Legalize / United Kingdom / Public General Act

Online Safety Act 2023

Type Public General Act

Publication 2023-10-26

Last updated 2026-04-07

State In force

Department Statute Law Database

Source legislation.gov.uk

articles Not indexed

Reform history JSON API

(2) “Provider pornographic content”, in relation to an internet service, means pornographic content that is published or displayed on the service by the provider of the service or by a person acting on behalf of the provider, including pornographic content published or displayed on the service by means of—

(a) software or an automated tool or algorithm applied by the provider or by a person acting on behalf of the provider, or

(b) an automated tool or algorithm made available on the service by the provider or by a person acting on behalf of the provider.

(3) “Regulated provider pornographic content”, in relation to an internet service, means provider pornographic content other than content within subsection (4) or (5).

(4) Content is within this subsection if it—

(a) consists only of text, or

(b) consists only of text accompanied by—

(i) a GIF which is not itself pornographic content,

(ii) an emoji or other symbol, or

(iii) a combination of content mentioned in sub-paragraphs (i) and (ii).

(5) Content is within this subsection if it consists of a paid-for advertisement (see section 236).

(6) References to pornographic content that is “published or displayed” on a service—

(a) include, in particular—

(i) references to pornographic content that is only visible or audible to users as a result of interacting with content that is blurred, distorted or obscured (for example, by clicking on such content), but only where the pornographic content is present on the service,

(ii) references to pornographic content that is embedded on the service, and

(iii) references to pornographic content that is generated on the service by means of an automated tool or algorithm in response to a prompt by a user and is only visible or audible to that user (no matter for how short a time);

(b) do not include references to pornographic content that appears in search results of a search service or a combined service.

(7) Pornographic content that is user-generated content in relation to an internet service is not to be regarded as provider pornographic content in relation to that service.

(8) In this section—

“search results” has the meaning given by section 57(3);

“user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

Scope of duties about regulated provider pornographic content

80

(1) A provider of an internet service within subsection (2) must comply with the duties set out in section 81 in relation to the service.

(2) An internet service is within this subsection if—

(a) regulated provider pornographic content is published or displayed on the service,

(b) the service is not exempt, and

(3) A service is “exempt” for the purposes of this Part if it is —

(a) a user-to-user service or a search service of a description that is exempt as provided for by Schedule 1, or

(b) an internet service of a kind described in Schedule 9.

(4) A service “has links with the United Kingdom” for the purposes of this Part if either of the following conditions is met in relation to the service—

(a) the service has a significant number of United Kingdom users, or

(b) United Kingdom users form one of the target markets for the service (or the only target market).

(5) This Part does not apply in relation to a part of a regulated service if—

(a) in the case of a Part 3 service, the conditions in paragraph 7(2) of Schedule 1 (internal business service conditions) are met in relation to that part;

(b) in the case of an internet service other than a Part 3 service, the conditions in paragraph 1(2) of Schedule 9 (internal business service conditions) are met in relation to that part.

(6) This Part does not apply in relation to a part of a regulated service if that part is an on-demand programme service or a non-UK on-demand programme service that is a Tier 1 service ....

(6A) In subsection (6), “on-demand programme service”, “non-UK on-demand programme service” and “Tier 1 service” have the same meaning as in the Communications Act (see sections 368A, 368AA and 368HA of that Act).

(7) If a person is the provider of more than one internet service within subsection (2), the duties set out in section 81 apply in relation to each such service.

(8) The duties set out in section 81 extend only to the design, operation and use of an internet service in the United Kingdom.

Duties about regulated provider pornographic content

81

(1) This section sets out the duties which apply in relation to internet services within section 80(2).

(2) A duty to ensure, by the use of age verification or age estimation (or both), that children are not normally able to encounter content that is regulated provider pornographic content in relation to the service.

(3) The age verification or age estimation must be of such a kind, and used in such a way, that it is highly effective at correctly determining whether or not a particular user is a child.

(4) In relation to the duty set out in subsection (2), a duty to make and keep a written record, in an easily understandable form, of—

(a) the kinds of age verification or age estimation used, and how they are used, and

(b) the way in which the provider, when deciding on the kinds of age verification or age estimation and how they should be used, has had regard to the importance of protecting United Kingdom users from a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of a regulated service (including, but not limited to, any such provision or rule concerning the processing of personal data).

