Online Safety Act 2023

Provisional notices and confirmation decisions

130 Provisional notice of contravention

(1) OFCOM may give a notice under this section (a “provisional notice of contravention”) relating to a regulated service to the provider of the service if they consider that there are reasonable grounds for believing that the provider has failed, or is failing, to comply with any enforceable requirement (see section 131) that applies in relation to the service.

(2) OFCOM may also give a provisional notice of contravention to a person on either of the grounds in subsection (3).

(3) The grounds are that—

(a) the person has been given an information notice and OFCOM consider that there are reasonable grounds for believing that the person has failed, or is failing, to comply with either of the duties set out in section 102(8) (duties in relation to information notices), or

(b) the person is required by a skilled person appointed under section 104 to give assistance to the skilled person, and OFCOM consider that there are reasonable grounds for believing that the person has failed, or is failing, to comply with the duty set out in subsection (7) of that section to give such assistance.

(4) A provisional notice of contravention given to a person must—

(a) specify the duty or requirement with which (in OFCOM’s opinion) the person has failed, or is failing, to comply, and

(b) give OFCOM’s reasons for their opinion that the person has failed, or is failing, to comply with it.

(5) A provisional notice of contravention may also contain details as mentioned in subsection (6) or (7), or both.

(6) A provisional notice of contravention may specify steps that OFCOM consider the person needs to take in order to—

(a) comply with the duty or requirement, or

(b) remedy the failure to comply with it.

(7) A provisional notice of contravention may state that OFCOM propose to impose a penalty on the person, and in such a case the notice must—

(a) state the reasons why OFCOM propose to impose a penalty,

(b) state whether OFCOM propose to impose a penalty of a single amount, a penalty calculated by reference to a daily rate, or both penalties (see section 137(1)),

(c) indicate the amount of a penalty that OFCOM propose to impose, including (in relation to a penalty calculated by reference to a daily rate) the daily rate and how the penalty would be calculated,

(d) in relation to a penalty calculated by reference to a daily rate, specify or describe the period for which OFCOM propose that the penalty should be payable, and

(e) state the reasons for proposing a penalty of that amount, including any aggravating or mitigating factors that OFCOM propose to take into account.

(8) A provisional notice of contravention given to a person must—

(a) state that the person may make representations to OFCOM (with any supporting evidence) about the matters contained in the notice, and

(b) specify the period within which such representations may be made.

(9) A provisional notice of contravention may be given in respect of a failure to comply with more than one enforceable requirement.

(10) Where a provisional notice of contravention is given in respect of a continuing failure, the notice may be given in respect of any period during which the failure has continued, and must specify that period.

(11) Where a provisional notice of contravention is given to a person in respect of a failure to comply with a duty or requirement (“the first notice”), a further provisional notice of contravention in respect of a failure to comply with that same duty or requirement may be given to the person only—

(a) in respect of a separate instance of the failure after the first notice was given,

(b) where a period was specified in the first notice in accordance with subsection (10), in respect of the continuation of the failure after the end of that period, or

(c) if the first notice has been withdrawn (without a confirmation decision being given to the person in respect of the failure).

131 Requirements enforceable by OFCOM against providers of regulated services

(1) References in this Chapter to “enforceable requirements” are to—

(a) the duties or requirements set out in the provisions of this Act specified in the table in subsection (2), and

(b) the requirements mentioned in subsection (3).

