Online Safety Act 2023

PART 5 Duties of providers of regulated services: certain pornographic content

79 “Provider pornographic content” and “regulated provider pornographic content”

(1) This section applies for the purposes of this Part.

(2) “Provider pornographic content”, in relation to an internet service, means pornographic content that is published or displayed on the service by the provider of the service or by a person acting on behalf of the provider, including pornographic content published or displayed on the service by means of—

(a) software or an automated tool or algorithm applied by the provider or by a person acting on behalf of the provider, or

(b) an automated tool or algorithm made available on the service by the provider or by a person acting on behalf of the provider.

(3) “Regulated provider pornographic content”, in relation to an internet service, means provider pornographic content other than content within subsection (4) or (5).

(4) Content is within this subsection if it—

(a) consists only of text, or

(b) consists only of text accompanied by—

(i) a GIF which is not itself pornographic content,

(ii) an emoji or other symbol, or

(iii) a combination of content mentioned in sub-paragraphs (i) and (ii).

(5) Content is within this subsection if it consists of a paid-for advertisement (see section 236).

(6) References to pornographic content that is “published or displayed” on a service—

(a) include, in particular—

(i) references to pornographic content that is only visible or audible to users as a result of interacting with content that is blurred, distorted or obscured (for example, by clicking on such content), but only where the pornographic content is present on the service,

(ii) references to pornographic content that is embedded on the service, and

(iii) references to pornographic content that is generated on the service by means of an automated tool or algorithm in response to a prompt by a user and is only visible or audible to that user (no matter for how short a time);

(b) do not include references to pornographic content that appears in search results of a search service or a combined service.

(7) Pornographic content that is user-generated content in relation to an internet service is not to be regarded as provider pornographic content in relation to that service.

(8) In this section—

• “search results” has the meaning given by section 57(3);

• “user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

80 Scope of duties about regulated provider pornographic content

(1) A provider of an internet service within subsection (2) must comply with the duties set out in section 81 in relation to the service.

(2) An internet service is within this subsection if—

(a) regulated provider pornographic content is published or displayed on the service,

(b) the service is not exempt, and

(c) the service has links with the United Kingdom.

(3) A service is “exempt” for the purposes of this Part if it is —

(a) a user-to-user service or a search service of a description that is exempt as provided for by Schedule 1, or

(b) an internet service of a kind described in Schedule 9.

(4) A service “has links with the United Kingdom” for the purposes of this Part if either of the following conditions is met in relation to the service—

(a) the service has a significant number of United Kingdom users, or

(b) United Kingdom users form one of the target markets for the service (or the only target market).

(5) This Part does not apply in relation to a part of a regulated service if—

(a) in the case of a Part 3 service, the conditions in paragraph 7(2) of Schedule 1 (internal business service conditions) are met in relation to that part;

(b) in the case of an internet service other than a Part 3 service, the conditions in paragraph 1(2) of Schedule 9 (internal business service conditions) are met in relation to that part.

(6) This Part does not apply in relation to a part of a regulated service if that part is an on-demand programme service within the meaning of section 368A of the Communications Act.

(7) If a person is the provider of more than one internet service within subsection (2), the duties set out in section 81 apply in relation to each such service.

(8) The duties set out in section 81 extend only to the design, operation and use of an internet service in the United Kingdom.

81 Duties about regulated provider pornographic content

(1) This section sets out the duties which apply in relation to internet services within section 80(2).

(2) A duty to ensure, by the use of age verification or age estimation (or both), that children are not normally able to encounter content that is regulated provider pornographic content in relation to the service.

(3) The age verification or age estimation must be of such a kind, and used in such a way, that it is highly effective at correctly determining whether or not a particular user is a child.

(4) In relation to the duty set out in subsection (2), a duty to make and keep a written record, in an easily understandable form, of—

(a) the kinds of age verification or age estimation used, and how they are used, and

(b) the way in which the provider, when deciding on the kinds of age verification or age estimation and how they should be used, has had regard to the importance of protecting United Kingdom users from a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of a regulated service (including, but not limited to, any such provision or rule concerning the processing of personal data).

(5) A duty to summarise the written record in a publicly available statement, so far as the record concerns compliance with the duty set out in subsection (2), including details about which kinds of age verification or age estimation a provider is using and how they are used.

82 OFCOM’s guidance about duties set out in section 81

(1) OFCOM must produce guidance for providers of internet services within section 80(2) to assist them in complying with their duties set out in section 81.

(2) The guidance must include—

(a) examples of kinds and uses of age verification and age estimation that are, or are not, highly effective at correctly determining whether or not a particular user is a child,

(b) examples of ways in which a provider may have regard to the importance of protecting users as mentioned in section 81(4)(b),

(c) principles that OFCOM propose to apply when determining whether a provider has complied with each of the duties set out in section 81, and

(d) examples of circumstances in which OFCOM are likely to consider that a provider has not complied with each of those duties.

(3) The guidance may elaborate on the following principles governing the use of age verification or age estimation for the purpose of compliance with the duty set out in section 81(2)—

(a) the principle that age verification or age estimation should be easy to use;

(b) the principle that age verification or age estimation should work effectively for all users regardless of their characteristics or whether they are members of a certain group;

(c) the principle of interoperability between different kinds of age verification or age estimation.

(4) The guidance may refer to industry or technical standards for age verification or age estimation (where they exist).

(5) Before producing the guidance (including revised or replacement guidance), OFCOM must consult—

(a) the Secretary of State,

(b) persons who appear to OFCOM to represent providers of internet services within section 80(2),

(c) persons who appear to OFCOM to represent adult users of internet services within section 80(2),

(d) persons who appear to OFCOM to represent the interests of children (generally or with particular reference to online safety matters),

(e) the Information Commissioner,

(f) persons whom OFCOM consider to have expertise in innovation, or emerging technology, that is relevant to online safety matters, and

(g) such other persons as OFCOM consider appropriate.

(6) But if OFCOM propose to revise the guidance, and consider that the minor nature of the proposal means that consultation is unnecessary—

(a) OFCOM must notify the Secretary of State of the proposed changes, and

(b) if the Secretary of State agrees that it is appropriate, the consultation requirements set out in subsection (5) do not apply in relation to the proposed changes.

(7) OFCOM must keep the guidance under review.

(8) OFCOM must publish the guidance (and any revised or replacement guidance).