Legalize / United Kingdom / Public General Act

Online Safety Act 2023

Type Public General Act

Publication 2023-10-26

Last updated 2026-04-07

State In force

Department Statute Law Database

Source legislation.gov.uk

articles Not indexed

Reform history JSON API

(b) in relation to provision in Scotland, have the same meaning as in the Education (Scotland) Act 1980 (see section 135(2) of that Act);

(c) in relation to provision in Northern Ireland, have the same meaning as in the Education and Libraries (Northern Ireland) Order 1986 (see Article 2(2) of that Order).

SCHEDULE 2

1

A user-to-user service described in any of paragraphs 1 to 5 of Schedule 1—

(a) on which regulated provider pornographic content is published or displayed, and

(b) that has links with the United Kingdom.

2

(1) A user-to-user service within sub-paragraph (2) or (3).

(2) A user-to-user service is within this sub-paragraph if—

(a) the internal business service conditions are met in relation to a part of the service,

(b) no user-generated content is enabled by the rest of the service,

(d) the service has links with the United Kingdom.

(3) A user-to-user service is within this sub-paragraph if—

(a) the internal business service conditions are met in relation to a part of the service,

(b) the only user-generated content enabled by the rest of the service is—

(i) content mentioned in paragraph 1, 2 or 3 of Schedule 1 and related identifying content, or

(ii) content arising in connection with any of the activities described in paragraph 4(1) of Schedule 1,

(d) the service has links with the United Kingdom.

3

(1) A search service within sub-paragraph (2).

(2) A search service is within this sub-paragraph if—

(a) the internal business service conditions are met in relation to a part of the service that is a search engine,

(b) the service does not include a public search engine,

(d) the service has links with the United Kingdom.

4

For the purposes of this Schedule, a service “has links with the United Kingdom” if it has links with the United Kingdom within the meaning of section 80(4).

5

In this Schedule—

“the internal business service conditions” means the conditions in paragraph 7(2) of Schedule 1;

“public search engine” means a search engine other than one in relation to which the internal business service conditions are met;

“regulated provider pornographic content” and “published or displayed” have the same meaning as in Part 5 (see section 79);

“the rest of the service” means any part of the user-to-user service or search service other than the part in relation to which the internal business service conditions are met;

“user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

SCHEDULE 3

PART 1 — Timing of illegal content risk assessments and children’s access assessments

Part 3 services already in operation at the outset of the regime provided for by this Act

1

(1) This paragraph applies in relation to a Part 3 service which is in operation immediately before the day on which the first illegal content risk assessment guidance is published.

(2) The first illegal content risk assessment of the service must be completed within the period of three months beginning with the day on which that guidance is published.

(3) The first CAA of the service must be completed within the period of three months beginning with the day on which the first CAA guidance is published.

New Part 3 services which start up, and existing services which become Part 3 services, between publication of the first illegal content risk assessment guidance and the first CAA guidance

2

(1) In this paragraph “the first day”, in relation to a Part 3 service, means—

(a) the first day on which the service is a Part 3 service (being a new service), or

(b) the first day on which the service becomes a Part 3 service (having previously not been a Part 3 service).

(2) Sub-paragraphs (3) and (4) apply if, on the first day, illegal content risk assessment guidance is available but the first CAA guidance has not yet been published.

(3) The first illegal content risk assessment of the service must be completed within the period of three months beginning with the first day.

(4) The first CAA of the service must be completed within the period of three months beginning with the day on which the first CAA guidance is published.

New Part 3 services which start up when illegal content risk assessment guidance and CAA guidance are both available

3

(1) In this paragraph “the first day”, in relation to a Part 3 service, means the first day on which the service is a Part 3 service (being a new service).

(2) If, on the first day, illegal content risk assessment guidance and CAA guidance are both available, both of the following must be completed within the period of three months beginning with that day—

(a) the first illegal content risk assessment of the service, and

(b) the first CAA of the service.

Existing services which become Part 3 services when illegal content risk assessment guidance and CAA guidance are both available

4

(1) In this paragraph “the first day”, in relation to a Part 3 service, means the first day on which the service becomes, or again becomes, a Part 3 service (following a period during which the service was not a Part 3 service).

(2) If, on the first day, illegal content risk assessment guidance and CAA guidance are both available, both of the following must be completed within the period of three months beginning with that day—

(a) an illegal content risk assessment of the service, and

(b) a CAA of the service.

PART 2 — Timing of children’s risk assessments and section 15(2) assessments

Children’s risk assessments

5

(1) In this paragraph “the relevant day”, in relation to a Part 3 service, means—

(a) the first day on which the service is treated as likely to be accessed by children, or

(b) the first day on which the service is again treated as likely to be accessed by children (following a period during which the service was not so treated).

(2) If, on the relevant day, children’s risk assessment guidance is available, a children’s risk assessment of the service must be completed within the period of three months beginning with that day.

(3) Sub-paragraph (4) applies if—

(a) on the relevant day, the first children’s risk assessment guidance has not yet been published, and

(b) immediately before the publication of that guidance, the service is still treated as likely to be accessed by children.

(4) The first children’s risk assessment of the service must be completed within the period of three months beginning with the day on which the first children’s risk assessment guidance is published.

Section 15(2) assessments

6

(1) In this paragraph “the relevant day”, in relation to a regulated user-to-user service, means—

(a) the first day on which the service is a Category 1 service, or

(b) the first day on which the service again becomes a Category 1 service (following a period during which the service was not a Category 1 service).

(2) If, on the relevant day, section 15(2) guidance is available, a section 15(2) assessment of the service must be completed within the period of three months beginning with that day.

(3) Sub-paragraph (4) applies if—

(a) on the relevant day, the first section 15(2) guidance has not yet been published, and

(b) immediately before the publication of that guidance, the service is still a Category 1 service.

(4) The first section 15(2) assessment of the service must be completed within the period of three months beginning with the day on which the first section 15(2) guidance is published.

