Online Safety Act 2023

Interpretation U.K.

226 “Provider” of internet service U.K.

(1) This section applies to determine who is the “provider” of an internet service for the purposes of this Act.

User-to-user services (other than combined services)

(2) The provider of a user-to-user service is to be treated as being the entity that has control over who can use the user-to-user part of the service (and that entity alone).

(3) If no entity has control over who can use the user-to-user part of a user-to-user service, but an individual or individuals have control over who can use that part, the provider of the service is to be treated as being that individual or those individuals.

Search services

(4) The provider of a search service is to be treated as being the entity that has control over the operations of the search engine (and that entity alone).

(5) If no entity has control over the operations of the search engine, but an individual or individuals have control over those operations, the provider of the search service is to be treated as being that individual or those individuals.

Combined services

(6) The provider of a combined service is to be treated as being the entity that has control over both—

(a) who can use the user-to-user part of the service, and

(b) the operations of the search engine,

(and that entity alone).

(7) If no entity has control over the matters mentioned in paragraphs (a) and (b) of subsection (6), but an individual or individuals have control over both those matters, the provider of the combined service is to be treated as being that individual or those individuals.

Internet services other than user-to-user services or search services

(8) The provider of an internet service, other than a user-to-user service or a search service, is to be treated as being the entity that has control over which content is published or displayed on the service.

(9) If no entity has control over which content is published or displayed on such an internet service, but an individual or individuals have control over which content is published or displayed, the provider of the service is to be treated as being that individual or those individuals.

Machine-generated services

(10) The provider of an internet service that is generated by a machine is to be treated as being the entity that controls the machine (and that entity alone).

(11) If no entity controls the machine, but an individual or individuals control it, the provider of the internet service is to be treated as being that individual or those individuals.

Interpretation

(12) A person who provides an access facility in relation to a user-to-user service, within the meaning of section 146, is not to be regarded as a person who has control over who can use the user-to-user part of the service for the purposes of this section.

(13) In this section “operations of the search engine” means operations which—

(a) enable users of a search service or a combined service to make search requests, and

(b) generate responses to those requests.

(14) In this section “published or displayed” is to be construed in accordance with section 79(6).

(15) For the purposes of subsections (8) and (9), a person who makes available on a service an automated tool or algorithm by means of which content is generated is to be regarded as having control over content so generated.

Commencement Information

I1 S. 226 in force at Royal Assent, see s. 240(z5)

227 “User”, “United Kingdom user” and “interested person” U.K.

(1) For the purposes of this Act a user is a “United Kingdom user” of a service if—

(a) where the user is an individual, the individual is in the United Kingdom;

(b) where the user is an entity, the entity is incorporated or formed under the law of any part of the United Kingdom.

(2) For the purposes of references in this Act to a user of a service it does not matter whether a person is registered to use a service.

(3) References in this Act to a user of a service do not include references to any of the following when acting in the course of the provider’s business—

(a) where the provider of the service is an individual or individuals, that individual or those individuals;

(b) where the provider is an entity, officers of the entity;

(c) persons who work for the provider (including as employees or volunteers);

(d) any other person providing a business service to the provider such as a contractor, consultant or auditor.

(4) In subsection (3) “acting in the course of the provider’s business” means (as the case may be)—

(a) acting in the course of the provider’s business of providing the service, or

(b) acting in the course of a business, trade, profession or other concern—

(i) carried on (whether or not for profit) by the provider of the service, and

(ii) for the purposes of which the service is provided.

(5) In subsections (1) to (4) “service” (except in the term “business service”) means internet service, user-to-user service or search service.

(6) In subsection (3) “officer” includes a director, manager, partner, associate, secretary or other similar officer.

(7) In this Act “interested person”, in relation to a search service or a combined service, means a person that is responsible for a website or database capable of being searched by the search engine, provided that—

(a) in the case of an individual, the individual is in the United Kingdom;

(b) in the case of an entity, the entity is incorporated or formed under the law of any part of the United Kingdom.