(2) Here is the table—

Provision	Subject matter
Section 9	Illegal content risk assessments
Section 10	Illegal content
Section 11	Children’s risk assessments
Section 12	Children’s online safety
Section 14	Assessments related to duty in section 15(2)
Section 15	User empowerment
Section 17	Content of democratic importance
Section 18	News publisher content
Section 19	Journalistic content
Section 20	Content reporting
Section 21	Complaints procedures
Section 22	Freedom of expression and privacy
Section 23	Record-keeping and review
Section 26	Illegal content risk assessments
Section 27	Illegal content
Section 28	Children’s risk assessments
Section 29	Children’s online safety
Section 31	Content reporting
Section 32	Complaints procedures
Section 33	Freedom of expression and privacy
Section 34	Record-keeping and review
Section 36	Children’s access assessments
Section 38	Fraudulent advertising
Section 39	Fraudulent advertising
Section 64	User identity verification
Section 66	Reporting CSEA content to NCA
Section 71	Acting against users only in accordance with terms of service
Section 72	Terms of service
Section 75	Information about use of service by deceased child users
Section 77(3) and (4)	Transparency reports
Section 81	Provider pornographic content
Section 83	Fees: notification of OFCOM
Section 102(8)	Information notices
Section 104(7)	Assistance to skilled person
Section 105(1)	Co-operation with investigation

(3) The requirements referred to in subsection (1)(b) are—

(a) requirements of a notice under section 104(5)(a) to appoint a skilled person;

(b) requirements of a notice given by virtue of section 175(3) (duty to make public statement);

(c) requirements of a notice under section 175(5) (information in connection with circumstances presenting a threat);

(d) requirements imposed by a person acting—

(i) in the exercise of powers conferred by paragraph 2 of Schedule 12 (entry and inspection without warrant), or

(ii) in the execution of a warrant issued under paragraph 5 of that Schedule.

132 Confirmation decisions

(1) This section applies if—

(a) OFCOM have given a provisional notice of contravention to a person in relation to a failure to comply with a duty or requirement (or with duties or requirements), and

(b) the period allowed for representations has expired.

A duty or requirement to which the provisional notice of contravention relates is referred to in this section as a “notified requirement”.

(2) If, after considering any representations and evidence, OFCOM decide not to give the person a notice under this section, they must inform the person of that fact.

(3) If OFCOM are satisfied that the person has failed, or has been failing, to comply with a notified requirement, OFCOM may give the person a notice under this section (a “confirmation decision”) confirming that that is OFCOM’s opinion.

(4) A confirmation decision and a notice under section 121(1) may be given in respect of the same failure.

(5) A confirmation decision given to a person may—

(a) require the person to take steps as mentioned in section 133;

(b) require the person to pay a penalty as mentioned in section 137;

(c) require the person to do both those things (or neither of them).

(6) See sections 134 and 135 for further provision which a confirmation decision may include in cases of failure to comply with duties about risk assessments or children’s access assessments.

133 Confirmation decisions: requirements to take steps

(1) A confirmation decision may require the person to whom it is given to take such steps as OFCOM consider appropriate (including steps relating to the use of a system or process) for either or both of the following purposes—

(a) complying with a notified requirement;

(b) remedying the failure to comply with a notified requirement.

(2) But see section 136 in relation to OFCOM’s power to include in a confirmation decision requirements as described in subsection (1) relating to the use of proactive technology.

(3) A confirmation decision may impose requirements as described in subsection (1) only in relation to the design or operation of a regulated service—

(a) in the United Kingdom, or

(b) as it affects United Kingdom users of the service.

(4) A confirmation decision that includes requirements as described in subsection (1) must—

(a) specify the steps that are required,

(b) give OFCOM’s reasons for their decision to impose those requirements,

(c) specify which of those requirements (if any) have been designated as CSEA requirements (see subsections (6) and (7)),

(d) specify each notified requirement to which the steps relate,

(e) specify the period during which the failure to comply with a notified requirement has occurred, and whether the failure is continuing,

(f) specify a reasonable period within which each of the steps specified in the decision must be taken or, if a step requires the use of a system or process, a reasonable period within which the system or process must begin to be used (but see subsection (5) in relation to information duties),

(g) (if relevant) specify the period for which a system or process must be used,

(h) contain details of the rights of appeal under section 168, and

(i) contain information about the consequences of not complying with the requirements included in the decision (including information about the further kinds of enforcement action that it would be open to OFCOM to take).

(5) A confirmation decision that requires a person to take steps for the purpose of complying with an information duty may require the person to take those steps immediately.