(5) A duty to summarise the written record in a publicly available statement, so far as the record concerns compliance with the duty set out in subsection (2), including details about which kinds of age verification or age estimation a provider is using and how they are used.

OFCOM’s guidance about duties set out in section 81

82

(1) OFCOM must produce guidance for providers of internet services within section 80(2) to assist them in complying with their duties set out in section 81.

(2) The guidance must include—

(a) examples of kinds and uses of age verification and age estimation that are, or are not, highly effective at correctly determining whether or not a particular user is a child,

(b) examples of ways in which a provider may have regard to the importance of protecting users as mentioned in section 81(4)(b),

(c) principles that OFCOM propose to apply when determining whether a provider has complied with each of the duties set out in section 81, and

(d) examples of circumstances in which OFCOM are likely to consider that a provider has not complied with each of those duties.

(3) The guidance may elaborate on the following principles governing the use of age verification or age estimation for the purpose of compliance with the duty set out in section 81(2)—

(a) the principle that age verification or age estimation should be easy to use;

(b) the principle that age verification or age estimation should work effectively for all users regardless of their characteristics or whether they are members of a certain group;

(4) The guidance may refer to industry or technical standards for age verification or age estimation (where they exist).

(5) Before producing the guidance (including revised or replacement guidance), OFCOM must consult—

(a) the Secretary of State,

(b) persons who appear to OFCOM to represent providers of internet services within section 80(2),

(d) persons who appear to OFCOM to represent the interests of children (generally or with particular reference to online safety matters),

(e) the Information Commissioner,

(f) persons whom OFCOM consider to have expertise in innovation, or emerging technology, that is relevant to online safety matters, and

(g) such other persons as OFCOM consider appropriate.

(6) But if OFCOM propose to revise the guidance, and consider that the minor nature of the proposal means that consultation is unnecessary—

(a) OFCOM must notify the Secretary of State of the proposed changes, and

(b) if the Secretary of State agrees that it is appropriate, the consultation requirements set out in subsection (5) do not apply in relation to the proposed changes.

(7) OFCOM must keep the guidance under review.

(8) OFCOM must publish the guidance (and any revised or replacement guidance).

PART 6 — Duties of providers of regulated services: fees

Duty to notify OFCOM

83

(1) A provider of a regulated service must notify OFCOM in relation to a charging year which is—

(a) the first fee-paying year in relation to that provider, or

(b) any charging year after the first fee-paying year where—

(i) the previous charging year was not a fee-paying year in relation to the provider, and the charging year in question is a fee-paying year in relation to the provider, or

(ii) the previous charging year was a fee-paying year in relation to the provider, and the charging year in question is not a fee-paying year in relation to the provider.

(2) A “fee-paying year”, in relation to a provider, means a charging year where both of the following conditions apply—

(a) the provider’s qualifying worldwide revenue for the qualifying period that relates to that charging year is equal to or greater than the threshold figure that has effect for that charging year (see section 86), and

(b) the provider is not exempt (see subsection (6)).

(3) A notification under subsection (1) in relation to a charging year must include details of all regulated services provided by the provider, and where it is a notification under subsection (1)(a) or (b)(i), it must also include—

(a) details of the provider’s qualifying worldwide revenue for the qualifying period that relates to that charging year, and

(b) supporting evidence, documents or other information as required by regulations made by OFCOM under section 85.

(4) Section 85 confers power on OFCOM to make regulations about the determination of a provider’s qualifying worldwide revenue, and the meaning of “qualifying period”, for the purposes of this Part.

(5) A notification under subsection (1) must be provided to OFCOM—

(a) in relation to the initial charging year, within four months of the date on which the first regulations under section 86 come into force (first threshold figure);

(b) in relation to subsequent charging years, at least six months before the beginning of the charging year to which the notification relates.

(6) OFCOM may provide that particular descriptions of providers of regulated services are exempt for the purposes of this section and section 84 where—

(a) OFCOM consider that an exemption for such providers is appropriate, and

(b) the Secretary of State approves the exemption.

(7) OFCOM may revoke such an exemption where they consider that it is no longer appropriate and the Secretary of State approves the revocation.

(8) Exemptions, or revocations of exemptions, which are approved by the Secretary of State are to take effect from the beginning of a particular charging year.