Commencement Information

I2 S. 227 in force at Royal Assent, see s. 240(z5)

228 “Internet service” U.K.

(1) In this Act “internet service” means a service that is made available by means of the internet.

(2) For the purposes of subsection (1) a service is “made available by means of the internet” even where it is made available by means of a combination of—

(a) the internet, and

(b) an electronic communications service.

(3) “Electronic communications service” has the same meaning as in the Communications Act (see section 32(2) of that Act).

Commencement Information

I3 S. 228 in force at Royal Assent, see s. 240(z5)

229 “Search engine” U.K.

(1) In this Act “search engine”—

(a) includes a service or functionality which enables a person to search some websites or databases (as well as a service or functionality which enables a person to search (in principle) all websites or databases);

(b) does not include a service which enables a person to search just one website or database.

(2) For the purposes of this Act, a search engine is not to be taken to be “included” in an internet service or a user-to-user service if the search engine is controlled by a person who does not control other parts of the service.

Commencement Information

I4 S. 229 in force at Royal Assent, see s. 240(z5)

230 “Age verification” and “age estimation” U.K.

(1) This section applies for the purposes of this Act.

(2) “Age verification” means any measure designed to verify the exact age of users of a regulated service.

(3) “Age estimation” means any measure designed to estimate the age or age-range of users of a regulated service.

(4) A measure which requires a user to self-declare their age (without more) is not to be regarded as age verification or age estimation.

Commencement Information

I5 S. 230 in force at Royal Assent, see s. 240(z5)

231 “Proactive technology” U.K.

(1) In this Act “proactive technology” means—

(a) content identification technology,

(b) user profiling technology, or

(c) behaviour identification technology,

but this is subject to subsections (3) and (7).

(2) “Content identification technology” means technology, such as algorithms, keyword matching, image matching or image classification, which analyses content to assess whether it is content of a particular kind (for example, illegal content).

(3) But content identification technology is not to be regarded as proactive technology if it is used in response to a report from a user or other person about particular content.

(4) “User profiling technology” means technology which analyses (any or all of)—

(a) relevant content,

(b) user data, or

(c) metadata relating to relevant content or user data,

for the purposes of building a profile of a user to assess characteristics such as age.

(5) Technology which—

(a) analyses data specifically provided by a user for the purposes of the provider verifying or estimating the user’s age in order to decide whether to allow the user to access a service (or part of a service) or particular content, and

(b) does not analyse any other data or content,

is not to be regarded as user profiling technology.

(6) “Behaviour identification technology” means technology which analyses (any or all of)—

(a) relevant content,

(b) user data, or

(c) metadata relating to relevant content or user data,

to assess a user’s online behaviour or patterns of online behaviour (for example, to assess whether a user may be involved in, or be the victim of, illegal activity).

(7) But behaviour identification technology is not to be regarded as proactive technology if it is used in response to concerns identified by another person or an automated tool about a particular user.

(8) “Relevant content” means—

(a) in relation to a user-to-user service, content that is user-generated content in relation to the service;

(b) in relation to a search service, the content of websites and databases capable of being searched by the search engine;

(c) in relation to an internet service within section 80(2), content that is provider pornographic content in relation to the service.

(9) “User data” means—

(a) data provided by users, including personal data (for example, data provided when a user sets up an account), and

(b) data created, compiled or obtained by providers of regulated services and relating to users (for example, data relating to when or where users access a service or how they use it).

(10) References in this Act to proactive technology include content identification technology, user profiling technology or behaviour identification technology which utilises artificial intelligence or machine learning.

(11) Accredited technology that may be required to be used in relation to the detection of terrorism content or CSEA content (or both) by a notice under section 121(1) is an example of content identification technology.

(12) The reference in subsection (8)(b) to a search service includes a reference to the search engine of a combined service.

