Online Safety Act 2023

PART 3 U.K. Providers of regulated user-to-user services and regulated search services: duties of care

CHAPTER 1 U.K. Introduction

6 Overview of Part 3 U.K.

(1) This Part imposes duties of care on providers of regulated user-to-user services and regulated search services and requires OFCOM to issue codes of practice relating to some of those duties.

(2) Chapter 2 imposes duties of care on providers of regulated user-to-user services in relation to content and activity on their services.

(3) Chapter 3 imposes duties of care on providers of regulated search services in relation to content and activity on their services.

(4) Chapter 4 imposes duties on providers of regulated user-to-user services and regulated search services to assess whether a service is likely to be accessed by children.

(5) Chapter 5 imposes duties on providers of certain regulated user-to-user services and regulated search services relating to fraudulent advertising.

(6) Chapter 6 requires OFCOM to issue codes of practice relating to particular duties and explains what effects the codes of practice have.

(7) Chapter 7 is about the interpretation of this Part, and it includes definitions of the following key terms—

• “content that is harmful to children”, “primary priority content that is harmful to children” and “priority content that is harmful to children” (see sections 60 to 62);

• “illegal content”, “priority offence”, “terrorism content”, “CSEA content” and “priority illegal content” (see section 59);

• “search content” (see section 57).

Commencement Information

I1 S. 6 in force at Royal Assent, see s. 240(4)(b)

CHAPTER 2 U.K. Providers of user-to-user services: duties of care

User-to-user services: which duties apply, and scope of duties U.K.

7 Providers of user-to-user services: duties of care U.K.

(1) Subsections (2) to (6) apply to determine which of the duties set out in this Chapter (and, in the case of combined services, Chapter 3) must be complied with by providers of regulated user-to-user services.

(2) All providers of regulated user-to-user services must comply with the following duties in relation to each such service which they provide—

(a) the duties about illegal content risk assessments set out in section 9,

(b) the duties about illegal content set out in section 10(2) to (8),

(c) the duty about content reporting set out in section 20,

(d) the duties about complaints procedures set out in section 21,

(e) the duties about freedom of expression and privacy set out in section 22(2) and (3), and

(f) the duties about record-keeping and review set out in section 23(2) to (6).

(3) Additional duties must be complied with by providers of particular kinds of regulated user-to-user services, as follows.

(4) All providers of regulated user-to-user services that are likely to be accessed by children must comply with the following duties in relation to each such service which they provide—

(a) the duties about children’s risk assessments set out in section 11, and

(b) the duties to protect children’s online safety set out in section 12(2) to (13).

(5) All providers of Category 1 services must comply with the following duties in relation to each such service which they provide—

(a) the duty about illegal content risk assessments set out in section 10(9),

(b) the duty about children’s risk assessments set out in section 12(14),

(c) the duties about assessments related to adult user empowerment set out in section 14,

(d) the duties to empower adult users set out in section 15,

(e) the duties to protect content of democratic importance set out in section 17,

(f) the duties to protect news publisher content set out in section 18,

(g) the duties to protect journalistic content set out in section 19,

(h) the duties about freedom of expression and privacy set out in section 22(4), (6) and (7), and

(i) the duties about record-keeping set out in section 23(9) and (10).

(6) All providers of combined services must comply with the following duties in relation to the search engine of each such service which they provide—

(a) if the service is not a Category 2A service and is not likely to be accessed by children, the duties set out in Chapter 3 referred to in section 24(2);

(b) if the service is not a Category 2A service and is likely to be accessed by children, the duties set out in Chapter 3 referred to in section 24(2) and (4);

(c) if the service is a Category 2A service not likely to be accessed by children, the duties set out in Chapter 3 referred to in section 24(2) and (5);

(d) if the service is a Category 2A service likely to be accessed by children, the duties set out in Chapter 3 referred to in section 24(2), (4) and (5).

(7) For the meaning of “likely to be accessed by children”, see section 37.

(8) For the meaning of “Category 1 service”, see section 95 (register of categories of services).

Commencement Information

I2 S. 7 not in force at Royal Assent, see s. 240(1)

I3 S. 7(1)-(4)(5)(a)-(e)(g)(i)(6)-(8) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(a)

8 Scope of duties of care U.K.

(1) A duty set out in this Chapter which must be complied with in relation to a user-to-user service that includes regulated provider pornographic content does not extend to—

(a) the regulated provider pornographic content, or

(b) the design, operation or use of the service so far as relating to that content.

See Part 5 for the duties which relate to regulated provider pornographic content, and the meaning of that term.

(2) A duty set out in this Chapter which must be complied with in relation to a combined service does not extend to—

(a) the search content of the service,

(b) any other content that, following a search request, may be encountered as a result of subsequent interactions with internet services, or

(c) anything relating to the design, operation or use of the search engine.

(3) A duty set out in this Chapter which must be complied with in relation to a user-to-user service extends only to—

(a) the design, operation and use of the service in the United Kingdom, and

(b) in the case of a duty that is expressed to apply in relation to users of a service, the design, operation and use of the service as it affects United Kingdom users of the service.

Commencement Information

I4 S. 8 not in force at Royal Assent, see s. 240(1)

I5 S. 8 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(b)

Illegal content duties for user-to-user services U.K.

9 Illegal content risk assessment duties U.K.

(1) This section sets out the duties about risk assessments which apply in relation to all regulated user-to-user services.

(2) A duty to carry out a suitable and sufficient illegal content risk assessment at a time set out in, or as provided by, Schedule 3.

(3) A duty to take appropriate steps to keep an illegal content risk assessment up to date, including when OFCOM make any significant change to a risk profile that relates to services of the kind in question.

(4) Before making any significant change to any aspect of a service’s design or operation, a duty to carry out a further suitable and sufficient illegal content risk assessment relating to the impacts of that proposed change.

(5) An “illegal content risk assessment” of a service of a particular kind means an assessment of the following matters, taking into account the risk profile that relates to services of that kind—

(a) the user base;

(b) the level of risk of individuals who are users of the service encountering the following by means of the service—

(i) each kind of priority illegal content (with each kind separately assessed), and

(ii) other illegal content,

taking into account (in particular) algorithms used by the service, and how easily, quickly and widely content may be disseminated by means of the service;

(c) the level of risk of the service being used for the commission or facilitation of a priority offence;

(d) the level of risk of harm to individuals presented by illegal content of different kinds or by the use of the service for the commission or facilitation of a priority offence;

(e) the level of risk of functionalities of the service facilitating the presence or dissemination of illegal content or the use of the service for the commission or facilitation of a priority offence, identifying and assessing those functionalities that present higher levels of risk;

(f) the different ways in which the service is used, and the impact of such use on the level of risk of harm that might be suffered by individuals;

(g) the nature, and severity, of the harm that might be suffered by individuals from the matters identified in accordance with paragraphs (b) to (f);

(h) how the design and operation of the service (including the business model, governance, use of proactive technology, measures to promote users’ media literacy and safe use of the service, and other systems and processes) may reduce or increase the risks identified.

(6) In this section references to risk profiles are to the risk profiles for the time being published under section 98 which relate to the risk of harm to individuals presented by illegal content.

(7) See also—

(a) section 23(2) and (10) (records of risk assessments), and

(b) Schedule 3 (timing of providers’ assessments).

Commencement Information

I6 S. 9 not in force at Royal Assent, see s. 240(1)

I7 S. 9 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(c)

10 Safety duties about illegal content U.K.

(1) This section sets out the duties about illegal content which apply in relation to regulated user-to-user services (as indicated by the headings).

All services

(2) A duty, in relation to a service, to take or use proportionate measures relating to the design or operation of the service to—

(a) prevent individuals from encountering priority illegal content by means of the service,

(b) effectively mitigate and manage the risk of the service being used for the commission or facilitation of a priority offence, as identified in the most recent illegal content risk assessment of the service, and

(c) effectively mitigate and manage the risks of harm to individuals, as identified in the most recent illegal content risk assessment of the service (see section 9(5)(g)).

(3) A duty to operate a service using proportionate systems and processes designed to—

(a) minimise the length of time for which any priority illegal content is present;

(b) where the provider is alerted by a person to the presence of any illegal content, or becomes aware of it in any other way, swiftly take down such content.

(4) The duties set out in subsections (2) and (3) apply across all areas of a service, including the way it is designed, operated and used as well as content present on the service, and (among other things) require the provider of a service to take or use measures in the following areas, if it is proportionate to do so—

(a) regulatory compliance and risk management arrangements,

(b) design of functionalities, algorithms and other features,

(c) policies on terms of use,

(d) policies on user access to the service or to particular content present on the service, including blocking users from accessing the service or particular content,

(e) content moderation, including taking down content,

(f) functionalities allowing users to control the content they encounter,

(g) user support measures, and

(h) staff policies and practices.

(5) A duty to include provisions in the terms of service specifying how individuals are to be protected from illegal content, addressing each paragraph of subsection (3), and (in relation to paragraph (a)) separately addressing terrorism content, CSEA content (see section 59 and Schedule 6) and other priority illegal content.

(6) A duty to apply the provisions of the terms of service referred to in subsection (5) consistently.

(7) A duty to include provisions in the terms of service giving information about any proactive technology used by a service for the purpose of compliance with a duty set out in subsection (2) or (3) (including the kind of technology, when it is used, and how it works).

(8) A duty to ensure that the provisions of the terms of service referred to in subsections (5) and (7) are clear and accessible.

Additional duty for Category 1 services

(9) A duty to summarise in the terms of service the findings of the most recent illegal content risk assessment of a service (including as to levels of risk and as to nature, and severity, of potential harm to individuals).

Interpretation

(10) In determining what is proportionate for the purposes of this section, the following factors, in particular, are relevant—

(a) all the findings of the most recent illegal content risk assessment (including as to levels of risk and as to nature, and severity, of potential harm to individuals), and

(b) the size and capacity of the provider of a service.

(11) In this section “illegal content risk assessment” has the meaning given by section 9.

(12) See also, in relation to duties set out in this section, section 22 (duties about freedom of expression and privacy).

Commencement Information

I8 S. 10 not in force at Royal Assent, see s. 240(1)

I9 S. 10 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(c)

User-to-user services likely to be accessed by children U.K.

11 Children’s risk assessment duties U.K.

(1) This section sets out the duties about risk assessments which apply in relation to regulated user-to-user services that are likely to be accessed by children (in addition to the duties about risk assessments set out in section 9 and, in the case of services likely to be accessed by children which are Category 1 services, the duties about assessments set out in section 14).

(2) A duty to carry out a suitable and sufficient children’s risk assessment at a time set out in, or as provided by, Schedule 3.

(3) A duty to take appropriate steps to keep a children’s risk assessment up to date, including when OFCOM make any significant change to a risk profile that relates to services of the kind in question.

(4) Before making any significant change to any aspect of a service’s design or operation, a duty to carry out a further suitable and sufficient children’s risk assessment relating to the impacts of that proposed change.

(5) Where a children’s risk assessment of a service identifies the presence of non-designated content that is harmful to children, a duty to notify OFCOM of—

(a) the kinds of such content identified, and

(b) the incidence of those kinds of content on the service.

(6) A “children’s risk assessment” of a service of a particular kind means an assessment of the following matters, taking into account the risk profile that relates to services of that kind—

(a) the user base, including the number of users who are children in different age groups;

(b) the level of risk of children who are users of the service encountering the following by means of the service—

(i) each kind of primary priority content that is harmful to children (with each kind separately assessed),

(ii) each kind of priority content that is harmful to children (with each kind separately assessed), and

(iii) non-designated content that is harmful to children,

giving separate consideration to children in different age groups, and taking into account (in particular) algorithms used by the service and how easily, quickly and widely content may be disseminated by means of the service;

(c) the level of risk of harm to children presented by different kinds of content that is harmful to children, giving separate consideration to children in different age groups;

(d) the level of risk of harm to children presented by content that is harmful to children which particularly affects individuals with a certain characteristic or members of a certain group;

(e) the extent to which the design of the service, in particular its functionalities, affects the level of risk of harm that might be suffered by children, identifying and assessing those functionalities that present higher levels of risk, including functionalities—

(i) enabling adults to search for other users of the service (including children), or

(ii) enabling adults to contact other users (including children) by means of the service;

(f) the different ways in which the service is used, including functionalities or other features of the service that affect how much children use the service (for example a feature that enables content to play automatically), and the impact of such use on the level of risk of harm that might be suffered by children;

(g) the nature, and severity, of the harm that might be suffered by children from the matters identified in accordance with paragraphs (b) to (f), giving separate consideration to children in different age groups;

(h) how the design and operation of the service (including the business model, governance, use of proactive technology, measures to promote users’ media literacy and safe use of the service, and other systems and processes) may reduce or increase the risks identified.

(7) In this section references to risk profiles are to the risk profiles for the time being published under section 98 which relate to the risk of harm to children presented by content that is harmful to children.

(8) See also—

(a) section 23(2) and (10) (records of risk assessments), and

(b) Schedule 3 (timing of providers’ assessments).

Commencement Information

I10 S. 11 not in force at Royal Assent, see s. 240(1)

I11 S. 11 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(d)

12 Safety duties protecting children U.K.

(1) This section sets out the duties to protect children’s online safety which apply in relation to regulated user-to-user services that are likely to be accessed by children (as indicated by the headings).

All services

(2) A duty, in relation to a service, to take or use proportionate measures relating to the design or operation of the service to effectively—

(a) mitigate and manage the risks of harm to children in different age groups, as identified in the most recent children’s risk assessment of the service (see section 11(6)(g)), and

(b) mitigate the impact of harm to children in different age groups presented by content that is harmful to children present on the service.

(3) A duty to operate a service using proportionate systems and processes designed to—

(a) prevent children of any age from encountering, by means of the service, primary priority content that is harmful to children;

(b) protect children in age groups judged to be at risk of harm from other content that is harmful to children (or from a particular kind of such content) from encountering it by means of the service.

(4) The duty set out in subsection (3)(a) requires a provider to use age verification or age estimation (or both) to prevent children of any age from encountering primary priority content that is harmful to children which the provider identifies on the service.

(5) That requirement applies to a provider in relation to a particular kind of primary priority content that is harmful to children in every case except where—

(a) a term of service indicates (in whatever words) that the presence of that kind of primary priority content that is harmful to children is prohibited on the service, and

(b) that policy applies in relation to all users of the service.

(6) If a provider is required by subsection (4) to use age verification or age estimation for the purpose of compliance with the duty set out in subsection (3)(a), the age verification or age estimation must be of such a kind, and used in such a way, that it is highly effective at correctly determining whether or not a particular user is a child.