(6) If the condition in subsection (7) is met in relation to a requirement imposed by a confirmation decision which is of a kind described in subsection (1), OFCOM must designate the requirement as a “CSEA requirement” for the purposes of section 138(3) (offence of failure to comply with confirmation decision).

(7) The condition referred to in subsection (6) is that the requirement is imposed (whether or not exclusively) in relation to either or both of the following—

(a) a failure to comply with section 10(2)(a) or (3)(a) in respect of CSEA content, or in respect of priority illegal content which includes CSEA content;

(b) a failure to comply with section 10(2)(b) in respect of an offence specified in Schedule 6 (CSEA offences), or in respect of priority offences which include such an offence.

(8) A person to whom a confirmation decision is given has a duty to comply with requirements included in the decision which are of a kind described in subsection (1).

(9) The duty under subsection (8) is enforceable in civil proceedings by OFCOM—

(a) for an injunction,

(b) for specific performance of a statutory duty under section 45 of the Court of Session Act 1988, or

(c) for any other appropriate remedy or relief.

(10) In this section—

• “CSEA content”, “priority illegal content” and “priority offence” have the same meaning as in Part 3 (see section 59);

• “information duty” means a duty set out in section 102(8);

• “notified requirement” has the meaning given by section 132.

134 Confirmation decisions: risk assessments

(1) This section applies if—

(a) OFCOM are satisfied that a provider of a Part 3 service has failed to comply with a risk assessment duty,

(b) based on evidence resulting from OFCOM’s investigation into that failure, OFCOM have identified a risk of serious harm to individuals in the United Kingdom arising from a particular aspect of the service (“the identified risk”), and

(c) OFCOM consider that the identified risk is not effectively mitigated or managed.

(2) A confirmation decision given to the provider of the service—

(a) if the identified risk relates to matters required to be covered by an illegal content risk assessment, may include a determination that the duty set out in section 10(2)(b) or (c) or 27(2) (as the case may be) applies as if an illegal content risk assessment carried out by the provider had identified that risk;

(b) if the identified risk relates to matters required to be covered by a children’s risk assessment, may include a determination that the duty set out in section 12(2)(a) or 29(2)(a) (as the case may be) applies as if a children’s risk assessment carried out by the provider had identified that risk.

(3) A confirmation decision which includes a determination as mentioned in subsection (2) must—

(a) give details of the identified risk,

(b) specify the duty to which the determination relates, and

(c) specify the date by which measures (at the provider’s discretion) to comply with that duty must be taken or must begin to be used.

(4) A determination as mentioned in subsection (2) ceases to have effect on the date on which the provider of the service complies with the risk assessment duty with which the provider had previously failed to comply (and accordingly, from that date the duty to which the determination relates applies without the modification mentioned in that subsection).

(5) In this section—

• “children’s risk assessment” has the meaning given by section 11 or 28 (as the case may be);

• “illegal content risk assessment” has the meaning given by section 9 or 26 (as the case may be);

• “risk assessment duty” means a duty set out in—

  (a)

  section 9,

  (b)

  section 11,

  (c)

  section 26, or

  (d)

  section 28.

135 Confirmation decisions: children’s access assessments

(1) This section applies if OFCOM are satisfied that a provider of a Part 3 service has failed to comply with a duty set out in section 36 (duties about children’s access assessments).

(2) If OFCOM include in a confirmation decision a requirement to take steps relating to the carrying out of a children’s access assessment of a service, they must require that assessment to be completed within three months of the date of the confirmation decision.

(3) OFCOM may vary a confirmation decision which includes a requirement as mentioned in subsection (2) to extend the deadline for completion of a children’s access assessment.

(4) Subsection (5) applies if, based on evidence that OFCOM have about a service resulting from their investigation into compliance with a duty set out in section 36, OFCOM consider that—

(a) it is possible for children to access the service or a part of it, and

(b) the child user condition is met in relation to—

(i) the service, or

(ii) a part of the service that it is possible for children to access.

