Online Safety Act 2023

231 “Proactive technology” U.K.

(1) In this Act “proactive technology” means—

(a) content identification technology,

(b) user profiling technology, or

(c) behaviour identification technology,

but this is subject to subsections (3) and (7).

(2) “Content identification technology” means technology, such as algorithms, keyword matching, image matching or image classification, which analyses content to assess whether it is content of a particular kind (for example, illegal content).

(3) But content identification technology is not to be regarded as proactive technology if it is used in response to a report from a user or other person about particular content.

(4) “User profiling technology” means technology which analyses (any or all of)—

(a) relevant content,

(b) user data, or

(c) metadata relating to relevant content or user data,

for the purposes of building a profile of a user to assess characteristics such as age.

(5) Technology which—

(a) analyses data specifically provided by a user for the purposes of the provider verifying or estimating the user’s age in order to decide whether to allow the user to access a service (or part of a service) or particular content, and

(b) does not analyse any other data or content,

is not to be regarded as user profiling technology.

(6) “Behaviour identification technology” means technology which analyses (any or all of)—

(a) relevant content,

(b) user data, or

(c) metadata relating to relevant content or user data,

to assess a user’s online behaviour or patterns of online behaviour (for example, to assess whether a user may be involved in, or be the victim of, illegal activity).

(7) But behaviour identification technology is not to be regarded as proactive technology if it is used in response to concerns identified by another person or an automated tool about a particular user.

(8) “Relevant content” means—

(a) in relation to a user-to-user service, content that is user-generated content in relation to the service;

(b) in relation to a search service, the content of websites and databases capable of being searched by the search engine;

(c) in relation to an internet service within section 80(2), content that is provider pornographic content in relation to the service.

(9) “User data” means—

(a) data provided by users, including personal data (for example, data provided when a user sets up an account), and

(b) data created, compiled or obtained by providers of regulated services and relating to users (for example, data relating to when or where users access a service or how they use it).

(10) References in this Act to proactive technology include content identification technology, user profiling technology or behaviour identification technology which utilises artificial intelligence or machine learning.

(11) Accredited technology that may be required to be used in relation to the detection of terrorism content or CSEA content (or both) by a notice under section 121(1) is an example of content identification technology.

(12) The reference in subsection (8)(b) to a search service includes a reference to the search engine of a combined service.

(13) In this section—

• “accredited” technology has the same meaning as in Chapter 5 of Part 7 (see section 125(12));

• “illegal content”, “terrorism content” and “CSEA content” have the same meaning as in Part 3 (see section 59);

• “user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

Commencement Information

I1 S. 231 in force at Royal Assent, see s. 240(z5)