UK law
Digital Markets, Competition and Consumers Act 2024 (Consequential Amendments) Regulations 2025 made
The Digital Markets, Competition and Consumers Act 2024 (Consequential Amendments) Regulations 2025 SI 2025/381 have been made. They amend primary and secondary legislation following the implementation of Parts 3, 4, and Chapter 2 of Part 5 of the Digital Markets, Competition and Consumers Act 2024. They come into force on 6 April 2025. They replace references to the enforcement regime under Part 8 of the Enterprise Act 2002, which Part 3 of the Act supersedes, and replaces references to the Consumer Protection from Unfair Trading Regulations 2008 (CPUTRs) and EU Directive 2005/29/EC concerning unfair business-to-consumer commercial practices (which the CPUTRs implemented), which Chapter 1 of Part 4 supersedes. They also update various pieces of legislation which restrict the disclosure of information. Under section 252(3)(a) of the Act, Part 4A of the CPUTRs continues to govern consumers’ rights of redress for unfair trading until regulations under section 233 (“section 233 regulations”) come into force. As it is not proposed to make section 233 regulations before Chapter 1 of Part 4 of the Act commences for other purposes, paragraph 32 of the Schedule amends Part 4A of the CPUTRs to allow it to function after that commencement. When the section 233 regulations come into force, paragraphs 2, 5 and 22 of the Schedule will replace references to Part 4A of the CPUTRs in other legislation.
Online Safety Act 2023 (Commencement No 5) Regulations 2025 made
The Online Safety Act 2023 (Commencement No 5) Regulations SI 2025/371 have been made. They bring certain provisions of the Online Safety Act 2023 into force on 3 November 2025. They bring into force duties on providers of regulated user-to-user services to report Child Sexual Exploitation and Abuse (CSEA) content to the National Crime Agency (NCA) and other provisions, such as the offence relating to CSEA reporting and provisions relating to Ofcom’s enforcement powers and the information offences, as they relate to the CSEA reporting requirement.
Online Safety (CSEA Content Reporting by Regulated User-to-User Service Providers) Regulations 2025 made
The Online Safety (CSEA Content Reporting by Regulated User-to-User Service Providers) Regulations 2025 SI 2025/368 have been made. They require providers who are obliged to report child sexual abuse and exploitation (CSEA) content to the National Crime Agency (NCA) to register with the NCA. If providers have entered into arrangements with another person to moderate the content on the provider’s services, that person is also required to register with the NCA. They come into force on 3 November 2025.
CMA responds to the UK government’s consultation on the resale of live events tickets
The CMA has responded to the UK’s government’s consultation about the resale of live events tickets. It sets out considerations to help government take forward its proposal for a resale price cap for live events tickets, and outlines a model for efficient, targeted enforcement that would help to ensure that any cap met the government’s objectives.
CMA seeks changes to the way Ticketmaster labels tickets and provides pricing information to fans
The CMA has issued a progress update on its investigation into Ticketmaster following widespread complaints about the sale of Oasis concert tickets last year. The CMA is concerned that Ticketmaster, which sold more than 900,000 tickets during the Oasis ticket sale, may have breached consumer protection law by labelling certain seated tickets as “platinum” and selling them for near 2.5 times the price of equivalent standard tickets, without sufficiently explaining that they did not offer additional benefits and were often located in the same area of the stadium. This risked giving consumers the misleading impression that platinum tickets were better. The CMA is also concerned that Ticketmaster did not inform consumers that there were two categories of standing tickets at different prices, with all of the cheaper standing tickets sold first before the more expensive standing tickets were released, resulting in many fans waiting in a lengthy queue without understanding what they would be paying and then having to decide whether to pay a higher price than they expected. Many fans thought that Ticketmaster used an algorithmic pricing model during the Oasis sale, with ticket prices adjusted in real time according to changing conditions like high demand. The CMA has not found evidence that this was the case. Instead, Ticketmaster released a number of standing tickets at a lower price and, once they had sold out, then released the remaining standing tickets at a much higher price. Although prices were not adjusted in real time using an algorithm, the CMA is concerned that consumers were not given clear and timely information about how the pricing of standing tickets would work, particularly where many customers had to wait in lengthy online queues to see what tickets were available. Ticketmaster has since made changes to some aspects of its ticket sales process, but the CMA does not currently consider these changes are sufficient to address its concerns. The CMA has provided Ticketmaster with details of the further steps required to address its concerns and is seeking changes to Ticketmaster’s processes – including to the information it provides to customers, when it provides that information, and how it labels some of its tickets. The CMA is now consulting on these changes with Ticketmaster.