(13) In this section—

• “accredited” technology has the same meaning as in Chapter 5 of Part 7 (see section 125(12));

• “illegal content”, “terrorism content” and “CSEA content” have the same meaning as in Part 3 (see section 59);

• “user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

Commencement Information

I6 S. 231 in force at Royal Assent, see s. 240(z5)

232 Content communicated “publicly” or “privately” U.K.

(1) This section specifies factors which OFCOM must, in particular, consider when deciding whether content is communicated “publicly” or “privately” by means of a user-to-user service for the purposes of—

(a) section 121 (notice to deal with terrorism content),

(b) section 136 (requirement to use proactive technology), or

(c) paragraph 13(4) of Schedule 4 (recommendation of proactive technology in codes of practice).

(2) The factors are—

(a) the number of individuals in the United Kingdom who are able to access the content by means of the service;

(b) any restrictions on who may access the content by means of the service (for example, a requirement for approval or permission from a user, or the provider, of the service);

(c) the ease with which the content may be forwarded to or shared with—

(i) users of the service other than those who originally encounter it, or

(ii) users of another internet service.

(3) The following factors do not count as restrictions on access—

(a) a requirement to log in to or register with a service (or part of a service);

(b) a requirement to make a payment or take out a subscription in order to access a service (or part of a service) or to access particular content;

(c) inability to access a service (or part of a service) or to access particular content except by using particular technology or a particular kind of device (as long as that technology or device is generally available to the public).

Commencement Information

I7 S. 232 in force at Royal Assent, see s. 240(z5)

233 “Functionality” U.K.

(1) In this Act “functionality”, in relation to a user-to-user service, includes any feature that enables interactions of any description between users of the service by means of the service, and includes any feature enabling a user to do anything listed in subsection (2).

(2) The things are—

(a) creating a user profile, including an anonymous or pseudonymous profile;

(b) searching within the service for user-generated content or other users of the service;

(c) forwarding content to, or sharing content with, other users of the service;

(d) sharing content on other internet services;

(e) sending direct messages to or speaking to other users of the service, or interacting with them in another way (for example by playing a game);

(f) expressing a view on content, including, for example, by—

(i) applying a “like” or “dislike” button or other button of that nature,

(ii) applying an emoji or symbol of any kind,

(iii) engaging in yes/no voting, or

(iv) rating or scoring content in any way (including giving star or numerical ratings);

(g) sharing current or historic location information with other users of the service, recording a user’s movements, or identifying which other users of the service are nearby;

(h) following or subscribing to particular kinds of content or particular users of the service;

(i) creating lists, collections, archives or directories of content or users of the service;

(j) tagging or labelling content present on the service;

(k) uploading content relating to goods or services;

(l) applying or changing settings on the service which affect the presentation of user-generated content on the service;

(m) accessing other internet services through content present on the service (for example through hyperlinks).

(3) In this Act “functionality”, in relation to a search service, includes (in particular)—

(a) a feature that enables users to search websites or databases;

(b) a feature that makes suggestions relating to users’ search requests (predictive search functionality).

(4) In this section “user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

Commencement Information

I8 S. 233 in force at Royal Assent, see s. 240(z5)

234 “Harm” etc U.K.

(1) This section applies for the purposes of this Act, apart from Part 10 (communications offences).

(2) “Harm” means physical or psychological harm.

(3) References to harm presented by content, and any other references to harm in relation to content, include references to harm arising or that may arise from any one or combination of the following—

(a) the nature of the content;

(b) the fact of its dissemination;

(c) the manner of its dissemination.

(4) References to harm presented by content, and any other references to harm in relation to content, include references to cumulative harm arising or that may arise in the following circumstances—

(a) where content, or content of a particular kind, is repeatedly encountered by an individual (including, but not limited to, where content, or a kind of content, is sent to an individual by one user or by different users or encountered as a result of algorithms used by, or functionalities of, a service);

(b) where content of a particular kind is encountered by an individual in combination with content of a different kind (including, but not limited to, where a kind of content is sent to an individual by one user or by different users or encountered as a result of algorithms used by, or functionalities of, a service).