PART 3 — Pre-existing Part 4B services

Interpretation of this Part

7

(1) In this Part, “pre-existing Part 4B service” means—

(a) an internet service which—

(i) is a video-sharing platform service by reason of the conditions in section 368S(1) and (2) of the Communications Act being met in relation to the service as a whole, and

(ii) was being provided immediately before Schedule 17 (videosharing platform services: transitional provision etc) comes into force; or

(b) a dissociable section of an internet service, where that dissociable section—

(i) is a video-sharing platform service by reason of the conditions in section 368S(1)(a) and (2) of the Communications Act being met in relation to that dissociable section, and

(ii) was being provided immediately before Schedule 17 comes into force.

(2) In sub-paragraph (1), any reference to a service provided before Schedule 17 comes into force includes a reference to a service provided in breach of the requirement in section 368V of the Communications Act.

8

(1) In this Part, “assessment start day”, in relation to a pre-existing Part 4B service, means—

(a) the date specified in regulations made by the Secretary of State for the purposes of this Part of this Schedule, or

(b) if the pre-existing Part 4B service ceases to be a video-sharing platform service before the date specified in the regulations, the date when that service ceases to be a video-sharing platform service.

(2) But in respect of any period during which this Schedule is fully in force and no regulations under sub-paragraph (1) have yet been made, the definition in sub-paragraph (1) has effect as if—

(a) for paragraph (a) there were substituted “the date when section 210 comes into force”, and

(b) in paragraph (b), for “specified in the regulations” there were substituted “when section 210 comes into force”.

9

In this Part “video-sharing platform service” has the same meaning as in Part 4B of the Communications Act (see section 368S of that Act).

10

Any reference in this Part to the effect of Part 1 or 2 of this Schedule is a reference to the effect that Part 1 or 2 would have if this Part were disregarded.

Pre-existing Part 4B services which are regulated user-to-user services

Application of paragraphs 12 to 14

11

(1) This paragraph and paragraphs 12 to 14 apply in relation to a pre-existing Part 4B service which—

(a) is within the definition in paragraph (a) of paragraph 7(1), and

(b) is also a regulated user-to-user service.

(2) If the effect of Part 1 of this Schedule is that the period within which the first illegal content risk assessment or CAA of the service must be completed begins on a day before the assessment start day, the time for carrying out that assessment is extended as set out in paragraph 12 or 13.

(3) If the effect of paragraph 6 is that the period within which the first section 15(2) assessment of the service must be completed begins on a day before the assessment start day, the time for carrying out that assessment is extended as set out in paragraph 14.

(4) But paragraphs 12 to 14 do not apply if the service ceases to be a regulated user-to-user service on the assessment start day.

Illegal content risk assessments and children’s access assessments

12

(1) Sub-paragraphs (2) and (3) apply in relation to the service if, on the assessment start day, illegal content risk assessment guidance is available but the first CAA guidance has not yet been published.

(2) The first illegal content risk assessment of the service must be completed within the period of three months beginning with the assessment start day.

(3) The first CAA of the service must be completed within the period of three months beginning with the day on which the first CAA guidance is published.

13

If, on the assessment start day, illegal content risk assessment guidance and CAA guidance are both available, both of the following must be completed within the period of three months beginning with that day—

(a) the first illegal content risk assessment of the service, and

(b) the first CAA of the service.

Section 15(2) assessments

14

(1) If section 15(2) guidance is available on the assessment start day, the first section 15(2) assessment of the service must be completed within the period of three months beginning with that day.

(2) If, on the assessment start day, the first section 15(2) guidance has not yet been published, the first section 15(2) assessment of the service must be completed within the period of three months beginning with the day on which the first section 15(2) guidance is published.

Regulated user-to-user services which include a pre-existing Part 4B service

Application of paragraphs 16 to 20

15

(1) Paragraphs 16 to 20 make provision about the timing of assessments in the case of a regulated user-to-user service which includes a pre-existing Part 4B service within the definition in paragraph (b) of paragraph 7(1).

(2) In sub-paragraph (3) and paragraphs 16 to 20—

(a) “the regulated service” means the regulated user-to-user service, and

(b) “the Part 4B part” means the pre-existing Part 4B service which is included in the regulated service.

(3) If the effect of Part 1 or paragraph 6 of this Schedule is that the period within which the first illegal content risk assessment, CAA or section 15(2) assessment of the regulated service must be completed begins on a day before the assessment start day—

(a) the time for carrying out the assessment in question in relation to the Part 4B part is extended as set out in paragraph 16, 17 or 18 (whichever applies),

(b) Part 1 and paragraph 6 apply as set out in paragraph 19, and

(4) But paragraphs 16 to 20 do not apply if the service ceases to be a regulated user-to-user service on the assessment start day.

Illegal content risk assessments and children’s access assessments of Part 4B part

16

(1) Sub-paragraphs (2) and (3) apply in relation to the Part 4B part if, on the assessment start day, illegal content risk assessment guidance is available but the first CAA guidance has not yet been published.

(2) The first illegal content risk assessment of the Part 4B part must be completed within the period of three months beginning with the assessment start day.

(3) The first CAA of the Part 4B part must be completed within the period of three months beginning with the day on which the first CAA guidance is published.

17

(a) an illegal content risk assessment of the Part 4B part, and

(b) a CAA of the Part 4B part.

Section 15(2) assessments of Part 4B part

18

(1) If section 15(2) guidance is available on the assessment start day, a section 15(2) assessment of the Part 4B part must be completed within the period of three months beginning with that day.

(2) If, on the assessment start day, the first section 15(2) guidance has not yet been published, a section 15(2) assessment of the Part 4B part must be completed within the period of three months beginning with the day on which the first section 15(2) guidance is published.

Application of Part 1 and paragraph 6

19

(1) This paragraph applies in relation to—

(a) an illegal content risk assessment or a CAA of the regulated service if an assessment of that kind is due to be carried out in relation to the Part 4B part of the service in accordance with paragraph 16 or 17;

(b) a section 15(2) assessment of the regulated service if a section 15(2) assessment is due to be carried out in relation to the Part 4B part of the service in accordance with paragraph 18.

