Online Safety Act 2023

PART 7 OFCOM's powers and duties in relation to regulated services

CHAPTER 1 General duties

91 General duties of OFCOM under section 3 of the Communications Act

(1) Section 3 of the Communications Act (general duties of OFCOM) is amended in accordance with subsections (2) to (8).

(2) In subsection (2), after paragraph (f) insert—

“(g) the adequate protection of citizens from harm presented by content on regulated services, through the appropriate use by providers of such services of systems and processes designed to reduce the risk of such harm.”

(3) In subsection (4)(c), at the beginning insert “(subject to subsection (5A))”.

(4) After subsection (4) insert—

“(4A) In performing their duties under subsection (1) in relation to matters to which subsection (2)(g) is relevant, OFCOM must have regard to such of the following as appear to them to be relevant in the circumstances—

(a) the risk of harm to citizens presented by regulated services;

(b) the need for a higher level of protection for children than for adults;

(c) the need for it to be clear to providers of regulated services how they may comply with their duties set out in Chapter 2, 3, 4 or 5 of Part 3, Chapter 1, 3 or 4 of Part 4, or Part 5 of the Online Safety Act 2023;

(d) the need to exercise their functions so as to secure that providers of regulated services may comply with such duties by taking measures, or using measures, systems or processes, which are (where relevant) proportionate to—

(i) the size or capacity of the provider in question, and

(ii) the level of risk of harm presented by the service in question, and the severity of the potential harm;

(e) the desirability of promoting the use by providers of regulated services of technologies which are designed to reduce the risk of harm to citizens presented by content on regulated services;

(f) the extent to which providers of regulated services demonstrate, in a way that is transparent and accountable, that they are complying with their duties set out in Chapter 2, 3, 4 or 5 of Part 3, Chapter 1, 3 or 4 of Part 4, or Part 5 of the Online Safety Act 2023.”

(5) After subsection (5) insert—

“(5A) Subsection (4)(c) does not apply in relation to the carrying out of any of OFCOM’s online safety functions.”

(6) After subsection (6) insert—

“(6ZA) Where it appears to OFCOM, in relation to the carrying out of any of their online safety functions, that any of their general duties conflict with their duty under section 24, priority must be given to their duty under that section.”

(7) In subsection (14), at the appropriate places insert—

• ““content on regulated services” means—

  (a)

  regulated user-generated content present on regulated services,

  (b)

  search content of regulated services,

  (c)

  fraudulent advertisements present on regulated services, and

  (d)

  regulated provider pornographic content present on regulated services;”;

• ““online safety functions” has the meaning given by section 235 of the Online Safety Act 2023, except that it does not include OFCOM’s general duties;”.

(8) After subsection (14) insert—

“(15) In this section the following terms have the same meaning as in the Online Safety Act 2023—

• “content” (see section 236 of that Act);

• “fraudulent advertisement” (see sections 38 and 39 of that Act);

• “harm” (see section 234 of that Act);

• “provider”, in relation to a regulated service (see section 226 of that Act);

• “regulated user-generated content” (see section 55 of that Act);

• “regulated provider pornographic content” (see section 79 of that Act);

• “regulated service” (see section 4 of that Act);

• “search content” (see section 57 of that Act).”

(9) In section 6 of the Communications Act (duties to review regulatory burdens)—

(a) in subsection (2), after “this section” insert “(except their online safety functions)”, and

(b) after subsection (10) insert—

“(11) In this section “online safety functions” has the same meaning as in section 3.”

92 Duties in relation to strategic priorities

(1) This section applies where a statement has been designated under section 172(1) (Secretary of State’s statement of strategic priorities).

(2) OFCOM must have regard to the statement when carrying out their online safety functions.

(3) Within the period of 40 days beginning with the day on which the statement is designated, or such longer period as the Secretary of State may allow, OFCOM must—

(a) explain in writing what they propose to do in consequence of the statement, and

(b) publish a copy of that explanation.

(4) OFCOM must, as soon as reasonably practicable after the end of—

(a) the period of 12 months beginning with the day on which the first statement is designated under section 172(1), and

(b) every subsequent period of 12 months,

publish a review of what they have done during the period in question in consequence of the statement.

93 Duty to carry out impact assessments

(1) Section 7 of the Communications Act (duty to carry out impact assessments) is amended as follows.

(2) In subsection (2), at the beginning insert “Subject to subsection (2A),”.

(3) After subsection (2) insert—

“(2A) A proposal to do any of the following is important for the purposes of this section—

(a) to prepare a code of practice under section 41 of the Online Safety Act 2023;

(b) to prepare amendments of such a code of practice; or

(c) to prepare a code of practice as a replacement for such a code of practice.”

(4) After subsection (4) insert—

“(4A) An assessment under subsection (3)(a) that relates to a proposal mentioned in subsection (2A) must include an assessment of the likely impact of implementing the proposal on small businesses and micro businesses.

(4B) An assessment under subsection (3)(a) that relates to a proposal to do anything else for the purposes of, or in connection with, the carrying out of OFCOM’s online safety functions (within the meaning of section 235 of the Online Safety Act 2023) must, so far as the proposal relates to such functions, include an assessment of the likely impact of implementing the proposal on small businesses and micro businesses.”

CHAPTER 2 Register of categories of regulated user-to-user services and regulated search services

94 Meaning of threshold conditions etc

(1) Schedule 11 contains provision about regulations specifying the threshold conditions that a Part 3 service must meet to be included in the relevant part of the register established by OFCOM under section 95, and associated provision about the publication of OFCOM’s advice.

(2) In this Chapter, “Category 1 threshold conditions”, “Category 2A threshold conditions” and “Category 2B threshold conditions” have the same meaning as in Schedule 11 (see paragraph 1(1), (2) and (3) of that Schedule).

(3) For the purposes of this Chapter—

(a) references to a service meeting the Category 1, Category 2A or Category 2B threshold conditions are to a service meeting those conditions in a way specified in regulations under paragraph 1 of Schedule 11 (see paragraph 1(4) of that Schedule);

(b) a regulated user-to-user service meets the Category 1 threshold conditions if those conditions are met in relation to the user-to-user part of the service;

(c) a regulated search service or a combined service meets the Category 2A threshold conditions if those conditions are met in relation to the search engine of the service;

(d) a regulated user-to-user service meets the Category 2B threshold conditions if those conditions are met in relation to the user-to-user part of the service;

(e) a regulated user-to-user service meets the conditions in section 97(2) if those conditions are met in relation to the user-to-user part of the service;

(f) references to OFCOM assessing a service (to determine if it meets, or no longer meets, the relevant threshold conditions or the conditions in section 97(2)) are accordingly to be read as references to OFCOM assessing the relevant part (or parts) of a service.

95 Register of categories of certain Part 3 services

(1) As soon as reasonably practicable after the first regulations under Schedule 11 come into force, OFCOM must comply with subsections (2) to (4).

(2) OFCOM must establish a register of particular categories of Part 3 services with—

(a) one part for regulated user-to-user services meeting the Category 1 threshold conditions,

(b) one part for regulated search services and combined services meeting the Category 2A threshold conditions, and

(c) one part for regulated user-to-user services meeting the Category 2B threshold conditions.

(3) OFCOM must assess Part 3 services, as follows—

(a) OFCOM must assess each regulated user-to-user service which they consider is likely to meet the Category 1 threshold conditions, to determine whether the service does, or does not, meet those conditions;

(b) OFCOM must assess each regulated search service and combined service which they consider is likely to meet the Category 2A threshold conditions, to determine whether the service does, or does not, meet those conditions;

(c) OFCOM must assess each regulated user-to-user service which they consider is likely to meet the Category 2B threshold conditions, to determine whether the service does, or does not, meet those conditions.

(4) If OFCOM consider that a service meets the relevant threshold conditions, they must add entries relating to that service to the relevant part of the register established under subsection (2).

(5) But—

(a) if OFCOM consider that a regulated user-to-user service meets the Category 1 threshold conditions and the Category 2B threshold conditions (only), entries relating to that service are to be added to the part of the register established under subsection (2)(a) (only);

(b) if OFCOM consider that a combined service meets the Category 1 threshold conditions, the Category 2A threshold conditions and the Category 2B threshold conditions, entries relating to that service are to be added to the parts of the register established under subsection (2)(a) and (b) (only).

(6) If OFCOM consider that a combined service—

(a) meets the Category 2A threshold conditions, and

(b) meets either the Category 1 threshold conditions or the Category 2B threshold conditions (but not both),

entries relating to that service are to be added to the part of the register established under subsection (2)(b) and to the part of the register established under subsection (2)(a) or (c) (whichever applies).

(7) Each part of the register must contain—

(a) the name, and a description, of each service that, in OFCOM’s opinion, meets the relevant threshold conditions, and

(b) the name of the provider of each such service.

(8) OFCOM must publish the register.

(9) When assessing whether a Part 3 service does, or does not, meet the relevant threshold conditions, OFCOM must take such steps as are reasonably practicable to obtain or generate information or evidence for the purposes of the assessment.

(10) In this Act—

(a) a “Category 1 service” means a regulated user-to-user service for the time being included in the part of the register established under subsection (2)(a);

(b) a “Category 2A service” means a regulated search service or a combined service for the time being included in the part of the register established under subsection (2)(b);

(c) a “Category 2B service” means a regulated user-to-user service for the time being included in the part of the register established under subsection (2)(c).

96 Duty to maintain register

(1) If regulations are made under paragraph 1(1) of Schedule 11 which amend or replace regulations previously made under that provision, OFCOM must, as soon as reasonably practicable after the date on which the amending or replacement regulations come into force—

(a) assess each regulated user-to-user service which they consider is likely to meet the new Category 1 threshold conditions, to determine whether the service does, or does not, meet those conditions, and

(b) make any necessary changes to the register.

(2) If regulations are made under paragraph 1(2) of Schedule 11 which amend or replace regulations previously made under that provision, OFCOM must, as soon as reasonably practicable after the date on which the amending or replacement regulations come into force—

(a) assess each regulated search service and combined service which they consider is likely to meet the new Category 2A threshold conditions, to determine whether the service does, or does not, meet those conditions, and

(b) make any necessary changes to the register.

(3) If regulations are made under paragraph 1(3) of Schedule 11 which amend or replace regulations previously made under that provision, OFCOM must, as soon as reasonably practicable after the date on which the amending or replacement regulations come into force—

(a) assess each regulated user-to-user service which they consider is likely to meet the new Category 2B threshold conditions, to determine whether the service does, or does not, meet those conditions, and

(b) make any necessary changes to the register.

(4) At any other time, if OFCOM consider that a Part 3 service not included in a particular part of the register is likely to meet the threshold conditions relevant to that part, OFCOM must—

(a) assess the service accordingly, and

(b) (subject to section 95(5)) if they consider that the service meets the relevant conditions, add entries relating to that service to that part of the register.

(5) Nothing in subsection (3) or (4) requires OFCOM to assess a Category 1 service to determine whether the service meets the Category 2B threshold conditions.

(6) A provider of a Part 3 service included in the register may at any time request OFCOM to remove entries relating to that service from the register, or from a particular part of the register.

(7) If OFCOM are satisfied, on the basis of evidence submitted by a provider with such a request, that since the registration day there has been a change to the service or to regulations under paragraph 1 of Schedule 11 which appears likely to be relevant, OFCOM must—

(a) assess the service, and

(b) notify the provider of OFCOM’s decision.

(8) OFCOM must remove entries relating to a Part 3 service from the relevant part of the register if, following an assessment of the service, they consider that it no longer meets the threshold conditions relevant to that part.

(9) Section 95(9) applies to an assessment under this section as it applies to an assessment under section 95.

(10) OFCOM must re-publish the register each time a change is made to it.

(11) See section 167 for provision about appeals against a decision to include a service in the register (or in a particular part of the register), or not to remove a service from the register (or from a particular part of the register).

(12) In this section—

• “the register” means the register established under section 95;

• “the registration day”, in relation to a Part 3 service, means—

  (a)

  the day on which entries relating to the service were added to the register, or to the particular part of the register in question, or

  (b)

  if later, the day on which OFCOM last completed an assessment of the service under subsection (1), (2), (3) or (7).

97 List of emerging Category 1 services

(1) As soon as reasonably practicable after the first regulations under paragraph 1(1) of Schedule 11 come into force (regulations specifying Category 1 threshold conditions), OFCOM must comply with subsections (2) and (3).

(2) OFCOM must assess each regulated user-to-user service which does not meet the Category 1 threshold conditions and which they consider is likely to meet each of the following conditions, to determine whether the service does, or does not, meet them—

(a) the first condition is that the number of United Kingdom users of the user-to-user part of the service is at least 75% of the figure specified in any of the Category 1 threshold conditions relating to number of users (calculating the number of users in accordance with the threshold condition in question);

(b) the second condition is that—

(i) at least one of the Category 1 threshold conditions relating to functionalities of the user-to-user part of the service is met, or

(ii) if the regulations under paragraph 1(1) of Schedule 11 specify that a Category 1 threshold condition relating to a functionality of the user-to-user part of the service must be met in combination with a Category 1 threshold condition relating to another characteristic of that part of the service or a factor relating to that part of the service (see paragraph 1(4) of Schedule 11), at least one of those combinations of conditions is met.

(3) OFCOM must prepare a list of regulated user-to-user services which meet the conditions in subsection (2).

(4) If the regulations under paragraph 1(1) of Schedule 11 specify that a service meets the Category 1 threshold conditions if any one condition about number of users or functionality is met (as mentioned in paragraph 1(4)(a) of that Schedule)—

(a) subsection (2) applies as if paragraph (b) were omitted, and

(b) subsections (3) and (8) apply as if the reference to the conditions in subsection (2) were to the condition in subsection (2)(a).

(5) The list must contain the following details about a service included in it—

(a) the name of the service,

(b) a description of the service,

(c) the name of the provider of the service, and

(d) a description of the Category 1 threshold conditions by reference to which the conditions in subsection (2) are met.

(6) OFCOM must take appropriate steps to keep the list up to date, including by carrying out further assessments of regulated user-to-user services.

(7) OFCOM must publish the list when it is first prepared and each time it is revised.

(8) When assessing whether a service does, or does not, meet the conditions in subsection (2), OFCOM must take such steps as are reasonably practicable to obtain or generate information or evidence for the purposes of the assessment.

(9) An assessment for the purposes of this section may be included in an assessment under section 95 or 96 (as the case may be) or carried out separately.

CHAPTER 3 Risk assessments of regulated user-to-user services and regulated search services

98 OFCOM’s register of risks, and risk profiles, of Part 3 services

(1) OFCOM must carry out risk assessments to identify and assess the following risks of harm presented by Part 3 services of different kinds—

(a) the risks of harm to individuals in the United Kingdom presented by illegal content present on regulated user-to-user services and by the use of such services for the commission or facilitation of priority offences;

(b) the risk of harm to individuals in the United Kingdom presented by search content of regulated search services that is illegal content;

(c) the risk of harm to children in the United Kingdom, in different age groups, presented by content that is harmful to children.

(2) The risk assessments must, among other things, identify characteristics of different kinds of Part 3 services that are relevant to such risks of harm, and assess the impact of those kinds of characteristics on such risks.

(3) OFCOM—

(a) may combine assessment of any or all of the risks of harm mentioned in subsection (1), or may carry out separate assessments of those risks;

(b) in the case of the risk of harm mentioned in subsection (1)(c), may assess regulated user-to-user services and regulated search services separately or together.

(4) The findings of each risk assessment are to be reflected, as soon as reasonably practicable after completion, in a register of risks of Part 3 services prepared and published by OFCOM.

(5) As soon as reasonably practicable after completing their assessment of a risk of harm mentioned in a particular paragraph of subsection (1), OFCOM must prepare risk profiles for Part 3 services which relate to that risk of harm.

(6) For the purposes of the risk profiles, OFCOM may group Part 3 services together in whichever way they consider appropriate, taking into account—

(a) the characteristics of the services, and

(b) the risk levels and other matters identified in the relevant risk assessment.

(7) OFCOM must publish risk profiles prepared under this section.

(8) OFCOM must from time to time review and revise the risk assessments and risk profiles so as to keep them up to date.

(9) References in this section to Part 3 services—

(a) in the case of a risk assessment or risk profiles which relate only to regulated user-to-user services or to regulated search services, are to be read as references to the kind of service in question;

(b) in the case of a risk assessment or risk profiles which relate only to the risk of harm mentioned in subsection (1)(a), are to be read as references to regulated user-to-user services;

(c) in the case of a risk assessment or risk profiles which relate only to the risk of harm mentioned in subsection (1)(b), are to be read as references to regulated search services.