(5) OFCOM may include in the confirmation decision given to the provider of the service—

(a) a determination that the duties set out in sections 11 and 12, or (as the case may be) sections 28 and 29, must be complied with—

(i) from the date of the confirmation decision, or

(ii) from a later date specified in that decision;

(b) provision about the circumstances in which that determination may be treated as no longer applying in relation to the service.

(6) Subsection (4) is to be interpreted consistently with section 35.

(7) In this section, “children’s access assessment” has the meaning given by section 35.

136 Confirmation decisions: proactive technology

(1) This section sets out what powers OFCOM have to include in a confirmation decision a requirement to take steps to use a kind, or one of the kinds, of proactive technology specified in the decision (a “proactive technology requirement”).

(2) A proactive technology requirement may be imposed in a confirmation decision if—

(a) the decision is given to the provider of an internet service within section 80(2), and

(b) the decision is imposed for the purpose of complying with, or remedying the failure to comply with, the duty set out in section 81(2) (provider pornographic content).

(3) The following provisions of this section set out constraints on OFCOM’s power to include a proactive technology requirement in a confirmation decision in any case not within subsection (2).

(4) A proactive technology requirement may be imposed in a confirmation decision only if the decision is given to the provider of a Part 3 service.

(5) A proactive technology requirement may be imposed in a confirmation decision only for the purpose of complying with, or remedying the failure to comply with, any of the duties set out in—

(a) section 10(2) or (3) (illegal content),

(b) section 12(2) or (3) (children’s online safety),

(c) section 27(2) or (3) (illegal content),

(d) section 29(2) or (3) (children’s online safety), or

(e) section 38(1) or 39(1) (fraudulent advertising).

(6) Proactive technology may be required to be used on or in relation to any Part 3 service or any part of such a service, but if and to the extent that the technology operates (or may operate) by analysing content that is user-generated content in relation to the service, or metadata relating to such content, the technology may not be required to be used except to analyse—

(a) user-generated content communicated publicly, and

(b) metadata relating to user-generated content communicated publicly.

(7) Before imposing a proactive technology requirement in relation to a service in a confirmation decision, OFCOM must particularly consider the matters mentioned in subsection (8), so far as they are relevant.

(8) The matters are as follows—

(a) the kind of service it is;

(b) the functionalities of the service;

(c) the user base of the service;

(d) the prevalence of relevant content on the service and the extent of its dissemination by means of the service, or (as the case may be) the prevalence of search content of the service that is relevant content;

(e) the level of risk of harm to individuals in the United Kingdom presented by relevant content present on the service, or (as the case may be) search content of the service that is relevant content, and the severity of that harm;

(f) the degree of accuracy, effectiveness and lack of bias achieved by the kind of technology specified in the decision;

(g) the extent to which the use of the kind of proactive technology specified in the decision would or might result in interference with users’ right to freedom of expression within the law;

(h) the level of risk of the use of the kind of proactive technology specified in the decision resulting in a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of the service (including, but not limited to, any such provision or rule concerning the processing of personal data);

(i) whether the use of any less intrusive measures than the proactive technology specified in the decision would be likely to result in compliance with, or would be likely to effectively remedy the failure to comply with, the duty in question.

(9) A confirmation decision that imposes a proactive technology requirement on a provider may also impose requirements about review of the technology by the provider.

(10) A confirmation decision relating to a service which requires the use of technology of a kind mentioned in subsection (6) must identify the content, or parts of the service that include content, that OFCOM consider is communicated publicly on that service (see section 232).

