Policy paper

Plan for Digital Regulation: Outcomes Monitoring Framework 2023

Updated 10 October 2023

This was published under the 2019 to 2022 Johnson Conservative government

1. Background and context

In 2021 the government published the Plan for Digital Regulation, launching a conversation about how to set the right rules for governing digital technologies. A key commitment of the Plan was to develop both a greater quantity and quality of evidence to underpin our digital regulatory approach.

To make progress against this commitment, in 2022 we published the first Outcomes Monitoring Framework (OMF) for digital regulation. It set out the government’s objectives and outcomes for regulating digital technologies, an initial set of indicators and our planned next steps to strengthen the evidence base. It was a first step towards developing a holistic approach to monitoring progress against the government’s overall priorities and objectives and identifying any gaps in our approach.

This document provides an update on our work to establish clear indicators, building on stakeholder views and new research.

Digital regulation: outcomes and objectives

Below are the government’s objectives and outcomes for digital regulation. We note that each of the outcomes we set out is influenced by a complex interplay of factors, of which regulation is likely only one, alongside other factors such as training, investment, and economic factors.

Promoting competition and innovation

Objectives

• digital markets are competitive and drive growth across the economy
• consumers trust they are treated fairly online and can exercise choice over the services they access
• the UK has a vibrant digital economy where startups and scaleups can prosper (alongside other firms)
• businesses and other organisations are able to use data innovatively

Outcomes

• enable data sharing to support competition, in line with privacy laws
• increase consumer choice and the quality of digital services
• increase investment in UK digital companies and grow the UK supplier base
• increase business incentives to innovate
• enable wider digital adoption across industries and regions and support UK AI exports
• ensure data is used in the public interest
• ensure data is used to support scientific research and development
• encourage digital business to locate and grow in the UK, and make the UK a highly attractive jurisdiction for digital investment

Keeping the UK safe and secure online

Objectives

• citizens are empowered to be safe online, and trust they are protected from online harms beyond their control
• organisations have the capabilities and resilience to preserve their digital security, and security is factored into new products and services from the outset
• the security of UK networks and critical infrastructure is protected

Outcomes

• increase user safety online through reduced incidents of online harms, especially with respect to children
• improve management of cyber risk within UK organisations
• work with global stakeholders to shape the development of global digital technical standards in priority areas
• improve law enforcement’s ability to tackle illegal content online
• ensure consumer connectable products meet essential cyber security requirements and providers of digital services follow better cyber security practices
• improve users’ ability to keep themselves safe online through greater platform transparency and non-legislative support measures

Promoting a flourishing democratic society

Objectives

• digital technologies support democratic engagement, preserve freedom of expression and human rights
• UK’s media and press sectors are able to flourish online
• UK citizens’ data will be used responsibly and their privacy preferences will be upheld

Outcomes

• preserve and enhance freedom of speech online
• ensure higher transparency for voters about those trying to influence their views when viewing digital campaigning material
• ensure an online environment which limits the spread of, and user exposure to, misinformation and disinformation and the harms caused by this content
• ensure platforms remain open to diverse viewpoints and allow for unencumbered circulation of press content
• enable the growth of digitally-adapted sustainable business models for the press sector
• increase citizens trust when sharing data and protect individual’s data rights

2. Summary of call for views: stakeholder responses

With the publication of the OMF (2022), we invited stakeholder views, alongside meetings with stakeholder across civil society, academia, regulators and industry to further understand the range of perspectives on developing evidence for digital regulation. Stakeholders highlighted that many topics and issues concerning digital regulation are connected. Metrics and evidence can show these connections and help further the principle of regulatory coherence under the Plan for Digital Regulation. We recognise that issues under digital regulation are evolving, and new ways of researching and evidencing outcomes are always in development. Below we summarise key themes we heard from stakeholders.

Key themes from the call for views

Indicators looking at growth of the digital economy, in-market competition, and types and scale of innovation in the economy need to include a range of evidence to give a full and accurate picture.