(7) Age verification or age estimation to identify who is or is not a child user or which age group a child user is in are examples of measures which (if not required by subsection (4)) may be taken or used (among others) for the purpose of compliance with a duty set out in subsection (2) or (3).

(8) The duties set out in subsections (2) and (3) apply across all areas of a service, including the way it is designed, operated and used as well as content present on the service, and (among other things) require the provider of a service to take or use measures in the following areas, if it is proportionate to do so—

(a) regulatory compliance and risk management arrangements,

(b) design of functionalities, algorithms and other features,

(c) policies on terms of use,

(d) policies on user access to the service or to particular content present on the service, including blocking users from accessing the service or particular content,

(e) content moderation, including taking down content,

(f) functionalities allowing for control over content that is encountered, especially by children,

(g) user support measures, and

(h) staff policies and practices.

(9) A duty to include provisions in the terms of service specifying—

(a) how children of any age are to be prevented from encountering primary priority content that is harmful to children (with each kind of primary priority content separately covered);

(b) how children in age groups judged to be at risk of harm from priority content that is harmful to children (or from a particular kind of such content) are to be protected from encountering it, where they are not prevented from doing so (with each kind of priority content separately covered);

(c) how children in age groups judged to be at risk of harm from non-designated content that is harmful to children (or from a particular kind of such content) are to be protected from encountering it, where they are not prevented from doing so.

(10) A duty to apply the provisions of the terms of service referred to in subsection (9) consistently.

(11) If a provider takes or uses a measure designed to prevent access to the whole of the service or a part of the service by children under a certain age, a duty to—

(a) include provisions in the terms of service specifying details about the operation of the measure, and

(b) apply those provisions consistently.

(12) A duty to include provisions in the terms of service giving information about any proactive technology used by a service for the purpose of compliance with a duty set out in subsection (2) or (3) (including the kind of technology, when it is used, and how it works).

(13) A duty to ensure that the provisions of the terms of service referred to in subsections (9), (11) and (12) are clear and accessible.

Additional duty for Category 1 services

(14) A duty to summarise in the terms of service the findings of the most recent children’s risk assessment of a service (including as to levels of risk and as to nature, and severity, of potential harm to children).

Commencement Information

I12 S. 12 not in force at Royal Assent, see s. 240(1)

I13 S. 12 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(d)

13 Safety duties protecting children: interpretation U.K.

(1) In determining what is proportionate for the purposes of section 12, the following factors, in particular, are relevant—

(a) all the findings of the most recent children’s risk assessment (including as to levels of risk and as to nature, and severity, of potential harm to children), and

(b) the size and capacity of the provider of a service.

(2) So far as a duty set out in section 12 relates to non-designated content that is harmful to children, the duty is to be taken to extend only to addressing risks of harm from the kinds of such content that have been identified in the most recent children’s risk assessment (if any have been identified).

(3) References in section 12(3)(b) and (9)(b) and (c) to children in age groups judged to be at risk of harm from content that is harmful to children are references to children in age groups judged to be at risk of such harm as assessed by the provider of a service in the most recent children’s risk assessment of the service.

(4) The duties set out in section 12(3) and (9) are to be taken to extend only to content that is harmful to children where the risk of harm is presented by the nature of the content (rather than the fact of its dissemination).

(5) The duties set out in section 12 extend only to such parts of a service as it is possible for children to access.

(6) For the purposes of subsection (5), a provider is only entitled to conclude that it is not possible for children to access a service, or a part of it, if age verification or age estimation is used on the service with the result that children are not normally able to access the service or that part of it.

(7) In section 12 and this section “children’s risk assessment” has the meaning given by section 11.

(8) See also, in relation to duties set out in section 12, section 22 (duties about freedom of expression and privacy).

Commencement Information

I14 S. 13 not in force at Royal Assent, see s. 240(1)

I15 S. 13 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(d)

Category 1 services U.K.

14 Assessment duties: user empowerment U.K.

(1) This section sets out the duties about assessments related to adult user empowerment which apply in relation to Category 1 services (in addition to the duties about risk assessments set out in section 9 and, in the case of Category 1 services likely to be accessed by children, section 11).

(2) A duty to carry out a suitable and sufficient assessment for the purposes of section 15(2) at a time set out in, or as provided by, Schedule 3.

(3) A duty to take appropriate steps to keep such an assessment up to date.

(4) Before making any significant change to any aspect of a service’s design or operation, a duty to carry out a further suitable and sufficient assessment for the purposes of section 15(2) relating to the impacts of that proposed change.

(5) An assessment of a service “for the purposes of section 15(2)” means an assessment of the following matters—

(a) the user base;

(b) the incidence of relevant content on the service;

(c) the likelihood of adult users of the service encountering, by means of the service, each kind of relevant content (with each kind separately assessed), taking into account (in particular) algorithms used by the service, and how easily, quickly and widely content may be disseminated by means of the service;

(d) the likelihood of adult users with a certain characteristic or who are members of a certain group encountering relevant content which particularly affects them;

(e) the likelihood of functionalities of the service facilitating the presence or dissemination of relevant content, identifying and assessing those functionalities more likely to do so;

(f) the different ways in which the service is used, and the impact of such use on the likelihood of adult users encountering relevant content;

(g) how the design and operation of the service (including the business model, governance, use of proactive technology, measures to strengthen adult users’ control over their interaction with user-generated content, and other systems and processes) may reduce or increase the likelihood of adult users encountering relevant content.

(6) In this section “relevant content” means content to which section 15(2) applies (content to which user empowerment duties set out in that provision apply).

(7) See also—

(a) section 23(9) and (10) (records of assessments), and

(b) Schedule 3 (timing of providers’ assessments).

Commencement Information

I16 S. 14 not in force at Royal Assent, see s. 240(1)

I17 S. 14 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(e)

15 User empowerment duties U.K.

(1) This section sets out the duties to empower adult users which apply in relation to Category 1 services.

(2) A duty to include in a service, to the extent that it is proportionate to do so, features which adult users may use or apply if they wish to increase their control over content to which this subsection applies.

(3) The features referred to in subsection (2) are those which, if used or applied by a user, result in the use by the service of systems or processes designed to effectively—

(a) reduce the likelihood of the user encountering content to which subsection (2) applies present on the service, or

(b) alert the user to content present on the service that is a particular kind of content to which subsection (2) applies.

(4) A duty to ensure that all features included in a service in compliance with the duty set out in subsection (2) (“control features”) are made available to all adult users and are easy to access.

(5) A duty to operate a service using a system or process which seeks to ensure that all registered adult users are offered the earliest possible opportunity, in relation to each control feature included in the service, to take a step indicating to the provider that—

(a) the user wishes to retain the default setting for the feature (whether that is that the feature is in use or applied, or is not in use or applied), or

(b) the user wishes to change the default setting for the feature.

(6) The duty set out in subsection (5)—

(a) continues to apply in relation to a user and a control feature for so long as the user has not yet taken a step mentioned in that subsection in relation to the feature;

(b) no longer applies in relation to a user once the user has taken such a step in relation to every control feature included in the service.

(7) A duty to include clear and accessible provisions in the terms of service specifying which control features are offered and how users may take advantage of them.

(8) A duty to summarise in the terms of service the findings of the most recent assessment of a service under section 14 (assessments related to the duty set out in subsection (2)).

(9) A duty to include in a service features which adult users may use or apply if they wish to filter out non-verified users.

(10) The features referred to in subsection (9) are those which, if used or applied by a user, result in the use by the service of systems or processes designed to effectively—

(a) prevent non-verified users from interacting with content which that user generates, uploads or shares on the service, and

(b) reduce the likelihood of that user encountering content which non-verified users generate, upload or share on the service.

Commencement Information

I18 S. 15 not in force at Royal Assent, see s. 240(1)

I19 S. 15 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(e)

16 User empowerment duties: interpretation U.K.

(1) In determining what is proportionate for the purposes of section 15(2), the following factors, in particular, are relevant—

(a) all the findings of the most recent assessment under section 14, and

(b) the size and capacity of the provider of the service.

(2) Section 15(2) applies to content that—

(a) is regulated user-generated content in relation to the service in question, and

(b) is within subsection (3), (4) or (5).

(3) Content is within this subsection if it encourages, promotes or provides instructions for—

(a) suicide or an act of deliberate self-injury, or

(b) an eating disorder or behaviours associated with an eating disorder.

(4) Content is within this subsection if it is abusive and the abuse targets any of the following characteristics—

(a) race,

(b) religion,

(c) sex,

(d) sexual orientation,

(e) disability, or

(f) gender reassignment.

(5) Content is within this subsection if it incites hatred against people—

(a) of a particular race, religion, sex or sexual orientation,

(b) who have a disability, or

(c) who have the characteristic of gender reassignment.

(6) The duty set out in section 15(5) applies in relation to all registered adult users, not just those who begin to use a service after that duty begins to apply.

(7) In section 15 and this section—

• “disability” means any physical or mental impairment;

• “injury” includes poisoning;

• “non-verified user” means a user who—

  (a)

  is an individual, whether in the United Kingdom or outside it, and

  (b)

  has not verified their identity to the provider of a service;

• “race” includes colour, nationality, and ethnic or national origins.

(8) In section 15 and this section—

(a) references to features include references to functionalities and settings, and

(b) references to religion include references to a lack of religion.

(9) For the purposes of section 15 and this section, a person has the characteristic of gender reassignment if the person is proposing to undergo, is undergoing or has undergone a process (or part of a process) for the purpose of reassigning the person’s sex by changing physiological or other attributes of sex, and the reference to gender reassignment in subsection (4) is to be construed accordingly.

(10) See also, in relation to duties set out in section 15, section 22 (duties about freedom of expression and privacy).

Commencement Information

I20 S. 16 not in force at Royal Assent, see s. 240(1)

I21 S. 16 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(e)

17 Duties to protect content of democratic importance U.K.

(1) This section sets out the duties to protect content of democratic importance which apply in relation to Category 1 services.

(2) A duty to operate a service using proportionate systems and processes designed to ensure that the importance of the free expression of content of democratic importance is taken into account when making decisions about—

(a) how to treat such content (especially decisions about whether to take it down or restrict users’ access to it), and

(b) whether to take action against a user generating, uploading or sharing such content.

(3) A duty to ensure that the systems and processes mentioned in subsection (2) apply in the same way to a wide diversity of political opinion.

(4) A duty to include provisions in the terms of service specifying the policies and processes that are designed to take account of the principle mentioned in subsection (2), including, in particular, how that principle is applied to decisions mentioned in that subsection.

(5) A duty to ensure that—

(a) the provisions of the terms of service referred to in subsection (4) are clear and accessible, and

(b) those provisions are applied consistently.

(6) In determining what is proportionate for the purposes of subsection (2), the size and capacity of the provider of a service, in particular, is relevant.

(7) For the purposes of this section content is “content of democratic importance”, in relation to a user-to-user service, if—

(a) the content is—

(i) news publisher content in relation to that service, or

(ii) regulated user-generated content in relation to that service; and

(b) the content is or appears to be specifically intended to contribute to democratic political debate in the United Kingdom or a part or area of the United Kingdom.

(8) In this section, the reference to “taking action” against a user is to giving a warning to a user, or suspending or banning a user from using a service, or in any way restricting a user’s ability to use a service.

(9) For the meaning of “news publisher content” and “regulated user-generated content”, see section 55.

Commencement Information

I22 S. 17 not in force at Royal Assent, see s. 240(1)

I23 S. 17 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(e)

Prospective

18 Duties to protect news publisher content U.K.

(1) This section sets out the duties to protect news publisher content which apply in relation to Category 1 services.

(2) Subject to subsections (4), (5) and (8), a duty, in relation to a service, to take the steps set out in subsection (3) before—

(a) taking action in relation to content present on the service that is news publisher content, or

(b) taking action against a user who is a recognised news publisher.

(3) The steps referred to in subsection (2) are—

(a) to give the recognised news publisher in question a notification which—

(i) specifies the action that the provider is considering taking,

(ii) gives reasons for that proposed action by reference to each relevant provision of the terms of service,

(iii) where the proposed action relates to news publisher content that is also journalistic content, explains how the provider took the importance of the free expression of journalistic content into account when deciding on the proposed action, and

(iv) specifies a reasonable period within which the recognised news publisher may make representations,

(b) to consider any representations that are made, and

(c) to notify the recognised news publisher of the decision and the reasons for it (addressing any representations made).

(4) If a provider of a service reasonably considers that the provider would incur criminal or civil liability in relation to news publisher content present on the service if it were not taken down swiftly, the provider may take down that content without having taken the steps set out in subsection (3).

(5) A provider of a service may also take down news publisher content present on the service without having taken the steps set out in subsection (3) if that content amounts to a relevant offence (see section 59 and also subsection (10) of this section).

(6) Subject to subsection (8), if a provider takes action in relation to news publisher content or against a recognised news publisher without having taken the steps set out in subsection (3), a duty to take the steps set out in subsection (7).

(7) The steps referred to in subsection (6) are—

(a) to swiftly notify the recognised news publisher in question of the action taken, giving the provider’s justification for not having first taken the steps set out in subsection (3),

(b) to specify a reasonable period within which the recognised news publisher may request that the action is reversed, and

(c) if a request is made as mentioned in paragraph (b)—

(i) to consider the request and whether the steps set out in subsection (3) should have been taken prior to the action being taken,

(ii) if the provider concludes that those steps should have been taken, to swiftly reverse the action, and

(iii) to notify the recognised news publisher of the decision and the reasons for it (addressing any reasons accompanying the request for reversal of the action).

(8) If a recognised news publisher has been banned from using a service (and the ban is still in force), the provider of the service may take action in relation to news publisher content present on the service which was generated or originally published or broadcast by the recognised news publisher without complying with the duties set out in this section.

(9) For the purposes of this section, a provider is not to be regarded as taking action in relation to news publisher content in the following circumstances—

(a) a provider takes action in relation to content which is not news publisher content, that action affects related news publisher content, the grounds for the action only relate to the content which is not news publisher content, and it is not technically feasible for the action only to relate to the content which is not news publisher content;

(b) a provider takes action against a user, and that action affects news publisher content that has been uploaded to or shared on the service by the user.

(10) Section 192 (providers’ judgements about the status of content) applies in relation to judgements by providers about whether news publisher content amounts to a relevant offence as it applies in relation to judgements about whether content is illegal content.

(11) Any provision of the terms of service has effect subject to this section.

(12) In this section—

(a) references to “news publisher content” are to content that is news publisher content in relation to the service in question;

(b) references to “taking action” against a person are to giving a warning to a person, or suspending or banning a person from using a service, or in any way restricting a person’s ability to use a service.

