YouSaid · the spoken record
Ian Murray
Lines from Political Thinking with Nick Robinson have been withdrawn from this page while we check who is speaking. See the correction.
On the record 2010–2026
hansard
This is everything the corpus holds for Ian Murray. It is not everything they have said on the record.
Every line below is reproduced as it was said and credited to the record it came from, and links to that record wherever it can be linked. Nothing here is summarised or generated. Directory · Search · Corrections
“The Bill builds on the 2018 regulations, which were a hangover from the EU when we adopted them in this country. The Bill expands on those. As my hon. Friend the Member for Harlow (Chris Vince) just suggested, this is about economic growth as well as protecting our systems, so we have to find a balance between ensuring that our regulators have the powers and tools to regulate properly and giving businesses and our public services the confidence to use digital technology knowing that we have the most secure cyber-security in Europe, if not the world. We are very good at this stuff, and that is the balance to be sought. This Bill is about economic growth rather than about the over-regulation of businesses.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Indeed it does. It is one of a number of provisions that the Government are bringing forward to create growth across the country, not just in Northern Ireland. The Secretary of State’s passion is to make sure that those jobs are everywhere, right across the United Kingdom, including in Northern Ireland. The Under-Secretary of State for Science, Innovation and Technology, my hon. Friend the Member for Vale of Glamorgan (Kanishka Narayan), has been in Belfast recently discussing this legislation and wider cyber-security issues with the industry in Northern Ireland, so I can assure the hon. Member for Strangford (Jim Shannon) that that is indeed the case.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“This is about making sure that we extend the scope of the 2018 regulations into other parts of the economy, and I will come on to that later in my contribution. It is about reporting things more quickly to ensure that the attacks can be seen and action can be taken more quickly. It is also about reporting to the regulators to give the regulators confidence and powers across a wider scope of sectors in the economy, and to give businesses the confidence that those sectors have to report to the regulators when things are going wrong so that swifter action can be taken. We can see from the host of recent high-profile issues, including at Hackney council, that it is important to ensure that this legislation goes through quickly and does the job that it is intended to do.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“As a result of all that, one of the very first things we did as a new Government after the election was announce this new cyber-security Bill, just 10 working days in. Since then, the Department has been talking to cyber experts, businesses and regulators to turn these proposals into the comprehensive, serious and proportionate piece of legislation that we present for Second Reading today—one that protects the public and strengthens national security without placing undue burdens on businesses. I appreciate that that is a fine balance, but I think that this Bill finds that balance, so I am confident that the whole House will support it.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“While physical security and national security are issues for all of us, so is cyber-security. The Bill builds on the 2018 regulations to widen the scope into other areas of the economy where such issues have become much more prevalent—for example, data centres. I hope that doing so will give industries and sectors, including their employees, the confidence to report things to the regulators. Giving powers to the regulators will give businesses the confidence that they can report stuff; it is not a regulatory heavy hand dampening businesses. I hope that I can assure my hon. Friend and the rest of the House on that. Before that significant number of interventions, I was talking about why this issue matters and gave statistics for recent cyber-security activity in the United Kingdom.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“We have had the rise of AI, which cyber-criminals are using to their advantage. Data centres have become a firm fixture of modern life, and we want to see more of them. Since the rules were introduced, criminals tactics have evolved to exploit loopholes in the regulations, as they did in the attack on the NHS supplier that I mentioned, which revealed how hackers can target third parties, such as IT companies, or supply chains as a back-door way to bringing down a wider system. As always, the story is one of technology and cyber-threats moving faster than policymakers can possibly keep up with.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“It is not in the scope of this Bill, which has been kept very tight to deal with these specific and serious cyber-security issues. As we know, the first duty of Government is to keep people safe. The question is how precisely the Bill will achieve that goal. The answer is simple. The UK’s main cyber-rules—the Network and Information Systems Regulations 2018, or the NIS regime—were first introduced seven years ago and have not been updated since. Those rules require operators of essential services such as energy, water and hospitals, as well as some digital service providers such as online search engines, to take steps to protect the services they provide and the data they hold from cyber-threats. As Members might expect, a lot has changed in the cyber-landscape in the past eight years.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“The hon. Gentleman is ingenious in the way in which he uses interventions on pieces of legislation. I know AI copyright is close to his heart as a former, or perhaps current, professional musician and, indeed, one of the key musicians in MP4—let’s not push that to a Division! AI copyright is, of course, a key issue that the Government are looking at. The Secretary of State for Science, Innovation and Technology and the Secretary of State for Culture, Media and Sport are working closely together on this issue. I think the legislation means that there has to be a report to Parliament in March—I am sure the hon. Gentleman will be very interested in that. We are bringing together the industry and tech companies to try to find a way through that particular issue. We know that it is a huge issue.