(5) References to harm presented by content, and any other references to harm in relation to content, include references to harm arising or that may arise in the following circumstances—

(a) where, as a result of the content, individuals act in a way that results in harm to themselves or that increases the likelihood of harm to themselves;

(b) where, as a result of the content, individuals do or say something to another individual that results in harm to that other individual or that increases the likelihood of such harm (including, but not limited to, where individuals act in such a way as a result of content that is related to that other individual’s characteristics or membership of a group).

(6) References to a risk of harm in relation to functionalities, and references to the risk of functionalities facilitating users encountering particular kinds of content (however expressed), include references to risks arising or that may arise due to multiple functionalities which, used in combination, increase the likelihood of harm arising (for example, as mentioned in subsection (4)).

(7) References to a risk of harm, or to potential harm, are to be read in the same way as references to harm.

(8) In contexts where harm (or a risk of harm or potential harm) relates to children, subsections (4) to (5) are to be read as if they referred to children instead of individuals.

Commencement Information

I9 S. 234 in force at Royal Assent, see s. 240(z5)

235 “Online safety functions” and “online safety matters” U.K.

(1) In this Act references to OFCOM’s “online safety functions”—

(a) are references to—

(i) the functions that OFCOM have under this Act,

(ii) the functions that OFCOM have under the provisions of the Communications Act listed in subsection (2), so far as those functions relate to regulated services or Part 3 services (as the case may be), and

(iii) the functions that OFCOM have under section 3 of the Communications Act (general duties), so far as duties under that section relate to a function which is an online safety function by reason of sub-paragraph (i) or (ii);

(b) include references to OFCOM’s power to do anything appearing to them to be incidental or conducive to the carrying out of any of their functions within paragraph (a)(i) or (ii) (see section 1(3) of the Communications Act).

(2) These are the provisions of the Communications Act referred to in subsection (1)(a)(ii)—

(a) section 6 (duties to review regulatory burdens);

(b) section 7 (duty to carry out impact assessments);

(c) section 8 (duty to publish and meet promptness standards);

(d) sections 11 and 11A (duties to promote media literacy);

(e) sections 12 and 13 (Content Board);

(f) section 14(6)(a) (research about media literacy);

(g) section 14(6B) (research about users’ experience of regulated services);

(h) section 16 (consumer consultation);

(i) section 20 (advisory committees for different parts of the United Kingdom);

(j) section 21 (advisory committee on elderly and disabled persons);

(k) section 22 (representation on international and other bodies);

(l) section 26 (publication of information and advice for consumers etc).

(3) References to OFCOM’s “online safety functions” also include references to OFCOM’s duty to comply with any of the following, so far as relating to the use of a regulated service by a person who has died—

(a) a notice from a senior coroner under paragraph 1(2) of Schedule 5 to the Coroners and Justice Act 2009 in connection with an investigation into a person’s death;

(b) a request for information in connection with the investigation of a procurator fiscal into, or an inquiry held or to be held in relation to, a person’s death;

(c) a notice from a coroner under section 17A(2) of the Coroners Act (Northern Ireland) 1959 (c. 15 (N.I.)) in connection with—

(i) an investigation to determine whether an inquest into a person’s death is necessary, or

(ii) an inquest in relation to a person’s death.

(4) In this Act “online safety matters” means the matters to which OFCOM’s online safety functions relate.

(5) In subsection (3)(b) “inquiry” means an inquiry held, or to be held, under the Inquiries into Fatal Accidents and Sudden Deaths etc. (Scotland) Act 2016 (asp 2).