References in the rest of this paragraph to an illegal content risk assessment, a CAA or a section 15(2) assessment are to an assessment of that kind to which this paragraph applies.

(2) For the purposes of this paragraph—

(a) the regulated service is “type 1” if it would still be a regulated user-to-user service even if the Part 4B part were to be assumed not to be part of the service;

(b) the regulated service is “type 2” if it would be a regulated search service if the Part 4B part were to be assumed not to be part of the service;

(3) If the regulated service is type 1, an illegal content risk assessment, a CAA or a section 15(2) assessment is to be treated as being due at the time provided for by Part 1 or paragraph 6 only in relation to the rest of the service.

(4) In sub-paragraph (3) “the rest of the service” means any user-to-user part of the regulated service other than the Part 4B part.

(5) If the regulated service is type 2—

(a) an illegal content risk assessment is not required to be carried out at the time provided for by Part 1, but that is not to be taken to prevent an illegal content risk assessment as defined by section 26 from being due in relation to the search engine of the service at the time provided for by Part 1;

(b) a CAA is to be treated as being due at the time provided for by Part 1 only in relation to the search engine of the service;

(6) If the regulated service is type 3, no illegal content risk assessment, CAA or section 15(2) assessment is required to be carried out at the time provided for by Part 1 or paragraph 6.

Application of paragraph 5

20

(1) This paragraph sets out how paragraph 5 (children’s risk assessments) is to apply if a CAA is required to be carried out in accordance with—

(a) paragraph 16 or 17 (CAA of Part 4B part of a service),

(b) paragraph 19(3) (CAA of the rest of a service), or

(2) The definition of “the relevant day” is to operate by reference to the CAA that was (or was required to be) carried out, and accordingly, references to the day on which the service is to be treated as likely to be accessed by children are to be read as references to the day on which the Part 4B part of the service, the rest of the service or the search engine of the service (as the case may be) is to be treated as likely to be accessed by children.

(3) References to a children’s risk assessment of the service are to a children’s risk assessment of the Part 4B part of the service, the rest of the service or the search engine of the service (as the case may be).

PART 4 — Interpretation, and extension of three-month periods

Interpretation of this Schedule

21

In this Schedule—

“CAA” means a children’s access assessment (see section 35);

“CAA guidance” means OFCOM’s guidance under section 52(3)(b) (guidance about children’s access assessments);

“children’s risk assessment guidance” means OFCOM’s guidance under section 99(3);

“section 15(2) assessment” means OFCOM’s assessment under section 14 (assessments related to the adult user empowerment duty set out in section 15(2));

“section 15(2) guidance” means OFCOM’s guidance under section 52(1).

22

For the meaning of “likely to be accessed by children”, see section 37.

23

In relation to regulated user-to-user services (or in the case of combined services, the user-to-user part of such services)—

(a) references to an illegal content risk assessment are to an illegal content risk assessment as defined by section 9;

(b) references to illegal content risk assessment guidance are to OFCOM’s guidance under section 99(1).

24

In relation to regulated search services and the search engine of combined services—

(a) references to an illegal content risk assessment are to an illegal content risk assessment as defined by section 26;

(b) references to illegal content risk assessment guidance are to OFCOM’s guidance under section 99(2).

25

In relation to regulated user-to-user services (or in the case of combined services, the user-to-user part of such services)—

(a) references to a children’s risk assessment are to a children’s risk assessment as defined by section 11;

(b) references to children’s risk assessment guidance are to be read as references to guidance about such children’s risk assessments.

26

In relation to regulated search services and the search engine of combined services—

(a) references to a children’s risk assessment are to a children’s risk assessment as defined by section 28;

(b) references to children’s risk assessment guidance are to be read as references to guidance about such children’s risk assessments.

27

For the purposes of this Schedule, guidance of a particular kind is available at a particular time if at that time there is in existence published guidance of that kind.

Extension of three-month periods

28

(1) This paragraph applies in relation to a time-limit of three months imposed by any provision of this Schedule for completing a CAA, a section 15(2) assessment or a particular kind of risk assessment.

(2) Extra time may be allowed—

(a) by agreement between OFCOM and the provider of a particular Part 3 service, or

(b) in accordance with a notice published by OFCOM specifying a longer period for CAAs, section 15(2) assessments or risk assessments of that kind (as the case may be) which relate to Part 3 services of a particular kind or size.

SCHEDULE 4

General principles

1

In preparing a draft of a code of practice or amendments of a code of practice, OFCOM must—

(a) consider the appropriateness of provisions of the code of practice to different kinds and sizes of Part 3 services and to providers of differing sizes and capacities, and

(b) have regard to the principles mentioned in paragraph 2.

2

The principles are as follows—

(a) providers of Part 3 services must be able to understand which provisions of the code of practice apply in relation to a particular service they provide;

(b) the measures described in the code of practice must be sufficiently clear, and at a sufficiently detailed level, that providers understand what those measures entail in practice;

(c) the measures described in the code of practice must be proportionate and technically feasible: measures that are proportionate or technically feasible for providers of a certain size or capacity, or for services of a certain kind or size, may not be proportionate or technically feasible for providers of a different size or capacity or for services of a different kind or size;

(d) the measures described in the code of practice that apply in relation to Part 3 services of various kinds and sizes must be proportionate to OFCOM’s assessment (under section 98) of the risk of harm presented by services of that kind or size.

Online safety objectives

3

OFCOM must ensure that measures described in codes of practice are compatible with pursuit of the online safety objectives.

