scanning of devices or additional surveillance were accelerating and spreading around the globe. There was widespread feeling that a global threat required a global response, and that the UK’s announcement of prohibition and device scanning required an immediate response. 

At that meeting, a young person who would be directly affected by proposed restrictions on internet access, described how those restrictions would make it harder to access educational videos online, or connect with friends, and socialise while playing games. 

Go to: www.stopkillingtheinternet.org for a statement of the threats facing the open internet and calls for rights-respecting, community-led solutions to online harm. Members of the public and organisations can sign up here and there will be a further public launch on 27 June 2026.

UK social media ban


The launch of the movement comes as a petition not to ban social media on the UK Government website broke through the 100,000 signatures required to trigger a debate in parliament.

Quotes

Moritz Katzner, Director of Stop Killing Games, said:

“The internet is a place of education, games, friendship, culture, work and public debate. Like any town hall, it can become ugly. But we would never respond by shutting down the town hall. We would never demand identity papers at the door.”

“We are building a global movement, if you believe in building a better internet and fighting for a global connected Internet then join us.”

James Baker, Programme Manager at Open Rights Group, said: 


“Stop Killing the Internet will bring together internet users, parents, families, young people, experts,  content creators and campaigners. Open Rights Group encourages people around the world who want a human-rights based approach to tackling harm to join this movement.

“

“The movement will challenge divisive policies that prescribe the wrong medicine of exclusion, surveillance and control to tackle online harms. It will champion positive rights-respecting alternatives, and promote the work campaigns are doing around the world.”

Jemimah Steinfeld, Chief Executive of Index on Censorship said:

“For decades now we’ve worked with people navigating the harshest online environments around the world and we’ve seen the impact on their free expression. An open internet is not a nice to have, it’s an essential part of democratic participation. That’s why autocrats try to control it.” 

“Today, sadly we are seeing threats to this space in the very countries where we thought openness was guaranteed. Even if the reasons are different, which they undoubtedly are, the results could be equally damaging. With proposals to block children in the U.K. from many platforms, limiting their right to free expression, both in terms of sharing and receiving information, now is therefore the time to act – decisively and boldly – to protect this sacred space.”

Silkie Carlo, Director of Big Brother Watch, said:

“There is a disturbing push by Five Eyes governments and Europe towards new laws that strangle the public’s access to the open internet with identity checkpoints and information chokeholds. The situation is particularly bad in the UK, where the Government is forcing companies to child-lock our smart phones and demand ID checks both for operating systems and social media.

“We’re proud to be part of a movement of technology, human rights and children’s policy experts that speaks for people in completely opposing this dangerous lurch towards a surveillance society. We all want children to be safe online, but these policies create new safety and privacy risks for young people and entire adult populations alike. Far from reining Big Tech in, age-gate policies gift corporations masses more of our personal information whilst letting them off the hook for their design choices. An attack on our rights online is an attack on the future of our democracy, and people around the world are uniting to stop it.”

Jen Persson, from Defend Digital Me, said:

“Children asked for safer platforms, not to be locked out. On a policy made in their name, they have not been heard.”

“When ban fails to keep children off platforms, we must demand politicians prioritise global expertise above populist appeasement. Rights’ respecting policies can bring the positive change they want to see, but only if they avoid more authoritarian moves.”

Phil Booth, National Coordinator of NO2ID, said: 

“3 million said no to digital ID, and the government ignored us. The day after announcing its social media ban, hundreds of thousands have signed a petition [3] against that. Here in the UK and around the world a movement is forming – NO2ID supports their demand: Stop Killing the Internet.”

Matthew Cassells, Founder, Project Lead and Director of Alderon Games [2], said: 

“To verify age, someone has to collect proof of age: a government ID, a face scan, a credit record. That data has to be transmitted, processed, and often stored. Every one of those steps is a new opportunity for catastrophic failure and the failures are not hypothetical.

The cruel irony is that children are among the most valuable targets for identity theft, precisely because a stolen child’s identity can go unnoticed for years. A law that forces millions of families to upload identity documents to comply does not reduce risk to children. It multiplies it.”

Notes

Stop Killing the Internet is launching with support from digital rights organisations including NO2ID, Open Rights Group, Big Brother Watch, Defend Digital Me, Progressive Voice, RWS, Stop Killing Games and civil society partners around the world. A full list of supporting organisations will be published when the public campaign formally launches in 13 days.