(13) In this section references to “taking action” in relation to content are to—

(a) taking down content,

(b) restricting users’ access to content, or

(c) adding warning labels to content, except warning labels normally encountered only by child users,

and also include references to taking any other action in relation to content on the grounds that it is content of a kind which is the subject of a relevant term of service (but not otherwise).

(14) A “relevant term of service” means a term of service which indicates to users (in whatever words) that the presence of a particular kind of content, from the time it is generated, uploaded or shared on the service, is not tolerated on the service or is tolerated but liable to result in the provider treating it in a way that makes it less likely that other users will encounter it.

(15) Taking any step set out in subsection (3) or (7) does not count as “taking action” for the purposes of this section.

(16) See—

• section 19 for the meaning of “journalistic content”;

• section 55 for the meaning of “news publisher content”;

• section 56 for the meaning of “recognised news publisher”.

Commencement Information

I24 S. 18 not in force at Royal Assent, see s. 240(1)

19 Duties to protect journalistic content U.K.

(1) This section sets out the duties to protect journalistic content which apply in relation to Category 1 services.

The duties

(2) A duty to operate a service using proportionate systems and processes designed to ensure that the importance of the free expression of journalistic content is taken into account when making decisions about—

(a) how to treat such content (especially decisions about whether to take it down or restrict users’ access to it), and

(b) whether to take action against a user generating, uploading or sharing such content.

(3) A duty, in relation to a decision by a provider to take down content or to restrict access to it, to make a dedicated and expedited complaints procedure available to a person who considers the content to be journalistic content and who is—

(a) the user who generated, uploaded or shared the content on the service, or

(b) the creator of the content (see subsections (14) and (15)).

(4) A duty to make a dedicated and expedited complaints procedure available to users of a service in relation to a decision by the provider of the service to take action against a user because of content generated, uploaded or shared by the user which the user considers to be journalistic content.

(5) A duty to ensure that—

(a) if a complaint about a decision mentioned in subsection (3) is upheld, the content is swiftly reinstated on the service;

(b) if a complaint about a decision mentioned in subsection (4) is upheld, the action against the user is swiftly reversed.

(6) Subsections (3) and (4) do not require a provider to make a dedicated and expedited complaints procedure available to a recognised news publisher in relation to a decision if the provider has taken the steps set out in section 18(3) in relation to that decision.

(7) A duty to include provisions in the terms of service specifying—

(a) by what methods content present on the service is to be identified as journalistic content;

(b) how the importance of the free expression of journalistic content is to be taken into account when making decisions mentioned in subsection (2);

(c) the policies and processes for handling complaints in relation to content which is, or is considered to be, journalistic content.

(8) A duty to ensure that—

(a) the provisions of the terms of service referred to in subsection (7) are clear and accessible, and

(b) those provisions are applied consistently.

Interpretation

(9) In determining what is proportionate for the purposes of subsection (2), the size and capacity of the provider of a service, in particular, is relevant.

(10) For the purposes of this Part content is “journalistic content”, in relation to a user-to-user service, if—

(a) the content is—

(i) news publisher content in relation to that service, or

(ii) regulated user-generated content in relation to that service;

(b) the content is generated for the purposes of journalism; and

(c) the content is UK-linked.

(11) For the purposes of this section content is “UK-linked” if—

(a) United Kingdom users of the service form one of the target markets for the content (or the only target market), or

(b) the content is or is likely to be of interest to a significant number of United Kingdom users.

(12) In this section references to “taking action” against a user are to giving a warning to a user, or suspending or banning a user from using a service, or in any way restricting a user’s ability to use a service.

(13) In this section the reference to the “creator” of content is to be read in accordance with subsections (14) and (15).

(14) The creator of news publisher content is the recognised news publisher in question.

(15) The creator of content other than news publisher content is—

(a) an individual who—

(i) created the content, and

(ii) is in the United Kingdom; or

(b) an entity which—

(i) created the content, and

(ii) is incorporated or formed under the law of any part of the United Kingdom.

(16) For the meaning of “news publisher content”, “regulated user-generated content” and “recognised news publisher”, see sections 55 and 56.

Commencement Information

I25 S. 19 not in force at Royal Assent, see s. 240(1)

I26 S. 19 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(e)

Duties about content reporting and complaints procedures U.K.

20 Duty about content reporting U.K.

(1) This section sets out the duty about content reporting which applies in relation to all regulated user-to-user services.

(2) A duty to operate a service using systems and processes that allow users and affected persons to easily report content which they consider to be content of a kind specified below (with the duty extending to different kinds of content depending on the kind of service, as indicated by the headings).

All services

(3) Illegal content.

Services likely to be accessed by children

(4) Content that is harmful to children, present on a part of a service that it is possible for children to access.

Interpretation

(5) In this section “affected person” means a person, other than a user of the service in question, who is in the United Kingdom and who is—

(a) the subject of the content,

(b) a member of a class or group of people with a certain characteristic targeted by the content,

(c) a parent of, or other adult with responsibility for, a child who is a user of the service or is the subject of the content, or

(d) an adult providing assistance in using the service to another adult who requires such assistance, where that other adult is a user of the service or is the subject of the content.

(6) For the purposes of subsection (4), a provider is only entitled to conclude that it is not possible for children to access a service, or a part of it, if age verification or age estimation is used on the service with the result that children are not normally able to access the service or that part of it.

(7) See also—

(a) section 22 (duties about freedom of expression and privacy), and

(b) section 72(5)(a) (reporting of content that terms of service allow to be taken down or restricted).

Commencement Information

I27 S. 20 not in force at Royal Assent, see s. 240(1)

I28 S. 20(1)-(6)(7)(a) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(f)

21 Duties about complaints procedures U.K.

(1) This section sets out the duties about complaints procedures which apply in relation to all regulated user-to-user services.

(2) A duty to operate a complaints procedure in relation to a service that—

(a) allows for relevant kinds of complaint to be made (as set out under the headings below),

(b) provides for appropriate action to be taken by the provider of the service in response to complaints of a relevant kind, and

(c) is easy to access, easy to use (including by children) and transparent.

(3) A duty to include in the terms of service provisions which are easily accessible (including to children) specifying the policies and processes that govern the handling and resolution of complaints of a relevant kind.

All services

(4) The following kinds of complaint are relevant for all services—

(a) complaints by users and affected persons about content present on a service which they consider to be illegal content;

(b) complaints by users and affected persons if they consider that the provider is not complying with a duty set out in—

(i) section 10 (illegal content),

(ii) section 20 (content reporting), or

(iii) section 22(2) or (3) (freedom of expression and privacy);

(c) complaints by a user who has generated, uploaded or shared content on a service if that content is taken down on the basis that it is illegal content;

(d) complaints by a user of a service if the provider has given a warning to the user, suspended or banned the user from using the service, or in any other way restricted the user’s ability to use the service, as a result of content generated, uploaded or shared by the user which the provider considers to be illegal content;

(e) complaints by a user who has generated, uploaded or shared content on a service if—

(i) the use of proactive technology on the service results in that content being taken down or access to it being restricted, or given a lower priority or otherwise becoming less likely to be encountered by other users, and

(ii) the user considers that the proactive technology has been used in a way not contemplated by, or in breach of, the terms of service (for example, by affecting content not of a kind specified in the terms of service as a kind of content in relation to which the technology would operate).

Services likely to be accessed by children

(5) The following kinds of complaint are relevant for services that are likely to be accessed by children—

(a) complaints by users and affected persons about content, present on a part of a service that it is possible for children to access, which they consider to be content that is harmful to children;

(b) complaints by users and affected persons if they consider that the provider is not complying with a duty set out in section 12 (children’s online safety);

(c) complaints by a user who has generated, uploaded or shared content on a service if that content is taken down, or access to it is restricted, on the basis that it is content that is harmful to children;

(d) complaints by a user of a service if the provider has given a warning to the user, suspended or banned the user from using the service, or in any other way restricted the user’s ability to use the service, as a result of content generated, uploaded or shared by the user which the provider considers to be content that is harmful to children;

(e) complaints by a user who is unable to access content because measures used to comply with a duty set out in section 12(2) or (3) have resulted in an incorrect assessment of the user’s age.

Category 1 services

(6) The relevant kind of complaint for Category 1 services is complaints by users and affected persons if they consider that the provider is not complying with a duty set out in—

(a) section 15 (user empowerment),

(b) section 17 (content of democratic importance),

(c) section 18 (news publisher content),

(d) section 19 (journalistic content), or

(e) section 22(4), (6) or (7) (freedom of expression and privacy).

Interpretation

(7) In this section “affected person” has the meaning given by section 20.

(8) For the purposes of subsection (5)(a), a provider is only entitled to conclude that it is not possible for children to access a service, or a part of it, if age verification or age estimation is used on the service with the result that children are not normally able to access the service or that part of it.

(9) See also—

(a) section 22 (duties about freedom of expression and privacy), and

(b) section 72(6) (complaints procedure relating to content that terms of service allow to be taken down or restricted).

Commencement Information

I29 S. 21 not in force at Royal Assent, see s. 240(1)

I30 S. 21(1)-(5)(6)(a)(b)(d)(e)(7)(8)(9)(a) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(g)

Cross-cutting duties U.K.

22 Duties about freedom of expression and privacy U.K.

(1) This section sets out the duties about freedom of expression and privacy which apply in relation to regulated user-to-user services (as indicated by the headings).

All services

(2) When deciding on, and implementing, safety measures and policies, a duty to have particular regard to the importance of protecting users’ right to freedom of expression within the law.

(3) When deciding on, and implementing, safety measures and policies, a duty to have particular regard to the importance of protecting users from a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of a user-to-user service (including, but not limited to, any such provision or rule concerning the processing of personal data).

Additional duties for Category 1 services

(4) A duty—

(a) when deciding on safety measures and policies, to carry out an assessment of the impact that such measures or policies would have on—

(i) users’ right to freedom of expression within the law, and

(ii) the privacy of users; and

(b) to carry out an assessment of the impact of adopted safety measures and policies on the matters mentioned in paragraph (a)(i) and (ii).

(5) An impact assessment relating to a service must include a section which considers the impact of the safety measures and policies on the availability and treatment on the service of content which is news publisher content or journalistic content in relation to the service.

(6) A duty to—

(a) keep an impact assessment up to date, and

(b) publish impact assessments.

(7) A duty to specify in a publicly available statement the positive steps that the provider has taken in response to an impact assessment to—

(a) protect users’ right to freedom of expression within the law, and

(b) protect the privacy of users.

Interpretation

(8) In this section—

• “impact assessment” means an impact assessment under subsection (4);

• “safety measures and policies” means measures and policies designed to secure compliance with any of the duties set out in—

  (a)

  section 10 (illegal content),

  (b)

  section 12 (children’s online safety),

  (c)

  section 15 (user empowerment),

  (d)

  section 20 (content reporting), or

  (e)

  section 21 (complaints procedures).

(9) Any reference in this section to the privacy of users or steps taken to protect the privacy of users is to be construed in accordance with subsection (3).

(10) See—

• section 19 for the meaning of “journalistic content”;

• section 55 for the meaning of “news publisher content”.

Commencement Information

I31 S. 22 not in force at Royal Assent, see s. 240(1)

I32 S. 22 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(h)

23 Record-keeping and review duties U.K.

(1) This section sets out the record-keeping and review duties which apply in relation to regulated user-to-user services (as indicated by the headings).

All services

(2) A duty to make and keep a written record, in an easily understandable form, of all aspects of every risk assessment under section 9 or 11, including details about how the assessment was carried out and its findings.

(3) A duty to make and keep a written record of any measures taken or in use to comply with a relevant duty which—

(a) are described in a code of practice and recommended for the purpose of compliance with the duty in question, and

(b) apply in relation to the provider and the service in question.

In this section such measures are referred to as “applicable measures in a code of practice”.

(4) If alternative measures have been taken or are in use to comply with a relevant duty, a duty to make and keep a written record containing the following information—

(a) the applicable measures in a code of practice that have not been taken or are not in use,

(b) the alternative measures that have been taken or are in use,

(c) how those alternative measures amount to compliance with the duty in question, and

(d) how the provider has complied with section 49(5) (freedom of expression and privacy).

(5) If alternative measures have been taken or are in use to comply with a duty set out in section 10(2) or (3) or 12(2) or (3), the record required under subsection (4) of this section must also indicate whether such measures have been taken or are in use in every area listed in section 10(4) or 12(8) (as the case may be) in relation to which there are applicable measures in a code of practice.

(6) A duty to review compliance with the relevant duties in relation to a service—

(a) regularly, and

(b) as soon as reasonably practicable after making any significant change to any aspect of the design or operation of the service.

(7) OFCOM may provide that particular descriptions of providers of user-to-user services are exempt from any or all of the duties set out in this section, and may revoke such an exemption.

(8) OFCOM must publish details of any exemption or revocation under subsection (7), including reasons for the revocation of an exemption.

Additional duties for Category 1 services

(9) A duty to make and keep a written record, in an easily understandable form, of all aspects of every assessment under section 14 (assessments related to the adult user empowerment duty set out in section 15(2)), including details about how the assessment was carried out and its findings.

(10) As soon as reasonably practicable after making a record of an assessment as required by subsection (2) or (9), or revising such a record, a duty to supply OFCOM with a copy of the record (in full).

Interpretation

(11) In this section—

• “alternative measures” means measures other than measures which are (in relation to the provider and the service in question) applicable measures in a code of practice;

• “code of practice” means a code of practice published under section 46;

• “relevant duties” means the duties set out in—

  (a)

  section 10 (illegal content),

  (b)

  section 12 (children’s online safety),

  (c)

  section 15 (user empowerment),

  (d)

  section 17 (content of democratic importance),

  (e)

  section 19 (journalistic content),

  (f)

  section 20 (content reporting), and

  (g)

  section 21 (complaints procedures),

  and for the purposes of subsection (6), also includes the duties set out in sections 18 (news publisher content), 71 and 72 (duties about terms of service), and 75 (deceased child users).

Commencement Information

I33 S. 23 not in force at Royal Assent, see s. 240(1)

I34 S. 23(1)-(10) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(i)

I35 S. 23(11) in force at 10.1.2024 for specified purposes by S.I. 2023/1420, reg. 2(i)

CHAPTER 3 U.K. Providers of search services: duties of care

Search services: which duties apply, and scope of duties U.K.

24 Providers of search services: duties of care U.K.

(1) Subsections (2) to (4) apply to determine which of the duties set out in this Chapter must be complied with by providers of regulated search services.

