Online Safety Act 2023

User-to-user services: which duties apply, and scope of duties U.K.

7 Providers of user-to-user services: duties of care U.K.

(1) Subsections (2) to (6) apply to determine which of the duties set out in this Chapter (and, in the case of combined services, Chapter 3) must be complied with by providers of regulated user-to-user services.

(2) All providers of regulated user-to-user services must comply with the following duties in relation to each such service which they provide—

(a) the duties about illegal content risk assessments set out in section 9,

(b) the duties about illegal content set out in section 10(2) to (8),

(c) the duty about content reporting set out in section 20,

(d) the duties about complaints procedures set out in section 21,

(e) the duties about freedom of expression and privacy set out in section 22(2) and (3), and

(f) the duties about record-keeping and review set out in section 23(2) to (6).

(3) Additional duties must be complied with by providers of particular kinds of regulated user-to-user services, as follows.

(4) All providers of regulated user-to-user services that are likely to be accessed by children must comply with the following duties in relation to each such service which they provide—

(a) the duties about children’s risk assessments set out in section 11, and

(b) the duties to protect children’s online safety set out in section 12(2) to (13).

(5) All providers of Category 1 services must comply with the following duties in relation to each such service which they provide—

(a) the duty about illegal content risk assessments set out in section 10(9),

(b) the duty about children’s risk assessments set out in section 12(14),

(c) the duties about assessments related to adult user empowerment set out in section 14,

(d) the duties to empower adult users set out in section 15,

(e) the duties to protect content of democratic importance set out in section 17,

(f) the duties to protect news publisher content set out in section 18,

(g) the duties to protect journalistic content set out in section 19,

(h) the duties about freedom of expression and privacy set out in section 22(4), (6) and (7), and

(i) the duties about record-keeping set out in section 23(9) and (10).

(6) All providers of combined services must comply with the following duties in relation to the search engine of each such service which they provide—

(a) if the service is not a Category 2A service and is not likely to be accessed by children, the duties set out in Chapter 3 referred to in section 24(2);

(b) if the service is not a Category 2A service and is likely to be accessed by children, the duties set out in Chapter 3 referred to in section 24(2) and (4);

(c) if the service is a Category 2A service not likely to be accessed by children, the duties set out in Chapter 3 referred to in section 24(2) and (5);

(d) if the service is a Category 2A service likely to be accessed by children, the duties set out in Chapter 3 referred to in section 24(2), (4) and (5).

(7) For the meaning of “likely to be accessed by children”, see section 37.

(8) For the meaning of “Category 1 service”, see section 95 (register of categories of services).

Commencement Information

I1 S. 7 not in force at Royal Assent, see s. 240(1)

I2 S. 7(1)-(4)(5)(a)-(e)(g)(i)(6)-(8) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(a)

8 Scope of duties of care U.K.

(1) A duty set out in this Chapter which must be complied with in relation to a user-to-user service that includes regulated provider pornographic content does not extend to—

(a) the regulated provider pornographic content, or

(b) the design, operation or use of the service so far as relating to that content.

See Part 5 for the duties which relate to regulated provider pornographic content, and the meaning of that term.

(2) A duty set out in this Chapter which must be complied with in relation to a combined service does not extend to—

(a) the search content of the service,

(b) any other content that, following a search request, may be encountered as a result of subsequent interactions with internet services, or

(c) anything relating to the design, operation or use of the search engine.

(3) A duty set out in this Chapter which must be complied with in relation to a user-to-user service extends only to—

(a) the design, operation and use of the service in the United Kingdom, and

(b) in the case of a duty that is expressed to apply in relation to users of a service, the design, operation and use of the service as it affects United Kingdom users of the service.

Commencement Information

I3 S. 8 not in force at Royal Assent, see s. 240(1)

I4 S. 8 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(b)