• Gross Value Added (GVA) is useful to understand the growth of the overall digital sector, but does not tell us about the uptake of specific products or services, digitalisation of the broader economy, and also does not tell us about aspects that do not rely on financial transactions (e.g. open source software). We also heard challenges around measuring why people might not want to use or continue using specific products or services.
• we note that there are many kinds of innovation that are produced by digital markets in different ways (e.g. incremental vs breakthrough, product vs process, sustaining vs disruptive). To gain a better understanding of market dynamics, suggestions included:
  • where available, using indicators for: in-market competition based on market shares and concentration ratios; investment and employment in the digital sector; innovation (e.g. via patent filings, R&D expenditure), business births and deaths; as well as innovative data use.
  • conducting qualitative research (e.g. interviews or ethnographic research) to understand “lived experiences” around digital technologies.
  • using “weak signals” of the future such as media reporting or social media posts to understand where innovation might be headed.
  • examining the discussions around products and services in order to understand why people may opt to “walk out” of a service (particularly where consumers do not have a great deal of choice).

Consumer outcomes need to be understood in context

• benefits and harms experienced by consumers in digital contexts have dependencies on contextual factors. For example, before an individual becomes a digital consumer, they must first have digital access. This means digital infrastructure (i.e. broadband) must be available. It also means the individual needs to have the means (i.e. capital) to pay for that access, and the digital literacy to navigate the internet.
• simply understanding whether a consumer has experienced a benefit or a harm does not tell us about the characteristics of that consumer (and the likelihood that those characteristics influence their experiences). For example, whether that consumer comes from a vulnerable group or a specific UK region.
• we heard that consumer preferences are themselves very contextual and variable. For instance, an individual’s attitude towards privacy can vary over the course of a single day.

Consumer trust in digital products, services and data use is linked to outcomes on online safety, digital market competition, and democratic values such as freedom of expression.

• trust underpins all three broad objectives under the Plan for Digital Regulation: people may opt out of using certain digital products and services if they do not trust that they can use them safely, and that they can express themselves freely on those services.
• stakeholders pointed to research that estimated there is a high economic value of giving UK consumers greater control over their personal data that is used for targeted advertising on large online platforms. This control over personal data may increase consumer trust in online products and services.
• it was also noted that trust in digital products and services takes many forms; for example some people might be concerned about how their data is used, while others might be concerned about whether their broadband connection is working in the first place. But trust is hard to measure; there is likely a feedback loop between a consumer being treated fairly, generating the consumer’s trust in that product or service, and that consumer then advocating those products or services to others.

Consumer complaints data can give a good indication about whether we are meeting our objectives for digital regulation

• in addition to statistics on incidents of online harm (based on surveys and police-recorded crime), we should also look into consumer complaints or dispute resolution procedures for digital technologies. This could serve to show existing mechanisms for complaints, as well as the types of consumers that make complaints and the reasons for which they do so. However, there are challenges with using complaints data:

  • even if they have experienced a harm, in some cases people do not complain, or are unable to make a complaint
  • complaints data may only concern specific businesses or processes rather than reflect a subset of broader issues
  • interpreting a rise in complaints data may be challenging - complaints might increase due to a worse service, due to easier processes to raise complaints, or due to more educated consumers

• information on judicial review processes may be useful for understanding issues with how government digital regulations are designed and implemented.

Digital settings can produce both benefits and harms through the same business practices, such as online choice architecture and the use of algorithms

• the same mechanism that may lead to consumer benefit through algorithmic targeting (e.g. price personalisation can offer certain customers lower prices) can also lead to consumer harm (e.g. this could amplify the ability of sellers to predict what people are willing to pay and to discriminate on the basis of this). How a harm is defined is therefore important.
• harmful outcomes should be looked at as a result of how practices are deployed. Businesses should be encouraged to deploy practices in a way which maximises benefits for both industry and consumers alike.
• stakeholders noted challenges with measuring and attributing harmful business practices. For example, consumers are often not aware their choices are being influenced through means such as online choice architecture or algorithms, making this difficult to ask via surveys. Similarly, businesses applying those practices are not always aware they are harmful, potentially deploying default options that harm consumers. Furthermore, firms that employ harmful practices often own the knowledge and data on these practices and are not always open to sharing this due to commercial sensitivity.
• our understanding of the prevalence of harmful practices could be deepened by collecting data on harmful practices online and reviewing organisations’ internal statements on consumer protection.

Our measures around the protection of human rights online need to be more holistic, and complemented by measures of human rights offline

• online harms can lead to offline harms; such as contributing to detrimental effects on freedom of expression, social or ideological polarisation, and negative impacts on mental health.
• measuring rights can be conceptually tricky; there are cases where individual rights (for example, to freedom of expression) might be at odds with the will of the majority (for example, to prevent the spread of mis/disinformation).
• we need a clearer understanding of individual and societal wellbeing within the context of digital growth, and to understand not just rights violations but also whether people are able to enjoy their human rights.