[1] Stop Killing Games
 is a campaign opposing the destruction or disabling of purchased video games and advocating for consumer rights, preservation and accountability in the games industry. 1.4M people have signed petitions supporting the campaigns objectives.

[2] Alderton Games Alderon Games is an independent studio based in Australia and Canada. Their flagship title, Path of Titans, is a cross platform dinosaur survival MMO that connects players across PC, console, and mobile, with up to 200 players per server, live in-game chat, and a modding and user generated content system.

Open Rights Group is urging MPs to vote for an amendment to the Cyber Security and Resilience Bill that would require the government to develop a Digital Sovereignty strategy that would help secure the resilience and independence of the UK’s critical infrastructure. Tabled by Liberal Democrat MP Victoria Collins, it is also supported by cross party MPs including Labour’s Clive Lewis and the Green’s Sian Berry and Adrian Ramsey.

Risks from overreliance on US Big Tech

The need for a Digital Sovereignty strategy – defined as the ability of a country to have control over its digital infrastructure, data and technology – has become more urgent as a result of increased geopolitical uncertainty as a result of US foreign policy actions. The US has tech powers of sanction which can be used to stop a company from supplying a government, institution or individual with services. If the UK’s relationship with the US were to deteriorate, for example over Greenland or Iran, the US could leverage power through its corporate dominance of the UK’s critical infrastructure.

These companies are also locking public bodies into proprietary systems, leading to inflated costs for government and businesses, and the extraction of value from the UK economy through tax avoidance and profit repatriation.

In addition, there are concerns about the influence of companies like Palantir, who recently published a manifesto promoting US military power as a goal. The Science, Innovation and Technology Committee has described Palantir’s increasing presence in public services as an “unacceptable point of weakness”.

See Open Rights Group’s report: Tech Giants and Giant Slayers: The case for Digital Sovereignty and the Digital Commons

Benefits of a Digital Sovereignty Strategy

A Digital Sovereignty Strategy would help the UK assess and reduce risks from foreign interference, vendor lock-in, insecure supply chains and over-reliance on foreign-supplied technologies. It would also support UK jobs, skills and innovation by encouraging investment in domestic capacity, open source software, open standards and more competitive technology markets.

Digital sovereignty does not mean isolationism or protectionism. It should mean ensuring that the UK has secure, resilient and reliable access to the hardware, software, data and digital services it needs. The UK needs a public sector that can make technology choices in the public interest.

The EU is pursuing Digital Sovereignty

Last week, the European Commission announced proposals for tech sovereignty. Germany, France, the Netherlands, Denmark and other EU countries are actively pursuing digital sovereignty through strategic investments in open technologies and international collaboration.

Documents that outline risks to UK from Big Tech dependence are classified

Collins, alongside the Green’s Sian Berry, Labour’s Clive Lewis and Plaid Cymru’s Ben Lake recently called for the government to publish classified documents that detail the “chronic risks” to the UK from our reliance on digital platforms and services, the dominance of global tech and the impact of AI. Digital rights campaigners, the Open Rights Group, have also requested the release of the classified documents through a freedom of information request. The publication of these risks is crucial to enable a proper public and parliamentary debate about the UK’s dependence on foreign tech companies for its critical infrastructure.

Jim Killock said:

“Big Tech companies like Palantir, Amazon and Google, have used their outsized power to gain control of the UK’s digital infrastructure, influence government policy in their favour and lock the government into wasteful, expensive contracts.

“This is both a national security and an economic risk. The EU is already taking action to develop digital sovereignty. The UK must do the same before it is too late.

“By voting for this amendment, MPs can take the first step to securing the UK’s resilience and control over its critical digital infrastructure.”

Victoria Collins MP said:

“The UK’s future prosperity and security depend on getting our approach to digital sovereignty right. This isn’t about shutting our doors to global technological innovation, it is about being smart, strategic, and ambitious for UK tech. Right now, too much of our critical national infrastructure and too many Government services depend on foreign technology and supply chains. This creates real risks, from national security vulnerabilities to economic fragility.

“At the same time, UK technology companies are being locked out of Government procurement in favour of large multinationals. A proper digital sovereignty strategy would change that: backing UK innovation, reducing the UK’s dependencies, and ensuring the UK is a world leader in the technologies that will define the next decade.”

Clive Lewis MP said:

“I am supporting this amendment as a first step to the UK taking control of its critical digital infrastructure and ending our over reliance on Big Tech companies that do not serve the public interest.