4

The online safety objectives for regulated user-to-user services are as follows—

(a) a service should be designed and operated in such a way that—

(i) the systems and processes for regulatory compliance and risk management are effective and proportionate to the kind and size of service,

(ii) the systems and processes are appropriate to deal with the number of users of the service and its user base,

(iii) United Kingdom users (including children) are made aware of, and can understand, the terms of service,

(iv) there are adequate systems and processes to support United Kingdom users,

(v) (in the case of a Category 1 service) users are offered options to increase their control over the content they encounter and the users they interact with,

(vi) the service provides a higher standard of protection for children than for adults,

(vii) the different needs of children at different ages are taken into account,

(viii) there are adequate controls over access to the service by adults, and

(ix) there are adequate controls over access to, and use of, the service by children, taking into account use of the service by, and impact on, children in different age groups;

(b) a service should be designed and operated so as to protect individuals in the United Kingdom who are users of the service from harm, including with regard to—

(i) algorithms used by the service,

(ii) functionalities of the service, and

(iii) other features relating to the operation of the service.

5

The online safety objectives for regulated search services are as follows—

(a) a service should be designed and operated in such a way that—

(i) the systems and processes for regulatory compliance and risk management are effective and proportionate to the kind and size of service,

(ii) the systems and processes are appropriate to deal with the number of users of the service and its user base,

(iii) United Kingdom users (including children) are made aware of, and can understand, the publicly available statement referred to in sections 27 and 29,

(iv) there are adequate systems and processes to support United Kingdom users,

(v) the service provides a higher standard of protection for children than for adults, and

(vi) the different needs of children at different ages are taken into account;

(b) a service should be assessed to understand its use by, and impact on, children in different age groups;

(c) a search engine should be designed and operated so as to protect individuals in the United Kingdom who are users of the service from harm, including with regard to—

(i) algorithms used by the search engine,

(ii) functionalities relating to searches (such as a predictive search functionality), and

(iii) the indexing, organisation and presentation of search results.

6

In the case of a combined service—

(a) the online safety objectives set out in paragraph 4 do not apply in relation to the search engine;

(b) the online safety objectives set out in paragraph 5 apply in relation to the search engine, and accordingly references in that paragraph to a search service are to be read as references to the search engine;

(c) the reference in paragraph 5(a)(iii) to a publicly available statement includes a reference to provisions of the terms of service which relate to the search engine.

7

The Secretary of State may by regulations amend paragraph 4 or 5 so as to vary the online safety objectives for regulated user-to-user services or regulated search services, and such regulations may make consequential amendments of paragraph 6.

8

If regulations are made amending the online safety objectives, OFCOM must, as soon as reasonably practicable after the regulations come into force, consider whether a review of the codes of practice published under section 46 is required and, if OFCOM consider that it is required, carry out a review to assess whether any amendments are needed to reflect the revised objectives.

Content of codes of practice

9

(1) Codes of practice that describe measures recommended for the purpose of compliance with a duty set out in section 10(2) or (3) (illegal content) must include measures in each of the areas of a service listed in section 10(4).

(2) Codes of practice that describe measures recommended for the purpose of compliance with a duty set out in section 12(2) or (3) (children’s online safety) must include measures in each of the areas of a service listed in section 12(8).

(3) Codes of practice that describe measures recommended for the purpose of compliance with a duty set out in section 27(2) or (3) (illegal content) must include measures in each of the areas of a service listed in section 27(4).

(4) Codes of practice that describe measures recommended for the purpose of compliance with a duty set out in section 29(2) or (3) (children’s online safety) must include measures in each of the areas of a service listed in section 29(4).

(5) Sub-paragraphs (1) to (4) apply to the extent that inclusion of the measures in question is consistent with paragraph 1(a) and the principles mentioned in paragraph 2(c) and (d).

10

(1) Measures described in a code of practice which are recommended for the purpose of compliance with any of the relevant duties must be designed in the light of the principles mentioned in sub-paragraph (2) and (where appropriate) incorporate safeguards for the protection of the matters mentioned in those principles.

(2) The principles are—

(a) the importance of protecting the right of users and (in the case of search services or combined services) interested persons to freedom of expression within the law, and

(b) the importance of protecting the privacy of users.

(3) In sub-paragraph (2)(b) the reference to protecting the privacy of users is to protecting users from a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of a user-to-user service or a search service (including, but not limited to, any such provision or rule concerning the processing of personal data).

(4) In this paragraph “the relevant duties” means the duties set out in—

(a) sections 10 and 27 (illegal content),

(b) sections 12 and 29 (children’s online safety),

(d) section 17 (content of democratic importance),

(e) section 19 (journalistic content),

(f) sections 20 and 31 (content reporting),

(g) sections 21 and 32 (complaints procedures), and

(h) sections 38 and 39 (fraudulent advertising).

11

Measures described in a code of practice may relate only to the design or operation of a Part 3 service—

(a) in the United Kingdom, or

(b) as it affects United Kingdom users of the service.

Content of codes of practice: age assurance

12

(1) This paragraph is about the inclusion of age assurance in a code of practice as a measure recommended for the purpose of compliance with any of the duties set out in section 12(2) or (3) or 29(2) or (3), and sub-paragraph (2) sets out some further principles, in addition to those in paragraphs 1 and 2 (general principles) and 10(2) (freedom of expression and privacy), which are particularly relevant.

(2) In deciding whether to recommend the use of age assurance, or which kinds of age assurance to recommend, OFCOM must have regard to the following—

(a) the principle that age assurance should be effective at correctly identifying the age or age-range of users;

(b) relevant standards set out in the latest version of the code of practice under section 123 of the Data Protection Act 2018 (age-appropriate design code);

(i) the levels of risk and the nature, and severity, of potential harm to children which the age assurance is designed to guard against, and

(ii) protecting the right of users and (in the case of search services or the search engine of combined services) interested persons to freedom of expression within the law;

(d) the principle that more effective kinds of age assurance should be used to deal with higher levels of risk of harm to children;

(e) the principle that age assurance should be easy to use, including by children of different ages and with different needs;

(f) the principle that age assurance should work effectively for all users regardless of their characteristics or whether they are members of a certain group;

(g) the principle of interoperability between different kinds of age assurance.