(10) References in this section to regulated search services include references to the search engine of combined services.

(11) In this section the “characteristics” of a service include its functionalities, user base, business model, governance and other systems and processes.

(12) In this section—

• “content that is harmful to children” has the same meaning as in Part 3 (see section 60);

• “illegal content” has the same meaning as in Part 3 (see section 59);

• “priority offence” has the same meaning as in Part 3 (see section 59).

99 OFCOM’s guidance about risk assessments

(1) As soon as reasonably practicable after OFCOM have published the first risk profiles relating to the illegality risks, OFCOM must produce guidance to assist providers of regulated user-to-user services in complying with their duties to carry out illegal content risk assessments under section 9.

(2) As soon as reasonably practicable after OFCOM have published the first risk profiles relating to the risk of harm from illegal content, OFCOM must produce guidance to assist providers of regulated search services in complying with their duties to carry out illegal content risk assessments under section 26.

(3) As soon as reasonably practicable after OFCOM have published the first risk profiles relating to the risk of harm to children, OFCOM must produce guidance to assist providers of Part 3 services in complying with their duties to carry out children’s risk assessments under section 11 or 28.

(4) Before producing any guidance under this section (including revised or replacement guidance), OFCOM must consult the Information Commissioner.

(5) OFCOM must revise guidance under this section from time to time in response to further risk assessments under section 98 or to revisions of the risk profiles.

(6) OFCOM must publish guidance under this section (and any revised or replacement guidance).

(7) If the risk profiles mentioned in subsection (3) relate to regulated user-to-user services only or to regulated search services only, that subsection is to be read as requiring the production of guidance relating only to regulated user-to-user services or to regulated search services, as the case may be.

(8) References in this section to regulated search services include references to the search engine of combined services.

(9) In this section—

• “illegality risks” means the risks mentioned in section 98(1)(a);

• “risk of harm from illegal content” means the risk of harm mentioned in section 98(1)(b);

• “risk of harm to children” means the risk of harm mentioned in section 98(1)(c);

• “risk profiles” means risk profiles prepared under section 98.

CHAPTER 4 Information

Information powers and information notices

100 Power to require information

(1) OFCOM may by notice under this subsection require a person within subsection (5) to provide them with any information that they require for the purpose of exercising, or deciding whether to exercise, any of their online safety functions.

(2) The power conferred by subsection (1) includes power to require a person within subsection (5) to—

(a) obtain or generate information;

(b) provide information about the use of a service by a named individual.

(3) The power conferred by subsection (1) also includes power to require a person within any of paragraphs (a) to (d) of subsection (5) to take steps so that a person authorised by OFCOM is able to view remotely—

(a) information demonstrating in real time the operation of systems, processes or features, including functionalities and algorithms, used by a service;

(b) information generated by a service in real time by the performance of a test or demonstration of a kind required by a notice under subsection (1).

(4) But the power conferred by subsection (1) must be exercised in a way that is proportionate to the use to which the information is to be put in the exercise of OFCOM’s functions.

(5) The persons within this subsection are—

(a) a provider of a user-to-user service or a search service,

(b) a provider of an internet service on which regulated provider pornographic content is published or displayed,

(c) a person who provides an ancillary service (within the meaning of section 144) in relation to a regulated service (see subsections (11) and (12) of that section),

(d) a person who provides an access facility (within the meaning of section 146) in relation to a regulated service (see subsections (10) and (11) of that section),

(e) a person who was within any of paragraphs (a) to (d) at a time to which the required information relates, and

(f) a person not within any of paragraphs (a) to (e) who appears to OFCOM to have, or to be able to generate or obtain, information required by them as mentioned in subsection (1).

(6) The information that may be required by OFCOM under subsection (1) includes, in particular, information that they require for any one or more of the following purposes—

(a) the purpose of assessing compliance with—

(i) any duty or requirement set out in Chapter 2, 3, 4 or 5 of Part 3,

(ii) any duty set out in section 64 (user identity verification),

(iii) any requirement under section 66 (reporting CSEA content),

(iv) any duty set out in section 71 or 72 (terms of service),

(v) any duty set out in section 75 (deceased child users),

(vi) any requirement relating to transparency reporting (see section 77(3) and (4)), or

(vii) any duty set out in section 81 (provider pornographic content);

(b) the purpose of assessing compliance with a requirement under section 83 (duty to notify OFCOM in relation to the charging of fees);

(c) the purpose of a consultation about a threshold figure as mentioned in section 86 (threshold figure for the purposes of charging fees);

(d) the purpose of ascertaining the amount of a person’s qualifying worldwide revenue for the purposes of—

(i) Part 6 (fees), or

(ii) paragraph 4 or 5 of Schedule 13 (amount of penalties etc);

(e) the purpose of assessing compliance with any requirements imposed on a person by—

(i) a notice under section 121(1) (notices to deal with terrorism content and CSEA content), or

(ii) a confirmation decision;

(f) the purpose of assessing the accuracy and effectiveness of technology required to be used by—

(i) a notice under section 121(1), or

(ii) a confirmation decision;

(g) the purpose of assessing whether to give a notice under section 121(1) relating to the development or sourcing of technology (see subsections (2)(b) and (3)(b) of that section);

(h) the purpose of dealing with complaints made to OFCOM under section 169 (super-complaints);

(i) the purpose of OFCOM’s advice to the Secretary of State about provision to be made by regulations under paragraph 1 of Schedule 11 (threshold conditions for categories of Part 3 services);

(j) the purpose of determining whether a Part 3 service meets threshold conditions specified in regulations under paragraph 1 of Schedule 11;

(k) the purpose of preparing a code of practice under section 41;

(l) the purpose of preparing guidance in relation to online safety matters;

(m) the purpose of carrying out research, or preparing a report, in relation to online safety matters;

(n) the purpose of complying with OFCOM’s duties under section 11 of the Communications Act, so far as relating to regulated services (media literacy).

(7) See also section 103 (power to include a requirement to name a senior manager).

(8) The reference in subsection (3) to a person authorised by OFCOM is to a person authorised by OFCOM in writing for the purposes of notices that impose requirements of a kind mentioned in that subsection, and such a person must produce evidence of their identity if requested to do so by a person in receipt of such a notice.

(9) The power conferred by subsection (1) does not include power to require the provision of information in respect of which a claim to legal professional privilege, or (in Scotland) to confidentiality of communications, could be maintained in legal proceedings.

(10) In this section—

• “information” includes documents, and any reference to providing information includes a reference to producing a document (and see also section 102(11));

• “regulated provider pornographic content” and “published or displayed” have the same meaning as in Part 5 (see section 79).

101 Information in connection with an investigation into the death of a child

(1) OFCOM may by notice under this subsection require a relevant person to provide them with information for the purpose of—

(a) responding to a notice given by a senior coroner under paragraph 1(2) of Schedule 5 to the Coroners and Justice Act 2009 in connection with an investigation into the death of a child, or preparing a report under section 163 in connection with such an investigation;

(b) responding to a request for information in connection with the investigation of a procurator fiscal into, or an inquiry held or to be held in relation to, the death of a child, or preparing a report under section 163 in connection with such an inquiry;

(c) responding to a notice given by a coroner under section 17A(2) of the Coroners Act (Northern Ireland) 1959 (c. 15 (N.I.)) in connection with—

(i) an investigation to determine whether an inquest into the death of a child is necessary, or

(ii) an inquest in relation to the death of a child,

or preparing a report under section 163 in connection with such an investigation or inquest.

(2) The power conferred by subsection (1) includes power to require a relevant person to provide OFCOM with information about the use of a regulated service by the child whose death is under investigation, including, in particular—

(a) content encountered by the child by means of the service,

(b) how the content came to be encountered by the child (including the role of algorithms or particular functionalities),

(c) how the child interacted with the content (for example, by viewing, sharing or storing it or enlarging or pausing on it), and

(d) content generated, uploaded or shared by the child.

(3) The power conferred by subsection (1) includes power to require a relevant person to obtain or generate information.

(4) The power conferred by subsection (1) must be exercised in a way that is proportionate to the purpose mentioned in that subsection.

(5) The power conferred by subsection (1) does not include power to require the provision of information in respect of which a claim to legal professional privilege, or (in Scotland) to confidentiality of communications, could be maintained in legal proceedings.

(6) Nothing in this section limits the power conferred on OFCOM by section 100.

(7) In this section—

• “information” includes documents, and any reference to providing information includes a reference to producing a document (and see also section 102(11));

• “inquiry” means an inquiry held, or to be held, under the Inquiries into Fatal Accidents and Sudden Deaths etc. (Scotland) Act 2016 (asp 2);

• “relevant person” means a person within any of paragraphs (a) to (e) of section 100(5).

102 Information notices

(1) A notice given under section 100(1) or 101(1) is referred to in this Act as an information notice.

(2) An information notice may require information in any form (including in electronic form).

(3) An information notice must—

(a) specify or describe the information to be provided,

(b) specify why OFCOM require the information,

(c) specify the form and manner in which it must be provided, and

(d) contain information about the consequences of not complying with the notice.

(4) An information notice must specify when the information must be provided (which may be on or by a specified date, within a specified period, or at specified intervals).

(5) An information notice requiring a person to take steps of a kind mentioned in section 100(3) must give the person at least seven days’ notice before the steps are required to be taken.

(6) An information notice may specify a place at which, and a person to whom, information is to be provided.

(7) A person to whom a document is produced in response to an information notice may—

(a) take copies of, or extracts from, the document;

(b) require the person producing the document, or a person who is or was an officer of that person, or (in the case of a partnership) a person who is or was a partner, to give an explanation of it.

(8) A person to whom an information notice is given has a duty—

(a) to act in accordance with the requirements of the notice, and

(b) to ensure that the information provided is accurate in all material respects.

(9) OFCOM may cancel an information notice by notice to the person to whom it was given.

(10) In this section—

• “information” includes documents, and any reference to providing information includes a reference to producing a document;

• “officer”, in relation to an entity, includes a director, a manager, an associate, a secretary or, where the affairs of the entity are managed by its members, a member.

(11) In relation to information recorded otherwise than in a legible form, references in this section to producing a document are to producing a copy of the information—

(a) in a legible form, or

(b) in a form from which it can readily be produced in a legible form.

103 Requirement to name a senior manager

(1) This section applies where—

(a) OFCOM give a provider of a regulated service an information notice, and

(b) the provider is an entity.

(2) OFCOM may include in the information notice a requirement that the provider must name, in their response to the notice, an individual who the provider considers to be a senior manager of the entity and who may reasonably be expected to be in a position to ensure compliance with the requirements of the notice.

(3) If OFCOM impose a requirement to name an individual, the information notice must—

(a) require the provider to inform such an individual, and

(b) include information about the consequences for such an individual of the entity’s failure to comply with the requirements of the notice (see section 110).

(4) An individual is a “senior manager” of an entity if the individual plays a significant role in—

(a) the making of decisions about how the entity’s relevant activities are to be managed or organised, or

(b) the actual managing or organising of the entity’s relevant activities.

(5) An entity’s “relevant activities” are activities relating to the entity’s compliance with the regulatory requirements imposed by this Act in connection with the regulated service to which the information notice in question relates.

Skilled persons' reports

104 Reports by skilled persons

(1) OFCOM may exercise the powers in this section where they consider that it is necessary to do so for either of the following purposes—

(a) assisting OFCOM in identifying and assessing a failure, or possible failure, by a provider of a regulated service to comply with a relevant requirement, or

(b) developing OFCOM’s understanding of—

(i) the nature and level of risk of a provider of a regulated service failing to comply with a relevant requirement, and

(ii) ways to mitigate such a risk.

(2) But the powers in this section may be exercised for a purpose mentioned in subsection (1)(b) only where OFCOM consider that the provider in question may be at risk of failing to comply with a relevant requirement.

(3) Section 122 requires OFCOM to exercise the power in subsection (4) for the purpose of assisting OFCOM in connection with a notice under section 121(1).

(4) OFCOM may appoint a skilled person to provide them with a report about matters relevant to the purpose for which the powers under this section are exercised (“the relevant matters”), and, where OFCOM make such an appointment, they must notify the provider about the appointment and the relevant matters to be explored in the report.

(5) Alternatively, OFCOM may give a notice to the provider—

(a) requiring the provider to appoint a skilled person to provide OFCOM with a report in such form as may be specified in the notice, and

(b) specifying the relevant matters to be explored in the report.

(6) References in this section to a skilled person are to a person—

(a) appearing to OFCOM to have the skills necessary to prepare a report about the relevant matters, and

(b) where the appointment is to be made by the provider, nominated or approved by OFCOM.

(7) It is the duty of—

(a) the provider of the service (“P”),

(b) any person who works for (or used to work for) P, or is providing (or used to provide) services to P related to the relevant matters, and

(c) other providers of internet services,

to give the skilled person all such assistance as the skilled person may reasonably require to prepare the report.

(8) The provider of the service is liable for the payment, directly to the skilled person, of the skilled person’s remuneration and expenses relating to the preparation of the report.

(9) Subsections (10) to (12) apply in relation to an amount due to a skilled person under subsection (8).

(10) In England and Wales, such an amount is recoverable—

(a) if the county court so orders, as if it were payable under an order of that court;

(b) if the High Court so orders, as if it were payable under an order of that court.

(11) In Scotland, such an amount may be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution issued by the sheriff court of any sheriffdom in Scotland.

(12) In Northern Ireland, such an amount is recoverable—

(a) if a county court so orders, as if it were payable under an order of that court;

(b) if the High Court so orders, as if it were payable under an order of that court.

(13) In this section “relevant requirement” means—

(a) a duty or requirement set out in any of the following—

(i) section 9, 11, 26 or 28 (risk assessments);

(ii) section 10 or 27 (illegal content);

(iii) section 12 or 29 (children’s online safety);

(iv) section 14 (assessments related to the adult user empowerment duty set out in section 15(2));

(v) section 15 (user empowerment);

(vi) section 20 or 31 (content reporting);

(vii) section 21 or 32 (complaints procedures);

(viii) section 23 or 34 (record-keeping and review);

(ix) section 36 (children’s access assessments);

(x) section 38 or 39 (fraudulent advertising);

(xi) section 64 (user identity verification);

(xii) section 66 (reporting CSEA content);

(xiii) section 71 or 72 (terms of service);

(xiv) section 75 (deceased child users);

(xv) section 77(3) or (4) (transparency reports);

(xvi) section 81(2) (children’s access to pornographic content);

(b) a requirement under section 83 to notify OFCOM in connection with the charging of fees (see subsections (1), (3) and (5) of that section); or

(c) a requirement imposed by a notice under section 121(1) (notices to deal with terrorism content and CSEA content).

Investigations and interviews

105 Investigations

(1) If OFCOM open an investigation into whether a provider of a regulated service has failed, or is failing, to comply with any requirement mentioned in subsection (2), the provider must co-operate fully with the investigation.

(2) The requirements are—

(a) a requirement imposed by a notice under section 121(1) (notices to deal with terrorism content and CSEA content), and

(b) an enforceable requirement as defined in section 131 (except the requirement in subsection (1) of this section).

106 Power to require interviews

(1) The power conferred by this section is exercisable by OFCOM for the purposes of an investigation that they are carrying out into the failure, or possible failure, of a provider of a regulated service to comply with a relevant requirement.

(2) OFCOM may give an individual within subsection (4) a notice requiring the individual—

(a) to attend at a time and place specified in the notice, and

(b) to answer questions and provide explanations about any matter relevant to the investigation.

(3) A notice under this section must—

(a) indicate the subject matter and purpose of the interview, and

(b) contain information about the consequences of not complying with the notice.

(4) The individuals within this subsection are—

(a) if the provider of the service is an individual or individuals, that individual or those individuals,

(b) an officer of the provider of the service,

(c) if the provider of the service is a partnership, a partner,

(d) an employee of the provider of the service, and

(e) an individual who was within any of paragraphs (a) to (d) at a time to which the required information or explanation relates.

(5) If OFCOM give a notice to an individual within subsection (4)(b), (c) or (d), they must give a copy of the notice to the provider of the service.

(6) An individual is not required under this section to disclose information in respect of which a claim to legal professional privilege, or (in Scotland) to confidentiality of communications, could be maintained in legal proceedings.

(7) In this section—

• “officer”, in relation to an entity, includes a director, a manager, an associate, a secretary or, where the affairs of the entity are managed by its members, a member;

• “relevant requirement” has the meaning given by section 104(13).