(9) Details of an exemption or revocation must be published by OFCOM at least six months before the beginning of the first charging year for which the exemption or revocation is to have effect.

(10) But subsection (9) does not apply in relation to any exemptions which are to have effect for the initial charging year.

(11) For the purposes of this section and section 84, the “provider” of a regulated service, in relation to a charging year, includes a person who is the provider of the service for part of that year.

Duty to pay fees

84

(1) OFCOM may require a provider of a regulated service to pay a fee in respect of a charging year which is a fee-paying year.

(2) Where OFCOM require a provider of a regulated service to pay a fee in respect of a charging year, the fee is to be equal to the amount produced by a computation—

(a) made by reference to—

(i) the provider’s qualifying worldwide revenue for the qualifying period relating to that charging year, and

(ii) any other factors that OFCOM consider appropriate, and

(b) made in the manner that OFCOM consider appropriate.

(3) For the purposes of this section and section 83—

(a) the amount of a provider’s qualifying worldwide revenue for a qualifying period, or

(b) the amount of a fee to be paid to OFCOM, or of an instalment of such a fee,

is, in the event of a disagreement between the provider and OFCOM, the amount determined by OFCOM.

(4) When determining fees payable under this section, OFCOM must do so in accordance with a statement of principles as mentioned in section 88(1).

(5) Where a person is the provider of a regulated service for part of a charging year only, OFCOM may refund all or part of a fee paid to OFCOM under this section by that provider in respect of that year.

(6) In this section, “fee-paying year” has the same meaning as in section 83.

Regulations by OFCOM about qualifying worldwide revenue etc

85

(1) For the purposes of this Part, OFCOM may by regulations make provision—

(a) about how the qualifying worldwide revenue of a provider of a regulated service is to be determined, and

(b) defining the “qualifying period” in relation to a charging year.

(2) OFCOM may by regulations also make provision specifying or describing evidence, documents or other information that providers must supply to OFCOM for the purposes of section 83 (see subsection (3)(b) of that section), including provision about the way in which providers must supply the evidence, documents or information.

(3) Regulations under subsection (1)(a) may provide that the qualifying worldwide revenue of a provider of a regulated service (P) who is a member of a group during any part of a qualifying period is to include the qualifying worldwide revenue of any entity that—

(a) is a group undertaking in relation to P for all or part of that period, and

(b) receives or is due to receive, during that period, any amount referable (to any degree) to a regulated service provided by P.

(4) Regulations under subsection (1)(a) may, in particular—

(a) make provision about circumstances in which amounts do, or do not, count as being referable (to any degree) to a regulated service for the purposes of the determination of the qualifying worldwide revenue of the provider of the service or of an entity that is a group undertaking in relation to the provider;

(b) provide for cases or circumstances in which amounts that—

(i) are of a kind specified or described in the regulations, and

(ii) are not referable to a regulated service,

are to be brought into account in determining the qualifying worldwide revenue of the provider of the service or of an entity that is a group undertaking in relation to the provider.

(5) Regulations which make provision of a kind mentioned in subsection (3) may include provision that, in the case of an entity that is a group undertaking in relation to a provider for part (not all) of a qualifying period, only amounts relating to the part of the qualifying period for which the entity was a group undertaking may be brought into account in determining the entity’s qualifying worldwide revenue.

(6) Regulations under subsection (1)(a) may make provision corresponding to paragraph 5(8) of Schedule 13.

(7) Before making regulations under subsection (1) OFCOM must consult—

(a) the Secretary of State,

(b) the Treasury, and

(8) Before making regulations under subsection (2) OFCOM must consult the Secretary of State.

(9) Regulations under this section may make provision subject to such exemptions and exceptions as OFCOM consider appropriate.

(10) In this section—

“group” means a parent undertaking and its subsidiary undertakings, reading those terms in accordance with section 1162 of the Companies Act 2006;

“group undertaking” has the meaning given by section 1161(5) of that Act.

Threshold figure

86

(1) OFCOM must carry out a consultation to inform the setting of the threshold figure for the purposes of sections 83 and 84, consulting such persons as they consider appropriate.

(2) After the completion of the consultation, and having taken advice from OFCOM, the Secretary of State must make regulations specifying the threshold figure for those purposes.

(3) The Secretary of State must keep the threshold figure under review.

(4) If the Secretary of State considers that it may be appropriate to revise the threshold figure, the Secretary of State may request OFCOM to carry out a further consultation, and subsections (1) and (2) apply again.