(2) All providers of regulated search services must comply with the following duties in relation to each such service which they provide—

(a) the duties about illegal content risk assessments set out in section 26,

(b) the duties about illegal content set out in section 27(2) to (8),

(c) the duty about content reporting set out in section 31,

(d) the duties about complaints procedures set out in section 32,

(e) the duties about freedom of expression and privacy set out in section 33, and

(f) the duties about record-keeping and review set out in section 34(2) to (6).

(3) Additional duties must be complied with by providers of particular kinds of regulated search services, as follows.

(4) All providers of regulated search services that are likely to be accessed by children must comply with the following duties in relation to each such service which they provide—

(a) the duties about children’s risk assessments set out in section 28, and

(b) the duties to protect children’s online safety set out in section 29(2) to (8).

(5) All providers of regulated search services that are Category 2A services must comply with the following duties in relation to each such service which they provide—

(a) the duty about illegal content risk assessments set out in section 27(9),

(b) the duty about children’s risk assessments set out in section 29(9), and

(c) the duty about record-keeping set out in section 34(9).

(6) For the meaning of “likely to be accessed by children”, see section 37.

(7) For the meaning of “Category 2A service”, see section 95 (register of categories of services).

Commencement Information

I36 S. 24 not in force at Royal Assent, see s. 240(1)

I37 S. 24 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)

25 Scope of duties of care U.K.

(1) A duty set out in this Chapter which must be complied with in relation to a search service extends only to—

(a) the search content of the service,

(b) the design, operation and use of the search engine in the United Kingdom, and

(c) in the case of a duty that is expressed to apply in relation to users of a service, the design, operation and use of the search engine as it affects United Kingdom users of the service.

(2) For the purposes of the application of this Chapter in relation to the search engine of a combined service (see section 7(6))—

(a) a duty set out in this Chapter which requires a matter to be included in a publicly available statement may be satisfied by including the matter in the terms of service;

(b) references in this Chapter (except in section 24) to a search service are to be read as references to the search engine;

(c) references in this Chapter (except in section 24) to the provider of a search service are to be read as references to the provider of the combined service.

Commencement Information

I38 S. 25 not in force at Royal Assent, see s. 240(1)

I39 S. 25 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)

Illegal content duties for search services U.K.

26 Illegal content risk assessment duties U.K.

(1) This section sets out the duties about risk assessments which apply in relation to all regulated search services.

(2) A duty to carry out a suitable and sufficient illegal content risk assessment at a time set out in, or as provided by, Schedule 3.

(3) A duty to take appropriate steps to keep an illegal content risk assessment up to date, including when OFCOM make any significant change to a risk profile that relates to services of the kind in question.

(4) Before making any significant change to any aspect of a service’s design or operation, a duty to carry out a further suitable and sufficient illegal content risk assessment relating to the impacts of that proposed change.

(5) An “illegal content risk assessment” of a service of a particular kind means an assessment of the following matters, taking into account the risk profile that relates to services of that kind—

(a) the level of risk of individuals who are users of the service encountering search content of the following kinds—

(i) each kind of priority illegal content (with each kind separately assessed), and

(ii) other illegal content,

taking into account (in particular) risks presented by algorithms used by the service, and the way that the service indexes, organises and presents search results;

(b) the level of risk of functionalities of the service facilitating individuals encountering search content that is illegal content, identifying and assessing those functionalities that present higher levels of risk;

(c) the nature, and severity, of the harm that might be suffered by individuals from the matters identified in accordance with paragraphs (a) and (b);

(d) how the design and operation of the service (including the business model, governance, use of proactive technology, measures to promote users’ media literacy and safe use of the service, and other systems and processes) may reduce or increase the risks identified.

(6) In this section references to risk profiles are to the risk profiles for the time being published under section 98 which relate to the risk of harm to individuals presented by illegal content.

(7) See also—

(a) section 34(2) and (9) (records of risk assessments), and

(b) Schedule 3 (timing of providers’ assessments).

Commencement Information

I40 S. 26 not in force at Royal Assent, see s. 240(1)

I41 S. 26 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)

27 Safety duties about illegal content U.K.

(1) This section sets out the duties about illegal content which apply in relation to regulated search services (as indicated by the headings).

All services

(2) A duty, in relation to a service, to take or use proportionate measures relating to the design or operation of the service to effectively mitigate and manage the risks of harm to individuals, as identified in the most recent illegal content risk assessment of the service (see section 26(5)(c)).

(3) A duty to operate a service using proportionate systems and processes designed to minimise the risk of individuals encountering search content of the following kinds—

(a) priority illegal content;

(b) other illegal content that the provider knows about (having been alerted to it by another person or become aware of it in any other way).

(4) The duties set out in subsections (2) and (3) apply across all areas of a service, including the way the search engine is designed, operated and used as well as search content of the service, and (among other things) require the provider of a service to take or use measures in the following areas, if it is proportionate to do so—

(a) regulatory compliance and risk management arrangements,

(b) design of functionalities, algorithms and other features relating to the search engine,

(c) functionalities allowing users to control the content they encounter in search results,

(d) content prioritisation,

(e) user support measures, and

(f) staff policies and practices.

(5) A duty to include provisions in a publicly available statement specifying how individuals are to be protected from search content that is illegal content.

(6) A duty to apply the provisions of the statement referred to in subsection (5) consistently.

(7) A duty to include provisions in a publicly available statement giving information about any proactive technology used by a service for the purpose of compliance with a duty set out in subsection (2) or (3) (including the kind of technology, when it is used, and how it works).

(8) A duty to ensure that the provisions of the publicly available statement referred to in subsections (5) and (7) are clear and accessible.

Additional duty for Category 2A services

(9) A duty to summarise in a publicly available statement the findings of the most recent illegal content risk assessment of a service (including as to levels of risk and as to nature, and severity, of potential harm to individuals).

Interpretation

(10) In determining what is proportionate for the purposes of this section, the following factors, in particular, are relevant—

(a) all the findings of the most recent illegal content risk assessment (including as to levels of risk and as to nature, and severity, of potential harm to individuals), and

(b) the size and capacity of the provider of a service.

(11) In this section “illegal content risk assessment” has the meaning given by section 26.

(12) See also, in relation to duties set out in this section, section 33 (duties about freedom of expression and privacy).

Commencement Information

I42 S. 27 not in force at Royal Assent, see s. 240(1)

I43 S. 27 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)

Search services likely to be accessed by children U.K.

28 Children’s risk assessment duties U.K.

(1) This section sets out the duties about risk assessments which apply in relation to regulated search services that are likely to be accessed by children (in addition to the duties about risk assessments set out in section 26).

(2) A duty to carry out a suitable and sufficient children’s risk assessment at a time set out in, or as provided by, Schedule 3.

(3) A duty to take appropriate steps to keep a children’s risk assessment up to date, including when OFCOM make any significant change to a risk profile that relates to services of the kind in question.

(4) Before making any significant change to any aspect of a service’s design or operation, a duty to carry out a further suitable and sufficient children’s risk assessment relating to the impacts of that proposed change.

(5) A “children’s risk assessment” of a service of a particular kind means an assessment of the following matters, taking into account the risk profile that relates to services of that kind—

(a) the level of risk of children who are users of the service encountering search content of the following kinds—

(i) each kind of primary priority content that is harmful to children (with each kind separately assessed),

(ii) each kind of priority content that is harmful to children (with each kind separately assessed), and

(iii) non-designated content that is harmful to children,

giving separate consideration to children in different age groups, and taking into account (in particular) risks presented by algorithms used by the service and the way that the service indexes, organises and presents search results;

(b) the level of risk of children who are users of the service encountering search content that is harmful to children which particularly affects individuals with a certain characteristic or members of a certain group;

(c) the extent to which the design of the service, in particular its functionalities, affects the level of risk of harm that might be suffered by children, identifying and assessing those functionalities that present higher levels of risk, including a functionality that makes suggestions relating to users’ search requests (predictive search functionality);

(d) the different ways in which the service is used, including functionalities or other features of the service that affect how much children use the service, and the impact of such use on the level of risk of harm that might be suffered by children;

(e) the nature, and severity, of the harm that might be suffered by children from the matters identified in accordance with paragraphs (a) to (d), giving separate consideration to children in different age groups;

(f) how the design and operation of the service (including the business model, governance, use of proactive technology, measures to promote users’ media literacy and safe use of the service, and other systems and processes) may reduce or increase the risks identified.

(6) In this section references to risk profiles are to the risk profiles for the time being published under section 98 which relate to the risk of harm to children presented by content that is harmful to children.

(7) See also—

(a) section 34(2) and (9) (records of risk assessments), and

(b) Schedule 3 (timing of providers’ assessments).

Commencement Information

I44 S. 28 not in force at Royal Assent, see s. 240(1)

I45 S. 28 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)

29 Safety duties protecting children U.K.

(1) This section sets out the duties to protect children’s online safety which apply in relation to regulated search services that are likely to be accessed by children (as indicated by the headings).

All services

(2) A duty, in relation to a service, to take or use proportionate measures relating to the design or operation of the service to effectively—

(a) mitigate and manage the risks of harm to children in different age groups, as identified in the most recent children’s risk assessment of the service (see section 28(5)(e)), and

(b) mitigate the impact of harm to children in different age groups presented by search content that is harmful to children.

(3) A duty to operate a service using proportionate systems and processes designed to—

(a) minimise the risk of children of any age encountering search content that is primary priority content that is harmful to children;

(b) minimise the risk of children in age groups judged to be at risk of harm from other content that is harmful to children (or from a particular kind of such content) encountering search content of that kind.

(4) The duties set out in subsections (2) and (3) apply across all areas of a service, including the way the search engine is designed, operated and used as well as search content of the service, and (among other things) require the provider of a service to take or use measures in the following areas, if it is proportionate to do so—

(a) regulatory compliance and risk management arrangements,

(b) design of functionalities, algorithms and other features relating to the search engine,

(c) functionalities allowing for control over content that is encountered in search results, especially by children,

(d) content prioritisation,

(e) user support measures, and

(f) staff policies and practices.

(5) A duty to include provisions in a publicly available statement specifying how children are to be protected from search content of the following kinds—

(a) primary priority content that is harmful to children (with each kind of primary priority content separately covered),

(b) priority content that is harmful to children (with each kind of priority content separately covered), and

(c) non-designated content that is harmful to children.

(6) A duty to apply the provisions of the statement referred to in subsection (5) consistently.

(7) A duty to include provisions in a publicly available statement giving information about any proactive technology used by a service for the purpose of compliance with a duty set out in subsection (2) or (3) (including the kind of technology, when it is used, and how it works).

(8) A duty to ensure that the provisions of the publicly available statement referred to in subsections (5) and (7) are clear and accessible.

Additional duty for Category 2A services

(9) A duty to summarise in a publicly available statement the findings of the most recent children’s risk assessment of a service (including as to levels of risk and as to nature, and severity, of potential harm to children).

Commencement Information

I46 S. 29 not in force at Royal Assent, see s. 240(1)

I47 S. 29 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)

30 Safety duties protecting children: interpretation U.K.

(1) In determining what is proportionate for the purposes of section 29, the following factors, in particular, are relevant—

(a) all the findings of the most recent children’s risk assessment (including as to levels of risk and as to nature, and severity, of potential harm to children), and

(b) the size and capacity of the provider of a service.

(2) So far as a duty set out in section 29 relates to non-designated content that is harmful to children, the duty is to be taken to extend only to addressing risks of harm from the kinds of such content that have been identified in the most recent children’s risk assessment (if any have been identified).

(3) The reference in section 29(3)(b) to children in age groups judged to be at risk of harm from content that is harmful to children is a reference to children in age groups judged to be at risk of such harm as assessed by the provider of a service in the most recent children’s risk assessment of the service.

(4) The duties set out in section 29(3) are to be taken to extend only to content that is harmful to children where the risk of harm is presented by the nature of the content (rather than the fact of its dissemination).

(5) The duties set out in section 29 extend only to such parts of a service as it is possible for children to access.

(6) For the purposes of subsection (5), a provider is only entitled to conclude that it is not possible for children to access a service, or a part of it, if age verification or age estimation is used on the service with the result that children are not normally able to access the service or that part of it.

(7) In section 29 and this section “children’s risk assessment” has the meaning given by section 28.

(8) See also, in relation to duties set out in section 29, section 33 (duties about freedom of expression and privacy).

Commencement Information

I48 S. 30 not in force at Royal Assent, see s. 240(1)

I49 S. 30 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)

Duties about content reporting and complaints procedures U.K.

31 Duty about content reporting U.K.

(1) This section sets out the duty about content reporting which applies in relation to all regulated search services.

(2) A duty to operate a service using systems and processes that allow users and affected persons to easily report search content which they consider to be content of a kind specified below (with the duty extending to content that is harmful to children depending on the kind of service, as indicated by the headings).

All services

(3) Illegal content.

Services likely to be accessed by children

(4) Content that is harmful to children.

Interpretation

(5) In this section “affected person” means a person, other than a user of the service in question, who is in the United Kingdom and who is—

(a) the subject of the content,

(b) a member of a class or group of people with a certain characteristic targeted by the content,

(c) a parent of, or other adult with responsibility for, a child who is a user of the service or is the subject of the content, or

(d) an adult providing assistance in using the service to another adult who requires such assistance, where that other adult is a user of the service or is the subject of the content.

(6) See also, in relation to the duty set out in this section, section 33 (duties about freedom of expression and privacy).

Commencement Information

I50 S. 31 not in force at Royal Assent, see s. 240(1)

I51 S. 31 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)

32 Duties about complaints procedures U.K.

(1) This section sets out the duties about complaints procedures which apply in relation to all regulated search services.

(2) A duty to operate a complaints procedure in relation to a service that—

(a) allows for relevant kinds of complaint to be made (as set out under the headings below),

(b) provides for appropriate action to be taken by the provider of the service in response to complaints of a relevant kind, and

(c) is easy to access, easy to use (including by children) and transparent.

(3) A duty to make the policies and processes that govern the handling and resolution of complaints of a relevant kind publicly available and easily accessible (including to children).

All services

(4) The following kinds of complaint are relevant for all services—

(a) complaints by users and affected persons about search content which they consider to be illegal content;

(b) complaints by users and affected persons if they consider that the provider is not complying with a duty set out in—

(i) section 27 (illegal content),

(ii) section 31 (content reporting), or

(iii) section 33 (freedom of expression and privacy);

(c) complaints by an interested person if the provider of a search service takes or uses measures in order to comply with a duty set out in section 27 that result in content relating to that interested person no longer appearing in search results or being given a lower priority in search results;

(d) complaints by an interested person if—

(i) the use of proactive technology on a search service results in content relating to that interested person no longer appearing in search results or being given a lower priority in search results, and

(ii) the interested person considers that the proactive technology has been used in a way not contemplated by, or in breach of, the provider’s policies on its use (for example, by affecting content not of a kind specified in those policies as a kind of content in relation to which the technology would operate).