Powers of entry, inspection and audit

107 Powers of entry, inspection and audit

Schedule 12 makes provision about—

(a) OFCOM’s powers of entry and inspection, and

(b) the carrying out of audits by OFCOM.

108 Amendment of Criminal Justice and Police Act 2001

(1) The Criminal Justice and Police Act 2001 is amended as follows.

(2) In section 57(1) (retention of seized items), after paragraph (t) insert—

“(u) paragraph 8 of Schedule 12 to the Online Safety Act 2023.”

(3) In section 65 (meaning of “legal privilege”)—

(a) after subsection (8B) insert—

“(8C) An item which is, or is comprised in, property which has been seized in exercise or purported exercise of the power of seizure conferred by paragraph 7(f), (j) or (k) of Schedule 12 to the Online Safety Act 2023 is to be taken for the purposes of this Part to be an item subject to legal privilege if, and only if, the seizure of that item was in contravention of paragraph 17(3) of that Schedule (privileged information or documents).”;

(b) in subsection (9)—

(i) at the end of paragraph (d) omit “or”;

(ii) at the end of paragraph (e) insert “or”;

(iii) before the closing words insert—

“(g) paragraph 7(f), (j) or (k) of Schedule 12 to the Online Safety Act 2023.”

(4) In Part 1 of Schedule 1 (powers of seizure to which section 50 of the Act applies), after paragraph 73U insert—

“Online Safety Act 2023

73V Each of the powers of seizure conferred by paragraph 7(f), (j) and (k) of Schedule 12 to the Online Safety Act 2023.”

Information offences and penalties

109 Offences in connection with information notices

(1) A person commits an offence if the person fails to comply with a requirement of an information notice.

(2) It is a defence for a person charged with an offence under subsection (1) to show that—

(a) it was not reasonably practicable to comply with the requirements of the information notice at the time required by the notice, but

(b) the person has subsequently taken all reasonable steps to comply with those requirements.

(3) A person commits an offence if, in response to an information notice—

(a) the person provides information that is false in a material respect, and

(b) at the time the person provides it, the person knows that it is false in a material respect or is reckless as to whether it is false in a material respect.

(4) A person commits an offence if, in response to an information notice, the person—

(a) provides information which is encrypted such that it is not possible for OFCOM to understand it, or produces a document which is encrypted such that it is not possible for OFCOM to understand the information it contains, and

(b) the person’s intention was to prevent OFCOM from understanding such information.

(5) A person commits an offence if—

(a) the person suppresses, destroys or alters, or causes or permits the suppression, destruction or alteration of, any information required to be provided, or document required to be produced, by an information notice, and

(b) the person’s intention was to prevent OFCOM from being provided with the information or document or (as the case may be) from being provided with it as it was before the alteration.

(6) The reference in subsection (5) to suppressing information or a document includes a reference to destroying the means of reproducing information recorded otherwise than in a legible form.

(7) Offences under this section may be committed only in relation to an information notice which—

(a) relates to—

(i) a user-to-user service,

(ii) a search service, or

(iii) an internet service on which regulated provider pornographic content is published or displayed; and

(b) is given to the provider of that service.

(8) If a person is convicted of an offence under this section, the court may, on an application by the prosecutor, make an order requiring the person to comply with a requirement of an information notice within such period as may be specified by the order.

(9) See also section 201 (supplementary provision about defences).

(10) In this section, “regulated provider pornographic content” and “published or displayed” have the same meaning as in Part 5 (see section 79).

110 Senior managers’ liability: information offences

(1) In this section “an individual named as a senior manager of an entity” means an individual who, as required by an information notice, is named as a senior manager of an entity in a response to that notice (see section 103).

(2) An individual named as a senior manager of an entity commits an offence if—

(a) the entity commits an offence under section 109(1) (failure to comply with information notice), and

(b) the individual has failed to take all reasonable steps to prevent that offence being committed.

(3) It is a defence for an individual charged with an offence under subsection (2) to show that the individual was a senior manager within the meaning of section 103 for such a short time after the information notice in question was given that the individual could not reasonably have been expected to take steps to prevent that offence being committed.

(4) An individual named as a senior manager of an entity commits an offence if—

(a) the entity commits an offence under section 109(3) (false information), and

(b) the individual has failed to take all reasonable steps to prevent that offence being committed.

(5) An individual named as a senior manager of an entity commits an offence if—

(a) the entity commits an offence under section 109(4) (encrypted information), and

(b) the individual has failed to take all reasonable steps to prevent that offence being committed.

(6) An individual named as a senior manager of an entity commits an offence if—

(a) the entity commits an offence under section 109(5) (destruction etc of information), and

(b) the individual has failed to take all reasonable steps to prevent that offence being committed.

(7) It is a defence for an individual charged with an offence under subsection (4), (5) or (6) to show that the individual was not a senior manager within the meaning of section 103 at the time at which the act constituting the offence occurred.

(8) It is a defence for an individual charged with an offence under this section to show that the individual had no knowledge of being named as a senior manager in a response to the information notice in question.

(9) See also section 201 (supplementary provision about defences).

111 Offences in connection with notices under Schedule 12

(1) A person commits an offence if the person fails without reasonable excuse to comply with a requirement of an audit notice.

(2) A person commits an offence if, in response to an audit notice—

(a) the person provides information that is false in a material respect, and

(b) at the time the person provides it, the person knows that it is false in a material respect or is reckless as to whether it is false in a material respect.

(3) A person commits an offence if—

(a) the person suppresses, destroys or alters, or causes or permits the suppression, destruction or alteration of, any information required to be provided, or document required to be produced, by a notice to which this subsection applies, and

(b) the person’s intention was to prevent OFCOM from being provided with the information or document or (as the case may be) from being provided with it as it was before the alteration.

(4) The reference in subsection (3) to suppressing information or a document includes a reference to destroying the means of reproducing information recorded otherwise than in a legible form.

(5) Subsection (3) applies to—

(a) a notice under paragraph 3 of Schedule 12 (information required for inspection), and

(b) an audit notice (see paragraph 4 of that Schedule).

(6) If a person is convicted of an offence under this section, the court may, on an application by the prosecutor, make an order requiring the person, within such period as may be specified by the order, to comply with a requirement of a notice under paragraph 3 of Schedule 12 or an audit notice (as the case may be).

112 Other information offences

(1) A person commits an offence if the person intentionally obstructs or delays a person in the exercise of the power conferred by section 102(7)(a) (copying a document etc).

(2) A person commits an offence if the person fails without reasonable excuse to comply with a requirement under section 106 (interviews).

(3) A person commits an offence if, in purported compliance with a requirement under section 106—

(a) the person provides information that is false in a material respect, and

(b) at the time the person provides it, the person knows that it is false in a material respect or is reckless as to whether it is false in a material respect.

(4) If a person is convicted of an offence under this section, the court may, on an application by the prosecutor, make an order requiring the person, within such period as may be specified by the order, to permit the making of a copy of a document, or to comply with a requirement under section 106 (as the case may be).

113 Penalties for information offences

(1) A person who commits an offence under section 109(1), 110(2) or 111(1) is liable—

(a) on summary conviction in England and Wales, to a fine;

(b) on summary conviction in Scotland or Northern Ireland, to a fine not exceeding the statutory maximum;

(c) on conviction on indictment, to a fine.

(2) A person who commits an offence under section 109(3), (4) or (5), 110(4), (5) or (6), 111(2) or (3) or 112(1) is liable—

(a) on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);

(b) on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum (or both);

(c) on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);

(d) on conviction on indictment, to imprisonment for a term not exceeding 2 years or a fine (or both).

(3) A person who commits an offence under section 112(2) or (3) is liable—

(a) on summary conviction in England and Wales, to a fine;

(b) on summary conviction in Scotland, to a fine not exceeding level 5 on the standard scale;

(c) on summary conviction in Northern Ireland, to a fine not exceeding level 5 on the standard scale.

Disclosure of information

114 Co-operation and disclosure of information: overseas regulators

(1) OFCOM may co-operate with an overseas regulator, including by disclosing online safety information to that regulator, for the purposes of—

(a) facilitating the exercise by the overseas regulator of any of that regulator’s online regulatory functions, or

(b) criminal investigations or proceedings relating to a matter to which the overseas regulator’s online regulatory functions relate.

(2) The power conferred by subsection (1) applies only in relation to an overseas regulator for the time being specified in regulations made by the Secretary of State.

(3) Where information is disclosed to a person in reliance on subsection (1), the person may not—

(a) use the information for a purpose other than the purpose for which it was disclosed, or

(b) further disclose the information,

except with OFCOM’s consent (which may be general or specific) or in accordance with an order of a court or tribunal.

(4) Except as provided by subsection (5), a disclosure of information under subsection (1) does not breach—

(a) any obligation of confidence owed by the person making the disclosure, or

(b) any other restriction on the disclosure of information (however imposed).

(5) Subsection (1) does not authorise a disclosure of information that—

(a) would contravene the restriction imposed by section 116 (intelligence service information),

(b) would contravene the data protection legislation (but in determining whether a disclosure would do so, the power conferred by that subsection is to be taken into account), or

(c) is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.

(6) Section 18 of the Anti-terrorism, Crime and Security Act 2001 (restriction on disclosure of information for overseas purposes) has effect in relation to a disclosure authorised by subsection (1)(b) as it has effect in relation to a disclosure authorised by any of the provisions to which section 17 of that Act applies.

(7) In this section—

• “online regulatory functions”, in relation to an overseas regulator, means functions of that regulator which correspond to OFCOM’s online safety functions;

• “online safety information” means information held by OFCOM in connection with any of OFCOM’s online safety functions;

• “overseas regulator” means a person exercising functions in a country outside the United Kingdom which correspond to any of OFCOM’s online safety functions;

• “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

115 Disclosure of information

(1) Section 393 of the Communications Act (general restrictions on disclosure of information) is amended as follows.

(2) In subsection (1)—

(a) at the end of paragraph (c) omit “or”,

(b) at the end of paragraph (d) insert “or”, and

(c) after paragraph (d) insert—

“(e) the Online Safety Act 2023,”.

(3) In subsection (2)(e), after “this Act” insert “or the Online Safety Act 2023”.

(4) In subsection (3), after paragraph (h) insert—

“(ha) a person appointed under—

(i) paragraph 1 of Schedule 3 to the Coroners and Justice Act 2009, or

(ii) section 2 of the Coroners Act (Northern Ireland) 1959 (c. 15 (N.I.));

(hb) the procurator fiscal, within the meaning of the enactment mentioned in subsection (5)(s);”.

(5) In subsection (5)—

(a) before paragraph (d) insert—

“(ca) the Coroners Act (Northern Ireland) 1959;”,

(b) after paragraph (na) insert—

“(nb) Part 1 of the Coroners and Justice Act 2009;”, and

(c) after paragraph (r) insert—

“(s) the Inquiries into Fatal Accidents and Sudden Deaths etc. (Scotland) Act 2016 (asp 2).”

(6) In subsection (6)(a), after “390” insert “, or under section 149 of or Schedule 11 to the Online Safety Act 2023”.

(7) In subsection (6)(b), at the end insert “or the Online Safety Act 2023”.

116 Intelligence service information

(1) OFCOM may not disclose information received (directly or indirectly) from, or that relates to, an intelligence service unless the intelligence service consents to the disclosure.

(2) If OFCOM have disclosed information described in subsection (1) to a person, the person must not further disclose the information unless the intelligence service consents to the disclosure.

(3) If OFCOM would contravene subsection (1) by publishing in its entirety—

(a) a statement required to be published by section 47(5), or

(b) a report mentioned in section 164(5),

OFCOM must, before publication, remove or obscure the information which by reason of subsection (1) they must not disclose.

(4) In this section—

• “information” means information held by OFCOM in connection with an online safety matter;

• “intelligence service” means—

  (a)

  the Security Service,

  (b)

  the Secret Intelligence Service, or

  (c)

  the Government Communications Headquarters.

117 Provision of information to the Secretary of State

(1) Section 24B of the Communications Act (provision of information to assist in formulation of policy) is amended as follows.

(2) In subsection (2)—

(a) at the end of paragraph (d) omit “or”,

(b) at the end of paragraph (e) insert “or”, and

(c) after paragraph (e) insert—

“(f) the Online Safety Act 2023,”.

(3) After subsection (3) insert—

“(4) Subsection (2) does not apply to information—

(a) obtained by OFCOM—

(i) in the exercise of a power conferred by section 100 of the Online Safety Act 2023 for the purpose mentioned in subsection (6)(c) of that section (information in connection with a consultation about a threshold figure for the purposes of charging fees under that Act), or

(ii) in the exercise of a power conferred by section 175(5) of that Act (information in connection with circumstances presenting a threat), and

(b) reasonably required by the Secretary of State.”

118 Amendment of Enterprise Act 2002

In Schedule 15 to the Enterprise Act 2002 (enactments relevant to provisions about disclosure of information), at the appropriate place insert—

• “Online Safety Act 2023.”

119 Information for users of regulated services

(1) Section 26 of the Communications Act (publication of information and advice for consumers etc) is amended as follows.

(2) In subsection (2), after paragraph (d) insert—

“(da) United Kingdom users of regulated services;”.

(3) After subsection (6) insert—

“(7) In this section the following terms have the same meaning as in the Online Safety Act 2023—

• “regulated service” (see section 4 of that Act);

• “United Kingdom user” (see section 227 of that Act).”

120 Admissibility of statements

(1) An explanation given, or information provided, by a person in response to a requirement imposed under or by virtue of section 100, 101 or 106 or paragraph 2(4)(e) or (f), 3(2), 4(2)(i) or (j) or 7(d) of Schedule 12, may, in criminal proceedings, only be used in evidence against that person—

(a) on a prosecution for an offence under a provision listed in subsection (2), or

(b) on a prosecution for any other offence where—

(i) in giving evidence that person makes a statement inconsistent with that explanation or information, and

(ii) evidence relating to that explanation or information is adduced, or a question relating to it is asked, by that person or on that person’s behalf.

(2) Those provisions are—

(a) section 69(1),

(b) section 109(3),

(c) section 110(4),

(d) section 111(2),

(e) section 112(3),

(f) paragraph 18(1)(c) of Schedule 12,

(g) section 5 of the Perjury Act 1911 (false statements made otherwise than on oath),

(h) section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath), and

(i) Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).

CHAPTER 5 Regulated user-to-user services and regulated search services: notices to deal with terrorism content and CSEA content

121 Notices to deal with terrorism content or CSEA content (or both)

(1) If OFCOM consider that it is necessary and proportionate to do so, they may give a notice described in subsection (2), (3) or (4) relating to a regulated user-to-user service or a regulated search service to the provider of the service.

(2) A notice under subsection (1) that relates to a regulated user-to-user service is a notice requiring the provider of the service—

(a) to do any or all of the following—

(i) use accredited technology to identify terrorism content communicated publicly by means of the service and to swiftly take down that content;

(ii) use accredited technology to prevent individuals from encountering terrorism content communicated publicly by means of the service;

(iii) use accredited technology to identify CSEA content, whether communicated publicly or privately by means of the service, and to swiftly take down that content;

(iv) use accredited technology to prevent individuals from encountering CSEA content, whether communicated publicly or privately, by means of the service; or

(b) to use the provider’s best endeavours to develop or source technology for use on or in relation to the service or part of the service, which—

(i) achieves the purpose mentioned in paragraph (a)(iii) or (iv), and

(ii) meets the standards published by the Secretary of State (see section 125(13)).

(3) A notice under subsection (1) that relates to a regulated search service is a notice requiring the provider of the service—

(a) to do either or both of the following—

(i) use accredited technology to identify search content of the service that is terrorism content and to swiftly take measures designed to secure, so far as possible, that search content of the service no longer includes terrorism content identified by the technology;

(ii) use accredited technology to identify search content of the service that is CSEA content and to swiftly take measures designed to secure, so far as possible, that search content of the service no longer includes CSEA content identified by the technology; or

(b) to use the provider’s best endeavours to develop or source technology for use on or in relation to the service which—

(i) achieves the purpose mentioned in paragraph (a)(ii), and

(ii) meets the standards published by the Secretary of State (see section 125(13)).