3. Update on indicators for digital regulation

Establishing clear indicators supports us to monitor trends on key areas of the digital ecosystem that the government is seeking to influence. We have not sought to use this set of indicators to demonstrate causality in how regulation impacts the government’s objectives of interest, but rather to build a holistic picture of the digital landscape. We provide sources for the data, a confidence assessment for each indicator, and measurement gaps.

In this report, we have included one key metric for each objective within the Plan for Digital Regulation that can be monitored over time. Criteria for highlighting specific metrics included robustness and availability over time, as well as policy relevance. For each key metric, we discuss below why we have chosen this metric in the context of our policy objectives, and discuss the challenges and opportunities of using that metric. We also mention complementary metrics where appropriate and, where we do not think a good metric is available, we discuss why - and what a good indicator could look like. The selection of metrics across each of the objectives below are intended to complement each other to create a picture of progress against regulatory outcomes.

Promoting Competition and Innovation

Key findings:

• on the objective of digital markets being competitive and driving growth across the economy, we found that the percentage of total digital sector revenue^{[footnote 1]} received by small and medium-sized enterprises (SMEs) remained fairly stable in the last ten years, showing some decline after a period of growth.
• assessing the extent to which the UK has a vibrant digital economy where startups and scaleups can prosper (alongside other firms), we note that UK digital sector business births first increased and then decreased again in the last ten years. UK digital sector business deaths have markedly increased during the same time.
• concerning the objective of consumers trusting they can exercise choice over the services they access, we note that around half of the people surveyed said they felt they have lots of choice between new and innovative digital products (e.g., social media platforms, search engines, comparison websites).
• on the objective of businesses and other organisations being able to use data innovatively, we note that in a 2022 survey, 43% of businesses that use digitised data and think that data has become more readily available in the last 3 years agree this has led their business to innovate and perform new functions.

1. Digital markets are competitive and drive growth across the economy

The percentage of total digital sector revenue received by SMEs over time can give a good indication of the extent of competition in the sector alongside the five biggest firms that capture a large share of the sector. We find that this percentage remained fairly stable but grew slightly from 42.3% in 2011 to 46.5% in 2018, before declining again, reaching 42.3% in 2022 (see Figure 1; Table 1). In absolute terms, SME revenue in the digital sector increased from £118 million out of £278 million total UK revenue in 2011 to £159 million SME revenue out of £375 million in total in 2022.

Gross Value Added (GVA) provides a measure of the value of the goods and services provided in a given sector or market. In 2020, GVA for the digital sector^{[footnote 2]} was £140.4 billion, an increase from £139.9 billion in 2019^{[footnote 3]}. Annual estimates for subsequent years will become available in due course. While GVA can show the overall growth of the digital sector, it is important to note that this growth is strongly driven by five of the largest firms as mentioned above.

Concentration ratios or the Herfindahl-Hirschman Index (HHI)^{[footnote 4]} are currently not available for specific digital markets, and cannot be interpreted clearly at a sector level. Better metrics for understanding growth and competition within specific digital markets such as online search, social media and e-commerce platforms would require reliable data and robust, static definitions for those markets.

Figure 1. Percentage of digital sector revenue received by SMEs, 2011 - 2022

2. The UK has a vibrant digital economy where startups and scaleups can prosper (alongside other firms)

Business births and deaths in the digital sector per year shows the annual number of new businesses that enter the digital sector and the number that exit it. As can be seen in table 2 below, since 2012, digital sector business births increased from 27,039 to a peak of 38,095 digital sector business births in 2015, constituting 10.1% of all UK business births in both 2012 and 2015. Since then, the number of digital sector business births per year decreased over time, but there were still 23,866 digital sector business births in 2021, constituting 6.6% of all UK business births. At the same time, digital sector business deaths per year have increased over time, possibly due to the effects of the Covid pandemic and economic downturns. While there were 19,103 digital sector business deaths in 2011, there were 38,107 in 2021. This constitutes 8.3% and 11.6% of all business deaths in the UK.

These statistics can help understand the relationship between business innovation and economic growth:

• if there are many business births and few business deaths, it can indicate a growing market and increased competition.
• a high number of business births can suggest a vibrant entrepreneurial ecosystem with innovative new ideas and products. Similarly, a high number of business deaths may reflect a lack of innovation or inability to keep up with changing consumer demands.
• however, failure of a business is a natural part of the innovation process, and can help entrepreneurs to shape innovative approaches for the future. Business deaths can also mean that a business has been acquired or merged with other businesses. Thereby, the business founder may acquire new capital and be freed up to start a new business.