(3) In a code of practice that describes measures for the purpose of compliance with the duty set out in section 12(3)(a), OFCOM must recommend (among other things) age verification or age estimation which is such of a kind, and which is to be used in such a way, that it is highly effective at correctly determining whether or not a particular user is a child (see section 12(6)).

(4) In deciding which kinds and uses of age verification or age estimation to recommend for the purpose of compliance with the duty set out in section 12(3)(a), OFCOM must have regard to their guidance under section 82 that gives examples of kinds and uses of age verification and age estimation that are, or are not, highly effective at correctly determining whether or not a particular user is a child.

(5) Nothing in sub-paragraph (2) is to be read as allowing OFCOM to recommend, for the purpose of compliance with the duty set out in section 12(3)(a) by providers subject to the requirement in section 12(4), a kind or use of age verification or age estimation which does not meet the requirement to be highly effective as mentioned in section 12(6).

(6) A code of practice that recommends the use of age assurance for the purpose of compliance with the duties set out in section 12(2) or (3) must also describe measures recommended for the purpose of compliance with the duties set out in—

(a) section 12(9), (11) and (13) (inclusion of clear information in terms of service), and

(b) section 21(2) and (3) (see, in particular, section 21(5)(e) (complaints about age assurance)).

(7) A code of practice that recommends the use of age assurance for the purpose of compliance with the duties set out in section 29(2) or (3) must also describe measures recommended for the purpose of compliance with the duties set out in—

(a) section 29(5) and (8) (inclusion of clear information in publicly available statement), and

(b) section 32(2) and (3) (see, in particular, section 32(5)(d) (complaints about age assurance)).

(8) A code of practice may—

(a) refer to industry or technical standards for age assurance (where they exist);

(b) elaborate on the principles mentioned in paragraphs (a) and (c) to (g) of sub-paragraph (2).

(9) In this paragraph “age assurance” means age verification or age estimation, and see in particular section 230(4) (self-declaration of age not to be regarded as age verification or age estimation).

Content of codes of practice: proactive technology

13

(1) If OFCOM consider it appropriate to do so, and in accordance with the principles to which they must have regard (see paragraphs 1 and 2 and, in particular, 10(2)), they may include in a code of practice a measure describing the use of a kind of technology.

(2) But there are constraints, set out in the rest of this paragraph, on OFCOM’s power to include in a code of practice a measure describing the use of proactive technology as a way (or one of the ways) of complying with a duty set out in this Act (a “proactive technology measure”).

(3) A proactive technology measure may be recommended only for the purpose of compliance with any of the duties set out in—

(a) section 10(2) or (3) (illegal content),

(b) section 12(2) or (3) (children’s online safety),

(d) section 29(2) or (3) (children’s online safety), or

(e) section 38(1) or 39(1) (fraudulent advertising).

(4) A proactive technology measure may relate to the use of a kind of technology on or in relation to any Part 3 service or any part of such a service, but if the technology operates (or may operate) by analysing user-generated content or metadata relating to such content, the measure may not recommend the use of the technology to analyse user-generated content communicated privately, or metadata relating to user-generated content communicated privately.

(5) A proactive technology measure may be included in a code of practice in relation to Part 3 services of a particular kind or size only if OFCOM are satisfied that use of the technology in question by such services would be proportionate to the risk of harm that the measure is designed to safeguard against (taking into account, in particular, the risk profile for the time being published by OFCOM under section 98 relating to such services).

(6) In deciding whether to include a proactive technology measure in a code of practice, OFCOM must have regard to the degree of accuracy, effectiveness and lack of bias achieved by the technology in question, and may—

(a) refer in the code of practice to industry or technical standards for the technology (where they exist);

(b) set out principles in the code of practice designed to ensure that the technology or its use is (so far as possible) accurate, effective and free of bias.

(7) Sub-paragraph (6) does not apply in relation to proactive technology which is a kind of age verification or age estimation technology.

General

14

A code of practice may make different provision for different purposes and may, in particular—

(a) make different provision with regard to—

(i) user-to-user services, and

(ii) search services;

(b) make different provision with regard to user-to-user services of different kinds or search services of different kinds; and

(c) otherwise differentiate between Part 3 services, and between providers of such services, in such manner as OFCOM consider appropriate.

15

A code of practice may apply in relation to a person who provides a Part 3 service from outside the United Kingdom.

Interpretation

16

In this Schedule—

“code of practice” means a code of practice under section 41;

“search results” has the meaning given by section 57(3);

“user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

SCHEDULE 5

1

An offence under any of the following provisions of the Terrorism Act 2000—

(a) section 11 (membership of a proscribed organisation);

(b) section 12(1) (inviting support for a proscribed organisation);

(d) section 12(2) (arranging a meeting supportive of a proscribed organisation);

(e) section 13(1A) (publishing image of uniform of proscribed organisation);

(f) section 15 (terrorist fund-raising);

(g) section 16(1) (use of money or property for terrorist purposes);

(h) section 16(2) (possession of money or property for terrorist purposes);

(i) section 17 (involvement in terrorist funding arrangements);

(j) section 18 (laundering of terrorist property);

(k) section 54(1) (providing weapons training);

(l) section 54(3) (inviting another to receive weapons training);

(m) section 56 (directing a terrorist organisation);

(n) section 58 (collection of information likely to be of use to a terrorist);

(o) section 58A (publishing information about members of the armed forces etc);

(p) sections 59 to 61 (inciting terrorism outside the United Kingdom).

2

An offence under section 113 of the Anti-terrorism, Crime and Security Act 2001 (use of noxious substances or things).

3

An offence under any of the following provisions of the Terrorism Act 2006—

(a) section 1 (encouragement of terrorism);

(b) section 2 (dissemination of terrorist publications);

(d) section 6 (training for terrorism);

(e) section 11 (terrorist threats relating to radioactive devices etc).

Inchoate offences

4

(1) An offence of attempting or conspiring to commit an offence specified in this Schedule.