(4) A notice under subsection (1) that relates to a combined service is a notice requiring the provider of the service—

(a) to do any or all of the things described in subsection (2)(a) in relation to the user-to-user part of the service, or to use best endeavours to develop or source technology as described in subsection (2)(b) for use on or in relation to that part of the service;

(b) to do either or both of the things described in subsection (3)(a) in relation to the search engine of the service, or to use best endeavours to develop or source technology as described in subsection (3)(b) for use on or in relation to the search engine of the service;

(c) to do any or all of the things described in subsection (2)(a) in relation to the user-to-user part of the service and either or both of the things described in subsection (3)(a) in relation to the search engine of the service; or

(d) to use best endeavours to develop or source—

(i) technology as described in subsection (2)(b) for use on or in relation to the user-to-user part of the service, and

(ii) technology as described in subsection (3)(b) for use on or in relation to the search engine of the service.

(5) For the purposes of subsections (2) and (3), a requirement to use accredited technology may be complied with by the use of the technology alone or by means of the technology together with the use of human moderators.

(6) See—

(a) section 122, which requires OFCOM to obtain a skilled person’s report before giving a notice under subsection (1),

(b) section 123, which requires OFCOM to give a warning notice before giving a notice under subsection (1), and

(c) section 124 for provision about matters which OFCOM must consider before giving a notice under subsection (1).

(7) A notice under subsection (1) that relates to a user-to-user service (or to the user-to-user part of a combined service) and requires the use of technology in relation to terrorism content must identify the content, or parts of the service that include content, that OFCOM consider is communicated publicly on that service (see section 232).

(8) For the meaning of “accredited” technology, see section 125(12) and (13).

122 Requirement to obtain skilled person’s report

(1) OFCOM may give a notice under section 121(1) to a provider only after obtaining a report from a skilled person appointed by OFCOM under section 104(4).

(2) The purpose of the report is to assist OFCOM in deciding whether to give a notice under section 121(1), and to advise about the requirements that might be imposed by such a notice if it were to be given.

123 Warning notices

(1) OFCOM may give a notice under section 121(1) to a provider relating to a service or part of a service only after giving a warning notice to the provider that they intend to give such a notice relating to that service or that part of it.

(2) A warning notice under subsection (1) relating to the use of accredited technology (see section 121(2)(a) and (3)(a)) must—

(a) contain a summary of the report obtained by OFCOM under section 122,

(b) contain details of the technology that OFCOM are considering requiring the provider to use,

(c) specify whether the technology is to be required in relation to terrorism content or CSEA content (or both),

(d) specify any other requirements that OFCOM are considering imposing (see section 125(2) to (4)),

(e) specify the period for which OFCOM are considering imposing the requirements (see section 125(7)),

(f) state that the provider may make representations to OFCOM (with any supporting evidence), and

(g) specify the period within which representations may be made.

(3) A warning notice under subsection (1) relating to the development or sourcing of technology (see section 121(2)(b)and (3)(b)) must—

(a) contain a summary of the report obtained by OFCOM under section 122,

(b) describe the proposed purpose for which the technology must be developed or sourced (see section 121(2)(a)(iii) and (iv) and (3)(a)(ii)),

(c) specify steps that OFCOM consider the provider needs to take in order to comply with the requirement described in section 121(2)(b) or (3)(b), or both those requirements (as the case may be),

(d) specify the proposed period within which the provider must take each of those steps,

(e) specify any other requirements that OFCOM are considering imposing,

(f) state that the provider may make representations to OFCOM (with any supporting evidence), and

(g) specify the period within which representations may be made.

(4) A notice under section 121(1) that relates to both the user-to-user part of a combined service and the search engine of the service (as described in section 121(4)(c) or (d)) may be given to the provider of the service only if—

(a) two separate warning notices have been given to the provider (one relating to the user-to-user part of the service and the other relating to the search engine), or

(b) a single warning notice relating to both the user-to-user part of the service and the search engine has been given to the provider.

(5) A notice under section 121(1) may not be given to a provider until the period allowed by the warning notice for the provider to make representations has expired.

124 Matters relevant to a decision to give a notice under section 121(1)

(1) This section specifies the matters which OFCOM must particularly consider in deciding whether it is necessary and proportionate to give a notice under section 121(1) relating to a Part 3 service to the provider of the service.

(2) In the case of a notice requiring the use of accredited technology, the matters are as follows—

(a) the kind of service it is;

(b) the functionalities of the service;

(c) the user base of the service;

(d) in the case of a notice relating to a user-to-user service (or to the user-to-user part of a combined service), the prevalence of relevant content on the service, and the extent of its dissemination by means of the service;

(e) in the case of a notice relating to a search service (or to the search engine of a combined service), the prevalence of search content of the service that is relevant content;

(f) the level of risk of harm to individuals in the United Kingdom presented by relevant content, and the severity of that harm;

(g) the systems and processes used by the service which are designed to identify and remove relevant content;

(h) the contents of the skilled person’s report obtained as required by section 122;

(i) the extent to which the use of the specified technology would or might result in interference with users’ right to freedom of expression within the law;

(j) the level of risk of the use of the specified technology resulting in a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of the service (including, but not limited to, any such provision or rule concerning the processing of personal data);

(k) in the case of a notice relating to a user-to-user service (or to the user-to-user part of a combined service), the extent to which the use of the specified technology would or might—

(i) have an adverse impact on the availability of journalistic content on the service, or

(ii) result in a breach of the confidentiality of journalistic sources;

(l) whether the use of any less intrusive measures than the specified technology would be likely to achieve a significant reduction in the amount of relevant content.

(3) The references to relevant content in subsection (2)(f), (g) and (l) are to—

(a) in the case of a user-to-user service (or the user-to-user part of a combined service), relevant content present on the service;

(b) in the case of a search service (or the search engine of a combined service), search content of the service that is relevant content.

(4) In the case of a notice relating to the development or sourcing of technology, subsection (2) applies—

(a) as if references to relevant content were to CSEA content, and

(b) with the omission of paragraphs (i), (j), (k) and (l).

(5) In this section—

• “journalistic content” has the meaning given by section 19;

• “relevant content” means terrorism content or CSEA content or both those kinds of content (depending on the kind, or kinds, of content in relation to which the specified technology is to operate);

• “specified technology” means the technology to be specified in the notice under section 121(1).

125 Notices under section 121(1): supplementary

(1) In this section “a notice” means a notice under section 121(1) (including a further notice under that provision).

(2) If a provider is already using accredited technology in relation to the service in question, a notice may require the provider to use it more effectively (specifying the ways in which that must be done).

(3) A notice relating to a user-to-user service (or to the user-to-user part of a combined service) may also require a provider to operate an effective complaints procedure allowing for United Kingdom users to challenge the provider for taking down content which they have generated, uploaded or shared on the service.

(4) A notice relating to a search service (or to the search engine of a combined service) may also require a provider to operate an effective complaints procedure allowing for an interested person (see section 227(7)) to challenge measures taken or in use by the provider that result in content relating to that interested person no longer appearing in search results of the service.

(5) A notice given to a provider of a Part 3 service requiring the use of accredited technology is to be taken to require the provider to make such changes to the design or operation of the service as are necessary for the technology to be used effectively.

(6) A notice requiring the use of accredited technology must—

(a) give OFCOM’s reasons for their decision to give the notice,

(b) contain details of the requirements imposed by the notice,

(c) contain details of the technology to be used,

(d) contain details about the manner in which the technology is to be implemented,

(e) specify a reasonable period for compliance with the notice,

(f) specify the period for which the notice is to have effect,

(g) contain details of the rights of appeal under section 168,

(h) contain information about when OFCOM intend to review the notice (see section 126), and

(i) contain information about the consequences of not complying with the notice (including information about the further kinds of enforcement action that it would be open to OFCOM to take).

(7) A notice requiring the use of accredited technology may impose requirements for a period of up to 36 months beginning with the last day of the period specified in the notice in accordance with subsection (6)(e).

(8) A notice relating to the development or sourcing of technology must—

(a) give OFCOM’s reasons for their decision to give the notice,

(b) describe the purpose for which technology is required to be developed or sourced (see section 121(2)(a)(iii) and (iv) and (3)(a)(ii),

(c) specify steps that the provider is required to take (including steps relating to the use of a system or process) in order to comply with the requirement described in section 121(2)(b) or (3)(b), or both those requirements (as the case may be),

(d) specify a reasonable period within which each of the steps specified in the notice must be taken,

(e) contain details of any other requirements imposed by the notice,

(f) contain details of the rights of appeal under section 168,

(g) contain information about when OFCOM intend to review the notice (see section 126), and

(h) contain information about the consequences of not complying with the notice (including information about the further kinds of enforcement action that it would be open to OFCOM to take).

(9) In deciding what period or periods to specify for steps to be taken in accordance with subsection (8)(d), OFCOM must, in particular, consider—

(a) the size and capacity of the provider, and

(b) the state of development of technology capable of achieving the purpose described in the notice in accordance with subsection (8)(b).

(10) A notice may impose requirements only in relation to the design and operation of a Part 3 service—

(a) in the United Kingdom, or

(b) as it affects United Kingdom users of the service.

(11) OFCOM may vary or revoke a notice given to a provider by notifying the provider to that effect.

(12) For the purposes of this Chapter, technology is “accredited” if it is accredited (by OFCOM or another person appointed by OFCOM) as meeting minimum standards of accuracy in the detection of terrorism content or CSEA content (as the case may be).

(13) Those minimum standards of accuracy must be such standards as are for the time being approved and published by the Secretary of State, following advice from OFCOM.

126 Review and further notice under section 121(1)

(1) This section applies where OFCOM have given a provider of a Part 3 service a notice under section 121(1).

(2) The power conferred by section 125(11) includes power to revoke the notice if there are reasonable grounds for believing that the provider is failing to comply with it.

(3) If a notice is revoked as mentioned in subsection (2), OFCOM may give the provider a further notice under section 121(1) if they consider that it is necessary and proportionate to do so (taking into account the matters mentioned in section 124).

(4) Except where a notice under section 121(1) is revoked as mentioned in subsection (2), OFCOM must carry out a review of the provider’s compliance with the notice—

(a) in the case of a notice requiring the use of accredited technology, before the end of the period for which the notice has effect;

(b) in the case of a notice relating to the development or sourcing of technology, before the last date by which any step specified in the notice is required to be taken.

(5) In the case of a notice requiring the use of accredited technology, the review must consider—

(a) the extent to which the technology specified in the notice has been used, and

(b) the effectiveness of its use.

(6) Following the review, and after consultation with the provider, OFCOM may give the provider a further notice under section 121(1) if they consider that it is necessary and proportionate to do so (taking into account the matters mentioned in section 124).

(7) If a further notice under section 121(1) is given, subsections (3) to (6) apply again.

(8) A further notice under section 121(1) may impose different requirements from an earlier notice under that provision.

(9) Sections 122 (skilled person’s report) and 123 (warning notices) do not apply in relation to a further notice under section 121(1).

127 OFCOM’s guidance about functions under this Chapter

(1) OFCOM must produce guidance for providers of Part 3 services about how OFCOM propose to exercise their functions under this Chapter.

(2) Before producing the guidance (including revised or replacement guidance), OFCOM must consult the Information Commissioner.

(3) OFCOM must keep the guidance under review.

(4) OFCOM must publish the guidance (and any revised or replacement guidance).

(5) In exercising their functions under this Chapter, or deciding whether to exercise them, OFCOM must have regard to the guidance for the time being published under this section.

128 OFCOM’s annual report

(1) OFCOM must produce and publish an annual report about—

(a) the exercise of their functions under this Chapter, and

(b) technology which meets, or is in the process of development so as to meet, minimum standards of accuracy (see subsections (12) and (13) of section 125) for the purposes of this Chapter.

(2) OFCOM must send a copy of the report to the Secretary of State, and the Secretary of State must lay it before Parliament.

(3) For further provision about reports under this section, see section 164.

129 Interpretation of this Chapter

In this Chapter—

• “search content” has the same meaning as in Part 3 (see section 57);

• “search results” has the meaning given by section 57(3);

• “terrorism content” and “CSEA content” have the same meaning as in Part 3 (see section 59).

CHAPTER 6 Enforcement powers

Provisional notices and confirmation decisions

130 Provisional notice of contravention

(1) OFCOM may give a notice under this section (a “provisional notice of contravention”) relating to a regulated service to the provider of the service if they consider that there are reasonable grounds for believing that the provider has failed, or is failing, to comply with any enforceable requirement (see section 131) that applies in relation to the service.

(2) OFCOM may also give a provisional notice of contravention to a person on either of the grounds in subsection (3).

(3) The grounds are that—

(a) the person has been given an information notice and OFCOM consider that there are reasonable grounds for believing that the person has failed, or is failing, to comply with either of the duties set out in section 102(8) (duties in relation to information notices), or

(b) the person is required by a skilled person appointed under section 104 to give assistance to the skilled person, and OFCOM consider that there are reasonable grounds for believing that the person has failed, or is failing, to comply with the duty set out in subsection (7) of that section to give such assistance.

(4) A provisional notice of contravention given to a person must—

(a) specify the duty or requirement with which (in OFCOM’s opinion) the person has failed, or is failing, to comply, and

(b) give OFCOM’s reasons for their opinion that the person has failed, or is failing, to comply with it.

(5) A provisional notice of contravention may also contain details as mentioned in subsection (6) or (7), or both.

(6) A provisional notice of contravention may specify steps that OFCOM consider the person needs to take in order to—

(a) comply with the duty or requirement, or

(b) remedy the failure to comply with it.

(7) A provisional notice of contravention may state that OFCOM propose to impose a penalty on the person, and in such a case the notice must—

(a) state the reasons why OFCOM propose to impose a penalty,

(b) state whether OFCOM propose to impose a penalty of a single amount, a penalty calculated by reference to a daily rate, or both penalties (see section 137(1)),

(c) indicate the amount of a penalty that OFCOM propose to impose, including (in relation to a penalty calculated by reference to a daily rate) the daily rate and how the penalty would be calculated,

(d) in relation to a penalty calculated by reference to a daily rate, specify or describe the period for which OFCOM propose that the penalty should be payable, and

(e) state the reasons for proposing a penalty of that amount, including any aggravating or mitigating factors that OFCOM propose to take into account.

(8) A provisional notice of contravention given to a person must—

(a) state that the person may make representations to OFCOM (with any supporting evidence) about the matters contained in the notice, and

(b) specify the period within which such representations may be made.

(9) A provisional notice of contravention may be given in respect of a failure to comply with more than one enforceable requirement.

(10) Where a provisional notice of contravention is given in respect of a continuing failure, the notice may be given in respect of any period during which the failure has continued, and must specify that period.

(11) Where a provisional notice of contravention is given to a person in respect of a failure to comply with a duty or requirement (“the first notice”), a further provisional notice of contravention in respect of a failure to comply with that same duty or requirement may be given to the person only—

(a) in respect of a separate instance of the failure after the first notice was given,

(b) where a period was specified in the first notice in accordance with subsection (10), in respect of the continuation of the failure after the end of that period, or

(c) if the first notice has been withdrawn (without a confirmation decision being given to the person in respect of the failure).

131 Requirements enforceable by OFCOM against providers of regulated services

(1) References in this Chapter to “enforceable requirements” are to—

(a) the duties or requirements set out in the provisions of this Act specified in the table in subsection (2), and

(b) the requirements mentioned in subsection (3).

(2) Here is the table—

Provision	Subject matter
Section 9	Illegal content risk assessments
Section 10	Illegal content
Section 11	Children’s risk assessments
Section 12	Children’s online safety
Section 14	Assessments related to duty in section 15(2)
Section 15	User empowerment
Section 17	Content of democratic importance
Section 18	News publisher content
Section 19	Journalistic content
Section 20	Content reporting
Section 21	Complaints procedures
Section 22	Freedom of expression and privacy
Section 23	Record-keeping and review
Section 26	Illegal content risk assessments
Section 27	Illegal content
Section 28	Children’s risk assessments
Section 29	Children’s online safety
Section 31	Content reporting
Section 32	Complaints procedures
Section 33	Freedom of expression and privacy
Section 34	Record-keeping and review
Section 36	Children’s access assessments
Section 38	Fraudulent advertising
Section 39	Fraudulent advertising
Section 64	User identity verification
Section 66	Reporting CSEA content to NCA
Section 71	Acting against users only in accordance with terms of service
Section 72	Terms of service
Section 75	Information about use of service by deceased child users
Section 77(3) and (4)	Transparency reports
Section 81	Provider pornographic content
Section 83	Fees: notification of OFCOM
Section 102(8)	Information notices
Section 104(7)	Assistance to skilled person
Section 105(1)	Co-operation with investigation

(3) The requirements referred to in subsection (1)(b) are—

(a) requirements of a notice under section 104(5)(a) to appoint a skilled person;

(b) requirements of a notice given by virtue of section 175(3) (duty to make public statement);

(c) requirements of a notice under section 175(5) (information in connection with circumstances presenting a threat);

(d) requirements imposed by a person acting—

(i) in the exercise of powers conferred by paragraph 2 of Schedule 12 (entry and inspection without warrant), or

(ii) in the execution of a warrant issued under paragraph 5 of that Schedule.