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“In fact, weaknesses in the supply chain have become such a risk that we will go even further by allowing regulators to designate certain organisations as critical suppliers. That includes certain suppliers to essential services that could have a significant impact on the economy or society as a whole—for example, key suppliers to water companies, grid operators or air traffic control. These critical suppliers will be subject to cyber-security duties, which we will set out in secondary legislation.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“This is the data that underpins modern life and all our lives and communities, and it must be protected. We are expanding the scope of the regulations to include managed service providers as well. Those are organisations that provide ongoing functions, such as an IT help desk, to an outside client. Their access makes them an attractive target for cyber-attacks as criminals can find one weak spot and bring countless organisations down. For example, in 2014, an attack on a service provider for the Ministry of Defence compromised the personal data of around 270,000 people—military personnel, reservists and veterans. As organisations rely more and more on outsourced tech, we have to close this gap.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“To keep up with the changes of the past eight years, we are adding a few new things to that list, starting with large-load controllers. That includes any organisation that manages a significant flow of electricity to or from a smart appliance. It might be a company that supports electric car charging, for example. Bringing these entities into scope will safeguard our power supply and give consumers confidence in using energy-smart appliances, all of which are critical as we advance towards our clean power 2030 mission and net zero. The second change is that we are adding large data centres in recognition of their growing importance to our day-to-day lives and to the economy. These are vast digital warehouses for the United Kingdom, home to servers that host everything from patient records to their bank details.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“The Bill widens the scope of the existing regulations, which do not include that, but of course the Government are working closely with Jaguar Land Rover, Marks & Spencer and other high-profile cases, because we know the impact they can have on our economy. Indeed, had the Government not stepped in and resolved that issue, the impact on Jaguar Land Rover, and the tens of thousands of employees at the plants and in the supply chain, would have been catastrophic and is not worth thinking about. I thank my hon. Friend for raising that issue. As I said, as always, the story is one of technology and cyber-threats moving faster than policymakers can possibly keep up with, but today we are fixing that. The first change in the Bill is to widen the scope of the 2018 regulations.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“I thank my hon. Friend for all he did on the issues facing Jaguar Land Rover. I know that the matter is close to his heart and, indeed, it was a really big issue across the country, showing how a cyber-attack can affect not just one company, but has a ripple effect throughout the economy. Of course, the Government stepped in to unlock a £1.5 billion bolster to Jaguar Land Rover’s cash reserves to help it through that problem. I should say to my hon. Friend, and I will come to it later, that Jaguar Land Rover and other private organisations are not in the scope of this Bill. [ Official Report , 29 January 2026; Vol. 779, c. 9WC.] (Correction) The reason is that individual private companies should take their own cyber-security seriously and ensure that the risks of such incidents and threats are minimised as much as possible.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“As I announced this morning, the Government cyber action plan sets a radically new model for how Government will strengthen their cyber-resilience and is backed by over £210 million of investment. Government Departments will be held to standards equivalent to those set out in the Bill. That is why the public sector and the Government are not included in the scope of the Bill. The Government should not need to legislate for themselves; we should just get on with making sure that we are leading the charge and that the cyber action plan strengthens the Government’s cyber-resilience. [ Interruption. ] I do not know if that was an attempt at an intervention from the Opposition Front Bench, but I am happy to take it.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“That is why, in October, members of the Cabinet wrote to the FTSE 350 companies urging them to strengthen their defences by doing three things: first, to make cyber risk a board priority; secondly, to require suppliers to have a cyber essentials certificate; and thirdly to sign up to the early warning service. That was followed by a similar letter to entrepreneurs and small businesses in November with bespoke advice for smaller teams. We know that those actions work. Organisations with cyber essentials are 92% less likely to claim on cyber insurance than those that do not. Businesses know best how to protect themselves; we are not here to regulate for the sake of regulating. Government are taking action too.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“The recent attacks on British icons such as Marks & Spencer and Jaguar Land Rover will loom large in people’s minds. Many Members across the Chamber have already mentioned them. Supply chains were thrown into chaos, with small businesses paying the price, which clearly shows the ripple effect across the economy—on other businesses, smaller businesses and patients, such as in the public service examples mentioned earlier—when one part of the system is attacked. We are clear that all businesses—that covers financial services, Jaguar Land Rover, Marks & Spencer and others—must take immediate steps to protect themselves.