(2) An offence under Part 2 of the Serious Crime Act 2007 (encouraging or assisting) in relation to an offence specified in this Schedule, or (in Scotland) inciting a person to commit such an offence.

(3) An offence of aiding, abetting, counselling or procuring the commission of an offence specified in this Schedule, or (in Scotland) being involved art and part in the commission of such an offence.

SCHEDULE 6

PART 1 — England and Wales, and Northern Ireland

1

An offence under section 2 of the Obscene Publications Act 1959 relating to an obscene article tending to deprave and corrupt others by encouraging them to commit an offence specified in paragraph 2, 4, 5, 7 or 8.

2

An offence under section 1 of the Protection of Children Act 1978 (indecent photographs of children).

3

An offence under Article 3 of the Protection of Children (Northern Ireland) Order 1978 (S.I. 1978/1047 (N.I. 17)) (indecent photographs of children).

4

An offence under section 160 of the Criminal Justice Act 1988 (possession of indecent photograph of a child).

5

An offence under any of the following provisions of the Sexual Offences Act 2003—

(a) section 8 (causing or inciting a child under 13 to engage in sexual activity);

(b) section 10 (causing or inciting a child to engage in sexual activity);

(d) section 12 (causing a child to watch a sexual act);

(e) section 13 (child sex offences committed by children or young persons);

(f) section 14 (arranging or facilitating commission of a child sex offence);

(g) section 15 (meeting a child following sexual grooming etc);

(h) section 15A (sexual communication with a child);

(i) section 47 (paying for sexual services of a child);

(j) section 48 (causing or inciting sexual exploitation of a child);

(k) section 49 (controlling a child in relation to sexual exploitation);

(l) section 50 (arranging or facilitating sexual exploitation of a child).

6

An offence under any of the following provisions of the Sexual Offences (Northern Ireland) Order 2008 (S.I. 2008/1769 (N.I. 2))—

(a) Article 15 (causing or inciting a child under 13 to engage in sexual activity);

(b) Article 17 (causing or inciting a child to engage in sexual activity);

(d) Article 19 (causing a child to watch a sexual act);

(e) Article 20 (sexual offences against children committed by children or young persons);

(f) Article 21 (arranging or facilitating commission of a sex offence against a child);

(g) Article 22 (meeting a child following sexual grooming etc);

(h) Article 22A (sexual communication with a child);

(i) Article 37 (paying for sexual services of a child);

(j) Article 38 (causing or inciting child prostitution or pornography);

(k) Article 39 (controlling a child prostitute or a child involved in pornography);

(l) Article 40 (arranging or facilitating child prostitution or pornography).

7

An offence under section 62 of the Coroners and Justice Act 2009 (possession of prohibited image of a child).

8

An offence under section 69 of the Serious Crime Act 2015 (possession of paedophile manual).

Inchoate offences

9

(1) An offence of attempting or conspiring to commit an offence specified in this Part.

(2) An offence under Part 2 of the Serious Crime Act 2007 (encouraging or assisting) in relation to an offence specified in this Part.

(3) An offence of aiding, abetting, counselling or procuring the commission of an offence specified in this Part.

PART 2 — Scotland

10

An offence under either of the following provisions of the Civic Government (Scotland) Act 1982—

(a) section 52 (indecent photographs etc of children);

(b) section 52A (possession of indecent photographs of children).

11

An offence under any of the following provisions of the Protection of Children and Prevention of Sexual Offences (Scotland) Act 2005—

(a) section 1 (meeting a child following certain preliminary contact);

(b) section 9 (paying for sexual services of a child);

(d) section 11 (controlling a child providing sexual services or involved in pornography);

(e) section 12 (arranging or facilitating provision by child of sexual services or child pornography).

12

An offence under any of the following provisions of the Sexual Offences (Scotland) Act 2009—

(a) section 21 (causing a young child to participate in a sexual activity);

(b) section 23 (causing a young child to look at a sexual image);

(d) section 31 (causing an older child to participate in a sexual activity);

(e) section 33 (causing an older child to look at a sexual image);

(f) section 34 (communicating indecently with an older child etc);

(g) section 54 (incitement to commit certain sexual acts outside Scotland).

Inchoate offences

13

(1) An offence of attempting or conspiring to commit an offence specified in this Part.

(2) An offence of inciting a person to commit an offence specified in this Part.

(3) An offence of aiding, abetting, counselling or procuring the commission of an offence specified in this Part, or being involved art and part in the commission of such an offence.

SCHEDULE 7

Assisting suicide

1

An offence under section 2 of the Suicide Act 1961 (assisting suicide etc).

2

An offence under section 13 of the Criminal Justice Act (Northern Ireland) 1966 (c. 20 (N.I.)) (assisting suicide etc).

Threats to kill

3

An offence under section 16 of the Offences against the Person Act 1861 (threats to kill).

Public order offences, harassment, stalking and fear or provocation of violence

4

An offence under any of the following provisions of the Public Order Act 1986—

(a) section 4 (fear or provocation of violence);

(b) section 4A (intentional harassment, alarm or distress);

5

An offence under any of the following provisions of the Public Order Act 1986—

(a) section 18 (use of words or behaviour or display of written material);

(b) section 19 (publishing or distributing written material);

(d) section 29B (use of words or behaviour or display of written material);

(e) section 29C (publishing or distributing written material);

(f) section 29E (distributing, showing or playing a recording).

6

An offence under section 50A of the Criminal Law (Consolidation) (Scotland) Act 1995 (racially-aggravated harassment).

7

An offence under any of the following provisions of the Protection from Harassment Act 1997—

(a) section 2 (harassment);

(b) section 2A (stalking);

(d) section 4A (stalking involving fear of violence or serious alarm or distress).

8

An offence under any of the following provisions of the Protection from Harassment (Northern Ireland) Order 1997 (S.I. 1997/1180 (N.I. 9))—

(a) Article 4 (harassment);

(b) Article 6 (putting people in fear of violence).

9

An offence under any of the following provisions of the Crime and Disorder Act 1998—

(a) section 31 (racially or religiously aggravated public order offences);

(b) section 32 (racially or religiously aggravated harassment etc).