132 Confirmation decisions

(1) This section applies if—

(a) OFCOM have given a provisional notice of contravention to a person in relation to a failure to comply with a duty or requirement (or with duties or requirements), and

(b) the period allowed for representations has expired.

A duty or requirement to which the provisional notice of contravention relates is referred to in this section as a “notified requirement”.

(2) If, after considering any representations and evidence, OFCOM decide not to give the person a notice under this section, they must inform the person of that fact.

(3) If OFCOM are satisfied that the person has failed, or has been failing, to comply with a notified requirement, OFCOM may give the person a notice under this section (a “confirmation decision”) confirming that that is OFCOM’s opinion.

(4) A confirmation decision and a notice under section 121(1) may be given in respect of the same failure.

(5) A confirmation decision given to a person may—

(a) require the person to take steps as mentioned in section 133;

(b) require the person to pay a penalty as mentioned in section 137;

(c) require the person to do both those things (or neither of them).

(6) See sections 134 and 135 for further provision which a confirmation decision may include in cases of failure to comply with duties about risk assessments or children’s access assessments.

133 Confirmation decisions: requirements to take steps

(1) A confirmation decision may require the person to whom it is given to take such steps as OFCOM consider appropriate (including steps relating to the use of a system or process) for either or both of the following purposes—

(a) complying with a notified requirement;

(b) remedying the failure to comply with a notified requirement.

(2) But see section 136 in relation to OFCOM’s power to include in a confirmation decision requirements as described in subsection (1) relating to the use of proactive technology.

(3) A confirmation decision may impose requirements as described in subsection (1) only in relation to the design or operation of a regulated service—

(a) in the United Kingdom, or

(b) as it affects United Kingdom users of the service.

(4) A confirmation decision that includes requirements as described in subsection (1) must—

(a) specify the steps that are required,

(b) give OFCOM’s reasons for their decision to impose those requirements,

(c) specify which of those requirements (if any) have been designated as CSEA requirements (see subsections (6) and (7)),

(d) specify each notified requirement to which the steps relate,

(e) specify the period during which the failure to comply with a notified requirement has occurred, and whether the failure is continuing,

(f) specify a reasonable period within which each of the steps specified in the decision must be taken or, if a step requires the use of a system or process, a reasonable period within which the system or process must begin to be used (but see subsection (5) in relation to information duties),

(g) (if relevant) specify the period for which a system or process must be used,

(h) contain details of the rights of appeal under section 168, and

(i) contain information about the consequences of not complying with the requirements included in the decision (including information about the further kinds of enforcement action that it would be open to OFCOM to take).

(5) A confirmation decision that requires a person to take steps for the purpose of complying with an information duty may require the person to take those steps immediately.

(6) If the condition in subsection (7) is met in relation to a requirement imposed by a confirmation decision which is of a kind described in subsection (1), OFCOM must designate the requirement as a “CSEA requirement” for the purposes of section 138(3) (offence of failure to comply with confirmation decision).

(7) The condition referred to in subsection (6) is that the requirement is imposed (whether or not exclusively) in relation to either or both of the following—

(a) a failure to comply with section 10(2)(a) or (3)(a) in respect of CSEA content, or in respect of priority illegal content which includes CSEA content;

(b) a failure to comply with section 10(2)(b) in respect of an offence specified in Schedule 6 (CSEA offences), or in respect of priority offences which include such an offence.

(8) A person to whom a confirmation decision is given has a duty to comply with requirements included in the decision which are of a kind described in subsection (1).

(9) The duty under subsection (8) is enforceable in civil proceedings by OFCOM—

(a) for an injunction,

(b) for specific performance of a statutory duty under section 45 of the Court of Session Act 1988, or

(c) for any other appropriate remedy or relief.

(10) In this section—

• “CSEA content”, “priority illegal content” and “priority offence” have the same meaning as in Part 3 (see section 59);

• “information duty” means a duty set out in section 102(8);

• “notified requirement” has the meaning given by section 132.

134 Confirmation decisions: risk assessments

(1) This section applies if—

(a) OFCOM are satisfied that a provider of a Part 3 service has failed to comply with a risk assessment duty,

(b) based on evidence resulting from OFCOM’s investigation into that failure, OFCOM have identified a risk of serious harm to individuals in the United Kingdom arising from a particular aspect of the service (“the identified risk”), and

(c) OFCOM consider that the identified risk is not effectively mitigated or managed.

(2) A confirmation decision given to the provider of the service—

(a) if the identified risk relates to matters required to be covered by an illegal content risk assessment, may include a determination that the duty set out in section 10(2)(b) or (c) or 27(2) (as the case may be) applies as if an illegal content risk assessment carried out by the provider had identified that risk;

(b) if the identified risk relates to matters required to be covered by a children’s risk assessment, may include a determination that the duty set out in section 12(2)(a) or 29(2)(a) (as the case may be) applies as if a children’s risk assessment carried out by the provider had identified that risk.

(3) A confirmation decision which includes a determination as mentioned in subsection (2) must—

(a) give details of the identified risk,

(b) specify the duty to which the determination relates, and

(c) specify the date by which measures (at the provider’s discretion) to comply with that duty must be taken or must begin to be used.

(4) A determination as mentioned in subsection (2) ceases to have effect on the date on which the provider of the service complies with the risk assessment duty with which the provider had previously failed to comply (and accordingly, from that date the duty to which the determination relates applies without the modification mentioned in that subsection).

(5) In this section—

• “children’s risk assessment” has the meaning given by section 11 or 28 (as the case may be);

• “illegal content risk assessment” has the meaning given by section 9 or 26 (as the case may be);

• “risk assessment duty” means a duty set out in—

  (a)

  section 9,

  (b)

  section 11,

  (c)

  section 26, or

  (d)

  section 28.

135 Confirmation decisions: children’s access assessments

(1) This section applies if OFCOM are satisfied that a provider of a Part 3 service has failed to comply with a duty set out in section 36 (duties about children’s access assessments).

(2) If OFCOM include in a confirmation decision a requirement to take steps relating to the carrying out of a children’s access assessment of a service, they must require that assessment to be completed within three months of the date of the confirmation decision.

(3) OFCOM may vary a confirmation decision which includes a requirement as mentioned in subsection (2) to extend the deadline for completion of a children’s access assessment.

(4) Subsection (5) applies if, based on evidence that OFCOM have about a service resulting from their investigation into compliance with a duty set out in section 36, OFCOM consider that—

(a) it is possible for children to access the service or a part of it, and

(b) the child user condition is met in relation to—

(i) the service, or

(ii) a part of the service that it is possible for children to access.

(5) OFCOM may include in the confirmation decision given to the provider of the service—

(a) a determination that the duties set out in sections 11 and 12, or (as the case may be) sections 28 and 29, must be complied with—

(i) from the date of the confirmation decision, or

(ii) from a later date specified in that decision;

(b) provision about the circumstances in which that determination may be treated as no longer applying in relation to the service.

(6) Subsection (4) is to be interpreted consistently with section 35.

(7) In this section, “children’s access assessment” has the meaning given by section 35.

136 Confirmation decisions: proactive technology

(1) This section sets out what powers OFCOM have to include in a confirmation decision a requirement to take steps to use a kind, or one of the kinds, of proactive technology specified in the decision (a “proactive technology requirement”).

(2) A proactive technology requirement may be imposed in a confirmation decision if—

(a) the decision is given to the provider of an internet service within section 80(2), and

(b) the decision is imposed for the purpose of complying with, or remedying the failure to comply with, the duty set out in section 81(2) (provider pornographic content).

(3) The following provisions of this section set out constraints on OFCOM’s power to include a proactive technology requirement in a confirmation decision in any case not within subsection (2).

(4) A proactive technology requirement may be imposed in a confirmation decision only if the decision is given to the provider of a Part 3 service.

(5) A proactive technology requirement may be imposed in a confirmation decision only for the purpose of complying with, or remedying the failure to comply with, any of the duties set out in—

(a) section 10(2) or (3) (illegal content),

(b) section 12(2) or (3) (children’s online safety),

(c) section 27(2) or (3) (illegal content),

(d) section 29(2) or (3) (children’s online safety), or

(e) section 38(1) or 39(1) (fraudulent advertising).

(6) Proactive technology may be required to be used on or in relation to any Part 3 service or any part of such a service, but if and to the extent that the technology operates (or may operate) by analysing content that is user-generated content in relation to the service, or metadata relating to such content, the technology may not be required to be used except to analyse—

(a) user-generated content communicated publicly, and

(b) metadata relating to user-generated content communicated publicly.

(7) Before imposing a proactive technology requirement in relation to a service in a confirmation decision, OFCOM must particularly consider the matters mentioned in subsection (8), so far as they are relevant.

(8) The matters are as follows—

(a) the kind of service it is;

(b) the functionalities of the service;

(c) the user base of the service;

(d) the prevalence of relevant content on the service and the extent of its dissemination by means of the service, or (as the case may be) the prevalence of search content of the service that is relevant content;

(e) the level of risk of harm to individuals in the United Kingdom presented by relevant content present on the service, or (as the case may be) search content of the service that is relevant content, and the severity of that harm;

(f) the degree of accuracy, effectiveness and lack of bias achieved by the kind of technology specified in the decision;

(g) the extent to which the use of the kind of proactive technology specified in the decision would or might result in interference with users’ right to freedom of expression within the law;

(h) the level of risk of the use of the kind of proactive technology specified in the decision resulting in a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of the service (including, but not limited to, any such provision or rule concerning the processing of personal data);

(i) whether the use of any less intrusive measures than the proactive technology specified in the decision would be likely to result in compliance with, or would be likely to effectively remedy the failure to comply with, the duty in question.

(9) A confirmation decision that imposes a proactive technology requirement on a provider may also impose requirements about review of the technology by the provider.

(10) A confirmation decision relating to a service which requires the use of technology of a kind mentioned in subsection (6) must identify the content, or parts of the service that include content, that OFCOM consider is communicated publicly on that service (see section 232).

(11) In this section—

• “content that is harmful to children” has the same meaning as in Part 3 (see section 60);

• “fraudulent advertisement” has the meaning given by section 38 or 39 (depending on the kind of service in question);

• “illegal content” has the same meaning as in Part 3 (see section 59);

• “relevant content” means illegal content, content that is harmful to children or content consisting of fraudulent advertisements, or any or all of those kinds of content (depending on the duties (as mentioned in subsection (5)) for the purposes of which the proactive technology requirement is imposed);

• “search content” has the same meaning as in Part 3 (see section 57);

• “user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

137 Confirmation decisions: penalties

(1) A confirmation decision may require the person to whom it is given to do either or both of the following, depending on what was proposed in the provisional notice of contravention (see paragraph 3 of Schedule 13)—

(a) pay to OFCOM a penalty of a single amount in sterling determined by OFCOM (a “single penalty”) and specified in the confirmation decision;

(b) if the confirmation decision includes a requirement of the kind described in section 133(1)(a) in respect of a continuous failure to comply with a notified requirement, pay a daily rate penalty to OFCOM if that same failure continues after the compliance date.

(2) A “daily rate penalty” means a penalty of an amount in sterling determined by OFCOM and calculated by reference to a daily rate.

(3) A confirmation decision may impose separate single penalties for failure to comply with separate notified requirements specified in the decision.

(4) Where a provisional notice of contravention is given in respect of a period of continuing failure to comply with a notified requirement, no more than one single penalty may be imposed by a confirmation decision in respect of the period of failure specified in the provisional notice of contravention.

(5) A confirmation decision that imposes a penalty must—

(a) give OFCOM’s reasons for their decision to impose the penalty,

(b) specify each notified requirement to which the penalty relates,

(c) specify the period during which the failure to comply with a notified requirement has occurred, and whether the failure is continuing,

(d) state the reasons for the amount of the penalty, including any aggravating or mitigating factors that OFCOM have taken into account,

(e) specify a reasonable period within which the penalty must be paid,

(f) contain details of the rights of appeal under section 168, and

(g) contain information about the consequences of not paying the penalty (including information about the further kinds of enforcement action that it would be open to OFCOM to take).

(6) The period specified under subsection (5)(e) for the payment of a single penalty must be at least 28 days beginning with the day on which the confirmation decision is given.

(7) If a confirmation decision imposes a single penalty and a daily rate penalty, the information mentioned in subsection (5)(a), (b), (d) and (e) must be given in respect of each kind of penalty.

(8) As well as containing the information mentioned in subsection (5), a confirmation decision that imposes a daily rate penalty in respect of a continuous failure to comply with a notified requirement must—

(a) state the daily rate of the penalty and how the penalty is calculated;

(b) state that the person will be liable to pay the penalty if that same failure continues after the compliance date;

(c) state the date from which the penalty begins to be payable, which must not be earlier than the day after the compliance date;

(d) provide for the penalty to continue to be payable at the daily rate until—

(i) the date on which the notified requirement is complied with,

(ii) if the penalty is imposed in respect of a failure to comply with more than one notified requirement, the date on which the last of those requirements is complied with, or

(iii) an earlier date specified in the confirmation decision.

(9) In this section—

• “compliance date”, in relation to a notified requirement, means—

  (a)

  in a case where the confirmation decision requires steps to be taken immediately to comply with that requirement (see section 133(5)), the date of the confirmation decision;

  (b)

  in any other case, the last day of the period specified in the confirmation decision in accordance with section 133(4)(f) for compliance with that requirement;

• “notified requirement” has the meaning given by section 132.

138 Confirmation decisions: offences

(1) A person to whom a confirmation decision is given commits an offence if, without reasonable excuse, the person fails to comply with a requirement imposed by the decision which—

(a) is of a kind described in section 133(1), and

(b) is imposed (whether or not exclusively) in relation to a failure to comply with a children’s online safety duty.

(2) A “children’s online safety duty” means a duty set out in—

(a) section 12(3)(a),

(b) section 12(3)(b),

(c) section 81(2), or

(d) section 81(4).

(3) A person to whom a confirmation decision is given commits an offence if, without reasonable excuse, the person fails to comply with a CSEA requirement imposed by the decision (see section 133(6) and (7)).

(4) A person who commits an offence under this section is liable—

(a) on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);

(b) on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum (or both);

(c) on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);

(d) on conviction on indictment, to imprisonment for a term not exceeding 2 years or a fine (or both).

Penalty notices etc

139 Penalty for failure to comply with confirmation decision

(1) This section applies if—

(a) OFCOM have given a confirmation decision to a person,

(b) the decision includes requirements of a kind described in section 133(1) (requirements to take steps),

(c) OFCOM are satisfied that the person has failed to comply with one or more of those requirements, and

(d) OFCOM have not imposed a daily rate penalty under section 137(1)(b) in respect of that failure.

(2) OFCOM may give the person a penalty notice under this section in respect of the failure to comply with the confirmation decision, requiring the person to pay to OFCOM a penalty of a single amount in sterling determined by OFCOM.

(3) But OFCOM may give such a notice to the person only after—

(a) notifying the person that they propose to give a penalty notice under this section, specifying the reasons for doing so and indicating the amount of the proposed penalty, and

(b) giving the person an opportunity to make representations (with any supporting evidence).

(4) A penalty notice under this section must—

(a) give OFCOM’s reasons for their decision to impose the penalty,

(b) state the amount of the penalty,

(c) state the reasons for the amount of the penalty, including any aggravating or mitigating factors that OFCOM have taken into account,

(d) specify the period within which the penalty must be paid,

(e) contain details of the rights of appeal under section 168, and

(f) contain information about the consequences of not paying the penalty (including information about the further kinds of enforcement action that it would be open to OFCOM to take).

(5) The period specified under subsection (4)(d) must be at least 28 days beginning with the day on which the penalty notice is given.

140 Penalty for failure to comply with notice under section 121(1)

(1) This section applies if—

(a) OFCOM have given a notice under section 121(1) relating to a Part 3 service to the provider of that service (notices to deal with terrorism content and CSEA content), and

(b) OFCOM are satisfied that the provider has failed, or is failing, to comply with the notice.

(2) OFCOM may give the provider a notice under this subsection stating that they propose to impose a penalty on the provider in respect of that failure.