“This over reliance is not only a national security risk but also a waste of a critical national resource when we are locked into contracts that benefit shareholders over citizens.“

Demand UK Digital Sovereignty

Find Out More

For more than a decade, UK governments have introduced successive child safety measures, responding to public concern about the availability of content that is either unsuitable or harmful to children, or due to harmful interactions ranging from bullying. Yet at each stage, the measures have delivered far less than was expected. Meanwhile, as online problems appear to escalate, the measures imposed seem more and more extreme, and even politicians admit that they’re likely to be less than fully effective. What is going on?

How it started

To recap what measures have been imposed so far: This began with the UK persuading ISPs and mobile providers to have Internet filters on by default in 2013 The expectation was that these would largely restrict access to adult and harmful content for children and teens. In practice, users in households did not want filters installed across all adults and children. For mobile users, providers found it impractical to block much more than pornography. Most importantly, over-blocking has caused a lot of legitimate and entirely harmless material to be blocked, including advice for people at risk, as highlighted by ORG’s Blocked tool.

The Online Safety debate and then Act was a response to the limited impact of filters, with the policy process starting in 2017. The measures announced in 2019 centred around a ‘duty of care’ and attempted to impose restrictions on harmful content for adults as well as children. The Online Safety Act, passed in 2023, has fuelled the use of age verification to allow adults to access content that might be unsuitable for children. Age Verification remains improperly regulated and largely US processed. Even the poster child of ‘doing it right’, Yoti, has been fined by the Spanish data protection authorities and criticised by privacy researchers.

The OSA is too complicated for us to summarise everything about it. But clearly, segregating categories of content like ‘violence’ (including UK police or Israeli military violence), ‘sexuality’ (including LGBTQ+ advice and social discussions), ‘drugs’ (including discussion of managing harms and avoiding risks), and so on, is problematic. Firstly, because the aim is to prevent teenagers from accessing this content, and secondly because adults are required to age verify and sacrifice privacy to access what can include political and socially important content. Future measures will include automated takedowns, and could even include breaking encryption to scan content.

Finally, the OSA has ended up with small but incredibly safe sites from shutting down or blocking UK access, due to compliance problems. The OSA is in this dimension preventing solutions to the problem of online safety.

Now there are proposals to remove children from social media and games’ chat systems, and for phones to scan for user created sexual images by default. These proposals also mean age verification for adults to access social media or to stop phones from scanning what they take photos of.

What the policy process is doing

Let’s take a step back and look at the way the policy process is designed, and why the measures seem less than effective. Firstly, I would like to introduce something about how government says it develops policy. It provides policy development guidance that is designed to ensure that unintended consequences are avoided, and that policy aims will deliver the intended results. To ensure this is done properly, the Government Office for Science provides an Introductory systems thinking toolkit for civil servants. Patrick Vallance explains:

The design of effective policies for citizens, communities and the UK requires policy makers to understand interconnected systems. For example, the role of transport in accessing healthcare. The most effective policy professionals across the UK Civil Service develop and deploy systems approaches in their work and I encourage all my colleagues to make full use of this toolkit.

What Vallance is pointing to is the problem of repeated policy failures like the War on Drugs, or the way that new roads generate new traffic and fail to stop traffic jams, or how the criminal justice system and longer sentences generate new crime. Highly complex systems and simplistic interventions really do not mix. Genuine solutions require careful thought to ensure that systems and policy goals actually align.

Online Safety is truly an “interconnected system” with a great deal of complexity. Following the government’s policy guidance, then, we can use some of their tools to describe at least some of their interconnections.

This is a basic flow diagram using Systems Dynamics, as the GOS advises. Systems Dynamics is a tool made famous by Limits to Growth, which presented a model of world resource usage that lead to the environmental sustainability debates of the 1970s, and by Peter Senge in the business world, with his book The Fifth Discipline.

The graph describes the social media and online harms dynamics. In the diagram, each measurable part of the system, or “stock”, causes changes in other parts, or “stocks”. Where the relationship is positive, ie causing an increase, such as users creating more content, the arrow is marked with a plus (+). Where negative, a minus (-) shows a negative causal reduction.

This allows us to see the pattern of interactions. While the graphs are my view of the system, most of the relations are generally accepted by people in the debate, including safety campaigners.

The graph shows on the top right the “attention economy”, with attention and user interaction being reinforced by algorithms, and these also reinforcing profits. These are reinforcing loops, or “virtuous cycles” in the view of social media companies. However, from the perspective of safety campaigners and free expression organisations like ORG, Amnesty and others, these cycles also cause increases in harmful content, and illegal content. These are shown in the centre of the diagram.