(11) In this section—

• “content that is harmful to children” has the same meaning as in Part 3 (see section 60);

• “fraudulent advertisement” has the meaning given by section 38 or 39 (depending on the kind of service in question);

• “illegal content” has the same meaning as in Part 3 (see section 59);

• “relevant content” means illegal content, content that is harmful to children or content consisting of fraudulent advertisements, or any or all of those kinds of content (depending on the duties (as mentioned in subsection (5)) for the purposes of which the proactive technology requirement is imposed);

• “search content” has the same meaning as in Part 3 (see section 57);

• “user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

137 Confirmation decisions: penalties

(1) A confirmation decision may require the person to whom it is given to do either or both of the following, depending on what was proposed in the provisional notice of contravention (see paragraph 3 of Schedule 13)—

(a) pay to OFCOM a penalty of a single amount in sterling determined by OFCOM (a “single penalty”) and specified in the confirmation decision;

(b) if the confirmation decision includes a requirement of the kind described in section 133(1)(a) in respect of a continuous failure to comply with a notified requirement, pay a daily rate penalty to OFCOM if that same failure continues after the compliance date.

(2) A “daily rate penalty” means a penalty of an amount in sterling determined by OFCOM and calculated by reference to a daily rate.

(3) A confirmation decision may impose separate single penalties for failure to comply with separate notified requirements specified in the decision.

(4) Where a provisional notice of contravention is given in respect of a period of continuing failure to comply with a notified requirement, no more than one single penalty may be imposed by a confirmation decision in respect of the period of failure specified in the provisional notice of contravention.

(5) A confirmation decision that imposes a penalty must—

(a) give OFCOM’s reasons for their decision to impose the penalty,

(b) specify each notified requirement to which the penalty relates,

(c) specify the period during which the failure to comply with a notified requirement has occurred, and whether the failure is continuing,

(d) state the reasons for the amount of the penalty, including any aggravating or mitigating factors that OFCOM have taken into account,

(e) specify a reasonable period within which the penalty must be paid,

(f) contain details of the rights of appeal under section 168, and

(g) contain information about the consequences of not paying the penalty (including information about the further kinds of enforcement action that it would be open to OFCOM to take).

(6) The period specified under subsection (5)(e) for the payment of a single penalty must be at least 28 days beginning with the day on which the confirmation decision is given.

(7) If a confirmation decision imposes a single penalty and a daily rate penalty, the information mentioned in subsection (5)(a), (b), (d) and (e) must be given in respect of each kind of penalty.

(8) As well as containing the information mentioned in subsection (5), a confirmation decision that imposes a daily rate penalty in respect of a continuous failure to comply with a notified requirement must—

(a) state the daily rate of the penalty and how the penalty is calculated;

(b) state that the person will be liable to pay the penalty if that same failure continues after the compliance date;

(c) state the date from which the penalty begins to be payable, which must not be earlier than the day after the compliance date;

(d) provide for the penalty to continue to be payable at the daily rate until—

(i) the date on which the notified requirement is complied with,

(ii) if the penalty is imposed in respect of a failure to comply with more than one notified requirement, the date on which the last of those requirements is complied with, or

(iii) an earlier date specified in the confirmation decision.

(9) In this section—

• “compliance date”, in relation to a notified requirement, means—

  (a)

  in a case where the confirmation decision requires steps to be taken immediately to comply with that requirement (see section 133(5)), the date of the confirmation decision;

  (b)

  in any other case, the last day of the period specified in the confirmation decision in accordance with section 133(4)(f) for compliance with that requirement;

• “notified requirement” has the meaning given by section 132.

138 Confirmation decisions: offences

(1) A person to whom a confirmation decision is given commits an offence if, without reasonable excuse, the person fails to comply with a requirement imposed by the decision which—

(a) is of a kind described in section 133(1), and

(b) is imposed (whether or not exclusively) in relation to a failure to comply with a children’s online safety duty.

(2) A “children’s online safety duty” means a duty set out in—

(a) section 12(3)(a),

(b) section 12(3)(b),

(c) section 81(2), or

(d) section 81(4).

(3) A person to whom a confirmation decision is given commits an offence if, without reasonable excuse, the person fails to comply with a CSEA requirement imposed by the decision (see section 133(6) and (7)).

(4) A person who commits an offence under this section is liable—

(a) on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);

(b) on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum (or both);

(c) on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);

(d) on conviction on indictment, to imprisonment for a term not exceeding 2 years or a fine (or both).