(3) The provider may make representations to OFCOM (with any supporting evidence) about the matters contained in the notice.

(4) Subsection (5) applies if—

(a) the period allowed for representations has expired, and

(b) OFCOM are still satisfied as to the failure mentioned in subsection (1).

(5) OFCOM may give the provider a penalty notice under this subsection requiring the provider to pay to OFCOM a penalty of an amount in sterling determined by OFCOM.

(6) The penalty may consist of any of the following, depending on what was specified in the notice about the proposed penalty—

(a) a single amount;

(b) an amount calculated by reference to a daily rate;

(c) a combination of a single amount and an amount calculated by reference to a daily rate.

(7) See section 142 for information which must be included in notices under this section.

(8) Nothing in this section is to be taken to prevent OFCOM from giving the provider a further notice under section 121(1) (see section 126), as well as giving a penalty notice under subsection (5).

141 Non-payment of fee

(1) This section applies if—

(a) the provider of a regulated service is liable to pay a fee to OFCOM under section 84 or Schedule 10 in respect of the current charging year (within the meaning of Part 6) or a previous charging year, and

(b) in OFCOM’s opinion, the provider has not paid the full amount of the fee that the provider is liable to pay.

(2) OFCOM may give the provider a notice under this subsection specifying—

(a) the outstanding amount of the fee that OFCOM consider the provider is due to pay to them under section 84 or Schedule 10, and

(b) the period within which the provider must pay it.

(3) A notice under subsection (2)—

(a) may be given in respect of liabilities that relate to different charging years;

(b) may also state that OFCOM propose to impose a penalty on the provider.

(4) The provider may make representations to OFCOM (with any supporting evidence) about the matters contained in the notice.

(5) Subsection (6) applies if—

(a) the notice under subsection (2) stated that OFCOM propose to impose a penalty,

(b) the period allowed for representations has expired, and

(c) OFCOM are satisfied that an amount of the fee is still due to them.

(6) OFCOM may give the provider a penalty notice under this subsection requiring the provider to pay to OFCOM a penalty of an amount in sterling determined by OFCOM.

(7) The penalty may consist of any of the following, depending on what was specified in the notice about the proposed penalty—

(a) a single amount;

(b) an amount calculated by reference to a daily rate;

(c) a combination of a single amount and an amount calculated by reference to a daily rate.

(8) A penalty notice under subsection (6) may require the payment of separate single amounts in respect of liabilities that relate to different charging years.

(9) See section 142 for information which must be included in notices under this section.

(10) Nothing in this section affects OFCOM’s power to bring proceedings (whether before or after the imposition of a penalty by a notice under subsection (6)) for the recovery of the whole or part of an amount due to OFCOM under section 84 or Schedule 10.

(11) But OFCOM may not bring such proceedings unless a provider has first been given a notice under subsection (2) specifying the amount due to OFCOM.

142 Information to be included in notices under sections 140 and 141

(1) Subsection (2) applies in relation to—

(a) a notice under section 140(2), and

(b) a notice under section 141(2) stating that OFCOM propose to impose a penalty.

(2) Such a notice must—

(a) state the reasons why OFCOM propose to impose the penalty,

(b) state whether OFCOM propose that the penalty should consist of a single amount, an amount calculated by reference to a daily rate, or a combination of the two,

(c) indicate the amount of the proposed penalty, including (in relation to an amount calculated by reference to a daily rate) the daily rate and how the penalty would be calculated,

(d) in relation to an amount calculated by reference to a daily rate, specify or describe the period for which OFCOM propose that the amount should be payable,

(e) state the reasons for proposing a penalty of that amount, including any aggravating or mitigating factors that OFCOM propose to take into account, and

(f) specify the period within which representations in relation to the proposed penalty may be made.

(3) A penalty notice under section 140(5) or 141(6) must—

(a) give OFCOM’s reasons for their decision to impose the penalty,

(b) state whether the penalty consists of a single amount, an amount calculated by reference to a daily rate, or a combination of the two, and how it is calculated,

(c) in relation to a single amount, state that amount,

(d) in relation to an amount calculated by reference to a daily rate, state the daily rate,

(e) state the reasons for the amount of the penalty, including any aggravating or mitigating factors that OFCOM have taken into account,

(f) specify a reasonable period within which the penalty must be paid,

(g) contain details of the rights of appeal under section 168, and

(h) contain information about the consequences of not paying the penalty (including information about the further kinds of enforcement action that it would be open to OFCOM to take).

(4) A penalty notice under section 141(6) must also specify the amount of the fee that is (in OFCOM’s opinion) due to be paid to OFCOM.

(5) The period specified under subsection (3)(f)  for the payment of a single amount must be at least 28 days beginning with the day on which the penalty notice is given.

(6) Subsection (7) applies in relation to a penalty notice under section 140(5) or 141(6) that includes a requirement to pay an amount calculated by reference to a daily rate.

(7) Such a notice must—

(a) state the date from which the amount begins to be payable, which must not be earlier than the day after the day on which the notice is given;

(b) provide for the amount to continue to be payable at the daily rate until—

(i) (in the case of a notice under section 140(5)) the date on which OFCOM are satisfied that the provider is complying with the notice under section 121(1), or (in the case of a notice under section 141(6)) the date on which the full amount of the fee (as specified in the penalty notice) has been paid to OFCOM, or

(ii) an earlier date specified in the penalty notice.

Amount of penalties etc

143 Amount of penalties etc

Schedule 13 contains provision about the amount of penalties that OFCOM may impose under this Chapter, and makes further provision about such penalties.

Business disruption measures

144 Service restriction orders

(1) OFCOM may apply to the court for an order under this section (a “service restriction order”) in relation to a regulated service where they consider that—

(a) the grounds in subsection (3) apply in relation to the service, or

(b) in the case of a Part 3 service, the grounds in subsection (4) apply in relation to the service.

(2) A service restriction order is an order imposing requirements on one or more persons who provide an ancillary service (whether from within or outside the United Kingdom) in relation to a regulated service (see subsection (11)).

(3) The grounds mentioned in subsection (1)(a) are that—

(a) the provider of the regulated service has failed to comply with an enforceable requirement that applies in relation to the regulated service,

(b) the failure is continuing, and

(c) any of the following applies—

(i) the provider has failed to comply with a requirement imposed by a confirmation decision that is of a kind described in section 133(1) relating to the failure;

(ii) the provider has failed to pay a penalty imposed by a confirmation decision relating to the failure (and the confirmation decision did not impose any requirements of a kind described in section 133(1));

(iii) the provider would be likely to fail to comply with requirements imposed by a confirmation decision if given;

(iv) the circumstances of the failure or the risks of harm to individuals in the United Kingdom are such that it is appropriate to make the application without having given a provisional notice of contravention, without having given a confirmation decision, or (having given a confirmation decision imposing requirements) without waiting to ascertain compliance with those requirements.

(4) The grounds mentioned in subsection (1)(b) are that—

(a) the provider of the Part 3 service has failed to comply with a notice under section 121(1) that relates to the service (notices to deal with terrorism content and CSEA content), and

(b) the failure is continuing.

(5) An application by OFCOM for a service restriction order must—

(a) specify the regulated service in relation to which the application is made (“the relevant service”),

(b) specify the provider of that service (“the non-compliant provider”),

(c) specify the grounds on which the application is based, and contain evidence about those grounds,

(d) specify the persons on whom (in OFCOM’s opinion) the requirements of the order should be imposed,

(e) contain evidence as to why OFCOM consider that the persons mentioned in paragraph (d) provide an ancillary service in relation to the relevant service, and specify any such ancillary service provided,

(f) specify the requirements which OFCOM consider that the order should impose on such persons, and

(g) in the case of an application made without notice having been given to the non-compliant provider, or to the persons mentioned in paragraph (d), state why no notice has been given.

(6) The court may make a service restriction order imposing requirements on a person in relation to the relevant service if the court is satisfied—

(a) as to the grounds in subsection (3) or the grounds in subsection (4) (as the case may be),

(b) that the person provides an ancillary service in relation to the relevant service,

(c) that it is appropriate to make the order for the purpose of preventing harm to individuals in the United Kingdom, and the order is proportionate to the risk of such harm,

(d) in the case of an application made on the ground in subsection (3)(c)(iii) or (iv), that it is appropriate to make the order before a provisional notice of contravention or confirmation decision has been given, or before compliance with requirements imposed by a confirmation decision has been ascertained (as the case may be), and

(e) if no notice of the application has been given to the non-compliant provider, or to the persons on whom requirements are being imposed, that it is appropriate to make the order without notice.

(7) When considering whether to make a service restriction order in relation to the relevant service, and when considering what provision it should contain, the court must take into account (among other things) the rights and obligations of all relevant parties, including those of—

(a) the non-compliant provider,

(b) the person or persons on whom the court is considering imposing the requirements, and

(c) United Kingdom users of the relevant service.

(8) A service restriction order made in relation to the relevant service must—

(a) identify the non-compliant provider,

(b) identify the persons on whom the requirements are imposed, and any ancillary service to which the requirements relate,

(c) require such persons to take the steps specified in the order, or to put in place arrangements, that have the effect of withdrawing the ancillary service to the extent that it relates to the relevant service (or part of it), or preventing the ancillary service from promoting or displaying content that relates to the relevant service (or part of it) in any way,

(d) specify the date by which the requirements in the order must be complied with, and

(e) specify the date on which the order expires, or the period for which the order has effect.

(9) The steps that may be specified or arrangements that may be required to be put in place—

(a) include steps or arrangements that will or may require the termination of an agreement (whether or not made before the coming into force of this section), or the prohibition of the performance of such an agreement, and

(b) are limited, so far as that is possible, to steps or arrangements relating to the operation of the relevant service as it affects United Kingdom users.

(10) OFCOM must inform the Secretary of State as soon as reasonably practicable after a service restriction order has been made.

(11) For the purposes of this section, a service is an “ancillary service” in relation to a regulated service if the service facilitates the provision of the regulated service (or part of it), whether directly or indirectly, or displays or promotes content relating to the regulated service (or to part of it).

(12) Examples of ancillary services include—

(a) services, provided (directly or indirectly) in the course of a business, which enable funds to be transferred in relation to a regulated service,

(b) search engines which generate search results displaying or promoting content relating to a regulated service,

(c) user-to-user services which make content relating to a regulated service available to users, and

(d) services which use technology to facilitate the display of advertising on a regulated service (for example, an ad server or an ad network).

(13) In this section “the court” means—

(a) in England and Wales, the High Court or the county court,

(b) in Scotland, the Court of Session or a sheriff, and

(c) in Northern Ireland, the High Court or a county court.

145 Interim service restriction orders

(1) OFCOM may apply to the court for an interim order under this section (an “interim service restriction order”) in relation to a regulated service where they consider that—

(a) the grounds in subsection (3) apply in relation to the service, or

(b) in the case of a Part 3 service, the grounds in subsection (4) apply in relation to the service.

(2) An interim service restriction order is an interim order imposing requirements on one or more persons who provide an ancillary service (whether from within or outside the United Kingdom) in relation to a regulated service (see subsection (9)).

(3) The grounds mentioned in subsection (1)(a) are that—

(a) it is likely that the provider of the regulated service is failing to comply with an enforceable requirement that applies in relation to the regulated service, and

(b) the level of risk of harm to individuals in the United Kingdom relating to the likely failure, and the nature and severity of that harm, are such that it would not be appropriate to wait to establish the failure before applying for the order.

(4) The grounds mentioned in subsection (1)(b) are that—

(a) it is likely that the provider of the Part 3 service is failing to comply with a notice under section 121(1) that relates to the service (notices to deal with terrorism content and CSEA content), and

(b) the level of risk of harm to individuals in the United Kingdom relating to the likely failure, and the nature and severity of that harm, are such that it would not be appropriate to wait to establish the failure before applying for the order.

(5) An application by OFCOM for an interim service restriction order must—

(a) specify the regulated service in relation to which the application is made (“the relevant service”),

(b) specify the provider of that service (“the non-compliant provider”),

(c) specify the grounds on which the application is based, and contain evidence about those grounds,

(d) specify the persons on whom (in OFCOM’s opinion) the requirements of the order should be imposed,

(e) contain evidence as to why OFCOM consider that the persons mentioned in paragraph (d) provide an ancillary service in relation to the relevant service, and specify any such ancillary service provided,

(f) specify the requirements which OFCOM consider that the order should impose on such persons, and

(g) in the case of an application made without notice having been given to the non-compliant provider, or to the persons mentioned in paragraph (d), state why no notice has been given.

(6) The court may make an interim service restriction order imposing requirements on a person in relation to the relevant service if the court is satisfied—

(a) as to the ground in subsection (3)(a) or the ground in subsection (4)(a) (as the case may be),

(b) that the person provides an ancillary service in relation to the relevant service,

(c) that there are prima facie grounds to suggest that an application for a service restriction order under section 144 would be successful,

(d) that the level of risk of harm to individuals in the United Kingdom relating to the likely failure mentioned in subsection (3)(a) or (4)(a) (whichever applies), and the nature and severity of that harm, are such that it is not appropriate to wait for the failure to be established before making the order, and

(e) if no notice of the application has been given to the non-compliant provider, or to the persons on whom requirements are being imposed, that it is appropriate to make the order without notice.

(7) An interim service restriction order ceases to have effect on the earlier of—

(a) the date specified in the order, or the date on which the period specified in the order expires (as the case may be), and

(b) the date on which the court makes a service restriction order under section 144 in relation to the relevant service that imposes requirements on the same persons on whom requirements are imposed by the interim order, or dismisses the application for such an order.

(8) Subsections (7) to (10) of section 144 apply in relation to an interim service restriction order under this section as they apply in relation to a service restriction order under that section.

(9) In this section, “ancillary service” and “the court” have the same meaning as in section 144 (see subsections (11), (12) and (13) of that section).

146 Access restriction orders

(1) OFCOM may apply to the court for an order under this section (an “access restriction order”) in relation to a regulated service where they consider that—

(a) the grounds in section 144(3) or (4) apply in relation to the service, and

(b) either—

(i) a service restriction order under section 144 or an interim service restriction order under section 145 has been made in relation to the failure, and it was not sufficient to prevent significant harm arising to individuals in the United Kingdom as a result of the failure, or

(ii) the likely consequences of the failure are such that if a service restriction order or an interim service restriction order were to be made, it would be unlikely to be sufficient to prevent significant harm arising to individuals in the United Kingdom as a result of the failure,

and in this paragraph, “the failure” means the failure mentioned in section 144(3)(a) or (4)(a) (as the case may be).

(2) An access restriction order is an order imposing requirements on one or more persons who provide an access facility (whether from within or outside the United Kingdom) in relation to a regulated service (see subsection (10)).

(3) An application by OFCOM for an access restriction order must—

(a) specify the regulated service in relation to which the application is made (“the relevant service”),

(b) specify the provider of that service (“the non-compliant provider”),

(c) specify the grounds on which the application is based, and contain evidence about those grounds,

(d) specify the persons on whom (in OFCOM’s opinion) the requirements of the order should be imposed,

(e) contain evidence as to why OFCOM consider that the persons mentioned in paragraph (d) provide an access facility in relation to the relevant service, and specify any such access facility provided,

(f) specify the requirements which OFCOM consider that the order should impose on such persons, and

(g) in the case of an application made without notice having been given to the non-compliant provider, or to the persons mentioned in paragraph (d), state why no notice has been given.

(4) The court may make an access restriction order imposing requirements on a person in relation to the relevant service if the court is satisfied—

(a) as to the grounds in subsection (1),

(b) that the person provides an access facility in relation to the relevant service,

(c) that it is appropriate to make the order for the purpose of preventing significant harm to individuals in the United Kingdom, and the order is proportionate to the risk of such harm,

(d) in the case of an application made on the ground in subsection (3)(c)(iii) or (iv) of section 144 (by virtue of subsection (1)(a)), that it is appropriate to make the order before a provisional notice of contravention or confirmation decision has been given, or before compliance with requirements imposed by a confirmation decision has been ascertained (as the case may be), and

(e) if no notice of the application has been given to the non-compliant provider, or to the persons on whom requirements are being imposed, that it is appropriate to make the order without notice.

(5) When considering whether to make an access restriction order in relation to the relevant service, and when considering what provision it should contain, the court must take into account (among other things) the rights and obligations of all relevant parties, including those of—

(a) the non-compliant provider,

(b) the person or persons on whom the court is considering imposing the requirements, and

(c) United Kingdom users of the relevant service.