The impact of digital sector businesses on the digital economy and consumers is difficult to predict. Businesses in the digital sector can scale rapidly due to digital market characteristics. Therefore it is important to consider:

• the type of digital sector businesses - some may be focused on incremental innovations, while others constitute innovative breakthroughs that create new markets.
• survival rates of new digital businesses.

We note that one possible reason for the high number of business births is that the UK has an underlying regulatory framework directly affecting businesses that makes it easy to start and operate a business (see World Bank ‘ease of doing business’ indicator in 2019 where the UK has a rank of 8^{[footnote 5]}; this indicator is currently being revised into a measure for a ‘business enabling environment, which we will monitor in future).

3. Consumers trust they are treated fairly online and can exercise choice over the services they access

Consumer choice is particularly difficult to measure in digital markets with structures that tend to favour large incumbent businesses, e.g. in search and social media, and where there are barriers to switching between services. It is also difficult to measure in settings where consumers do not pay with money but rather with data and attention. We conducted a demographically representative survey of UK consumers in 2021, and found that 47% of people said they felt they have lots of choice between new and innovative digital products (e.g., social media platforms, search engines, comparison websites) that they want to use and 50% said so in 2022 (see Table 3 at the end of this page). Noting the limitations of self-reported metrics (e.g. public attitudes being affected by external shocks) we will complement our understanding with other data sources seeking to understand consumer choice in digital settings^{[footnote 6]}.

Consumers having choice between goods and services is a critical underpinning of a competitive economy. Consumer choice drives innovation because the act of choosing better options between alternatives forces markets to respond by producing new and better digital products and services. In turn, this competition between firms to produce better choices also drives economic growth. Effective choice between products and services is key to make sure that consumers can access fair prices and the best outcomes online.

4. Businesses and other organisations are able to use data innovatively

Data access and use is now essential for economic growth, research, adoption of innovations and it drives productivity. While the UK data economy represented 6.5% of GDP in 2020 and 2021, this underplays its critical role in developing and using digital technologies such as AI, cloud and quantum technologies, and bulk data analysis is the basis of much scientific discovery. All significant policy decisions on data require consideration of the balance between security, growth/innovation and individual rights.

A range of measures around businesses’ use of data and technology exist, which can provide insights into whether or not UK businesses are using data innovatively. It is important to note that the majority of UK businesses (an estimated 85%) reported handling digitised data in 2022 (Business Data Survey 2022). For this 2023 OMF, we note that 43% of businesses that use digitised data and think that data has become more readily available in the last 3 years agree this has led their business to innovate and perform new functions in 2022.

This moves on from the measure cited in the 2022 OMF, assessing the percentage of businesses who use digital data who think data has become more readily available. 54% thought this in 2021, referring to a period of data becoming more available over the last 10 years and 37% thought this in 2022, referring to a period of data becoming more available over the last 3 years. Businesses that conduct data-driven activities need to be able to access and use data in line with data protection regulations. Businesses that use data effectively are likely to innovate and generate new products and services. Therefore, they are a fundamental part of the digital economy.

There are many ways that businesses can use data innovatively, such as using artificial intelligence to gain insights. Businesses that are investing in skills and training may be more likely to be using data innovatively. With this rationale, we also look at metrics that track data skills over time from the UK Business Data Survey (82% of businesses that use digital data agreed they have sufficient data skills to meet their needs in 2022) or other sources.

Keeping the UK safe and secure online

Key findings:

• on the objective of citizen empowerment online and protection from harms, the percentage of UK adults who disagree that they feel safe and secure online from harms has increased since last year.
• on the objective for organisations to have the capabilities and resilience to preserve their digital security, there was an increase in the percentage of businesses that have taken action on 5 or more of the ten steps outlined in the government’s 10 Steps to Cyber Security guidance between 2022 and 2023.
• metrics to track the security of new products and services and the security of UK networks and critical infrastructure are under development.

1. Citizens are empowered to be safe online, and trust they are protected from online harms beyond their control

In order to measure citizens’ empowerment and feeling trusted to be protected from online harms, we propose to look at perceptions of being safe online. Survey findings show that 45% of UK adults disagree that they feel safe and secure online from harms like cyber-attacks, fraud and scams in 2022, a rise from 38% in 2021 (see Table 4). We would expect this number to decrease if citizens feel more empowered online and trust they were protected from online harms.