On the left of the diagram, we see the policy results. Harmful content generates calls for age verification; this generates Evasion by users; this generates calls for tougher age verification, such as application to VPNs, in a reinforcing cycle. As the pipeline of harmful content is not reduced, calls for age restrictions are unlikely to reduce.

For illegal content, we see pressure for more and more content to be moved from Other illegal content, which is anything illegal that a platform must remove if reported, to the Priority illegal content bucket, starting with terrorism and child abuse material, where platforms must remove the content through scanning and algorithmic identification. Here, there may be a bit more policy resistance where too much content is removed.

What is also apparent is that the measures are mostly burdens on users, rather than platforms. They cause privacy and free expression costs, introduce age verification and other barriers that act on users.

The graph illustrates a policy system where the measures are not really acting on the production of problematic content. The engine of online harms, ie algorithmic prioritisation, remains essentially untouched. The attention-seeking goal of the social media system is not changed, and the policy interventions seem to work against rather than with the overall system. This ought to call into question whether the online safety policy approach is really trying to act systemically and effectively. Could other interventions make more sense than simply trying to restrict content and access to content?

In this graph, I have mapped out the basics of the user attention economy that we saw above in a bit more detail. Again, none of the relationships depicted are unknown or controversial. The main loops we see are that the Total active userbase increases Content production, which leads to content prioritisation due to the glut of content. Content production also increases User dependency, which increases the Total active userbase. Content production also increases User satisfaction, also increasing the Total active userbase. So far, all great for the social media company, which also uses the loop of Content prioritisation by algorithms to increase Ad revenue (and thereby Profits).

As before, we note that Illegal and lawful but awful content is also produced by the algorithms system, while Regulatory counter-measures seek to reduce this.

What is illustrated in the graph but appears forgotten in the policy debate however, is that the presence of lawful but awful content, and poor interactions, ought to lead to a decrease in User satisfaction, (illustrated by the long arrow at the foot of the graph) which would then break the reinforcement loop holding up the Total user base. Yet it doesn’t, presumably because of User dependency.

As is noted in many guides to Systems Dynamics, these kinds of graphs help show you where the intervention points really are. What we are looking for is places where there are lots of arrows flowing in. Here the obvious ones are Total active userbase and Content prioritisation by algorithms, and perhaps Content production. These seem central to the system we are illustrating.

In other words, if we could find ways to change how the social media companies retain their Total active userbase, by reducing User dependency, then social media companies might have to re-evaluate what was causing customers to leave. Or perhaps Content production could be less of a driver of User dependency, if people could interact with the content through third parties.

Similarly, if government introduced interventions that acted on the algorithms, like letting users choose any prioritisation engine they liked, then users might act to reduce the harmful content they receive.

Lastly, we should note that in these graphs I have narrowed the policy space that we are looking at. Social media is embedded in society, and wider economics. We have not looked at the role of social media in children’s lives, or their own offline social experiences. There are questions around the way that educators and parents are supported.

However, the analysis above does show that there are a few immediately obvious interventions government could take to change the way the whole system works. They are not a silver bullet, and we do not claim they are the entire answer, nor necessarily politically easy; nor are they a replacement for content duties, but they could help better align the social media content system with the policy goal of safety. They are:

• User switching rights: so users can leave Facebook, Instagram, X, Threads, etc, while retaining their contact networks, as you can with your phone number or your email account. This was identified by the Competition and Markets Authority, for example, as a potential intervention to create competition in social media.

• Freeing user feeds: ensuring that users can control content on platforms, directly or by third parties, so that users can decide what makes them safer and what gives them value.

• Creating competition by breaking up platforms: it is unclear why platforms should be able to own multiple social networks, or why tech giants should be able to use social media platforms as part of a wider business strategy.

• Socially-driven social media: would these dynamics be wholly different if social media was socially owned and controlled? That seems to be the case for Mastodon and BlueSky, where user switching rights are central, and their communities power small environments, which appear to lead to much safer online spaces

That is plenty to think about for now. The UK can stick to a policy ratchet where failed policies lead to more of the same, without really causing anyone at a social media company to blink. Or it can engage in more effective policy design, by looking at the social media system in its fuller context, and then shifting the measures from costs on users, to user empowerment, directly tackling the market power of social media which is generating online harms.

Free expression online

Fix the Online Safety Act

Find Out More