10

An offence under any of the following provisions of the Criminal Justice and Licensing (Scotland) Act 2010 (asp 13)—

(a) section 38 (threatening or abusive behaviour);

(b) section 39 (stalking).

11

An offence under section 76 of the Serious Crime Act 2015 (controlling or coercive behaviour in an intimate or family relationship).

Drugs and psychoactive substances

12

An offence under any of the following provisions of the Misuse of Drugs Act 1971—

(a) section 4(3) (unlawful supply, or offer to supply, of controlled drugs);

(b) section 9A (prohibition of supply etc of articles for administering or preparing controlled drugs);

13

An offence under section 5 of the Psychoactive Substances Act 2016 (supplying, or offering to supply, a psychoactive substance).

Firearms and other weapons

14

An offence under section 1(1) or (2) of the Restriction of Offensive Weapons Act 1959 (sale etc of flick knife etc).

15

An offence under any of the following provisions of the Firearms Act 1968—

(a) section 1(1) (purchase etc of firearms or ammunition without certificate);

(b) section 2(1) (purchase etc of shot gun without certificate);

(d) section 3(2) (sale etc of firearms or ammunition to person other than registered dealer);

(e) section 5(1), (1A) or (2A) (purchase, sale etc of prohibited weapons);

(f) section 21(5) (sale etc of firearms or ammunition to persons previously convicted of crime);

(g) section 22(1) (purchase etc of firearms or ammunition by person under 18);

(h) section 24 (supplying firearms to minors);

(i) section 24A (supplying imitation firearms to minors).

16

An offence under any of the following provisions of the Crossbows Act 1987—

(a) section 1 (sale and letting on hire of crossbow);

(b) section 2 (purchase and hiring of crossbow).

17

An offence under any of the following provisions of the Criminal Justice Act 1988—

(a) section 141(1) or (4) (sale etc of offensive weapons);

(b) section 141A (sale of knives etc to persons under 18).

18

An offence under any of the following provisions of the Criminal Justice (Northern Ireland) Order 1996 (S.I. 1996/3160 (N.I. 24))—

(a) Article 53 (sale etc of knives);

(b) Article 54 (sale of knives etc to minors).

19

An offence under any of the following provisions of the Knives Act 1997—

(a) section 1 (unlawful marketing of knives);

(b) section 2 (publication of material in connection with marketing of knives).

20

An offence under any of the following provisions of the Firearms (Northern Ireland) Order 2004 (S.I. 2004/702 (N.I. 3))—

(a) Article 24 (sale etc of firearms or ammunition without certificate);

(b) Article 37(1) (sale etc of firearms or ammunition to person without certificate etc);

(d) Article 63(8) (sale etc of firearms or ammunition to people who have been in prison etc);

(e) Article 66A (supplying imitation firearms to minors).

21

An offence under section 36(1)(c) or (d) of the Violent Crime Reduction Act 2006 (sale etc of realistic imitation firearms).

22

An offence under any of the following provisions of the Air Weapons and Licensing (Scotland) Act 2015 (asp 10)—

(a) section 2 (requirement for air weapon certificate);

(b) section 24 (restrictions on sale etc of air weapons).

Assisting illegal immigration

23

An offence under any of the following provisions of the Immigration Act 1971—

(a) section 24(A1), (B1), (C1) or (D1) (illegal entry and similar offences);

(b) section 25 (assisting unlawful immigration).

Human trafficking

24

An offence under section 2 of the Modern Slavery Act 2015 (human trafficking).

25

An offence under section 1 of the Human Trafficking and Exploitation (Scotland) Act 2015 (asp 12) (human trafficking).

26

An offence under section 2 of the Human Trafficking and Exploitation (Criminal Justice and Support for Victims) Act (Northern Ireland) 2015 (c. 2 (N.I.)) (human trafficking).

Sexual exploitation

27

An offence under any of the following provisions of the Sexual Offences Act 2003—

(a) section 52 (causing or inciting prostitution for gain);

(b) section 53 (controlling prostitution for gain).

28

An offence under any of the following provisions of the Sexual Offences (Northern Ireland) Order 2008 (S.I. 2008/1769 (N.I. 2))—

(a) Article 62 (causing or inciting prostitution for gain);

(b) Article 63 (controlling prostitution for gain).

Sexual images

29

An offence under section 63 of the Criminal Justice and Immigration Act 2008 (possession of extreme pornographic images).

30

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

31

An offence under section 2 of the Abusive Behaviour and Sexual Harm (Scotland) Act 2016 (asp 22) (disclosing, or threatening to disclose, an intimate photograph or film).

Proceeds of crime

32

An offence under any of the following provisions of the Proceeds of Crime Act 2002—

(a) section 327 (concealing etc criminal property);

(b) section 328 (arrangements facilitating acquisition etc of criminal property);

Fraud

33

An offence under any of the following provisions of the Fraud Act 2006—

(a) section 2 (fraud by false representation);

(b) section 4 (fraud by abuse of position);

(d) section 9 (participating in fraudulent business carried on by sole trader etc).

34

An offence under section 49(3) of the Criminal Justice and Licensing (Scotland) Act 2010 (articles for use in fraud).

Financial services

35

An offence under any of the following provisions of the Financial Services and Markets Act 2000—

(a) section 23 (contravention of prohibition on carrying on regulated activity unless authorised or exempt);

(b) section 24 (false claims to be authorised or exempt);

36

An offence under any of the following provisions of the Financial Services Act 2012—

(a) section 89 (misleading statements);

(b) section 90 (misleading impressions).

Foreign interference

37

An offence under section 13 of the National Security Act 2023 (foreign interference).

Animal welfare

38

An offence under section 4(1) of the Animal Welfare Act 2006 (unnecessary suffering of an animal).

Inchoate offences

39

(1) An offence of attempting or conspiring to commit an offence specified in this Schedule.