In the OMF published in 2022, we suggested looking at the reported experiences of online harms in the last 12 months based on an Ofcom survey and at reports of unauthorised access to personal information based on the Crime Survey for England and Wales. These survey statistics constitute self-reported measures of online harms, which may be underreported or inaccurate.

Empowerment could also take the form of citizens having access to avenues of redress or complaints in digital settings; for example, by being able to make a complaint or escalate an issue, with some means of resolution. As discussed in the summary of stakeholder responses to the OMF 2022, consumer complaints data would be a useful source of information to understand if such processes exist, and whether/how they are used. As a source for this information, we suggest looking at corporate transparency reports, in which companies publish data about requests for user data, demands to remove content, and content-takedowns related to breaches of intellectual property law or terms of service.

Transparency reporting requirements should improve standardised information reporting formats and predictable environments, which should lead to greater user trust (though currently corporate transparency reporting fails to meet transparency standards^{[footnote 7]}. The Online Safety Bill will create new transparency reporting requirements, meaning large online companies will need to publish more information about how they are tackling online harms and the effectiveness of their safety measures^{[footnote 8]}.

2. Organisations have the capabilities and resilience to preserve their digital security, and security is factored into new products and services from the outset

Organisations have the capabilities and resilience to preserve their digital security

A good insight into cyber resilience comes from understanding whether UK organisations have undertaken measures to protect themselves to increase cyber security. This is because, even if we cannot directly attribute a rise or fall in cybersecurity breaches to the use of such measures, we can presume that having rules and controls in place would logically lead to increased security, and therefore fewer vulnerabilities that can be exploited. According to the Cyber Security Breaches Survey 2023, 37% of businesses and 30% of charities have undertaken action on 5 or more of the ten steps outlined in the government’s 10 Steps to Cyber Security guidance^{[footnote 9]}. This percentage increased with statistical significance for businesses from 29% in 2022 but stayed similar for charities (25% in 2022)^{[footnote 10]}.

Additionally, we may look at the number of cyber security breaches faced by UK organisations in a given year. 32% of businesses in 2023, a fall from 39% in 2022 and 2021, and 24% of charities in 2023, a fall from 30% in 2022 after a rise from 26% in 2021, reported having any kind of cyber security breach or attack in the last 12 months. However, using incidents as our metric for understanding digital security is problematic - these numbers do not tell us about cyber security breaches which may have occurred but were missed or were not reported. For the same reason, organisations that increase their ability to detect attacks by adopting increased security measures may record more breaches - which would indicate a false positive trend - even if they are more resilient against the negative impacts of those breaches. At the same time, with the expansion of digital products and services, the volume of incidents overall increases while digital security levels stay the same.

In order to have a better understanding of digital security across UK organisations, we would want to understand which businesses follow which rules, as well as which sectors those businesses are in. This would also help us better understand the impact of cybersecurity breaches, as it is important to note that cyber breaches can have an impact on individuals and businesses alike.

Figure 2. Percentage of businesses and charities that have undertaken action on 5 or more of the ten steps outlined in the government’s 10 Steps to Cyber Security guidance

Security is factored into new products and services from the outset

There is an overlap between the cyber security of individual products (i.e. consumer devices that are connected to the internet) and overall security of devices used within organisations. As with organisational cyber security, product and service security has similar measurement challenges. We propose to monitor the level of compliance with the three security requirements set out as part of the product security regime formed by the Product Security and Telecommunications Infrastructure Act 2022 and the draft Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023, which are to: (1) ban on universal default or easily guessable passwords, (2) require manufacturers to publish a point of contact information so security issues can be reported to them, and (3) require transparency about the length of time for which the product will receive security updates. These security requirements as well as the Code of Practice for Consumer IoT Security^{[footnote 11]} seek to increase the cyber security of consumer connectable devices. Once active enforcement of the PSTI regulatory regime starts on 29 April 2024, more data on rates of non-compliance is going to be available.

We found that measuring the incidence rate or prevalence of product security breaches (i.e. exploitation of device vulnerabilities) does not tell us about breaches that were not spotted; there are times when people do not know that their products have been exploited which leads to underreporting. At the same time, we expect the consumer connectable (IoT) device market to grow significantly, and this may mean that incidents and reporting of breaches increase, which makes it difficult to measure the impact of regulatory intervention.