Commencement Information

I10 S. 235 in force at Royal Assent, see s. 240(z5)

236 Interpretation: general U.K.

(1) In this Act—

• “adult” means a person aged 18 or over;

• “audit notice” means a notice given under paragraph 4 of Schedule 12;

• “automated tool” includes bot;

• “capacity”: any reference to the capacity of a provider of a regulated service is to—

  (a)

  the financial resources of the provider, and

  (b)

  the level of technical expertise which is available to the provider, or which it is reasonable to expect would be available to the provider given its size and financial resources;

• “child” means a person under the age of 18;

• “the Communications Act” means the Communications Act 2003;

• “confirmation decision” means a notice given under section 132;

• “content” means anything communicated by means of an internet service, whether publicly or privately, including written material or messages, oral communications, photographs, videos, visual images, music and data of any description;

• “the Convention” has the meaning given by section 21(1) of the Human Rights Act 1998;

• “country” includes territory;

• “document” means anything in which information (in whatever form) is recorded;

• “encounter”, in relation to content, means read, view, hear or otherwise experience content;

• “entity” means a body or association of persons or an organisation, regardless of whether the body, association or organisation is—

  (a)

  formed under the law of any part of the United Kingdom or of a country outside the United Kingdom, or

  (b)

  a legal person under the law under which it is formed;

• “freedom of expression”: any reference to freedom of expression (except in sections 41(6)(f) and 78(2)(d)) is to the freedom to receive and impart ideas, opinions or information (referred to in Article 10(1) of the Convention) by means of speech, writing or images;

• “identifying content” means content the function of which is to identify a user of an internet service (for example, a user name or profile picture);

• “information notice” means a notice given under section 100(1) or 101(1);

• “measure”: any reference to a measure includes a reference to any system or process relevant to the operation of an internet service or any step or action which may be taken by a provider of an internet service to comply with duties or requirements under this Act;

• “notice” means notice in writing;

• “notify” means notify in writing, and “notification” is to be construed accordingly;

• “OFCOM” means the Office of Communications;

• “paid-for advertisement”: an advertisement is a “paid-for advertisement” in relation to an internet service if—

  (a)

  the provider of the service receives any consideration (monetary or non-monetary) for the advertisement (whether directly from the advertiser or indirectly from another person), and

  (b)

  the placement of the advertisement is determined by systems or processes that are agreed between the parties entering into the contract relating to the advertisement;

• “person” includes (in addition to an individual and a body of persons corporate or unincorporate) any organisation or association of persons;

• “personal data” has the meaning given by section 3(2) of the Data Protection Act 2018;

• “pornographic content” means content of such a nature that it is reasonable to assume that it was produced solely or principally for the purpose of sexual arousal;

• “processing” has the meaning given by section 3(4) of the Data Protection Act 2018;

• “provisional notice of contravention” means a notice given under section 130;

• “publicly available” means available to members of the public in the United Kingdom;

• “systems and/or processes”: any reference to systems and/or processes is to human or automated systems and/or processes, and accordingly includes technologies;

• “taking down” (content): any reference to taking down content is to any action that results in content being removed from a user-to-user service or being permanently hidden so users of the service cannot encounter it (and related expressions are to be read accordingly);

• “terms of service”, in relation to a user-to-user service, means all documents (whatever they are called) comprising the contract for use of the service (or of part of it) by United Kingdom users;

• “user-to-user part”, in relation to a user-to-user service, means the part of the service on which content that is user-generated content in relation to the service is present.

(2) The definitions of “encounter” and “person” in subsection (1) do not apply for the purposes of Part 10 (for the definition of “encounter” in that Part, see section 182(5)).

(3) References in this Act to an individual with a certain characteristic include references to an individual with a combination of characteristics.

(4) References in this Act to a kind of user-to-user service or search service (or Part 3 service) include references to user-to-user services or search services grouped together for the purposes of a risk profile prepared by OFCOM under section 98 (and references to different kinds of user-to-user services or search services (or Part 3 services) are to be read accordingly).

(5) References in this Act to content (or content of a particular kind) present or prevalent on a user-to-user service (or on a part of it), or to the presence, incidence or prevalence of content (or content of a particular kind) on a user-to-user service (or on a part of it), do not include, in the case of a user-to-user service that includes a search engine—

(a) search content, or

(b) any other content that, following a search request, may be encountered as a result of subsequent interactions with internet services.

In this subsection “search content” and “search request” have the same meaning as in Part 3 (see section 57).

