Before the Code Becomes the Censor: Seven Digital-Rights Tests for Ofcom's Enforcement Winter

The argument about Britain's online safety regime has changed register. For much of the past few years the debate concerned the wording of codes, the scope of duties and the timetable for implementation. By winter 2026 the question is more concrete: what happens when the regulator begins to enforce? That shift matters for human rights. The most serious threat to free expression online is rarely a single dramatic act of censorship. It is the slow accumulation of procedural choices that make dissent harder to organise, journalism harder to protect and public debate harder to see.

The Oxford Amnesty Lectures have long treated free expression as a practice rather than a slogan. The archive's value lies in its insistence that rights are tested at the point of application: in the lecture theatre, on the picket line, in the newsroom and in the committee room. The same discipline should now be applied to digital regulation. The Online Safety Act 2023 gave Ofcom substantial powers. The task for campaigners in 2026 is to ensure that those powers are exercised with proportionality, transparency and a clear route of appeal.

The phrase that should guide this work is the muted microphone. A platform need not ban a speaker to narrow the space for speech. It can remove a post, delay a livestream, suspend an account, restrict a hashtag or make verification so burdensome that only the well-resourced persist. Each decision may appear modest. Taken together, they can silence a campaign before it reaches the public square.

1. Does encryption remain a shield rather than a scanning surface?

End-to-end encryption protects journalists, activists, survivors of abuse and ordinary users. It is also the point at which online safety duties can collide most sharply with privacy. Campaigners should test whether enforcement pressures are leading platforms towards client-side scanning, mandatory content filtering or backdoors dressed as safety features. The right question is not whether a measure is technically possible, but whether it is necessary and proportionate. Ofcom and the Department for Science, Innovation and Technology should be asked to publish their assessment of encryption-related compliance measures, including any risk of mass surveillance.

2. Is age assurance proportionate and privacy-preserving?

Age verification is now a familiar part of the UK online landscape, but familiarity should not breed indifference. Campaigners should ask whether age assurance relies on blanket identity uploads, facial estimation or data retention that creates new risks for vulnerable users. A rights-based test asks for data minimisation, clear alternatives, independent auditing and a route of complaint. It also asks what happens to adults who choose not to verify: are they excluded from public information, support services or political debate? Safety and anonymity are not opposites. A regime that treats them as such will narrow the space for everyone.

3. Can protest organising survive platform risk controls?

Online coordination is now part of the infrastructure of assembly. Event pages, group chats, livestreams and shared maps are not incidental to protest; they are how many campaigns begin. Enforcement should therefore be tested against the right to peaceful assembly. Campaigners should look for evidence that political organising is being caught by automated risk controls, that event pages are removed without reasons, or that accounts are restricted during periods of public contention. A proportionate regime would treat political expression as high-value speech, require human review before removal and provide rapid restoration when mistakes occur.

4. Are journalistic sources protected in practice?

Source protection is not a luxury of the national press. It is a condition of public-interest reporting at every level, from local council scrutiny to investigations of state power. Campaigners should ask whether platform compliance with online safety duties creates new pressures to disclose metadata, weaken encryption or hand over communications. Ofcom is not a press regulator, but its enforcement decisions shape the environment in which journalism operates. The test is whether source confidentiality is treated as a presumptive protection, rebuttable only through independent legal process and with notice to those affected wherever possible.

5. Is there a real appeal against takedowns?

A takedown without an effective appeal is simply a deletion with better branding. Campaigners should test the accessibility, speed and independence of platform complaints systems. Are reasons given? Is there human review? Are timelines published? Can users challenge automated decisions? Is there an independent route beyond the platform itself? The principle should be notice and appeal, not notice and stay down. For political speech, journalism and assembly-related content, the threshold for removal should be higher and the restoration process faster.

6. Will transparency serve the public as well as the regulator?

Transparency is often promised and rarely delivered in a form that civil society can use. Campaigners should press for standardised transparency reports, researcher access and published risk assessments. The public interest is not served by data that is visible only to regulators and platforms. Independent scrutiny is essential if enforcement is to be trusted. Questions should be asked about algorithmic amplification, removal patterns, appeals outcomes and the treatment of protected groups. Without such evidence, debate about online safety becomes a contest of anecdotes.

7. Is the regulator itself accountable?

Ofcom is now a central actor in the exercise of expressive freedom. That makes its own accountability a human-rights question. Campaigners should examine how enforcement priorities are set, how consultations are conducted and how affected communities are heard. Parliamentary committees, judicial review and stakeholder panels all have a role. So does the archive: the Oxford Amnesty Lectures tradition reminds us that rights are best defended when institutions expect to be questioned in public. Ofcom should publish a clear enforcement strategy, explain how it weighs free expression and privacy, and evaluate the impact of its decisions.

A winter 2026 checklist for campaigners

First, map the decision-makers. Identify the relevant Ofcom team, the departmental officials and the MPs on the relevant select committees. Second, ask written questions about encryption, age assurance, protest-related removals and appeal outcomes. Third, submit evidence to consultations rather than waiting for the closing statement. Fourth, use freedom of information requests to track enforcement patterns. Fifth, work with researchers and lawyers who can test decisions in practice. Sixth, keep a public record of cases, because patterns are easier to deny than individual complaints. Seventh, connect digital rights to the older struggles for assembly, speech and due process.

The muted microphone is not a metaphor for a single law. It describes a regulatory culture in which safety is pursued through restrictions that are rarely reviewed and poorly explained. Britain's online safety regime can still be made to serve users rather than silence them. That will not happen through good intentions alone. It requires tests, evidence and the kind of public argument that the Oxford Amnesty Lectures were founded to sustain.