Services likely to be accessed by children

(5) The following kinds of complaint are relevant for services that are likely to be accessed by children—

(a) complaints by users and affected persons about search content which they consider to be content that is harmful to children;

(b) complaints by users and affected persons if they consider that the provider is not complying with a duty set out in section 29 (children’s online safety);

(c) complaints by an interested person if the provider of a search service takes or uses measures in order to comply with a duty set out in section 29 that result in content relating to that interested person no longer appearing in search results or being given a lower priority in search results;

(d) complaints by a user who is unable to access content because measures used to comply with a duty set out in section 29(2) or (3) have resulted in an incorrect assessment of the user’s age.

Interpretation

(6) In this section—

• “affected person” has the meaning given by section 31;

• “interested person” has the meaning given by section 227(7).

(7) See also, in relation to duties set out in this section, section 33 (duties about freedom of expression and privacy).

Commencement Information

I52 S. 32 not in force at Royal Assent, see s. 240(1)

I53 S. 32 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)

Cross-cutting duties U.K.

33 Duties about freedom of expression and privacy U.K.

(1) This section sets out the duties about freedom of expression and privacy which apply in relation to all regulated search services.

(2) When deciding on, and implementing, safety measures and policies, a duty to have particular regard to the importance of protecting the rights of users and interested persons to freedom of expression within the law.

(3) When deciding on, and implementing, safety measures and policies, a duty to have particular regard to the importance of protecting users from a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of a search service (including, but not limited to, any such provision or rule concerning the processing of personal data).

(4) In this section—

• “interested person” has the meaning given by section 227(7);

• “safety measures and policies” means measures and policies designed to secure compliance with any of the duties set out in—

  (a)

  section 27 (illegal content),

  (b)

  section 29 (children’s online safety),

  (c)

  section 31 (content reporting), or

  (d)

  section 32 (complaints procedures).

Commencement Information

I54 S. 33 not in force at Royal Assent, see s. 240(1)

I55 S. 33 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)

34 Record-keeping and review duties U.K.

(1) This section sets out the record-keeping and review duties which apply in relation to regulated search services (as indicated by the headings).

All services

(2) A duty to make and keep a written record, in an easily understandable form, of all aspects of every risk assessment under section 26 or 28, including details about how the assessment was carried out and its findings.

(3) A duty to make and keep a written record of any measures taken or in use to comply with a relevant duty which—

(a) are described in a code of practice and recommended for the purpose of compliance with the duty in question, and

(b) apply in relation to the provider and the service in question.

In this section such measures are referred to as “applicable measures in a code of practice”.

(4) If alternative measures have been taken or are in use to comply with a relevant duty, a duty to make and keep a written record containing the following information—

(a) the applicable measures in a code of practice that have not been taken or are not in use,

(b) the alternative measures that have been taken or are in use,

(c) how those alternative measures amount to compliance with the duty in question, and

(d) how the provider has complied with section 49(5) (freedom of expression and privacy).

(5) If alternative measures have been taken or are in use to comply with a duty set out in section 27(2) or (3) or 29(2) or (3), the record required under subsection (4) of this section must also indicate whether such measures have been taken or are in use in every area listed in subsection (4) of those sections in relation to which there are applicable measures in a code of practice.

(6) A duty to review compliance with the relevant duties in relation to a service—

(a) regularly, and

(b) as soon as reasonably practicable after making any significant change to any aspect of the design or operation of the service.

(7) OFCOM may provide that particular descriptions of providers of search services are exempt from any or all of the duties set out in this section, and may revoke such an exemption.

(8) OFCOM must publish details of any exemption or revocation under subsection (7), including reasons for the revocation of an exemption.

Additional duty for Category 2A services

(9) As soon as reasonably practicable after making a record of a risk assessment as required by subsection (2), or revising such a record, a duty to supply OFCOM with a copy of the record (in full).

Interpretation

(10) In this section—

• “alternative measures” means measures other than measures which are (in relation to the provider and the service in question) applicable measures in a code of practice;

• “code of practice” means a code of practice published under section 46;

• “relevant duties” means the duties set out in—

  (a)

  section 27 (illegal content),

  (b)

  section 29 (children’s online safety),

  (c)

  section 31 (content reporting), and

  (d)

  section 32 (complaints procedures),

and for the purposes of subsection (6), also includes the duties set out in section 75 (deceased child users).

Commencement Information

I56 S. 34 not in force at Royal Assent, see s. 240(1)

I57 S. 34(1)-(9) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)

I58 S. 34(10) in force at 10.1.2024 for specified purposes by S.I. 2023/1420, reg. 2(j)

CHAPTER 4 U.K. Children's access assessments

35 Children’s access assessments U.K.

(1) In this Part, a “children’s access assessment” means an assessment of a Part 3 service—

(a) to determine whether it is possible for children to access the service or a part of the service, and

(b) if it is possible for children to access the service or a part of the service, to determine whether the child user condition is met in relation to the service or a part of the service.

(2) A provider is only entitled to conclude that it is not possible for children to access a service, or a part of it, if age verification or age estimation is used on the service with the result that children are not normally able to access the service or that part of it.

(3) The “child user condition” is met in relation to a service, or a part of a service, if—

(a) there is a significant number of children who are users of the service or of that part of it, or

(b) the service, or that part of it, is of a kind likely to attract a significant number of users who are children.

(4) For the purposes of subsection (3)—

(a) the reference to a “significant” number includes a reference to a number which is significant in proportion to the total number of United Kingdom users of a service or (as the case may be) a part of a service;

(b) whether the test in paragraph (a) of that subsection is met is to be based on evidence about who actually uses a service, rather than who the intended users of the service are.

(5) In this Chapter—

(a) references to children are to children in the United Kingdom;

(b) references to a part of a service do not include any part of a service that is not, or is not included in, a user-to-user part of a service or a search engine.

Commencement Information

I59 S. 35 not in force at Royal Assent, see s. 240(1)

I60 S. 35 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(k)

36 Duties about children’s access assessments U.K.

(1) A provider of a Part 3 service must carry out the first children’s access assessment at a time set out in, or as provided by, Schedule 3.

(2) Subsections (3) and (4) apply to a provider of a Part 3 service during any period when the service is not treated as likely to be accessed by children (see section 37).

(3) The provider must carry out children’s access assessments of the service not more than one year apart.

(4) The provider must carry out a children’s access assessment of the service—

(a) before making any significant change to any aspect of the service’s design or operation to which such an assessment is relevant,

(b) in response to evidence about reduced effectiveness of age verification or age estimation that is used on the service as mentioned in section 35(2), or

(c) in response to evidence about a significant increase in the number of children using the service.

(5) If a person is the provider of more than one Part 3 service, children’s access assessments must be carried out for each service separately.

(6) Children’s access assessments must be suitable and sufficient for the purposes of this Part.

(7) A provider must make and keep a written record, in an easily understandable form, of every children’s access assessment.

Commencement Information

I61 S. 36 not in force at Royal Assent, see s. 240(1)

I62 S. 36 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(k)

37 Meaning of “likely to be accessed by children” U.K.

(1) For the purposes of this Part, a Part 3 service is to be treated as “likely to be accessed by children” in the following three cases (with the result that the duties set out in sections 11 and 12, or (as the case may be) sections 28 and 29, apply in relation to the service).

(2) The first case is where a children’s access assessment carried out by the provider of the service concludes that—

(a) it is possible for children to access the service or a part of it, and

(b) the child user condition is met in relation to—

(i) the service, or

(ii) a part of the service that it is possible for children to access.

This subsection is to be interpreted consistently with section 35.

(3) In that case, the service is to be treated as likely to be accessed by children from the date on which the children’s access assessment is completed.

(4) The second case is where the provider of the service fails to carry out the first children’s access assessment as required by section 36(1).

(5) In that case—

(a) the service is to be treated as likely to be accessed by children from the date by which the first children’s access assessment was required to have been completed (see Part 1 of Schedule 3), and

(b) the service is to continue to be treated as likely to be accessed by children by reason of subsection (4) until such time as the provider completes the first children’s access assessment of the service.

(6) The third case is where, following an investigation into a failure to comply with a duty set out in section 36, OFCOM determine that a service should be treated as likely to be accessed by children: see section 135(4) and (5).

(7) In that case, the service is to be treated as likely to be accessed by children from the date of, or specified in, the confirmation decision given to the provider of the service (as the case may be: see section 135(5)).

Commencement Information

I63 S. 37 not in force at Royal Assent, see s. 240(1)

I64 S. 37 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(k)

CHAPTER 5 U.K. Duties about fraudulent advertising

38 Duties about fraudulent advertising: Category 1 services U.K.

(1) A provider of a Category 1 service must operate the service using proportionate systems and processes designed to—

(a) prevent individuals from encountering content consisting of fraudulent advertisements by means of the service;

(b) minimise the length of time for which any such content is present;

(c) where the provider is alerted by a person to the presence of such content, or becomes aware of it in any other way, swiftly take down such content.

(2) A provider of a Category 1 service must include clear and accessible provisions in the terms of service giving information about any proactive technology used by the service for the purpose of compliance with the duty set out in subsection (1) (including the kind of technology, when it is used, and how it works).

(3) In relation to a Category 1 service, an advertisement is a “fraudulent advertisement” if—

(a) it is a paid-for advertisement (see section 236),

(b) it amounts to an offence specified in section 40 (construed in accordance with section 59: see subsections (3), (11) and (12) of that section), and

(c) it is not regulated user-generated content (see section 55) in relation to the service.

(4) If a person is the provider of more than one Category 1 service, the duties set out in this section apply in relation to each such service.

(5) In determining what is proportionate for the purposes of this section, the following factors, in particular, are relevant—

(a) the nature, and severity, of potential harm to individuals presented by different kinds of fraudulent advertisement, and

(b) the degree of control a provider has in relation to the placement of advertisements on the service.

(6) In the case of a Category 1 service which is a combined service, the duties set out in this section do not extend to—

(a) fraudulent advertisements that may be encountered in search results of the service or, following a search request, as a result of subsequent interactions with internet services, or

(b) anything relating to the design, operation or use of the search engine.

But if the service is also a Category 2A service, the duties set out in section 39 apply as well as the duties set out in this section.

(7) The duties set out in this section extend only to the design, operation and use of a Category 1 service in the United Kingdom.

(8) For the meaning of “Category 1 service”, see section 95 (register of categories of services).

Commencement Information

I65 S. 38 not in force at Royal Assent, see s. 240(1)

I66 S. 38 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(l)

39 Duties about fraudulent advertising: Category 2A services U.K.

(1) A provider of a Category 2A service must operate the service using proportionate systems and processes designed to—

(a) prevent individuals from encountering content consisting of fraudulent advertisements in or via search results of the service;

(b) if any such content may be encountered in or via search results of the service, minimise the length of time that that is the case;

(c) where the provider is alerted by a person to the fact that such content may be so encountered, or becomes aware of that fact in any other way, swiftly ensure that individuals are no longer able to encounter such content in or via search results of the service.

(2) A provider of a Category 2A service must include clear and accessible provisions in a publicly available statement giving information about any proactive technology used by the service for the purpose of compliance with the duty set out in subsection (1) (including the kind of technology, when it is used, and how it works).

(3) In relation to a Category 2A service, an advertisement is a “fraudulent advertisement” if—

(a) it is a paid-for advertisement (see section 236), and

(b) it amounts to an offence specified in section 40 (construed in accordance with section 59: see subsections (3), (11) and (12) of that section).

(4) The references to encountering fraudulent advertisements “in or via search results” of a search service—

(a) are references to encountering fraudulent advertisements—

(i) in search results of the service, or

(ii) as a result of interacting with a paid-for advertisement in search results of the service (for example, by clicking on it);

(b) do not include references to encountering fraudulent advertisements as a result of any subsequent interactions with an internet service other than the search service.

(5) If a person is the provider of more than one Category 2A service, the duties set out in this section apply in relation to each such service.

(6) In determining what is proportionate for the purposes of this section, the following factors, in particular, are relevant—

(a) the nature, and severity, of potential harm to individuals presented by different kinds of fraudulent advertisement, and

(b) the degree of control a provider has in relation to the placement of advertisements on the service.

(7) The duties set out in this section extend only to the design, operation and use of a Category 2A service in the United Kingdom.

(8) For the meaning of “Category 2A service”, see section 95 (register of categories of services).

Commencement Information

I67 S. 39 not in force at Royal Assent, see s. 240(1)

I68 S. 39 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(l)

40 Fraud etc offences U.K.

(1) This section specifies offences for the purposes of this Chapter (see sections 38(3)(b) and 39(3)(b)).

(2) An offence under any of the following provisions of the Financial Services and Markets Act 2000—

(a) section 23 (contravention of prohibition on carrying on regulated activity unless authorised or exempt);

(b) section 24 (false claims to be authorised or exempt);

(c) section 25 (contravention of restrictions on financial promotion).

(3) An offence under any of the following provisions of the Fraud Act 2006—

(a) section 2 (fraud by false representation);

(b) section 4 (fraud by abuse of position);

(c) section 7 (making or supplying articles for use in frauds);

(d) section 9 (participating in fraudulent business carried on by sole trader etc).

(4) An offence under any of the following provisions of the Financial Services Act 2012—

(a) section 89 (misleading statements);

(b) section 90 (misleading impressions).

(5) An offence of attempting or conspiring to commit an offence specified in subsection (2), (3) or (4).

(6) An offence under Part 2 of the Serious Crime Act 2007 (encouraging or assisting) in relation to an offence specified in subsection (2), (3) or (4), or (in Scotland) inciting a person to commit such an offence.

(7) An offence of aiding, abetting, counselling or procuring the commission of an offence specified in subsection (2), (3) or (4), or (in Scotland) being involved art and part in the commission of such an offence.

Commencement Information

I69 S. 40 not in force at Royal Assent, see s. 240(1)

I70 S. 40 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(l)

CHAPTER 6 U.K. Codes of practice and guidance

Codes of practice U.K.

41 Codes of practice about duties U.K.

(1) OFCOM must prepare and issue a code of practice for providers of Part 3 services describing measures recommended for the purpose of compliance with duties set out in section 10 or 27 (illegal content) so far as relating to terrorism content or offences within Schedule 5 (terrorism offences).