(6) For the purposes of this Act—

(a) any reference to the use of or access to a service, or to content present, published or displayed on a service, is to be taken to include use of or access to the service or content on registering or on the making of a payment or on subscription;

(b) any reference to content that is made available or that may be accessed, encountered or shared, is to be taken to include content that is made available or that may be accessed, encountered or shared for a limited period of time only;

and references to restrictions on access to a service or to content are to be read accordingly.

(7) For the purposes of this Act, content that is user-generated content in relation to an internet service does not cease to be such content in relation to the service when published or displayed on the service by means of—

(a) software or an automated tool or algorithm applied by the provider of the service or by a person acting on behalf of the provider, or

(b) an automated tool or algorithm made available on the service by the provider or by a person acting on behalf of the provider.

(8) Nothing in this Act (other than section 212) affects any prohibition or restriction in relation to pornographic content, or powers in relation to such content, under another enactment or rule of law.

(9) In this section, “user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

Commencement Information

I11 S. 236 in force at Royal Assent, see s. 240(z5)

237 Index of defined terms U.K.

The following table sets out terms defined or explained for this Act or for a Part of this Act.

Term	Provision
adult	section 236
age estimation	section 230
age verification	section 230
audit notice	section 236
automated tool	section 236
capacity (of a provider)	section 236
Category 1 service	section 95(10)(a)
Category 2A service	section 95(10)(b)
Category 2B service	section 95(10)(c)
charging year (in Part 6)	section 90
child	section 236
children’s access assessment (in Part 3)	section 35
combined service	section 4(7)
the Communications Act	section 236
confirmation decision	section 236
content	section 236
content that is harmful to children (in Part 3)	section 60
the Convention	section 236
country	section 236
CSEA content (in Part 3)	section 59
document	section 236
encounter (content) (except in Part 10)	section 236
entity	section 236
freedom of expression	section 236
functionality	section 233
harm (except in Part 10)	section 234
identifying content	section 236
illegal content (in Part 3)	section 59
information notice	section 236
initial charging year (in Part 6)	section 90
interested person	section 227
internet service	section 228 (see also section 204(1))
journalistic content (in Part 3)	section 19
likely to be accessed by children (in Part 3)	section 37
measure	section 236
news publisher content (in Part 3)	section 55(8) to (10)
non-designated content that is harmful to children (in Part 3)	section 60
notice	section 236
notify, notification	section 236
OFCOM	section 236
online safety functions	section 235
online safety matters	section 235
paid-for advertisement	section 236
Part 3 service	section 4(3)
person (except in Part 10)	section 236
personal data	section 236
pornographic content	section 236
primary priority content that is harmful to children (in Part 3)	section 61
priority content that is harmful to children (in Part 3)	section 62
priority illegal content (in Part 3)	section 59
priority offence (in Part 3)	section 59
proactive technology	section 231
processing (of data)	section 236
provider	section 226
provider pornographic content (in Part 5)	section 79
provisional notice of contravention	section 236
publicly available	section 236
publicly/privately (in relation to communication of content)	section 232
published or displayed (in relation to pornographic content) (in Part 5)	section 79
recognised news publisher (in Part 3)	section 56
regulated provider pornographic content (in Part 5)	section 79
regulated search service	section 4(2)
regulated service	section 4(4)
regulated user-generated content (in Part 3)	section 55
regulated user-to-user service	section 4(2)
restricting users’ access to content (in Part 3)	section 58
search	section 57
search content	section 57
search engine	section 229
search request	section 57
search results	section 57
search service	section 3 (see also section 204(1))
systems and/or processes	section 236
taking down (content)	section 236
terms of service	section 236
terrorism content (in Part 3)	section 59
United Kingdom user	section 227
user	section 227
user-generated content (in Part 3)	section 55(3) and (4)
user-to-user part (of a service)	section 236
user-to-user service	section 3 (see also section 204(1))

Commencement Information

I12 S. 237 in force at Royal Assent, see s. 240(z5)