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“The banking sector is obviously in the regulators’ scope for cyber-security, and there have been a number of outages, as my hon. Friend mentions. The general principle is that cyber-attacks no longer come in through the front door, but through third parties and suppliers. We have seen that, for example, in the recent incidents at Heathrow and in cloud outages with Amazon Web Services and other such companies. They are covered by their own regulations. As I said in answer to my hon. Friend the Member for Lichfield (Dave Robertson) about Jaguar Land Rover, those companies will not be in the scope of the Bill, but we hope that the financial services sector, which is a leader in cyber-security for a whole host of fairly obvious reasons, will take that forward.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Public services, and indeed central Government, must take the leading role to show businesses that the approach to take is to ensure that all our systems are as secure as possible, not just on economic grounds, but for the people that we all seek to represent.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“The right hon. Gentleman would have had some involvement in this when he was in government; indeed, the 2018 regulations came from the previous Government. We are all trying to make sure that we are catching up with the technology as quickly as it moves. He makes a very interesting point that I am very conscious of and happy to take away. We are determined to deliver the cyber-security action plan, which is backed by £210 million. The actions that the previous Government took did not come to fruition in terms of their 2030 target, which is why we have refreshed the action plan and brought it forward with some significant cash. It is important for Ministers to take that forward. I hope that the right hon. Gentleman will hold us to account to ensure that we are fulfilling that promise in the cyber-security action plan.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Effective compliance is crucial to the success of any regime. These reforms could be world-leading on paper, but without proper enforcement they are meaningless.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“As I said, the Government cyber action plan launched this morning is backed by over £210 million of investment and Government Departments will be held to standards equivalent to those set out in the Bill. I hope that that partially answers the question from my hon. Friend the Chair of the Science, Innovation and Technology Committee. Although the focus of the Bill is on essential services, it will also indirectly help businesses, including those damaged by the recent attacks, and Government. Almost all organisations today rely on data centres, outsourced IT or some kind of external supplier. By extending the Bill’s oversight, we are preventing attacks that could, in theory, reach thousands of organisations. The Bill also gives new powers to regulators responsible for enforcing the NIS framework.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“There are some key dates to monitor progress in the action plan itself. I wrote to my hon. Friend, the Chair of the Science, Innovation and Technology Committee, this morning on the publication of the action plan to lay out some of those issues; the letter will be landing soon. I would be happy to discuss that in front of the Committee in more detail. I hope that the Committee, and indeed the Opposition and our own Labour Members, hold us to account for delivering on this, because it is fundamentally important to Government, whether it be digitisation, modernising Government or winning the case with the public about why digitisation is so important and why Government should be as secure as possible and lead the charge on that across the whole economy. I hope that we and the Committee can take that forward in the weeks and months ahead.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Cyber-security is the responsibility of the Department for Science, Innovation and Technology, but the Cabinet Office has a clear resilience issue as well, as we heard from the right hon. Member for Hertsmere (Sir Oliver Dowden), who was in the Cabinet Office previously. The DSIT Secretary of State will make those regulations, but a plethora of regulators are involved in this process—energy, water and data centres all have different regulators. The regulators that regulate those sectors are being empowered through the expanded number of sectors being brought into the legislation to take the responsibility.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“It achieves double-digit growth year on year. We have fast-growing clusters of expertise in Cheltenham and Manchester. This legislation will supercharge that success, doubling down on one of our nation’s greatest assets. At its core, the Bill is about protecting the essential services that we all rely on, so that the lights always stay switched on, clean water always runs in our taps, and hospitals are always safe and secure. Those are the real life community issues that we and our constituents all encounter every single day. This is more than a technical upgrade; it is a bold commitment from the Government to protect one of our biggest economic strengths and keep the UK safe in a rapidly evolving digital world. Together, we are working towards a future in which security is not a hope but a guarantee. I commend the Bill to the House.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“When national security is on the line, we need the ability to act fast and decisively. In fact, in extreme cases some threats emerge so rapidly that even secondary legislation is too slow; if an ally were to be invaded by a hostile state, for example, the cyber risk to the UK would suddenly escalate. The Government will therefore also be given powers to direct regulators or regulated entities where national security is threatened—to issue specific cyber-security guidance in a crisis, for example. Those powers are intended as a last resort to protect our national security, and safeguards will go into the Bill to ensure that they are used accordingly. The UK’s cyber sector is the third largest in the world, as we heard from our friend from Northern Ireland, the hon. Member for Strangford (Jim Shannon).”