Evolving Risks And Legal Challenges Relating To Online Harm - Reflections From A Global Liability Defence Panel

Against the backdrop of accelerating regulatory change and rising claimant activity, online harm is no longer a fringe issue. It is fast becoming an area of exposure for insurers, corporates and their advisers, cutting across casualty, product liability, cyber and directors’ and officers’ (D&O) risk. 

On 10 June 2026 Kennedys global liability defense group shared their perspectives on how the concept of online harm is evolving, what risks are crystallising, and how defendants should respond.

Here we provide an overview of some of the key areas of discussion from the discussion.

Key Takeaways

• Online harm is evolving from a regulatory issue into a significant liability exposure across multiple lines of business.
• Claimants are alleging psychiatric injury, addictive design and failures to remove harmful content, driving a growing volume of litigation worldwide.
• Regulators in the UK, Australia and elsewhere are placing greater responsibility on platforms to identify, prevent and mitigate foreseeable harms.
• Organisations, insurers and boards should review governance, risk management and insurance arrangements as online harm exposures continue to develop.

In Depth

What is “online harm”?

There remains no universally accepted definition of online harm, but the panel broadly agreed that it encompasses:

• Physical and psychological injury arising from digital environments, including social media, forums, gaming platforms and messaging services.
• Conduct facilitated or amplified online, rather than harm caused purely by the technology itself.
• A wide spectrum of harm, including:
• Harassment, bullying and stalking
• Exposure to harmful or age-inappropriate content
• Exploitation, including sexual exploitation
• Emerging categories such as “addictive design” or algorithmic amplification

Crucially, the panel emphasised that online harm is inherently subjective and highly context dependent. The same content or interaction may be benign, or even trivial, for one individual, but deeply harmful for another. This variability presents a fundamental challenge for both regulators and defendants.

A key theme across jurisdictions is that online harm is not purely reputational or economic; it is increasingly framed as giving rise to recognisable personal injury, including psychiatric injury and, in some cases, physical consequences.

What is the current lay of the land?

The regulatory landscape remains fragmented and jurisdiction-specific, but there is a clear direction of travel toward greater platform accountability and proactive harm prevention.

The UK is moving toward a duty-based regulatory model, placing obligations on platforms to identify and mitigate harm. There is an increasing focus on children’s safety, illegal and harmful content and platform governance and systems design. The regulatory framework is supported by a regulator with enforcement and fining powers.

From a civil liability perspective, the UK remains relatively conservative, but there is growing pressure to test the boundaries of negligence in the online harm context.

In the US, plaintiffs’ efforts to hold social media companies accountable were, for decades, blocked by Section 230 of the Communications Decency Act. In recent years, however, plaintiffs have increasingly sought to avoid those barriers by focusing not on the content itself, but on the design of the platforms, including allegations that features such as recommendation systems, autoplay and engagement-based design are addictive and harmful to users. There are now reported to be more than 10,000 related claims or plaintiffs in the US. Recent first-instance verdicts in P.F., et al. v Meta Platforms, Inc., et al. in California and State of New Mexico, ex rel. v Meta Platforms, Inc., et al. in New Mexico have added momentum to social media harm litigation, although both remain subject to further challenge. Meta and YouTube are appealing the California addictive design verdict, while the New Mexico proceedings have moved into a remedies phase focused on alleged public nuisance and potential platform changes.

Australia has adopted a more interventionist regulatory approach, particularly in relation to online safety and harmful content removal. The regulator has direct powers to compel removal of harmful material and there is also a growing willingness to explore civil liability pathways, particularly where harm to minors is involved. Australia is notable for its relatively robust enforcement posture, which may act as a bellwether for other common law jurisdictions.

What sort of cases are emerging?

Across all three jurisdictions, the panel highlighted a clear shift from theoretical risk to active claims development. Key categories include:

• Psychiatric injury claims arising from cyberbullying, harassment or prolonged exposure to harmful content
• “Addictive design” litigation, alleging that platforms are engineered to encourage compulsive use, particularly among children and young people
• Failure to remove harmful content, following reports or flagging
• Facilitation claims, where platforms are alleged to have enabled harmful conduct by third parties
• Data and privacy breaches, where distress and psychological harm are central to the claim
• Serious injury claims in extreme cases

Another developing issue is whether online platforms could be characterised as defective products rather than merely service providers. Claimants, particularly in the US, have sought to frame platform design, algorithms and engagement features as creating foreseeable risks of harm. This argument is being tested in the US multidistrict litigation in California, where claimants allege that social media platforms' design features and recommendation algorithms contribute to foreseeable harm. By contrast, the UK and Europe have generally favoured a more proactive regulatory approach, imposing duties on platforms through measures such as the UK’s Online Safety Act 2023 and the EU's Digital Services Act, rather than the traditionally litigation-led approach seen in the US.

The EU's revised Product Liability Directive (PLD), which expressly extends the product liability regime to software and certain digital products, may add momentum to these arguments and further blur the lines between product liability, negligence and regulatory enforcement. Given that children and teenagers are foreseeable users of many social media and online platforms, organisations may face increased scrutiny as to whether their products adequately account for the vulnerabilities and behaviours of those user groups. The revised PLD also expressly includes medically recognised damage to psychological health within the scope of compensable damage. While some Member States have already recognised psychological injury within their domestic product liability regimes, the new PLD harmonises this position across the EU and reflects the growing significance of harms arising in digital environments. The question of whether an AI system is as safe as persons are reasonably entitled to expect is likely to be informed, at least in part, by compliance with the requirements of the AI Act. Where harm arises from user-generated content, platform operators may seek to rely on the conditional liability exemptions preserved by the Digital Services Act.

Looking ahead, the panel also identified a likely expansion into D&O exposure, particularly in the UK, driven by the Online Safety Act 2023 and the broader shift toward governance-based accountability.

Who is responsible for protecting future generations?

Perhaps the most contested question is where responsibility ultimately lies. The panel identified a shifting balance between stakeholders:

• Platforms are increasingly expected to design safer systems and proactively mitigate harm
• Regulators are taking a more assertive role in setting and enforcing standard
• Governments are expanding legislative frameworks, particularly in relation to children’s online safety
• Parents and educators are still viewed as key, but no longer the primary line of defence
• Insurers and corporates are facing pressure to influence behaviour through underwriting, governance and risk management.