(2) OFCOM must prepare and issue a code of practice for providers of Part 3 services describing measures recommended for the purpose of compliance with duties set out in section 10 or 27 (illegal content) so far as relating to CSEA content or offences within Schedule 6 (child sexual exploitation and abuse offences).

(3) OFCOM must prepare and issue one or more codes of practice for providers of Part 3 services describing measures recommended for the purpose of compliance with the relevant duties (except to the extent that measures for the purpose of compliance with such duties are described in a code of practice prepared under subsection (1) or (2)).

(4) OFCOM must prepare and issue a code of practice for providers of Category 1 services and providers of Category 2A services describing measures recommended for the purpose of compliance with the duties set out in Chapter 5 (fraudulent advertising).

(5) Where a code of practice under this section is in force, OFCOM may—

(a) prepare a draft of amendments of the code of practice;

(b) prepare a draft of a code of practice under subsection (1), (2), (3) or (4) as a replacement for a code of practice previously issued under the subsection in question;

(c) withdraw the code of practice.

(6) In the course of preparing a draft of a code of practice or amendments of a code of practice under this section, OFCOM must consult—

(a) the Secretary of State,

(b) persons who appear to OFCOM to represent providers of Part 3 services,

(c) persons who appear to OFCOM to represent the interests of United Kingdom users of Part 3 services,

(d) persons who appear to OFCOM to represent the interests of children (generally or with particular reference to online safety matters),

(e) persons who appear to OFCOM to represent the interests of persons who have suffered harm as a result of matters to which the code of practice is relevant,

(f) persons whom OFCOM consider to have relevant expertise in equality issues and human rights, in particular—

(i) the right to freedom of expression set out in Article 10 of the Convention, and

(ii) the right to respect for a person’s private and family life, home and correspondence set out in Article 8 of the Convention,

(g) the Information Commissioner,

(h) the Children’s Commissioner,

(i) the Commissioner for Victims and Witnesses,

(j) the Domestic Abuse Commissioner,

(k) persons whom OFCOM consider to have expertise in public health, science or medicine that is relevant to online safety matters,

(l) persons whom OFCOM consider to have expertise in innovation, or emerging technology, that is relevant to online safety matters, and

(m) such other persons as OFCOM consider appropriate.

(7) In the course of preparing a draft of a code of practice or amendments to which this subsection applies, OFCOM must also consult persons whom OFCOM consider to have expertise in the enforcement of the criminal law and the protection of national security that is relevant to online safety matters.

(8) Subsection (7) applies to—

(a) a code of practice under subsection (1) and amendments of such a code,

(b) a code of practice under subsection (2) and amendments of such a code,

(c) a code of practice under subsection (3) that describes measures recommended for the purpose of compliance with duties set out in section 10 or 27 (illegal content),

(d) amendments of a code of practice under subsection (3), if and to the extent that those amendments relate to measures recommended for the purpose of compliance with duties set out in section 10 or 27, and

(e) a code of practice under subsection (4) and amendments of such a code.

(9) Subsections (6) and (7) are subject to section 48 (minor amendments of code of practice).

(10) In this section “the relevant duties” means the duties set out in—

(a) sections 10 and 27 (illegal content),

(b) sections 12 and 29 (children’s online safety),

(c) section 15 (user empowerment),

(d) section 17 (content of democratic importance),

(e) section 19 (journalistic content),

(f) sections 20 and 31 (content reporting), and

(g) sections 21 and 32 (complaints procedures).

Commencement Information

I71 S. 41(1)-(3)(5)-(10) in force at Royal Assent, see s. 240(4)(c)

I72 S. 41(4) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(m)

42 Codes of practice: principles, objectives, content U.K.

Schedule 4 contains—

(a) provision about the principles OFCOM must consider when preparing codes of practice under section 41,

(b) the online safety objectives (and a power for the Secretary of State by regulations to revise those objectives),

(c) provision about the measures that may be described in codes of practice (including, in particular, constraints on the recommendation of the use of proactive technology), and

(d) other provision related to codes of practice.

Commencement Information

I73 S. 42 in force at Royal Assent, see s. 240(4)(d)

43 Procedure for issuing codes of practice U.K.

(1) Where OFCOM have prepared a draft of a code of practice under section 41, they must submit the draft to the Secretary of State.

(2) Unless the Secretary of State intends to give a direction to OFCOM under section 44(1), (2) or (3) in relation to the draft, the Secretary of State must, as soon as reasonably practicable, lay the draft before Parliament.

(3) If, within the 40-day period, either House of Parliament resolves not to approve the draft—

(a) OFCOM must not issue the code of practice in the form of that draft, and

(b) OFCOM must prepare another draft of the code of practice under section 41.

(4) If no such resolution is made within that period—

(a) OFCOM must issue the code of practice in the form of the draft laid before Parliament, and

(b) the code of practice comes into force at the end of the period of 21 days beginning with the day on which it is issued.

(5) “The 40-day period” is the period of 40 days beginning with the day on which the draft is laid before Parliament (or, if it is not laid before each House of Parliament on the same day, the later of the days on which it is laid).

(6) In calculating the 40-day period, no account is to be taken of any period during which Parliament is dissolved or prorogued or during which both Houses are adjourned for more than 4 days.

(7) Subsections (1) to (6) apply in relation to a draft of amendments of a code of practice prepared under section 41 as they apply in relation to a draft of a code of practice prepared under that section.

(8) This section is subject to section 48 (minor amendments of codes of practice).

(9) Subsection (11) applies to—

(a) a draft of the first code of practice prepared under section 41(1) (terrorism code of practice);

(b) a draft of the first code of practice prepared under section 41(2) (CSEA code of practice);

(c) a draft of the first code of practice prepared under section 41(3) relating to a duty set out in section 10 or 27 (illegal content);

(d) a draft of the first code of practice prepared under section 41(3) relating to a duty set out in section 12 or 29 (children’s online safety);

(e) a draft of the first code of practice prepared under section 41(3) relating to a duty set out in section 20 or 31 (content reporting);

(f) a draft of the first code of practice prepared under section 41(3) relating to—

(i) a duty set out in section 21 (complaints procedures) that concerns complaints of a kind mentioned in subsection (4) or (5) of that section, or

(ii) a duty set out in section 32 (complaints procedures).

(10) For the purposes of paragraphs (c) to (f) of subsection (9) a draft of a code of practice is a draft of the first code of practice relating to a duty if—

(a) it describes measures recommended for the purpose of compliance with the duty, and

(b) it is a draft of the first code of practice prepared under section 41(3) that describes measures for that purpose.

(11) OFCOM must submit a draft to which this subsection applies to the Secretary of State under subsection (1) within the period of 18 months beginning with the day on which this Act is passed.

(12) If OFCOM consider that it is necessary to extend the period mentioned in subsection (11) in relation to a draft mentioned in any of paragraphs (a) to (f) of subsection (9), OFCOM may extend the period in relation to that draft by up to 12 months by making and publishing a statement.

But this is subject to subsection (15).

(13) A statement under subsection (12) must set out—

(a) the reasons why OFCOM consider that it is necessary to extend the period mentioned in subsection (11) in relation to the draft concerned, and

(b) the period of extension.

(14) A statement under subsection (12) may be published at the same time as (or incorporate) a statement under section 194(3) (extension of time to prepare certain guidance).

(15) But a statement under subsection (12) may not be made in relation to a draft mentioned in a particular paragraph of subsection (9) if—

(a) a statement has previously been made under subsection (12) (whether in relation to a draft mentioned in the same or a different paragraph of subsection (9)), or

(b) a statement has previously been made under section 194(3).

Commencement Information

I74 S. 43 in force at Royal Assent, see s. 240(4)(e)

44 Secretary of State’s powers of direction U.K.

(1) The Secretary of State may direct OFCOM to modify a draft of a code of practice submitted under section 43(1) if the Secretary of State believes that modifications are required for the purpose of securing compliance with an international obligation of the United Kingdom.

(2) The Secretary of State may direct OFCOM to modify a draft of a code of practice, other than a terrorism or CSEA code of practice, submitted under section 43(1) if the Secretary of State believes that modifications are required for exceptional reasons relating to—

(a) national security,

(b) public safety,

(c) public health, or

(d) relations with the government of a country outside the United Kingdom.

(3) The Secretary of State may direct OFCOM to modify a draft of a terrorism or CSEA code of practice submitted under section 43(1) if the Secretary of State believes that modifications are required—

(a) for reasons of national security or public safety, or

(b) for exceptional reasons relating to public health or relations with the government of a country outside the United Kingdom.

(4) But if a draft of a terrorism or CSEA code of practice is submitted under section 43(1) following a review under section 47(2), the Secretary of State may only direct OFCOM to modify the draft if the Secretary of State believes that modifications are required for reasons of national security or public safety.

(5) If, following a review of a terrorism or CSEA code of practice under section 47(2), OFCOM submit a statement to the Secretary of State under section 47(3)(b) (“OFCOM’s review statement”), the Secretary of State may direct OFCOM to modify the code of practice if the Secretary of State believes that modifications are required for reasons of national security or public safety.

(6) A direction given under subsection (5)—

(a) must be given within the period of 45 days beginning with the day on which OFCOM’s review statement is submitted to the Secretary of State, and

(b) must make particular reference to OFCOM’s review statement.

(7) A direction given under this section—

(a) may not require OFCOM to include in a code of practice provision about a particular measure recommended to be taken or used by providers of Part 3 services,

(b) must set out the Secretary of State’s reasons for requiring modifications, except in a case where the Secretary of State considers that doing so would be against the interests of national security, public safety or relations with the government of a country outside the United Kingdom, and

(c) must, as soon as reasonably practicable, be published and laid before Parliament.

(8) If the Secretary of State considers that publishing and laying before Parliament a direction given under this section would be against the interests of national security, public safety or relations with the government of a country outside the United Kingdom—

(a) subsection (7)(c) does not apply in relation to the direction, and

(b) the Secretary of State must, as soon as reasonably practicable, publish and lay before Parliament a document stating—

(i) that a direction has been given,

(ii) the kind of code of practice to which it relates, and

(iii) the reasons for not publishing it.

(9) If the Secretary of State gives a direction under this section, OFCOM must, as soon as reasonably practicable—

(a) comply with the direction,

(b) submit to the Secretary of State a draft of the code of practice modified in accordance with the direction,

(c) submit to the Secretary of State a document containing—

(i) (except in a case mentioned in subsection (7)(b)) details of the direction, and

(ii) details about how the draft has been revised in response to the direction,

(d) publish the document, and

(e) inform the Secretary of State about modifications that OFCOM have made to the draft that are not in response to the direction (if there are any).

(10) The Secretary of State may give OFCOM one or more further directions requiring OFCOM to modify the draft of the code of practice.

(11) Such further directions may only be given for the reasons set out in subsection (1), (2), (3), (4) or (5) (as the case may be), and subsections (7) to (9) apply again in relation to such further directions.

(12) When the Secretary of State is satisfied that no further modifications to the draft are required, the Secretary of State must, as soon as reasonably practicable, lay before Parliament—

(a) the modified draft,

(b) any document submitted by OFCOM as mentioned in subsection (9)(c), and

(c) in the case of a direction under subsection (5), OFCOM’s review statement.

(13) Before laying OFCOM’s review statement before Parliament, the Secretary of State may, with OFCOM’s agreement, remove or obscure information in the statement (whether by redaction or otherwise) in order to prevent the disclosure of matters that the Secretary of State considers would be against the interests of national security, public safety or relations with the government of a country outside the United Kingdom.

(14) This section applies in relation to a draft of amendments of a code of practice submitted under section 43(1) as it applies in relation to a draft of a code of practice submitted under that provision.

(15) In this section “terrorism or CSEA code of practice” means a code of practice under section 41(1) or (2).

Commencement Information

I75 S. 44 in force at Royal Assent, see s. 240(4)(e)

45 Procedure for issuing codes of practice following direction under section 44 U.K.

(1) This section sets out the procedure that applies where a draft of a code of practice is laid before Parliament under section 44(12).

(2) If the draft contains modifications made following a direction given under section 44(1), (2) or (3)(b), the affirmative procedure applies.

(3) If the draft contains modifications made following a direction given under section 44(3)(a), (4) or (5), the negative procedure applies.

(4) The “affirmative procedure” is as follows—

(a) a code of practice in the form of the draft laid before Parliament must not be issued by OFCOM unless the draft has been approved by a resolution of each House of Parliament;

(b) if the draft is so approved, the code of practice comes into force at the end of the period of 21 days beginning with the day on which it is issued;

(c) if the draft is not so approved, OFCOM must prepare another draft of the code of practice under section 41.

(5) The “negative procedure” is as follows—

(a) if, within the 40-day period, either House of Parliament resolves not to approve the draft—

(i) OFCOM must not issue the code of practice in the form of that draft, and

(ii) OFCOM must prepare another draft of the code of practice under section 41;

(b) if no such resolution is made within that period—

(i) OFCOM must issue the code of practice in the form of the draft laid before Parliament, and

(ii) the code of practice comes into force at the end of the period of 21 days beginning with the day on which it is issued.

(6) “The 40-day period” has the same meaning as in section 43 (see subsections (5) and (6) of that section).

(7) This section applies in relation to a draft of amendments of a code of practice laid before Parliament under section 44(12) as it applies in relation to a draft of a code of practice laid under that provision.

Commencement Information

I76 S. 45 in force at Royal Assent, see s. 240(4)(e)

46 Publication of codes of practice U.K.

(1) OFCOM must publish each code of practice issued under section 43 or 45 within the period of three days beginning with the day on which it is issued.

(2) Where amendments of a code of practice are issued under either of those sections, OFCOM must publish the amended code of practice within the period of three days beginning with the day on which the amendments are issued.

(3) Where a code of practice is withdrawn, OFCOM must publish a notice to that effect.

Commencement Information

I77 S. 46 in force at Royal Assent, see s. 240(4)(e)

47 Review of codes of practice U.K.

(1) OFCOM must keep under review each code of practice published under section 46.

(2) The Secretary of State may require OFCOM to review a terrorism or CSEA code of practice published under section 46 if the Secretary of State considers a review to be necessary for reasons of national security or public safety (and the Secretary of State must notify OFCOM whether the reasons fall into the category of national security or public safety).

(3) OFCOM must carry out a review of the code of practice under subsection (2) as soon as reasonably practicable, and when it is completed—

(a) if OFCOM consider that changes are required, they must prepare a draft of amendments to the code of practice or a draft of a replacement code of practice under section 41, or

(b) if OFCOM consider that no changes are required, they must submit to the Secretary of State a statement which explains the reasons for that conclusion.

