Online Safety Act 2023

7 Providers of user-to-user services: duties of care

(1) Subsections (2) to (6) apply to determine which of the duties set out in this Chapter (and, in the case of combined services, Chapter 3) must be complied with by providers of regulated user-to-user services.

(2) All providers of regulated user-to-user services must comply with the following duties in relation to each such service which they provide—

(a) the duties about illegal content risk assessments set out in section 9,

(b) the duties about illegal content set out in section 10(2) to (8),

(c) the duty about content reporting set out in section 20,

(d) the duties about complaints procedures set out in section 21,

(e) the duties about freedom of expression and privacy set out in section 22(2) and (3), and

(f) the duties about record-keeping and review set out in section 23(2) to (6).

(3) Additional duties must be complied with by providers of particular kinds of regulated user-to-user services, as follows.

(4) All providers of regulated user-to-user services that are likely to be accessed by children must comply with the following duties in relation to each such service which they provide—

(a) the duties about children’s risk assessments set out in section 11, and

(b) the duties to protect children’s online safety set out in section 12(2) to (13).

(5) All providers of Category 1 services must comply with the following duties in relation to each such service which they provide—

(a) the duty about illegal content risk assessments set out in section 10(9),

(b) the duty about children’s risk assessments set out in section 12(14),

(c) the duties about assessments related to adult user empowerment set out in section 14,

(d) the duties to empower adult users set out in section 15,

(e) the duties to protect content of democratic importance set out in section 17,

(f) the duties to protect news publisher content set out in section 18,

(g) the duties to protect journalistic content set out in section 19,

(h) the duties about freedom of expression and privacy set out in section 22(4), (6) and (7), and

(i) the duties about record-keeping set out in section 23(9) and (10).

(6) All providers of combined services must comply with the following duties in relation to the search engine of each such service which they provide—

(a) if the service is not a Category 2A service and is not likely to be accessed by children, the duties set out in Chapter 3 referred to in section 24(2);

(b) if the service is not a Category 2A service and is likely to be accessed by children, the duties set out in Chapter 3 referred to in section 24(2) and (4);

(c) if the service is a Category 2A service not likely to be accessed by children, the duties set out in Chapter 3 referred to in section 24(2) and (5);

(d) if the service is a Category 2A service likely to be accessed by children, the duties set out in Chapter 3 referred to in section 24(2), (4) and (5).

(7) For the meaning of “likely to be accessed by children”, see section 37.

(8) For the meaning of “Category 1 service”, see section 95 (register of categories of services).