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“That procedural quirk has left essential UK services more exposed, which perhaps tells us something about why the UK has such appalling figures compared with some of our EU counterparts, as hackers and cyber criminals exploit gaps in our dated laws. That is an unacceptable risk, so the Bill includes new powers for the Government to update the NIS regime via secondary legislation, to make it quicker and more agile for dealing with evolving technologies—we might need to respond quickly to a new type of cyber-threat, for example. That is not in order to override Parliament; in almost all cases, the Government will still be required to consult on any changes, and Parliament will have the final say on any legislation made under the power. However, delegated powers are essential for keeping us as responsive as possible.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“The Bill ensures that the UK’s cyber-security regime is not only fit for today but flexible enough to head off future threats as well. I have mentioned a few things that have changed in the past eight years—shifts in technology and the nature of cyber-attacks, artificial intelligence, data centres and the economy—but one of the biggest changes was, of course, Brexit. Since our exit from the European Union in January 2020, we have been unable to amend the NIS regulations without primary legislation, because the rules were originally part of European Union law. That has slowed the process and made it difficult for us to keep pace with new emerging threats and technology. Meanwhile, Brussels is pressing ahead with NIS2—its forward-looking update—while we lag behind.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“We will also improve the way in which regulators, intelligence agencies and law enforcement share information with each other by providing greater clarity on what regulators can share and receive. It is important that regulators have the resources to do their job, as the right hon. Member for New Forest East (Sir Julian Lewis) said. The Bill will also give them new powers to cover the full costs associated with their regulatory duties. To ensure transparency, regulators will consult on how fees are calculated and publish a statement each year to show how the funds are being used. Together, the measures add up to a much more consistent and effective regime with better reporting and much clearer guidance for all involved.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“The Bill will also allow the Government to set clear and consistent outcomes for regulations to work towards. One of the virtues of having a regime enforced by different agencies is that each has sector-specific expertise—Ofgem understands the complex digital systems that underpin the national grid, and the Civil Aviation Authority knows the precise threats to air traffic control, for example—but that approach has sometimes led to inconsistencies in how the regime is applied. Some bodies interpret the rules differently from others. The Bill aims to fix that with a single set of objectives issued by central Government and applied across the board. That will send the message that no sector is an easy target in the UK.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Under the current rules, regulators get notified about a breach only once it has already caused significant disruption—when traffic lights have failed or the heating has shut off. The system does not include cases with the potential to cause a crisis much later, like a hospital’s computer system quietly being spied on as hackers wait for their moment to strike. Under the Bill, if an organisation is within scope, it will have to tell its regulator and the National Cyber Security Centre about these types of breaches within 24 hours and provide a full report within three days. Pace and speed are of the essence. This will not only give us better information, but help agencies to warn others, should they need to, before they become the next targets.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“The Bill will strengthen the powers of the NIS regulators, ranging from Ofgem to the Civil Aviation Authority, which work together to uphold the UK’s cyber rules across those different sectors—I may have taken the previous intervention 10 seconds too early! We are raising the maximum fine that they can impose, for example, while simplifying the penalty bands to make them clearer. The key driving force for this measure is not to punish rulebreakers or raise revenue, but to incentivise firms to be vigilant. Our goal is 100% compliance and zero fines. We will also ask regulated organisations to change the way they report attacks and expand both the types of instance they have to report and the timeframe in which they have to report them. This is a small but crucial change.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“We have to pass the legislation first. It may be amended during its passage through both Houses. Therefore, the regulators will not know what they are regulating until the Bill has passed. However, as I mentioned at the start of my contribution, we have been working with regulators, businesses, organisations and cyber-security experts in the run-up to producing the Bill to make sure that it is in the right place—that it is proportionate on businesses and regulators—and that it is effective, which is the most important thing. I am sure that we will have debates on those kinds of issues as we go through Committee and on to Third Reading, but I very much acknowledge what the right hon. Gentleman said.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“It is worth clarifying for the House that we brought forward the Government cyber-security strategy this morning because the 2022 consultation undertaken by the previous Conservative Government was not acted upon. This Government are acting on those threats, bringing forward a plan that we will subsequently see through, and I think the hon. Lady should acknowledge that.”