(4) Subsection (5) applies if—

(a) OFCOM submit a statement under subsection (3)(b) to the Secretary of State,

(b) the period of 45 days beginning with the day on which the statement was submitted has elapsed, and

(c) the Secretary of State has not given a direction under section 44(5).

(5) OFCOM must publish the statement as soon as reasonably practicable after the end of the period mentioned in subsection (4)(b), making it clear which code of practice the statement relates to.

(6) In advance of publication, the Secretary of State may make representations to OFCOM about the desirability of removing or obscuring information in the statement (whether by redaction or otherwise) in order to prevent the disclosure of matters that the Secretary of State considers would be against the interests of national security, public safety or relations with the government of a country outside the United Kingdom (and see also section 116(3)).

(7) In this section “terrorism or CSEA code of practice” means a code of practice under section 41(1) or (2).

Commencement Information

I78 S. 47 in force at Royal Assent, see s. 240(4)(e)

48 Minor amendments of codes of practice U.K.

(1) This section applies if—

(a) OFCOM propose to amend a code of practice under section 41, and

(b) OFCOM consider that the minor nature of the proposal means that—

(i) consultation is unnecessary, and

(ii) the proposed amendments should not be required to be laid before Parliament.

(2) OFCOM must notify the Secretary of State of the proposed amendments.

(3) If the Secretary of State agrees with OFCOM that it is appropriate—

(a) the consultation requirements set out in section 41(6) and (7) do not apply in relation to the proposed amendments, and

(b) section 43 does not apply to the amendments, once prepared.

(4) If the Secretary of State agrees with OFCOM as mentioned in subsection (3), OFCOM may prepare and issue the amendments of the code of practice.

(5) Amendments of a code of practice issued under this section come into force at the end of the period of 21 days beginning with the day on which the amendments are issued.

(6) Section 46(2) applies in relation to amendments of a code of practice issued under this section as it applies in relation to amendments of a code of practice issued under section 43 or 45.

Commencement Information

I79 S. 48 in force at Royal Assent, see s. 240(4)(e)

49 Relationship between duties and codes of practice U.K.

Duties set out in Chapters 2 and 3

(1) A provider of a Part 3 service is to be treated as complying with a relevant duty if the provider takes or uses the measures described in a code of practice which are recommended for the purpose of compliance with the duty in question.

(2) A provider of a user-to-user service—

(a) is to be treated as complying with the duty set out in section 22(2) (freedom of expression) if the provider takes or uses such of the relevant recommended measures as incorporate safeguards to protect users’ right to freedom of expression within the law;

(b) is to be treated as complying with the duty set out in section 22(3) (privacy) if the provider takes or uses such of the relevant recommended measures as incorporate safeguards to protect the privacy of users.

(3) A provider of a search service—

(a) is to be treated as complying with the duty set out in section 33(2) (freedom of expression) if the provider takes or uses such of the relevant recommended measures as incorporate safeguards to protect the rights of users and interested persons to freedom of expression within the law;

(b) is to be treated as complying with the duty set out in section 33(3) (privacy) if the provider takes or uses such of the relevant recommended measures as incorporate safeguards to protect the privacy of users.

Duties set out in Chapter 5

(4) A provider of a Category 1 service or a Category 2A service (or a provider of a service which is both a Category 1 service and a Category 2A service) is to be treated as complying with a duty set out in Chapter 5 if the provider takes or uses the measures described in a fraudulent advertising code of practice which are recommended for the purpose of compliance with the duty in question.

Alternative measures

(5) A provider of a Part 3 service who seeks to comply with a relevant duty by acting otherwise than by taking or using a measure described in a code of practice or a fraudulent advertising code of practice which is recommended for the purpose of compliance with the duty must have particular regard to the importance of the following (where relevant)—

(a) protecting the right of users and (in the case of search services) interested persons to freedom of expression within the law, and

(b) protecting the privacy of users.

(6) When assessing whether a provider of a Part 3 service is compliant with a relevant duty where the provider has acted otherwise than by taking or using a measure described in a code of practice or a fraudulent advertising code of practice which is recommended for the purpose of compliance with the duty, OFCOM must consider the extent to which the alternative measures taken or in use by the provider—

(a) extend across all areas of a service as mentioned in section 10(4), 12(8), 27(4) or 29(4) (if relevant to the duty in question), and

(b) (where appropriate) incorporate safeguards for the protection of the matters mentioned in subsection (5)(a) and (b).

Interpretation

(7) In subsections (1) to (4), references to taking or using measures recommended for the purpose of compliance with a duty, or to taking or using relevant recommended measures, are to taking or using such of those measures as are relevant to the provider and the service in question.

(8) In this section—

(a) references to protecting the privacy of users are to protecting users from a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of a user-to-user service or search service (including, but not limited to, any such provision or rule concerning the processing of personal data);

(b) references to a search service include references to a combined service (see section 7(6)).

(9) In this section—

• “Chapter 2 safety duty” means a duty set out in—

  (a)

  section 10 (illegal content), or

  (b)

  section 12 (children’s online safety);

• “Chapter 3 safety duty” means a duty set out in—

  (a)

  section 27 (illegal content), or

  (b)

  section 29 (children’s online safety);

• “code of practice” means a code of practice published under section 46, except a fraudulent advertising code of practice;

• “fraudulent advertising code of practice” means a code of practice prepared under section 41(4) and published under section 46;

• “relevant duty” means—

  (a)

  a Chapter 2 safety duty,

  (b)

  a Chapter 3 safety duty,

  (c)

  a duty set out in section 15 (user empowerment),

  (d)

  a duty set out in section 17 (content of democratic importance),

  (e)

  a duty set out in section 19 (journalistic content),

  (f)

  a duty set out in section 20 or 31 (content reporting), or

  (g)

  a duty set out in section 21 or 32 (complaints procedures);

• “relevant recommended measures” means the measures described in a code of practice which are recommended for the purpose of compliance with—

  (a)

  in the case of a user-to-user service—

  (i)

  a Chapter 2 safety duty, or

  (ii)

  a duty set out in section 15 (user empowerment);

  (b)

  in the case of a search service, a Chapter 3 safety duty.

Commencement Information

I80 S. 49 not in force at Royal Assent, see s. 240(1)

I81 S. 49 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(n)

50 Effects of codes of practice U.K.

(1) A failure by a provider of a Part 3 service to act in accordance with a provision of a code of practice does not of itself make the provider liable to legal proceedings in a court or tribunal.

(2) A code of practice is admissible in evidence in legal proceedings.

(3) In any proceedings in a court or tribunal, the court or tribunal must take into account a provision of a code of practice in determining a question arising in the proceedings if—

(a) the question relates to a time when the provision was in force, and

(b) the provision appears to the court or tribunal to be relevant to the question.

(4) OFCOM must take into account a provision of a code of practice in determining a question arising in connection with their exercise of any relevant function if—

(a) the question relates to a time when the provision was in force, and

(b) the provision appears to OFCOM to be relevant to the question.

(5) In this section—

• “code of practice” means a code of practice published under section 46;

• “relevant functions” means OFCOM’s functions under—

  (a)

  Chapter 4 of Part 7 (information),

  (b)

  Chapter 5 of Part 7 (notices to deal with terrorism content and CSEA content),

  (c)

  Chapter 6 of Part 7 (enforcement), and

  (d)

  Chapter 2 of Part 8 (super-complaints).

Commencement Information

I82 S. 50 not in force at Royal Assent, see s. 240(1)

I83 S. 50 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(n)

51 Duties and the first codes of practice U.K.

(1) A duty mentioned in subsection (3) applies to providers of Part 3 services from the day on which a code of practice prepared under section 41(3) that is the first code of practice relating to that duty comes into force.

(2) In the case of the duties set out in sections 10 and 27, subsection (1) is subject to subsections (5) and (6).

(3) The duties referred to in subsection (1) are the duties set out in—

(a) sections 10 and 27 (illegal content),

(b) sections 12 and 29 (children’s online safety),

(c) section 15 (user empowerment),

(d) section 17 (content of democratic importance),

(e) section 19 (journalistic content),

(f) sections 20 and 31 (content reporting), and

(g) sections 21 and 32 (complaints procedures).

(4) For the purposes of subsection (1) a code of practice is the first code of practice relating to a duty if—

(a) it describes measures recommended for the purpose of compliance with that duty, and

(b) it is the first code of practice prepared under section 41(3) that describes measures for that purpose.

(5) The duties set out in sections 10 and 27, so far as relating to terrorism content or offences within Schedule 5 (terrorism offences), apply to providers of Part 3 services from the day on which the first code of practice prepared under section 41(1) comes into force.

(6) The duties set out in sections 10 and 27, so far as relating to CSEA content or offences within Schedule 6 (child sexual exploitation and abuse offences), apply to providers of Part 3 services from the day on which the first code of practice prepared under section 41(2) comes into force.

(7) The duties set out in Chapter 5 (fraudulent advertising) apply to providers of a Category 1 service and providers of a Category 2A service (and to providers of a service which is both a Category 1 service and a Category 2A service) from the day on which the first code of practice prepared under section 41(4) comes into force.

(8) In relation to the provider of a particular Part 3 service, references in this section to duties applying to providers of Part 3 services (or to providers of Category 1 services or Category 2A services) are to such duties as apply in relation to that service in accordance with sections 7 and 24 or (as the case may be) Chapter 5.

(9) This section is subject to Part 2 of Schedule 17 (video-sharing platform services: transitional provision etc).

Commencement Information

I84 S. 51 not in force at Royal Assent, see s. 240(1)

I85 S. 51 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(n)

Guidance U.K.

52 OFCOM’s guidance about certain duties in Part 3 U.K.

(1) OFCOM must produce guidance for providers of Category 1 services to assist them in complying with their duties set out in section 14 (assessments related to the adult user empowerment duty set out in section 15(2)).

(2) OFCOM must produce guidance for providers of Category 1 services to assist them in complying with their duties set out in section 18 (news publisher content).

(3) OFCOM must produce guidance for providers of Part 3 services to assist them in complying with—

(a) their duties set out in section 23 or 34, except the duty set out in section 23(10) or 34(9) (record-keeping and review), and

(b) their duties set out in section 36 (children’s access assessments).

(4) Before producing guidance under subsection (1) or (3) (including revised or replacement guidance), OFCOM must consult the Information Commissioner.

(5) OFCOM must publish guidance under this section (and any revised or replacement guidance).

Commencement Information

I86 S. 52(3)-(5) in force at Royal Assent, see s. 240(4)(f)

I87 S. 52(1)(2) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(o)

53 OFCOM’s guidance: content that is harmful to children and user empowerment U.K.

(1) OFCOM must produce guidance for providers of Part 3 services which contains examples of content or kinds of content that OFCOM consider to be, or consider not to be—

(a) primary priority content that is harmful to children, or

(b) priority content that is harmful to children.

(2) OFCOM must produce guidance for providers of Category 1 services which contains examples of content or kinds of content that OFCOM consider to be, or consider not to be, content to which section 15(2) applies (see section 16).

(3) Before producing any guidance under this section (including revised or replacement guidance), OFCOM must consult such persons as they consider appropriate.

(4) OFCOM must publish guidance under this section (and any revised or replacement guidance).

Commencement Information

I88 S. 53(1)(3)(4) in force at Royal Assent, see s. 240(4)(g)

I89 S. 53(2) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(p)

54 OFCOM’s guidance about protecting women and girls U.K.

(1) OFCOM must produce guidance for providers of Part 3 services which focuses on content and activity—

(a) in relation to which such providers have duties set out in this Part or Part 4, and

(b) which disproportionately affects women and girls.

(2) The guidance may, among other things—

(a) contain advice and examples of best practice for assessing risks of harm to women and girls from content and activity mentioned in subsection (1), and for reducing such risks;

(b) refer to provisions contained in a code of practice under section 41 which are particularly relevant to the protection of women and girls from such content and activity.

(3) Before producing the guidance (including revised or replacement guidance), OFCOM must consult—

(a) the Commissioner for Victims and Witnesses,

(b) the Domestic Abuse Commissioner, and

(c) such other persons as OFCOM consider appropriate.

(4) OFCOM must publish the guidance (and any revised or replacement guidance).

Commencement Information

I90 S. 54 not in force at Royal Assent, see s. 240(1)

I91 S. 54 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(q)

CHAPTER 7 U.K. Interpretation of Part 3

55 “Regulated user-generated content”, “user-generated content”, “news publisher content” U.K.

(1) This section applies for the purposes of this Part.

(2) “Regulated user-generated content”, in relation to a regulated user-to-user service, means user-generated content, except—

(a) emails,

(b) SMS messages,

(c) MMS messages,

(d) one-to-one live aural communications (see subsection (5)),

(e) comments and reviews on provider content (see subsection (6)),

(f) identifying content that accompanies content within any of paragraphs (a) to (e), and

(g) news publisher content (see subsection (8)).

(3) “User-generated content”, in relation to a user-to-user service, means content—

(a) that is—

(i) generated directly on the service by a user of the service, or

(ii) uploaded to or shared on the service by a user of the service, and

(b) that may be encountered by another user, or other users, of the service by means of the service.

(4) For the purposes of subsection (3)—

(a) the reference to content generated, uploaded or shared by a user includes content generated, uploaded or shared by means of software or an automated tool applied by the user;

(b) a bot or other automated tool is to be regarded as a user of a service if—

(i) the functions of the bot or tool include interacting with user-generated content, and

(ii) the bot or tool is not controlled by or on behalf of the provider of the service.

(5) “One-to-one live aural communications”, in relation to a user-to-user service, means content—

(a) consisting of speech or other sounds conveyed in real time between two users of the service by means of the service,

(b) that is not a recording, and

(c) that is not accompanied by user-generated content of any other kind, except identifying content.

(6) “Comments and reviews on provider content”, in relation to a user-to-user service, means content present on the service consisting of comments or reviews relating to provider content (together with any further comments on such comments or reviews).

(7) In subsection (6) “provider content” means content published on a service by the provider of the service or by a person acting on behalf of the provider, including where the publication of the content is effected or controlled by means of—

(a) software or an automated tool or algorithm applied by the provider or by a person acting on behalf of the provider, or

(b) an automated tool or algorithm made available on the service by the provider or by a person acting on behalf of the provider.

For the purposes of subsection (6), content that is user-generated content in relation to a service is not to be regarded as provider content in relation to that service.

(8) “News publisher content”, in relation to a regulated user-to-user service, means any content present on the service that is within subsection (9) or (10).

(9) Content is within this subsection if it was generated directly on the service by a user of the service that is a recognised news publisher.