3. The security of UK networks and critical infrastructure is protected

For telecoms and other parts of digital infrastructure, it would be good to measure whether digital infrastructure operators are following security guidance and measures^{[footnote 12]}. Unfortunately, the two measures that were proposed in the OMF 2022 from the Post-Implementation Review 2020 of the NIS Regulations were either based on a very small sample and/or not comparable to the measures shown in the newer Post-Implementation Review of 2022. The government plans to develop new measures to use in this area in the near future.

Measuring digital infrastructure and network security presents similar challenges to measuring both device and organisation-level security. As with the above objectives, network security incidents can increase over time as technologies evolve and new threats emerge, which makes it difficult to measure the impact of new cybersecurity regulation, guidance or tools. The 2022 OMF mentioned that the number of reported security incidents from telecoms providers was 532 in 2020. Ofcom has temporarily discontinued tracking this metric because of changes to security reporting requirements.

Promoting a flourishing democratic society

Key findings:

• our measure around whether digital technologies support democratic engagement, preserve freedom of expression and human rights, the UK’s Freedom of the Internet score, has gradually increased over the last five years.
• on the objective for the UK’s media and press sectors to be able to flourish online, we have seen gradual increases in digital advertising spend compared to a fall in print advertising spend.
• concerning the objective of responsible data use and privacy, the percentage of people who ‘highly’ trust companies and organisations storing and using their personal information has decreased between 2018 and 2021.

1. Digital technologies support democratic engagement, preserve freedom of expression and human rights

Digital technologies can support democracy in a number of ways, including enabling greater access to information and facilitating citizen participation in decision-making. A combination of metrics that show these ways could provide a good insight into how digital technologies are supporting democracy within the UK. The 2022 OMF suggested the Freedom on the Net Index score for the UK, a composite indicator that contains many of the relevant elements of digital democracy, such as obstacles to access, limits to content and violations to user rights described above^{[footnote 13]}. This indicator had a UK score of 77/100 (Free) in 2018 and 2019, 78/100 in 2020 and 2021 and 79/100 in 2022 (see Table 6).

An important insight can also be gained from the extent of the government’s use of digital technologies to enable the development of people-centric and user-driven policies. The UK is a frontrunner in government-led work to support data sharing, digitalising public services, and being user and data driven, including on open data access^{[footnote 14]}. The OECD Digital Government Index (DGI) benchmarks the comprehensiveness of digital government strategies and initiatives by assessing the presence of a whole-of-government approach to adopting digital technologies, where the UK had a score of 0.74 out of 1^{[footnote 15]} in 2019, ranking 2nd out of 38 OECD countries.

More broadly, subject to data quality and availability, whether and how digital technologies support democracies could be measured by the level of digital literacy and access to information by the general population, the level of engagement and participation of citizens in democratic processes through digital technologies and the level of transparency and accountability within government institutions, as facilitated by digital technologies.

2. UK’s media and press sectors are able to flourish online

A flourishing news media and press sector is a key element of a healthy democracy as these organisations are uniquely placed to undertake vital investigative journalism and scrutiny of public institutions. In order to measure media and press sector growth and sustainability, one can look at the extent to which these organisations are able to generate revenue from online advertising, subscriptions, and other digital revenue streams. We suggest looking at annual advertising expenditure reports that set out digital advertising spend across regional and national news publishers^{[footnote 16]}. As shown in Figure 3, while having gradually increased from 247.1 million per year in 2011 to 634.8 million in 2022, digital advertising spend does not currently make up for significant declines in advertising spend in the print part of the sector (see also Table 7). Publishers’ financial statements, where publicly available, can also provide useful insights for individual businesses against this metric. One of the metrics proposed in the 2022 OMF, the percentage of UK adults paying for news online^{[footnote 17]}, can serve as an additional partial proxy in this context.

As proposed in the OMF 2022, we can track the percentage of UK adults accessing news online, including social media, but this focuses on readership levels and does not take organisational sustainability into account directly (see above). This metric was 74% in 2023 and 73% in 2022; higher than print, TV and social media separately.