House of Commons6 January 2026Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“I congratulate the hon. Gentleman on his fantastic event in Parliament last week on this subject. I am delighted that Queen’s University Belfast is benefiting from £5 million in funding from the programme, which is part of a £13 million wider package from this Government to support making UK supply chains more resilient. The Government are investing a record £86 billion over the spending review period, which is the largest ever investment in research and development, and Ministers regularly discuss a range of issues with Cabinet colleagues to ensure that those programmes align with wider Government priorities on economic resilience and innovation.”
House of Commons17 December 2025Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“I think the hon. Gentleman acknowledges in his question the amount of funding that is going into the area that he represents and the wider Northern Ireland communities. UKRI plays a key role in strengthening supply chains, supporting regional innovation hubs and aligning research with local economic development goals. This Government’s funding rounds highlight partnership opportunities, including with the Advanced Manufacturing Innovation Centre that he has mentioned, where projects can complement those facilities, boosting regional innovation and productivity. That builds on initiatives such as the local innovation partnership funding, which empowers local leaders to target research and development investment and unleash the full potential of innovation in his and the wider Northern Ireland region.”
House of Commons17 December 2025Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“I thank the Chair of the Select Committee for her question. Of course, technological advancement in AI is going to change the way that the Government work, and the way that all of us work, but the key thing about the publication of UK Research and Innovation’s document this afternoon is that it is implementing a record £86 billion-worth of investment over the spending review period—the largest ever investment in research and development. We have to trust UKRI and this Government to put that money into the places that will benefit the country most, and that means more jobs in more communities all over the country.”
House of Commons17 December 2025Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Department for Science, Innovation and Technology and Cabinet Office Ministers are working closely to deliver the new digital ID scheme. The scheme will be inclusive, secure and effective. It will give the public more control over their data than they have now, and it will make public services easier to access. A major inclusion programme, backed by £11.7 million, will support those at risk of digital exclusion, ensuring that the system is accessible and secure for all as we modernise our public services.”
House of Commons17 December 2025Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Modernising government was at the heart of our manifesto, and the Government are proposing this national digital ID scheme to modernise our public services, improve security and streamline right-to-work checks. Since we introduced the digital veterans card, it has been downloaded 11,000 times, and 260,000 people have already downloaded the gov.uk app and 13.2 million people have started to use One Login as part of the gov.uk service. In the new year, a public consultation will be launched, alongside wider engagement, which has already begun, with expert organisations and wider stakeholders. A major digital inclusion programme will also be rolled out alongside that.”
House of Commons17 December 2025Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“It is up to the Petitions Committee to schedule those debates, and I am sure the Committee will schedule that debate in Westminster Hall in due course. I can only reiterate that the Government are proposing this national ID scheme to modernise public services, improve security, streamline right-to-work checks and give the public control over their data. I am not quite so sure why the hon. Lady objects to the government modernising. We have analogue government with a digital population, and we live in a new world where the economy is modernising and digitising all the time, and government has to catch up.”
House of Commons17 December 2025Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“One of the aspects of digital ID that is under-debated in this House is the fact that those who are furthest away geographically and economically from digital inclusion will benefit the most from it. That is why we are investing millions of pounds into the digital inclusion programme, which has just announced 80 projects, including many in my hon. Friend’s constituency. We have to make sure that the entirety of the public, wherever they are in the country and whichever economic situation they are in, benefit from digital government and better public services.”
House of Commons17 December 2025Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Space is fundamental to many civil and defence requirements. It is vital that we collaborate closely across Government and with our allies. Just last month, the European Space Agency Council of Ministers committed £1.7 billion of funding focused on just that: growth and national security.”
House of Commons17 December 2025Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Following the introduction of the child safety duties in July, Ofcom reported that UK daily active users of VPN apps temporarily doubled to around 1.5 million—the average is normally about 750,000. Since then, usage has dropped, falling back down to around 1 million daily users by the end of September. That was expected, and it has also happened in other jurisdictions that have introduced age checks. According to an Ofcom rule, services should “take appropriate steps to mitigate against methods of circumvention that are easily accessible to children”. If a provider is not complying with the age assurance duties, by promoting VPN usage to bypass age assurance methods, Ofcom can and should take enforcement action. The use of VPNs does not protect platforms from not complying with the Act itself.”
House of Commons15 December 2025Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Services must take proportionate steps to minimise the risk of children encountering that type of content when using them, and they must also put in place age assurance measures to protect children from harmful content, such as bullying and violent content. Ofcom’s “Protection of Children Codes of Practice” set out what steps services can take to comply, and Ofcom has robust enforcement powers available to use against companies that fail to fulfil those important duties. We are already seeing that enforcement happening, with 6,000 sites having taken action to stop children from seeing harmful content, primarily via age checks. That shows the scale of the issue. Virtual private networks have also been mentioned by a number of Members, including the shadow Minister.”