(10) Content is within this subsection if—

(a) the content was uploaded to or shared on the service by a user of the service, and

(b) the content either—

(i) reproduces in full an article or written item that was originally published by a recognised news publisher (and is not a screenshot or photograph of that article or item or of part of it),

(ii) is video or audio content that was originally published or broadcast by a recognised news publisher, and is not a clipped or edited form of such content (unless it is the recognised news publisher who has clipped or edited it), or

(iii) is a link to an article or item within sub-paragraph (i) or to content within sub-paragraph (ii).

(11) For the meaning of “recognised news publisher”, see section 56.

(12) In this section—

• “MMS message” means a Multimedia Messaging Service message (that may include images, sounds and short videos) that may be sent between telephone numbers allocated in accordance with a national or international numbering plan;

• “SMS message” means a Short Message Service text message composed principally of letters or numbers that may be sent between telephone numbers allocated in accordance with a national or international numbering plan.

Commencement Information

I92 S. 55 in force at Royal Assent, see s. 240(4)(h)

56 “Recognised news publisher” U.K.

(1) In this Part, “recognised news publisher” means any of the following entities—

(a) the British Broadcasting Corporation,

(b) Sianel Pedwar Cymru,

(c) the holder of a licence under the Broadcasting Act 1990 or 1996 who publishes news-related material in connection with the broadcasting activities authorised under the licence, and

(d) any other entity which—

(i) meets all of the conditions in subsection (2),

(ii) is not an excluded entity (see subsection (3)), and

(iii) is not a sanctioned entity (see subsection (4)).

(2) The conditions referred to in subsection (1)(d)(i) are that the entity—

(a) has as its principal purpose the publication of news-related material, and such material—

(i) is created by different persons, and

(ii) is subject to editorial control,

(b) publishes such material in the course of a business (whether or not carried on with a view to profit),

(c) is subject to a standards code,

(d) has policies and procedures for handling and resolving complaints,

(e) has a registered office or other business address in the United Kingdom,

(f) is the person with legal responsibility for material published by it in the United Kingdom, and

(g) publishes—

(i) the entity’s name, the address mentioned in paragraph (e) and the entity’s registered number (if any), and

(ii) the name and address of any person who controls the entity (including, where such a person is an entity, the address of that person’s registered or principal office and that person’s registered number (if any)).

(3) An “excluded entity” is an entity—

(a) which is a proscribed organisation under the Terrorism Act 2000 (see section 3 of that Act), or

(b) the purpose of which is to support a proscribed organisation under that Act.

(4) A “sanctioned entity” is an entity which—

(a) is designated by name under a power contained in regulations under section 1 of the Sanctions and Anti-Money Laundering Act 2018 that authorises the Secretary of State or the Treasury to designate persons for the purposes of the regulations or of any provisions of the regulations, or

(b) is a designated person under any provision included in such regulations by virtue of section 13 of that Act (persons named by or under UN Security Council Resolutions).

(5) For the purposes of subsection (2)—

(a) news-related material is “subject to editorial control” if there is a person (whether or not the publisher of the material) who has editorial or equivalent responsibility for the material, including responsibility for how it is presented and the decision to publish it;

(b) “control” has the same meaning as it has in the Broadcasting Act 1990 by virtue of section 202 of that Act.

(6) In this section—

• “news-related material” means material consisting of—

  (a)

  news or information about current affairs,

  (b)

  opinion about matters relating to the news or current affairs, or

  (c)

  gossip about celebrities, other public figures or other persons in the news;

• “publish” means publish by any means (including by broadcasting), and references to a publisher and publication are to be construed accordingly;

• “standards code” means—

  (a)

  a code of standards that regulates the conduct of publishers, that is published by an independent regulator, or

  (b)

  a code of standards that regulates the conduct of the entity in question, that is published by the entity itself.

Commencement Information

I93 S. 56 in force at Royal Assent, see s. 240(4)(h)

57 “Search content”, “search results” etc U.K.

(1) This section applies for the purposes of this Part.

(2) “Search content” means content that may be encountered in or via search results of a search service, except—

(a) paid-for advertisements (see section 236),

(b) content on the website of a recognised news publisher (see section 56), and

(c) content that—

(i) reproduces in full an article or written item that was originally published by a recognised news publisher (and is not a screenshot or photograph of that article or item or of part of it),

(ii) is video or audio content that was originally published or broadcast by a recognised news publisher, and is not a clipped or edited form of such content (unless it is the recognised news publisher who has clipped or edited it), or

(iii) is a link to an article or item within sub-paragraph (i) or to content within sub-paragraph (ii).

(3) “Search results”, in relation to a search service, means content presented to a user of the service by operation of the search engine in response to a search request made by the user.

(4) “Search” means search by any means, including by input of text or images or by speech, and references to a search request are to be construed accordingly.

(5) In subsection (2), the reference to encountering content “via search results”—

(a) is to encountering content as a result of interacting with search results (for example, by clicking on them);

(b) does not include a reference to encountering content as a result of subsequent interactions with an internet service other than the search service.

(6) In this section references to a search service include references to a user-to-user service that includes a search engine.

Commencement Information

I94 S. 57 in force at Royal Assent, see s. 240(4)(h)

58 Restricting users’ access to content U.K.

(1) This section applies for the purposes of this Part.

(2) References to restricting users’ access to content, and related references, include any case where a provider takes or uses a measure which has the effect that—

(a) a user is unable to access content without taking a prior step (whether or not taking that step might result in access being denied), or

(b) content is temporarily hidden from a user.

(3) But such references do not include any case where—

(a) the effect mentioned in subsection (2) results from the voluntary use or application by a user of features, functionalities or settings which a provider includes in a service (for example, features, functionalities or settings included in compliance with the duty set out in section 15(2) or (9) (user empowerment)), or

(b) access to content is controlled by another user, rather than the provider.

(4) See also section 236(6).

Commencement Information

I95 S. 58 in force at Royal Assent, see s. 240(4)(h)

59 “Illegal content” etc U.K.

(1) This section applies for the purposes of this Part.

(2) “Illegal content” means content that amounts to a relevant offence.

(3) Content consisting of certain words, images, speech or sounds amounts to a relevant offence if—

(a) the use of the words, images, speech or sounds amounts to a relevant offence,

(b) the possession, viewing or accessing of the content constitutes a relevant offence, or

(c) the publication or dissemination of the content constitutes a relevant offence.

(4) “Relevant offence” means—

(a) a priority offence, or

(b) an offence within subsection (5).

(5) An offence is within this subsection if—

(a) it is not a priority offence,

(b) the victim or intended victim of the offence is an individual (or individuals), and

(c) the offence is created by this Act or, before or after this Act is passed, by—

(i) another Act,

(ii) an Order in Council,

(iii) an order, rules or regulations made under an Act by the Secretary of State or other Minister of the Crown, including such an instrument made jointly with a devolved authority, or

(iv) devolved subordinate legislation made by a devolved authority with the consent of the Secretary of State or other Minister of the Crown.

(6) But an offence is not within subsection (5) if—

(a) the offence concerns—

(i) the infringement of intellectual property rights,

(ii) the safety or quality of goods (as opposed to what kind of goods they are), or

(iii) the performance of a service by a person not qualified to perform it; or

(b) it is an offence under the Consumer Protection from Unfair Trading Regulations 2008 (S.I. 2008/1277).

(7) “Priority offence” means—

(a) an offence specified in Schedule 5 (terrorism offences),

(b) an offence specified in Schedule 6 (offences related to child sexual exploitation and abuse), or

(c) an offence specified in Schedule 7 (other priority offences).

(8) “Terrorism content” means content that amounts to an offence specified in Schedule 5.

(9) “CSEA content” means content that amounts to an offence specified in Schedule 6.

(10) “Priority illegal content” means—

(a) terrorism content,

(b) CSEA content, and

(c) content that amounts to an offence specified in Schedule 7.

(11) For the purposes of determining whether content amounts to an offence, no account is to be taken of whether or not anything done in relation to the content takes place in any part of the United Kingdom.

(12) References in subsection (3) to conduct of particular kinds are not to be taken to prevent content generated by a bot or other automated tool from being capable of amounting to an offence (see also section 192(7) (providers’ judgements about the status of content)).

(13) Subsection (14) applies in relation to a regulated user-to-user service (but, in the case of a combined service, does not apply in relation to the search content of the service).

(14) References to “illegal content”, “terrorism content”, “CSEA content” and “priority illegal content” are to be read as—

(a) limited to content within the definition in question that is regulated user-generated content in relation to the service, and

(b) including material which, if it were present on the service, would be content within paragraph (a) (and this section is to be read with such modifications as may be necessary for the purpose of this paragraph).

(15) In this section—

• “devolved authority” means—

  (a)

  the Scottish Ministers,

  (b)

  the Welsh Ministers, or

  (c)

  a Northern Ireland department;

• “devolved subordinate legislation” means—

  (a)

  an instrument made under an Act of the Scottish Parliament,

  (b)

  an instrument made under an Act or Measure of Senedd Cymru, or

  (c)

  an instrument made under Northern Ireland legislation;

• “Minister of the Crown” has the meaning given by section 8 of the Ministers of the Crown Act 1975 and also includes the Commissioners for His Majesty’s Revenue and Customs;

• “offence” means an offence under the law of any part of the United Kingdom.

(16) See also section 192 (providers’ judgements about the status of content).

Commencement Information

I96 S. 59 in force at Royal Assent, see s. 240(4)(h)

60 “Content that is harmful to children” U.K.

(1) This section and sections 61 and 62 apply for the purposes of this Part.

(2) “Content that is harmful to children” means—

(a) primary priority content that is harmful to children (see section 61),

(b) priority content that is harmful to children (see section 62), or

(c) content, not within paragraph (a) or (b), of a kind which presents a material risk of significant harm to an appreciable number of children in the United Kingdom.

(3) Content is not to be regarded as within subsection (2)(c) if the risk of harm flows from—

(a) the content’s potential financial impact,

(b) the safety or quality of goods featured in the content, or

(c) the way in which a service featured in the content may be performed (for example, in the case of the performance of a service by a person not qualified to perform it).

(4) “Non-designated content that is harmful to children” means content within subsection (2)(c).

(5) Subsection (6) applies in relation to a regulated user-to-user service (but, in the case of a combined service, does not apply in relation to the search content of the service).

(6) References to “primary priority content that is harmful to children”, “priority content that is harmful to children”, “content that is harmful to children” and “non-designated content that is harmful to children” are to be read as—

(a) limited to content within the definition in question that is regulated user-generated content in relation to the service, and

(b) including material which, if it were present on the service, would be content within paragraph (a) (and this section and sections 61 and 62 are to be read with such modifications as may be necessary for the purpose of this paragraph).

Commencement Information

I97 S. 60 in force at Royal Assent, see s. 240(4)(h)

61 “Primary priority content that is harmful to children” U.K.

(1) “Primary priority content that is harmful to children” means content of any of the following kinds.

(2) Pornographic content, other than content within subsection (6).

(3) Content which encourages, promotes or provides instructions for suicide.

(4) Content which encourages, promotes or provides instructions for an act of deliberate self-injury.

(5) Content which encourages, promotes or provides instructions for an eating disorder or behaviours associated with an eating disorder.

(6) Content is within this subsection if it—

(a) consists only of text, or

(b) consists only of text accompanied by—

(i) identifying content which consists only of text,

(ii) other identifying content which is not itself pornographic content,

(iii) a GIF which is not itself pornographic content,

(iv) an emoji or other symbol, or

(v) any combination of content mentioned in sub-paragraphs (i) to (iv).

(7) In this section and section 62 “injury” includes poisoning.

Commencement Information

I98 S. 61 in force at Royal Assent, see s. 240(4)(h)

62 “Priority content that is harmful to children” U.K.

(1) “Priority content that is harmful to children” means content of any of the following kinds.

(2) Content which is abusive and which targets any of the following characteristics—

(a) race,

(b) religion,

(c) sex,

(d) sexual orientation,

(e) disability, or

(f) gender reassignment.

(3) Content which incites hatred against people—

(a) of a particular race, religion, sex or sexual orientation,

(b) who have a disability, or

(c) who have the characteristic of gender reassignment.

(4) Content which encourages, promotes or provides instructions for an act of serious violence against a person.

(5) Bullying content.

(6) Content which—

(a) depicts real or realistic serious violence against a person;

(b) depicts the real or realistic serious injury of a person in graphic detail.

(7) Content which—

(a) depicts real or realistic serious violence against an animal;

(b) depicts the real or realistic serious injury of an animal in graphic detail;

(c) realistically depicts serious violence against a fictional creature or the serious injury of a fictional creature in graphic detail.

(8) Content which encourages, promotes or provides instructions for a challenge or stunt highly likely to result in serious injury to the person who does it or to someone else.

(9) Content which encourages a person to ingest, inject, inhale or in any other way self-administer—

(a) a physically harmful substance;

(b) a substance in such a quantity as to be physically harmful.

(10) In subsections (2) and (3)—

(a) “disability” means any physical or mental impairment;

(b) “race” includes colour, nationality, and ethnic or national origins;

(c) references to religion include references to a lack of religion.

(11) For the purposes of subsection (3), a person has the characteristic of gender reassignment if the person is proposing to undergo, is undergoing or has undergone a process (or part of a process) for the purpose of reassigning the person’s sex by changing physiological or other attributes of sex, and the reference to gender reassignment in subsection (2) is to be construed accordingly.

(12) For the purposes of subsection (5) content may, in particular, be “bullying content” if it is content targeted against a person which—

(a) conveys a serious threat;

(b) is humiliating or degrading;

(c) forms part of a campaign of mistreatment.

(13) In subsection (6) “person” is not limited to a real person.

(14) In subsection (7) “animal” is not limited to a real animal.

Commencement Information

I99 S. 62 in force at Royal Assent, see s. 240(4)(h)

63 Content harmful to children: OFCOM’s review and report U.K.

(1) OFCOM must carry out reviews of—

(a) the incidence on regulated user-to-user services of content that is harmful to children,

(b) the incidence on regulated search services and combined services of search content that is harmful to children, and

(c) the severity of harm that children in the United Kingdom suffer, or may suffer, as a result of those kinds of content.

(2) OFCOM must produce and publish a report on the outcome of each review.

(3) The report must include advice as to whether, in OFCOM’s opinion, it is appropriate to make changes to sections 61 and 62, specifying the changes that OFCOM recommend.

(4) The reports must be published not more than three years apart.

(5) The first report must be published before the end of the period of three years beginning with the day on which this Act is passed.

(6) OFCOM must send a copy of each report to the Secretary of State.

Commencement Information

I100 S. 63 in force at Royal Assent, see s. 240(4)(h)