(6) An access restriction order made in relation to the relevant service must—

(a) identify the non-compliant provider,

(b) identify the persons on whom the requirements are imposed, and any access facility to which the requirements relate,

(c) require such persons to take the steps specified in the order, or to put in place arrangements, to withdraw, adapt or manipulate the access facility in order to impede users’ access (by means of that facility) to the relevant service (or to part of it),

(d) specify the date by which the requirements in the order must be complied with, and

(e) specify the date on which the order expires, or the period for which the order has effect.

(7) The steps that may be specified or arrangements that may be required to be put in place—

(a) include steps or arrangements that will or may require the termination of an agreement (whether or not made before the coming into force of this section), or the prohibition of the performance of such an agreement,

(b) are limited, so far as that is possible, to steps or arrangements that impede the access of United Kingdom users, and

(c) are limited, so far as that is possible, to steps or arrangements that do not affect such users’ ability to access any other internet services.

(8) OFCOM must inform the Secretary of State as soon as reasonably practicable after an access restriction order has been made.

(9) Where a person who provides an access facility takes steps or puts in place arrangements required by an access restriction order, OFCOM may, by notice, require that person to (where possible) notify persons in the United Kingdom who attempt to access the relevant service via that facility of the access restriction order (and where a confirmation decision has been given to the non-compliant provider, the notification must refer to that decision).

(10) For the purposes of this section, a facility is an “access facility” in relation to a regulated service if the person who provides the facility is able to withdraw, adapt or manipulate it in such a way as to impede access (by means of that facility) to the regulated service (or to part of it) by United Kingdom users of that service.

(11) Examples of access facilities include—

(a) internet access services by means of which a regulated service is made available, and

(b) app stores through which a mobile app for a regulated service may be downloaded or otherwise accessed.

(12) In this section—

• “the court” means—

  (a)

  in England and Wales, the High Court or the county court,

  (b)

  in Scotland, the Court of Session or a sheriff, and

  (c)

  in Northern Ireland, the High Court or a county court;

• “facility” means any kind of service, infrastructure or apparatus enabling users of a regulated service to access the regulated service;

• “internet access service” means a service that provides access to virtually all (or just some) of the end points of the internet.

147 Interim access restriction orders

(1) OFCOM may apply to the court for an interim order under this section (an “interim access restriction order”) in relation to a regulated service where they consider that—

(a) the grounds in section 145(3) or (4) apply in relation to the service, and

(b) either—

(i) a service restriction order under section 144 or an interim service restriction order under section 145 has been made in relation to the likely failure, and it was not sufficient to prevent significant harm arising to individuals in the United Kingdom as a result of the failure, or

(ii) the likely consequences of such a failure would be such that if a service restriction order or an interim service restriction order were to be made, it would be unlikely to be sufficient to prevent significant harm arising to individuals in the United Kingdom as a result of the failure,

and in this section, “the likely failure” means the likely failure mentioned in section 145(3)(a) or (4)(a) (as the case may be).

(2) An interim access restriction order is an interim order imposing requirements on one or more persons who provide an access facility (whether from within or outside the United Kingdom) in relation to a regulated service (see subsection (8)).

(3) An application by OFCOM for an interim access restriction order must—

(a) specify the regulated service in relation to which the application is made (“the relevant service”),

(b) specify the provider of that service (“the non-compliant provider”),

(c) specify the grounds on which the application is based, and contain evidence about those grounds,

(d) specify the persons on whom (in OFCOM’s opinion) the requirements of the order should be imposed,

(e) contain evidence as to why OFCOM consider that the persons mentioned in paragraph (d) provide an access facility in relation to the relevant service, and specify any such access facility provided,

(f) specify the requirements which OFCOM consider that the order should impose on such persons, and

(g) in the case of an application made without notice having been given to the non-compliant provider, or to the persons mentioned in paragraph (d), state why no notice has been given.

(4) The court may make an interim access restriction order imposing requirements on a person in relation to the relevant service if the court is satisfied—

(a) that the ground in section 145(3)(a) or (4)(a) (as the case may be) applies in relation to the service,

(b) as to the ground in subsection (1)(b)(i) or (ii),

(c) that the person provides an access facility in relation to the relevant service,

(d) that there are prima facie grounds to suggest that an application for an access restriction order under section 146 would be successful,

(e) that the level of risk of harm to individuals in the United Kingdom relating to the likely failure, and the nature and severity of that harm, are such that it is not appropriate to wait for the failure to be established before making the order, and

(f) if no notice of the application has been given to the non-compliant provider, or to the persons on whom requirements are being imposed, that it is appropriate to make the order without notice.

(5) An interim access restriction order ceases to have effect on the earlier of—

(a) the date specified in the order, or the date on which the period specified in the order expires (as the case may be), and

(b) the date on which the court makes an access restriction order under section 146 in relation to the relevant service that imposes requirements on the same persons on whom requirements are imposed by the interim order, or dismisses an application for such an order.

(6) Subsections (5) to (8) of section 146 apply in relation to an interim access restriction order under this section as they apply in relation to an access restriction order under that section.

(7) Where a person who provides an access facility takes steps or puts in place arrangements required by an interim access restriction order, OFCOM may, by notice, require that person to (where possible) notify persons in the United Kingdom who attempt to access the relevant service via that facility of the interim access restriction order.

(8) In this section, “access facility” and “the court” have the same meaning as in section 146 (see subsections (10), (11) and (12) of that section).

148 Interaction with other action by OFCOM

(1) Where OFCOM apply for a business disruption order in respect of a failure by a provider of a regulated service to comply with an enforceable requirement, nothing in sections 144 to 147 is to be taken to prevent OFCOM also giving the provider—

(a) a confirmation decision in respect of the failure, or

(b) a penalty notice under section 139 in relation to a confirmation decision in respect of the failure.

(2) Where OFCOM apply for a business disruption order in respect of a failure by a provider of a Part 3 service to comply with a notice under section 121(1) (notices to deal with terrorism content and CSEA content), nothing in sections 144 to 147 is to be taken to prevent OFCOM also giving the provider either or both of the following—

(a) a further notice under section 121(1) (see section 126);

(b) a penalty notice under section 140(5).

(3) In this section, a “business disruption order” means—

(a) a service restriction order under section 144,

(b) an interim service restriction order under section 145,

(c) an access restriction order under section 146, or

(d) an interim access restriction order under section 147.

Publication of enforcement action

149 Publication by OFCOM of details of enforcement action

(1) Subsections (2) and (3) apply where OFCOM have given a person (and not withdrawn) any of the following—

(a) a confirmation decision;

(b) a penalty notice under section 139;

(c) a penalty notice under section 140(5);

(d) a penalty notice under section 141(6).

(2) OFCOM must publish details identifying the person and describing—

(a) the failure (or failures) to which the decision or notice relates, and

(b) OFCOM’s response.

(3) But OFCOM may not publish anything that, in OFCOM’s opinion—

(a) is confidential in accordance with subsections (4) and (5), or

(b) is otherwise not appropriate for publication.

(4) A matter is confidential under this subsection if—

(a) it relates specifically to the affairs of a particular body, and

(b) publication of that matter would or might, in OFCOM’s opinion, seriously and prejudicially affect the interests of that body.

(5) A matter is confidential under this subsection if—

(a) it relates to the private affairs of an individual, and

(b) publication of that matter would or might, in OFCOM’s opinion, seriously and prejudicially affect the interests of that individual.

(6) Where OFCOM have given a person a provisional notice of contravention but have not given the person a confirmation decision, OFCOM may publish details identifying the person and describing the reasons for the provisional notice.

(7) OFCOM must notify the person concerned that information has been published under this section.

150 Publication by providers of details of enforcement action

(1) This section applies where—

(a) OFCOM have given a person (and not withdrawn) any of the following—

(i) a confirmation decision;

(ii) a penalty notice under section 139;

(iii) a penalty notice under section 140(5);

(iv) a penalty notice under section 141(6), and

(b) the appeal period in relation to the decision or notice has ended.

(2) OFCOM may give to the person a notice (a “publication notice”) requiring the person to—

(a) publish details describing—

(i) the failure (or failures) to which the decision or notice mentioned in subsection (1)(a) relates, and

(ii) OFCOM’s response, or

(b) otherwise notify users of the service to which the decision or notice mentioned in subsection (1)(a) relates of those details.

(3) A publication notice may require a person to publish details under subsection (2)(a) or give notification of details under subsection (2)(b) or both.

(4) A publication notice must—

(a) specify the decision or notice mentioned in subsection (1)(a) to which it relates,

(b) specify or describe the details that must be published or notified,

(c) specify the form and manner in which the details must be published or notified,

(d) specify a date by which the details must be published or notified, and

(e) contain information about the consequences of not complying with the notice.

(5) Where a publication notice requires a person to publish details under subsection (2)(a) the notice may also specify a period during which publication in the specified form and manner must continue.

(6) Where a publication notice requires a person to give notification of details under subsection (2)(b) the notice may only require that notification to be given to United Kingdom users of the service (see section 227).

(7) A publication notice may not require a person to publish or give notification of anything that, in OFCOM’s opinion—

(a) is confidential in accordance with subsections (8) and (9), or

(b) is otherwise not appropriate for publication or notification.

(8) A matter is confidential under this subsection if—

(a) it relates specifically to the affairs of a particular body, and

(b) publication or notification of that matter would or might, in OFCOM’s opinion, seriously and prejudicially affect the interests of that body.

(9) A matter is confidential under this subsection if—

(a) it relates to the private affairs of an individual, and

(b) publication or notification of that matter would or might, in OFCOM’s opinion, seriously and prejudicially affect the interests of that individual.

(10) A person to whom a publication notice is given has a duty to comply with it.

(11) The duty under subsection (10) is enforceable in civil proceedings by OFCOM—

(a) for an injunction,

(b) for specific performance of a statutory duty under section 45 of the Court of Session Act 1988, or

(c) for any other appropriate remedy or relief.

(12) For the purposes of subsection (1)(b) “the appeal period”, in relation to a decision or notice mentioned in subsection (1)(a), means—

(a) the period during which any appeal relating to the decision or notice may be made, or

(b) where such an appeal has been made, the period ending with the determination or withdrawal of that appeal.

Guidance

151 OFCOM’s guidance about enforcement action

(1) OFCOM must produce guidance for providers of regulated services about how OFCOM propose to exercise their functions under this Chapter.

(2) The guidance must, in particular, give information about the factors that OFCOM would consider it appropriate to take into account when taking, or considering taking, enforcement action relating to a person’s failure to comply with different kinds of enforceable requirements.

(3) In relation to any enforcement action by OFCOM which relates to a failure by a provider of a regulated service to comply with a relevant duty, the guidance must include provision explaining how OFCOM will take into account the impact (or possible impact) of such a failure on children.

(4) Before producing the guidance (including revised or replacement guidance), OFCOM must consult—

(a) the Secretary of State,

(b) the Information Commissioner, and

(c) such other persons as OFCOM consider appropriate.

(5) OFCOM must publish the guidance (and any revised or replacement guidance).

(6) Guidelines prepared by OFCOM under section 392 of the Communications Act (amount of penalties) may, so far as relating to penalties imposed under this Chapter, be included in the same document as guidance under this section.

(7) In exercising their functions under this Chapter, or deciding whether to exercise them, OFCOM must have regard to the guidance for the time being published under this section.

(8) In this section, a “relevant duty” means—

(a) a duty set out in section 10 or 27 (illegal content),

(b) a duty set out in section 12 or 29 (children’s online safety), or

(c) a duty set out in section 81(2) (children’s access to provider pornographic content).

CHAPTER 7 Committees, research and reports

152 Advisory committee on disinformation and misinformation

(1) OFCOM must, in accordance with the following provisions of this section, exercise their powers under paragraph 14 of the Schedule to the Office of Communications Act 2002 (committees of OFCOM) to establish and maintain a committee to provide the advice specified in this section.

(2) The committee is to consist of—

(a) a chairman appointed by OFCOM, and

(b) such number of other members appointed by OFCOM as OFCOM consider appropriate.

(3) In appointing persons to be members of the committee, OFCOM must have regard to the desirability of ensuring that the members of the committee include—

(a) persons representing the interests of United Kingdom users of regulated services,

(b) persons representing providers of regulated services, and

(c) persons with expertise in the prevention and handling of disinformation and misinformation online.

(4) The function of the committee is to provide advice to OFCOM (including other committees established by OFCOM) about—

(a) how providers of regulated services should deal with disinformation and misinformation on such services,

(b) OFCOM’s exercise of the power conferred by section 77 to require information about a matter listed in Part 1 or 2 of Schedule 8, so far as relating to disinformation and misinformation, and

(c) OFCOM’s exercise of their functions under section 11 of the Communications Act (duties to promote media literacy) in relation to countering disinformation and misinformation on regulated services.

(5) The committee must publish a report within the period of 18 months after being established, and after that must publish periodic reports.

153 Functions of the Content Board

(1) Section 13 of the Communications Act (functions of the Content Board) is amended as follows.

(2) At the beginning of subsection (2), insert “Subject to subsection (3A),”.

(3) After subsection (3) insert—

“(3A) OFCOM may, but need not, confer on the Content Board functions in relation to matters that concern the nature or kind of online content in relation to which OFCOM have functions under the Online Safety Act 2023 (see Parts 3 and 5 of that Act).”

(4) After subsection (7) insert—

“(8) In this section references to “matters mentioned in subsection (2)” do not include references to the matters mentioned in subsection (3A).”

154 Research about users’ experiences of regulated services

(1) Section 14 of the Communications Act (consumer research) is amended as follows.

(2) After subsection (6A) insert—

“(6B) OFCOM must make arrangements for ascertaining—

(a) the state of public opinion from time to time concerning providers of regulated services and their manner of operating their services;

(b) the experiences of United Kingdom users of regulated services in relation to their use of such services;

(c) the experiences of United Kingdom users of regulated user-to-user services and regulated search services in relation to the handling of complaints made by them to providers of such services; and

(d) the interests and experiences of United Kingdom users of regulated services in relation to matters that are incidental to or otherwise connected with their experiences of using such services.

(6C) OFCOM’s report under paragraph 12 of the Schedule to the Office of Communications Act 2002 for each financial year must contain a statement by OFCOM about the research that has been carried out in that year under subsection (6B).”

(3) After subsection (8) insert—

“(8A) In subsection (6B) the following terms have the same meaning as in the Online Safety Act 2023—

• “provider” (see section 226 of that Act);

• “regulated service”, “regulated user-to-user service” and “regulated search service” (see section 4 of that Act);

• “United Kingdom user” (see section 227 of that Act).”

155 Consumer consultation

(1) Section 16 of the Communications Act (consumer consultation) is amended as follows.

(2) In subsection (4), after paragraph (d) insert—

“(da) regulated services;”.

(3) After subsection (5) insert—

“(5A) As regards OFCOM’s functions under the Online Safety Act 2023 in relation to regulated services—

(a) the reference in subsection (5) to “the contents” of a thing includes a reference to specific pieces of online content, but

(b) subsection (5) is not to be read as preventing the Consumer Panel from being able to give advice about any matter that more generally concerns—

(i) different kinds of online content in relation to which OFCOM have functions under that Act (see Parts 3 and 5 of that Act), and

(ii) the impact that different kinds of such content may have on United Kingdom users of regulated services.”

(4) After subsection (12) insert—

“(12A) OFCOM’s report under paragraph 12 of the Schedule to the Office of Communications Act 2002 for each financial year must contain a statement by OFCOM about the arrangements for consultation that have been made in that year under this section, so far as the arrangements relate to regulated services.”

(5) In subsection (13), in the definition of “domestic and small business consumer”, in paragraph (b)(i), after “available” insert “or a provider of a regulated service”.

(6) After subsection (13) insert—

“(14) In this section the following terms have the same meaning as in the Online Safety Act 2023—

• “provider”, in relation to a regulated service (see section 226 of that Act);

• “regulated service” (see section 4 of that Act);

• “United Kingdom user” (see section 227 of that Act).”

156 OFCOM’s statement about freedom of expression and privacy

OFCOM’s report under paragraph 12 of the Schedule to the Office of Communications Act 2002 for each financial year must contain a statement by OFCOM about the steps they have taken, and the processes they operate, to ensure that their online safety functions have been exercised in that year compatibly with Articles 8 and 10 of the Convention (so far as relevant).