House of Commons15 December 2025Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“To deliver that, Ofcom is providing support to online service providers of all sizes to make it easier for them to understand and comply with their responsibilities under the UK’s new online safety laws. For example, Ofcom has already launched a regulation checker to help firms to check whether they are covered by the new rules, as well as a number of quick guides for them. I will address some of the issues raised by Members. My right hon. Friend the Member for Oxford East (Anneliese Dodds) started by raising the issue of pornography and other harmful content. User-to-user services that allow pornographic content, and content that promotes, provides instructions for or encourages suicide, self-harm or eating disorders, must use highly effective age assurance to prevent all children under 18 from accessing that type of content.”
House of Commons15 December 2025Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“The Government recognise the importance of ensuring that low-risk services do not have unnecessary regulatory burdens placed upon them, which I hope reassures the shadow Minister. That is why, in the statement of strategic priorities issued on 2 July, the Government set out our expectation that Ofcom should continue focusing its efforts on safety improvements among services that pose the highest risk of harm to users, including small but risky services. The Government also made it explicitly clear that Ofcom should ensure that expectations on low-risk services are proportionate. Alongside proportionate implementation of the Act, the Government also understand the need to communicate the new regulations effectively, and to work with companies within its scope to ensure that compliance is as easy as possible.”
House of Commons15 December 2025Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“However, while many services carry low risks of harm, risk assessment duties are key to ensuring that risky services of all sizes do not slip through the net of regulation. For example, the Government are very concerned about small platforms that host the most harmful content, such as forums dedicated to encouraging suicide or self-harm. Exempting all small services from duties requiring them to tackle that type of content would mean that those forums would not be subject to the Act’s enforcement powers, which is why we reject the petitioner’s views. Even forums that might seem harmless carry potential risks, such as where adults can engage directly with child users.”
House of Commons15 December 2025Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“When recommending steps that providers can take to comply with their duties, Ofcom must consider the size and risk level of different types and kinds of services. Let me just concentrate on that for a minute. For instance, Ofcom recommends user blocking and muting measures to help to protect children from harmful content, including bullying, violent content and other harmful materials, and those recommendations are tailored to services’ size and risk profile. Specifically, Ofcom recommends that all services that are high risk for this content need to implement those measures in full. However, for services that are medium risk for this content, Ofcom suggests that they need to implement the measures only if they have more than 700,000 users.”
House of Commons15 December 2025Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Members have referenced already, many services now deploy age checks, including the top 10 most popular pornographic sites, the UK’s most popular dating apps and a wide range of other services, including X, Telegram, Reddit, TikTok, Bluesky, Discord, Xbox and Steam. This represents a safer online experience for millions of children across the UK; we have heard that it is already having an impact. The Government recognise, however, the importance of implementing the duties proportionately. That is why proportionality is a core principle of the Act and is built into many of the duties contained within it. Ofcom’s illegal content and child safety codes of practice set out recommended measures that are tailored to both size and risk to help providers to comply with their obligations —it is really important to emphasise that.”
House of Commons15 December 2025Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“Services now use highly effective age assurance to prevent children in the UK from encountering pornography and content that encourages, promotes and provides instructions for self-harm, suicide or eating disorders. Platforms are also now legally required to put in place measures to protect children from other types of harmful content, including abusive or hateful content, or bullying and violent content. When we visited schools, we spoke to headteachers, teachers and parents about the real problem that schools have in trying to deal with the bullying effects of social media. According to Ofcom’s 4 December report that some hon.”
House of Commons15 December 2025Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗
“The priority offences are assisted suicide; threats to kill; public order offences such as harassment, stalking and fear of provocation of violence; drugs and psychoactive substances; firearms and other weapons; assisted illegal immigration; human trafficking; sexual exploitation; sexual images; intimate images of children; proceeds of crime; fraud; financial services fraud; foreign interference; animal welfare; terrorism; and controlling or coercive behaviour. The new ones that have been added by the Secretary of State include self-harm, cyber-flashing and strangulation porn. Do we honestly have to write that into a schedule of an Online Safety Act to say that those things are unacceptable and should not be happening on our computers? On 25 July, the child safety regime came into force.”
House of Commons15 December 2025Contains Parliamentary information licensed under the Open Parliament Licence v3.0Source ↗