Further measures can include the level of competition and diversity within media and press sectors online. This could be measured by evaluating the number and type of media and press organisations operating online - and the geographical spread of their coverage, including identifying areas of the UK that have no local coverage. One can also investigate the extent to which these organisations are able to operate online without undue interference or censorship from the government or other actors. For global comparison, the UK ranks 26 out of 180 countries in 2023, compared to 24 in 2022 and 33 in 2021 according to the Reporters Without Borders Index^{[footnote 18]}. Finally, the level of digital literacy and access among the general population can be useful since this can impact the ability of media and press organisations to reach and engage with audiences online - as can public trust in the news, which research has shown to be in decline^{[footnote 19]}. Reuters found that those with higher news literacy levels tend to consume news from a wider range of sources{^20].

Figure 3. Print versus digital advertising spend across UK newsbrands

3. UK citizens’ data will be used responsibly and their privacy preferences will be upheld

As discussed throughout this publication, data protection and privacy measures are a key input to consumer trust in digital settings more generally, and contribute to outcomes in consumer choice and perceptions of online safety.

The 2022 OMF contained a metric from the Information Commissioner’s Office Trust and Confidence report: the percentage of people who ‘highly’ trust companies and organisations storing and using their personal information was 34% in 2018, slightly decreased to 32% in 2019 and further decreased to 27% in 2020. The percentage for 2021 is similar to the previous year, at 28%.

This metric measures attitudes towards companies and organisations storing and using personal information, and does not measure actual experiences of privacy breaches. The level of protection afforded to personal data online can be measured through the number of data breaches or unauthorised data access incidents, evaluating the strength of data protection laws, and assessing the transparency of online data collection practices - although such measures rely on reported data and have similar limitations as other metrics cited throughout this publication.

While there is literature suggesting that individuals have very context-driven privacy preferences - and that some people may not care very much about data privacy - the Trust and Confidence report also contains a useful measure showing that UK adults care about data privacy: When asked “how much do you agree or disagree that ‘it is important that my personal information is protected when I share it with companies and organisations’?” 75% agreed in 2018, and 80% agreed in 2019.

This question was not asked in 2020. In 2021, the question was asked, “thinking generally about the overall trust and confidence that you have in companies and organisations storing and using your personal information, please tell us how much you agree or disagree with the following” - where 77% of respondents agreed that “protecting my personal information is essential to me”.

4. Next steps

Understanding how digital economy issues fit together and how interventions can address these issues will be critical for the government to maximise the benefits society gets from digital technologies. The OMF is intended as a strong signal to show that we are actively listening to the debate and participating in tricky discussions on measuring new concepts and issues. These publications are as much about creating baselines and monitoring progress/impact against stated objectives, as well as to engage stakeholders in a conversation about the direction of where digital regulation is heading.

Annex A: summary of key metrics

Promoting competition and innovation

Table 1. Digital Sector Business turnover (£ million) deflated to 2019 prices; and the % of digital sector turnover accounted for by SMEs, 2011 - 2022, UK

Source: DCMS data tables.

year	2011	2012	2013	2014	2015	2016	2017	2018	2019	2020	2021	2022
Percentage of Digital sector turnover generated by SMEs	42.3	43.0	42.6	43.4	44.4	43.8	46.1	46.5	46.4	45.3	42.8	42.3
Total Digital sector turnover by SMEs	117,534	122,838	122,099	125,089	133,392	134,928	152,644	158,144	164,262	160,873	157,400	158,649
Total Digital sector turnover, all businesses	277,552	285,452	286,737	288,182	300,423	308,268	331,102	340,289	353,706	355,035	367,936	374,985

Table 2. Business births and deaths in the digital sector and wider economy, 2011 - 2021, UK

Source: ONS data.

year	2011	2012	2013	2014	2015	2016	2017	2018	2019	2020	2021
digital sector business births	28022	27039	35251	35594	38095	35197	33077	34217	33133	25284	23866
% digital business births of all UK business births	10.8	10.1	10.2	10.2	10.1	8.5	8.8	9.3	8.5	7.1	6.6
digital sector business deaths	19103	21553	21054	22455	24878	25318	28053	27170	27403	33468	38107
% digital business deaths of all UK business deaths	8.3	8.6	8.9	9.1	8.9	9.0	8.2	8.7	9.0	11.2	11.6

Table 3. Percentage of people that agree they felt they have lots of choice between new and innovative digital products and services that they want to use, 2021 + 2022

Source: Public Attitudes to Digital Regulation Tracker Survey.

year	2021	2022
% people who said they felt they had lots of choice between new and innovative digital products	47	50

Keeping the UK safe and secure online

Table 4. Percentage of people that disagree they feel safe and secure online from harms, 2021 and 2022

Source: Public Attitudes to Digital Regulation Tracker Survey.