157 OFCOM’s reports about use of age assurance

(1) OFCOM must produce and publish a report assessing—

(a) how providers of regulated services have used age assurance for the purpose of compliance with their duties set out in this Act,

(b) how effective the use of age assurance has been for that purpose, and

(c) whether there are factors that have prevented or hindered the effective use of age assurance, or a particular kind of age assurance, for that purpose,

(and in this section, references to a report are to a report described in this subsection).

(2) A report must, in particular, consider whether the following have prevented or hindered the effective use of age assurance—

(a) the costs to providers of using it, and

(b) the need to protect users from a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of a regulated service (including, but not limited to, any such provision or rule concerning the processing of personal data).

(3) Unless the Secretary of State requires the production of a further report (see subsection (6)), the requirement in subsection (1) is met by producing and publishing one report within the period of 18 months beginning with the day on which sections 12 and 81(2) come into force (or if those provisions come into force on different days, the period of 18 months beginning with the later of those days).

(4) In preparing a report, OFCOM must consult—

(a) the Information Commissioner, and

(b) such other persons as OFCOM consider appropriate.

(5) OFCOM must send a copy of a report to the Secretary of State, and the Secretary of State must lay it before Parliament.

(6) The Secretary of State may require OFCOM to produce and publish a further report in response to—

(a) the development of age assurance technology, or

(b) evidence of the reduced effectiveness of such technology.

(7) But such a requirement may not be imposed—

(a) within the period of three years beginning with the date on which the first report is published, or

(b) more frequently than once every three years.

(8) For further provision about reports under this section, see section 164.

(9) In this section “age assurance” means age verification or age estimation.

158 OFCOM’s reports about news publisher content and journalistic content

(1) OFCOM must produce and publish a report assessing the impact of the regulatory framework provided for in this Act on the availability and treatment of news publisher content and journalistic content on Category 1 services (and in this section, references to a report are to a report described in this subsection).

(2) Unless the Secretary of State requires the production of a further report (see subsection (6)), the requirement in subsection (1) is met by producing and publishing one report within the period of two years beginning with the day on which sections 18 and 19 come into force (or if those sections come into force on different days, the period of two years beginning with the later of those days).

(3) A report must, in particular, consider how effective the duties to protect such content set out in sections 18 and 19 are at protecting it.

(4) In preparing a report, OFCOM must consult—

(a) persons who represent recognised news publishers,

(b) persons who appear to OFCOM to represent creators of journalistic content,

(c) persons who appear to OFCOM to represent providers of Category 1 services, and

(d) such other persons as OFCOM consider appropriate.

(5) OFCOM must send a copy of a report to the Secretary of State, and the Secretary of State must lay it before Parliament.

(6) The Secretary of State may require OFCOM to produce and publish a further report if the Secretary of State considers that the regulatory framework provided for in this Act is, or may be, having a detrimental effect on the availability and treatment of news publisher content or journalistic content on Category 1 services.

(7) But such a requirement may not be imposed—

(a) within the period of three years beginning with the date on which the first report is published, or

(b) more frequently than once every three years.

(8) For further provision about reports under this section, see section 164.

(9) In this section—

• “journalistic content” has the meaning given by section 19;

• “news publisher content” has the meaning given by section 55;

• “recognised news publisher” has the meaning given by section 56.

(10) For the meaning of “Category 1 service”, see section 95 (register of categories of services).

159 OFCOM’s transparency reports

(1) OFCOM must produce transparency reports based on information contained in the transparency reports produced by providers of Part 3 services under section 77.

(2) OFCOM’s transparency reports must contain—

(a) a summary of conclusions drawn from the transparency reports produced under section 77 regarding patterns or trends which OFCOM have identified in such reports,

(b) a summary of measures mentioned in such transparency reports which OFCOM consider to be good industry practice, and

(c) any other information from such transparency reports which OFCOM consider it appropriate to include.

(3) OFCOM’s first transparency report must be published by the end of the period of one year beginning with—

(a) the day on which the first report under section 77 is published by a provider of a Part 3 service (see subsection (3)(d) of that section), or

(b) if later, the earliest date specified by OFCOM for submission of a report under section 77 in a notice given to a provider (see subsection (3)(c) of that section).

(4) OFCOM must publish a transparency report at least once a year after the publication of their first transparency report.

(5) For further provision about reports under this section, see section 164.

160 OFCOM’s report about reporting and complaints procedures

(1) OFCOM must produce a report assessing the measures taken or in use by providers of Part 3 services to enable users and others to—

(a) report particular kinds of content present on such services, and

(b) make complaints to providers of such services.

(2) OFCOM’s report must take into account the experiences of users and others in reporting content and making complaints to providers of Part 3 services, including—

(a) how clear the procedures are for reporting content and making complaints,

(b) how easy it is to do those things, and

(c) whether providers are taking appropriate and timely action in response to reports and complaints that are made.

(3) The report must include advice from OFCOM about whether they consider that the Secretary of State should make regulations under section 217 (duty about alternative dispute resolution procedure).

(4) In the report, OFCOM may make recommendations that they consider would improve the experiences of users and others in reporting content or making complaints to providers of Part 3 services, or would deliver better outcomes in relation to reports or complaints that are made.

(5) In preparing the report under this section, OFCOM must consult—

(a) the Secretary of State,

(b) persons who appear to OFCOM to represent the interests of United Kingdom users of Part 3 services,

(c) persons who appear to OFCOM to represent the interests of children (generally or with particular reference to online safety matters),

(d) the Information Commissioner, and

(e) such other persons as OFCOM consider appropriate.

(6) The report may draw on OFCOM’s research under section 14 of the Communications Act (see subsection (6B) of that section).

(7) The report is not required to address any matters which are the subject of a report by OFCOM under section 158 (report about the availability and treatment of news publisher content and journalistic content).

(8) OFCOM must publish the report within the period of two years beginning with the day on which this section comes into force.

(9) OFCOM must send a copy of the report to the Secretary of State, and the Secretary of State must lay it before Parliament.

(10) The Secretary of State must publish a statement responding to the report within the period of three months beginning with the day on which the report is published, and the statement must include a response to OFCOM’s advice about whether to make regulations under section 217.

(11) The statement must be published in such manner as the Secretary of State considers appropriate for bringing it to the attention of persons who may be affected by it.

(12) For further provision about the report under this section, see section 164.

(13) References in this section to “users and others” are to United Kingdom users and individuals in the United Kingdom.

161 OFCOM’s report about use of app stores by children

(1) OFCOM must produce a report about the use of app stores by children.

(2) In particular, the report must—

(a) assess what role app stores play in children encountering content that is harmful to children, search content that is harmful to children or regulated provider pornographic content by means of regulated apps which the app stores make available,

(b) assess the extent to which age assurance is currently used by providers of app stores, and how effective it is, and

(c) explore whether children’s online safety would be better protected by the greater use of age assurance or particular kinds of age assurance by such providers, or by other measures.

(3) OFCOM must publish the report during the period beginning two years, and ending three years, after the day on which sections 12 and 29 come into force (or if those sections come into force on different days, the later of those days).

(4) For further provision about the report under this section, see section 164.

(5) In this section—

• “age assurance” means age verification or age estimation;

• “app” includes an app for use on any kind of device, and “app store” is to be read accordingly;

• “content that is harmful to children” has the same meaning as in Part 3 (see section 60);

• “regulated app” means an app for a regulated service;

• “regulated provider pornographic content” has the same meaning as in Part 5 (see section 79);

• “search content” has the same meaning as in Part 3 (see section 57).

(6) In this section references to children are to children in the United Kingdom.

162 OFCOM’s report about researchers’ access to information

(1) OFCOM must produce a report—

(a) describing how, and to what extent, persons carrying out independent research into online safety matters are currently able to obtain information from providers of regulated services to inform their research,

(b) exploring the legal and other issues which currently constrain the sharing of information for such purposes, and

(c) assessing the extent to which greater access to information for such purposes might be achieved.

(2) For the purposes of this section a person carries out “independent research” if the person carries out research on behalf of a person other than a provider of a regulated service.

(3) In preparing the report, OFCOM must consult—

(a) the Information Commissioner,

(b) the Centre for Data Ethics and Innovation,

(c) United Kingdom Research and Innovation,

(d) persons who appear to OFCOM to represent providers of regulated services, and

(e) such other persons as OFCOM consider appropriate.

(4) OFCOM must publish the report within the period of 18 months beginning with the day on which this section comes into force.

(5) OFCOM must send a copy of the report to the Secretary of State, and the Secretary of State must lay it before Parliament.

(6) For further provision about the report under this section, see section 164.

(7) OFCOM must produce guidance about the matters dealt with by the report for providers of regulated services and persons carrying out independent research into online safety matters.

(8) Before producing the guidance (including revised guidance) OFCOM must consult the persons mentioned in subsection (3).

(9) OFCOM must publish the guidance (and any revised guidance).

(10) OFCOM must include in each transparency report under section 159 an assessment of the effectiveness of the guidance.

163 OFCOM’s report in connection with investigation into a death

(1) Subsection (2) applies if OFCOM receive—

(a) a notice from a senior coroner under paragraph 1(2) of Schedule 5 to the Coroners and Justice Act 2009 in connection with an investigation into the death of a person;

(b) a request for information in connection with the investigation of a procurator fiscal into, or an inquiry held or to be held in relation to, the death of a person;

(c) a notice from a coroner under section 17A(2) of the Coroners Act (Northern Ireland) 1959 (c. 15 (N.I.)) in connection with—

(i) an investigation to determine whether an inquest into the death of a person is necessary, or

(ii) an inquest in relation to the death of a person.

(2) OFCOM may produce a report for use by the coroner or procurator fiscal, dealing with any matters that they consider may be relevant.

(3) In subsection (1)(b) “inquiry” means an inquiry held, or to be held, under the Inquiries into Fatal Accidents and Sudden Deaths etc. (Scotland) Act 2016 (asp 2).

164 OFCOM’s reports

(1) OFCOM may from time to time produce and publish reports about online safety matters.

(2) In publishing a report mentioned in subsection (5), OFCOM must have regard to the need to exclude from publication, so far as that is practicable, the matters which are confidential in accordance with subsections (3) and (4).

(3) A matter is confidential under this subsection if—

(a) it relates specifically to the affairs of a particular body, and

(b) publication of that matter would or might, in OFCOM’s opinion, seriously and prejudicially affect the interests of that body.

(4) A matter is confidential under this subsection if—

(a) it relates to the private affairs of an individual, and

(b) publication of that matter would or might, in OFCOM’s opinion, seriously and prejudicially affect the interests of that individual.

(5) The reports referred to in subsection (2) are—

(a) a report under section 128 (report in connection with notices to deal with terrorism content and CSEA content),

(b) a report under section 157 (report about use of age assurance),

(c) a report under section 158 (report about news publisher content and journalistic content),

(d) a report under section 159 (transparency report),

(e) a report under section 160 (report about reporting and complaints procedures),

(f) a report under section 161 (report about use of app stores by children),

(g) a report under section 162 (report about researchers’ access to information), and

(h) a report produced under this section.

(6) See also section 116(3) (restriction on publishing intelligence service information).

CHAPTER 8 Media literacy

165 Media literacy

(1) Section 11 of the Communications Act is amended in accordance with subsections (2) to (5).

(2) Before subsection (1) insert—

“(A1) In this section—

(a) subsection (1) imposes duties on OFCOM which apply in relation to material published by means of the electronic media (including by means of regulated services), and

(b) subsections (1A) to (1E) expand on those duties, and impose further duties on OFCOM, in relation to regulated services only.”

(3) After subsection (1) insert—

“(1A) OFCOM must take such steps, and enter into such arrangements, as they consider most likely to be effective in heightening the public’s awareness and understanding of ways in which they can protect themselves and others when using regulated services, in particular by helping them to—

(a) understand the nature and impact of harmful content and the harmful ways in which regulated services may be used, especially content and activity disproportionately affecting particular groups, including women and girls;

(b) reduce their and others’ exposure to harmful content and to the use of regulated services in harmful ways, especially content and activity disproportionately affecting particular groups, including women and girls;

(c) use or apply—

(i) features included in a regulated service, including features mentioned in section 15(2) of the Online Safety Act 2023, and

(ii) tools or apps, including tools such as browser extensions,

so as to mitigate the harms mentioned in paragraph (b);

(d) establish the reliability, accuracy and authenticity of content;

(e) understand the nature and impact of disinformation and misinformation, and reduce their and others’ exposure to it;

(f) understand how their personal information may be protected.

(1B) OFCOM must take such steps, and enter into such arrangements, as they consider most likely to encourage the development and use of technologies and systems for supporting users of regulated services to protect themselves and others as mentioned in paragraph (a), (b), (c), (d) or (e) of subsection (1A), including technologies and systems which—

(a) provide further context to users about content they encounter;

(b) help users to identify, and provide further context about, content of democratic importance present on regulated user-to-user services;

(c) signpost users to resources, tools or information raising awareness about how to use regulated services so as to mitigate the harms mentioned in subsection (1A)(b).

(1C) OFCOM’s duty under subsection (1A) is to be performed in the following ways (among others)—

(a) pursuing activities and initiatives,

(b) commissioning others to pursue activities and initiatives,

(c) taking steps designed to encourage others to pursue activities and initiatives, and

(d) making arrangements for the carrying out of research (see section 14(6)(a)).

(1D) OFCOM must draw up, and from time to time review and revise, a statement recommending ways in which others, including providers of regulated services, might develop, pursue and evaluate activities or initiatives relevant to media literacy in relation to regulated services.

(1E) OFCOM must publish the statement and any revised statement in such manner as they consider appropriate for bringing it to the attention of the persons who, in their opinion, are likely to be affected by it.”

(4) After subsection (2) insert—

“(3) In this section and in section 11A, “regulated service” means—

(a) a regulated user-to-user service, or

(b) a regulated search service.

“Regulated user-to-user service” and “regulated search service” have the same meaning as in the Online Safety Act 2023 (see section 4 of that Act).

(4) In this section—

(a) “content”, in relation to regulated services, means regulated user-generated content, search content or fraudulent advertisements;

(b) the following terms have the same meaning as in the Online Safety Act 2023—

• “content of democratic importance” (see section 17 of that Act);

• “fraudulent advertisement” (see sections 38 and 39 of that Act);

• “harm” (see section 234 of that Act) (and “harmful” is to be interpreted consistently with that section);

• “provider” (see section 226 of that Act);

• “regulated user-generated content” (see section 55 of that Act);

• “search content” (see section 57 of that Act).”

(5) In the heading, for “Duty” substitute “Duties”.

(6) In section 14 of the Communications Act (consumer research), in subsection (6)(a), after “11(1)” insert “, (1A) and (1B)”.

166 Media literacy strategy and media literacy statement

After section 11 of the Communications Act insert—

“11A Regulated services: media literacy strategy and media literacy statement

(1) OFCOM must prepare and publish a media literacy strategy within the period of one year beginning with the day on which the Online Safety Act 2023 is passed.

(2) A media literacy strategy is a plan setting out how OFCOM propose to exercise their functions under section 11 in the period covered by the plan, which must be not more than three years.

(3) In particular, a media literacy strategy must state OFCOM’s objectives and priorities for the period it covers.

(4) Before the end of the period covered by a media literacy strategy, OFCOM must prepare and publish a media literacy strategy for a further period, ensuring that each successive strategy covers a period beginning immediately after the end of the last one.

(5) In preparing or revising a media literacy strategy, OFCOM must consult such persons as they consider appropriate.

(6) OFCOM’s annual report must contain a media literacy statement.

(7) A media literacy statement is a statement by OFCOM—

(a) summarising what they have done in the financial year to which the report relates in the exercise of their functions under section 11, and

(b) assessing what progress has been made towards achieving the objectives and priorities set out in their media literacy strategy in that year.

(8) A media literacy statement must include a summary and an evaluation of the activities and initiatives pursued or commissioned by OFCOM in the exercise of their functions under section 11 in the financial year to which the report relates.

(9) The first annual report that is required to contain a media literacy statement is the report for the financial year during which OFCOM’s first media literacy strategy is published, and that first statement is to relate to the period from publication day until the end of that financial year.

(10) But if OFCOM’s first media literacy strategy is published during the second half of a financial year—

(a) the first annual report that is required to contain a media literacy statement is the report for the next financial year, and

(b) that first statement is to relate to the period from publication day until the end of that financial year.

(11) References in this section to OFCOM’s functions under section 11 are to those functions so far as they relate to regulated services.

(12) In this section—

• “annual report” means OFCOM’s annual report under paragraph 12 of the Schedule to the Office of Communications Act 2002;

• “financial year” means a year ending with 31 March.”