(2) An offence under Part 2 of the Serious Crime Act 2007 (encouraging or assisting) in relation to an offence specified in this Schedule, or (in Scotland) inciting a person to commit such an offence.

(3) An offence of aiding, abetting, counselling or procuring the commission of an offence specified in this Schedule, or (in Scotland) being involved art and part in the commission of such an offence.

SCHEDULE 8

PART 1 — Matters about which information may be required: user-to-user part of service

1

The incidence of illegal content, content that is harmful to children, relevant content and content to which section 15(2) applies on a service.

2

The dissemination of illegal content, content that is harmful to children, relevant content and content to which section 15(2) applies by means of a service.

3

The number of users who are assumed to have encountered illegal content, content that is harmful to children, relevant content or content to which section 15(2) applies by means of the service.

4

The formulation, development, scope and application of the terms of service.

5

The systems and processes for users to report content which they consider to be illegal content, content that is harmful to children or relevant content.

6

The systems and processes that a provider operates to deal with illegal content, content that is harmful to children and relevant content, including systems and processes for identifying such content and taking it down.

7

Functionalities designed to help users manage risks relating to content that is harmful to children and relevant content.

8

Features, including functionalities, that a provider considers may contribute to risks of harm to individuals using the service, and measures taken or in use by the provider to mitigate and manage those risks.

9

The design and operation of algorithms which affect the display, promotion, restriction or recommendation of illegal content, content that is harmful to children, relevant content or content to which section 15(2) applies.

10

Measures taken or in use by a provider to comply with any duty set out in Chapter 2 or 4 of Part 3 or section 38 (including in particular measures that are described in a code of practice under section 41).

11

Measures taken or in use by a provider to comply with the duty set out in section 64(1) (user identity verification).

12

Arrangements that a provider has in place for the reporting (in the United Kingdom or elsewhere) of content relating to child sexual exploitation and abuse, and measures taken or in use by a provider to comply with a requirement under section 66.

13

Measures taken or in use by a provider to comply with any duty set out in section 71 or 72 (terms of service).

14

Measures taken or in use by a provider to comply with any duty set out in section 75 (deceased child users).

15

The systems and processes by which a provider assesses the risk of harm to individuals from the presence of illegal content or content that is harmful to children—

(a) when the service is initially being designed or developed,

(b) when any further development or update to the service is being considered, and

16

The systems and processes that a provider operates—

(a) to direct users of the service to information about how they can protect themselves from harm in relation to illegal content and content that is harmful to children, and

(b) to counteract or provide support to users of the service in relation to illegal content and content that is harmful to children present on the service.

17

Co-operation by a provider with government, regulatory or other public sector bodies in the United Kingdom, in particular those involved in the enforcement of the criminal law.

18

Measures taken or in use by a provider to provide for a higher standard of protection for children than for adults.

19

Measures taken or in use by a provider to improve the media literacy of users, and an evaluation of the effectiveness of such measures.

20

Any other measures taken or in use by a provider which relate to online safety matters.

PART 2 — Matters about which information may be required: search engine

21

The incidence of illegal search content and search content that is harmful to children on a service.

22

The number of users who are assumed to have encountered illegal search content or search content that is harmful to children.

23

The formulation, development, scope and application of the statements of policies and procedures mentioned in sections 27(5) and 29(5).

24

The systems and processes for users to report search content which they consider to be illegal content or content that is harmful to children, or other content which they consider breaches any statements of policies and procedures which have been made publicly available by the provider of a service.

25

The systems and processes that a provider operates to deal with illegal search content and search content that is harmful to children, including systems and processes for identifying such content and minimising the risk of those kinds of content being encountered by means of the service.

26

Functionalities designed to help users manage risks relating to search content that is harmful to children.

27

The design and operation of algorithms which affect the display, promotion, restriction or recommendation of illegal search content or search content that is harmful to children.

28

Measures taken or in use by a provider to comply with any duty set out in Chapter 3 or 4 of Part 3 or section 39 (including in particular measures that are described in a code of practice under section 41).

29

30

Measures taken or in use by a provider to comply with any duty set out in section 75 (deceased child users).

31

The systems and processes by which a provider assesses the risk of harm to individuals from illegal search content or search content that is harmful to children—

(a) when the service is initially being designed or developed,

(b) when any further development or update to the service is being considered, and

32

The systems and processes that a provider operates—

(a) to direct users of the service to information about how they can protect themselves from harm in relation to illegal content and content that is harmful to children, and

(b) to counteract or provide support to users of the service in relation to illegal search content and search content that is harmful to children.

33

Co-operation by a provider with government, regulatory or other public sector bodies in the United Kingdom, in particular those involved in the enforcement of the criminal law.

34

Measures taken or in use by a provider to provide a higher standard of protection for children than for adults.

35

Measures taken or in use by a provider to improve the media literacy of users, and an evaluation of the effectiveness of such measures.

36

Any other measures taken or in use by a provider which relate to online safety matters.

PART 3 — Further provision and interpretation

37

When determining which information to require in a notice under section 77(1) in relation to a particular service, OFCOM must take into account—

(a) the kind of service it is;

(b) the functionalities of the service;

(d) the capacity of the provider;

(e) the duties set out in Chapter 2 or 3 of Part 3 or Chapters 1 to 4 of Part 4 that apply in relation to the service;

(f) the proportion of users of the service who are children.

38

The Secretary of State may by regulations—

(a) amend Part 1 or Part 2 of this Schedule so as to add further matters about which information may be required, or to vary or omit matters about which information may be required, and

Reading this document does not replace reading the official text published on legislation.gov.uk. Contains public sector information licensed under the Open Government Licence v3.0. We assume no responsibility for any inaccuracies arising from the conversion of the original CLML XML to this format.

This text is published under legislation.gov.uk's own terms of reuse, not a Legalize or public-domain licence. legislation.gov.uk
Open Government Licence v3.0 (attribution required)
© Crown and database right. Derived from content available under the Open Government Licence v3.0 from legislation.gov.uk.