year	2021	2022
% people that disagree they feel safe and secure online from harms	38	45

Table 5. Percentage of businesses and charities that have undertaken action on 5 or more of the ten steps outlined in the government’s 10 Steps to Cyber Security guidance, 2022 and 2023

Source: Cyber Security Breaches Survey.

year	2022	2023
% businesses	39	32
% charities	30	24

Promoting a flourishing democratic society

Table 6. Freedom on the Net Index score for the UK, 2019-2023

Source: Freedom House.

year	2018	2019	2020	2021	2022
freedom on the Net Index score UK	77	77	78	78	79

Table 7. Print versus digital advertising spend across UK newsbrands, 2011-2023 (with 2023-24 forecasts)

Source: Advertising Association/WARC Expenditure Report 2023.

year	2011	2012	2013	2014	2015	2016	2017	2018	2019	2020	2021	2022	2023 (forecast)	2024 (forecast)
print ad spend (millions)	2955	2654	2414	2236	1980	1692	1437	1278	1160	729	737	697	623	566
digital spent ad spend (millions)	247	283	323	388	419	428	493	528	556	485	618	635	636	647

Table 8. Percentage of people who ‘highly’ trust companies and organisations storing and using their personal information, 2018-2021

Source: ICO, Information Rights Strategic Plan: Trust and Confidence.

year	2018	2019	2020	2021
% people who ‘highly’ trust companies and organisations storing and using their personal information	34	32	27	28

1. Please note that ‘revenue’ and ‘turnover’ are used interchangeably throughout this report. ↩

2. The definition of the digital sector is based on the following Standard Industrial Classification (SIC) code sub-sectors: Manufacturing of electronics and computers, Wholesale of computers and electronics, Publishing (excluding translation and interpretation activities), Software publishing, Film, TV, video, radio and music, Telecommunications, Computer programming, consultancy and related activities, Information service activities and Repair of computers and communication equipment. ↩

3. The 2019 figure shown in the 2022 OMF has been revised, based on a new calculation using chained volume measures. ↩

4. The Herfindahl-Hirschman Index looks at the size of companies relative to the size of the sector. ↩

5. World Bank Ease of Doing Business Index. Note, rank 1 = most business friendly regulations ↩

6. For example see ‘Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites’ , Princeton University, September 2019, which finds growing evidence of the negative impact of exploitative online choice architecture practices. ↩

7. See Urman, Aleksandra and Makhortykh, Mykola. How transparent are transparency reports? Comparative analysis of transparency reporting across online platforms. In Telecommunications Policy. ↩

8. Online Safety Bill: Ofcom’s roadmap to regulation and the government report on transparency reporting in relation to online harms - GOV.UK ↩

9. See Cyber Essentials and 10 Steps to Cyber Security guidance, which aim to summarise what organisations should do to protect themselves. These include but are not limited to malware protection, password policies, network firewalls and restricted IT admin rights. ↩

10. In 2023, the mapping was changed for how the questions relate to the 10 Steps. The revised mapping has been retrospectively applied to the 2022 results. In 2021, NCSC updated the 10 Steps guidance so percentages for previous years are not comparable. ↩

11. Code of Practice for Consumer IoT Security - GOV.UK ↩

12. For this objective, we are focusing on the security of network infrastructure, i.e. preventing incidents from occurring, rather than resilience, i.e. developing mechanisms to cope with incidents that have occurred. ↩

13. It is worth noting that global internet freedom declined for the 12th consecutive year of Freedom of the Internet reporting (2022). ↩

14. IDRC - CRDI The State of Open Data: Histories and Horizons ↩

15. The DGI is a composite index that takes values from 0 to 1, where 1 indicates the highest digital government maturity and 0 indicates low and/or fragmented progress across organisations. ↩

16. The Advertising Association/WARC’s annual advertising expenditure reports demonstrated a decline in ad spend across newsbrands (print and digital) from c.£3 billion in 2011 to c.£1.3 billion in 2022. ↩

17. According to the Reuters Institute’s Digital News Report 2023, the percentage of UK adults paying for news online was 9% in 2022 and remains at that level in 2023. ↩

18. This is based on measuring the legislative and regulatory environment for journalists, press autonomy, and dynamics of media ownership. ↩

19. Reuters’ Digital News Report 2023 shows that the proportion of people in the UK that trust ‘most news most of the time’ has fallen from 51% in 2015 to 33% in 2023. ↩