Ofcom launches consultation on satellite-to-phone spectrum licensing framework
Ofcom is consulting on new spectrum licensing arrangements to enable direct satellite-to-phone services in the UK. The consultation sets out three potential authorisation approaches, with Ofcom’s preferred option being amendments to existing mobile operator licences. The proposals would make the UK the first European jurisdiction to establish a regulatory framework for commercial satellite-to-phone services. The consultation ends on 20 May 2025. Subject to feedback, implementation is possible later in 2025.
CLA expands licences to support generative AI use in the workplace
The Copyright Licensing Agency (CLA) has announced the addition of new permissions to its commercial and public sector licences, enabling UK professionals to use copyright protected content to prompt generative AI (GAI) tools. These new permissions take effect from 1 May 2025. They will allow the lawful copying of published content to prompt relevant GAI tools to generate outputs. As professionals increasingly use copyright-protected content in GAI tools at work, the new permissions from CLA will allow lawful use and peace of mind, while fairly remunerating rightsholders and creators for the reuse of their work.
CCAV issues guidance on Automated Vehicles Act implementation programme
The Centre for Connected and Autonomous Vehicles has published guidance about the implementation programme for the Automated Vehicles Act 2024. It covers the deployment of automated vehicles and the steps towards implementing the Automated Vehicles Act 2024.
ICO and CMA issue joint statement on AI foundation models
The ICO and CMA have issued a joint document which discusses the transformative potential of AI foundation models in driving innovation and growth across various sectors. It highlights the significant advancements in AI technology, particularly in the development of large-scale models that can perform a wide range of tasks with high accuracy and efficiency. The statement emphasises the importance of using these AI models to unlock new opportunities and improve productivity. It also addresses the need for regulatory frameworks to ensure the ethical and responsible use of AI technology. By adopting AI foundation models, organisations can stay competitive and drive economic growth while adhering to ethical standards and practices. The ICO and CMA welcome further engagement with stakeholders on their experiences of AI in general, and on the issues raised in the article in particular. They will continue to collaborate on a broad range of projects to identify the interactions between their regulatory remits and aim to ensure clarity for stakeholders. This includes working together on online advertising issues, as well as collaboration on Strategic Market Status investigations under the CMA’s new digital markets competition regime.
Software provider fined £3 million by ICO following 2022 ransomware attack
The ICO has fined Advanced Computer Software Group Ltd £3.07m for security failings that put the personal information of 79,404 people at risk. Advanced provides IT and software services to organisations, including the NHS and other healthcare providers, and processes people’s personal information on their behalf. The fine relates to a ransomware incident in August 2022. Hackers accessed certain systems of Advanced’s health and care subsidiary via a customer account that did not have multi-factor authentication (MFA). The cyber-attack was widely reported at the time, with reports of disruption to critical services such as NHS 111, and other healthcare staff unable to access patient records. The investigation found that personal information belonging to 79,404 people was taken, including details of how to enter the homes of 890 people who were receiving care at home. The ICO’s investigation concluded that Advanced’s health and care subsidiary did not have the appropriate technical and organisational measures in place to keep its health and care systems fully secure before the 2022 incident, including gaps in the deployment of MFA, a lack of comprehensive vulnerability scanning and inadequate patch management. Several factors led to a reduction in the fine, including Advanced’s proactive engagement with the National Cyber Security Centre, the National Crime Agency and the NHS in the wake of the attack and other steps taken to mitigate the risk to those affected. The ICO and Advanced have now agreed a voluntary settlement. Advanced has acknowledged the ICO’s decision to impose a reduced fine and agreed to pay a final penalty of £3,076,320 without appealing.