(5) Regulations must provide that a threshold figure is to take effect from the beginning of a particular charging year.

(6) Regulations specifying a threshold figure must be in force at least nine months before the beginning of the first charging year for which that figure is to have effect.

(7) But subsection (6) does not apply in relation to the first regulations made under this section.

Secretary of State’s guidance about fees

87

(1) The Secretary of State must issue guidance to OFCOM about the principles to be included in a statement of principles that OFCOM propose to apply in determining fees payable under section 84 (see section 88).

(2) The Secretary of State must consult OFCOM before issuing, revising or replacing the guidance.

(3) The guidance may not be revised or replaced more frequently than once every three years unless—

(a) the guidance needs to be corrected because of an amendment, repeal or modification of any provision of this Part, or

(b) the revision or replacement is by agreement between the Secretary of State and OFCOM.

(4) The Secretary of State must lay the guidance (including revised or replacement guidance) before Parliament.

(5) The Secretary of State must publish the guidance (and any revised or replacement guidance).

(6) In exercising any functions under this Part, OFCOM must have regard to the guidance for the time being published under this section.

OFCOM’s fees statements

88

(1) OFCOM may not require a provider of a regulated service to pay a fee under section 84 unless there is in force a statement of the principles that OFCOM propose to apply in determining fees payable under that section.

(2) Those principles must be such as appear to OFCOM to be likely to secure, on the basis of such estimates of the likely costs as it is practicable for them to make—

(a) that on a year by year basis, the aggregate amount of the fees payable to OFCOM under section 84 is sufficient to meet, but does not exceed, the annual cost to OFCOM of the exercise of their online safety functions;

(b) that the fees required under section 84 are justifiable and proportionate having regard to the functions in respect of which they are imposed;

(c) that the relationship between meeting the cost of the exercise of those functions and the amounts of the fees is transparent.

(3) A statement of principles mentioned in subsection (1) must (among other things)—

(a) include details relating to the computation model used to calculate fees payable under section 84, including details of factors mentioned in subsection (2)(a)(ii) of that section (if any),

(b) include details about the meaning of “qualifying worldwide revenue” and “qualifying period” for the purposes of this Part, and

(4) Before making or revising such a statement of principles, OFCOM must consult such persons as they consider appropriate.

(5) Such a statement of principles may make different provision in relation to different kinds of regulated services.

(6) OFCOM must publish such a statement of principles (and any revised or replacement statement).

(7) As soon as reasonably practicable after the end of each charging year, OFCOM must publish a statement setting out, in respect of that year—

(a) the aggregate amount of the fees payable under section 84 for that year that has been received by OFCOM,

(b) the aggregate amount of the fees payable under that section for that year that remains outstanding and is likely to be paid or recovered, and

(8) Any deficit or surplus shown (after applying this subsection for all previous years) by a statement under subsection (7) must be carried forward and taken into account in determining what is required to satisfy the requirement imposed by virtue of subsection (2)(a) in relation to the following year.

(9) For the purposes of this section OFCOM’s costs of the exercise of their online safety functions during a charging year include the costs of preparations for the exercise of their online safety functions incurred during that year.

Recovery of OFCOM’s initial costs

89

Schedule 10 makes provision about fees chargeable to providers of regulated services in connection with OFCOM’s recovery of costs incurred before the first day of the initial charging year.

Meaning of “charging year” and “initial charging year”

90

In this Part—

“charging year” means any period of 12 months beginning with 1 April, except such a period that falls before the initial charging year;

“initial charging year” means the period of 12 months beginning with 1 April specified by OFCOM in a notice published for the purposes of this Part.

PART 7 — OFCOM's powers and duties in relation to regulated services

CHAPTER 1 — General duties

General duties of OFCOM under section 3 of the Communications Act

91

(1) Section 3 of the Communications Act (general duties of OFCOM) is amended in accordance with subsections (2) to (8).

(2) In subsection (2), after paragraph (f) insert—

(g) the adequate protection of citizens from harm presented by content on regulated services, through the appropriate use by providers of such services of systems and processes designed to reduce the risk of such harm.

(3) In subsection (4)(c), at the beginning insert “(subject to subsection (5A))”.

(4) After subsection (4) insert—

(4A) In performing their duties under subsection (1) in relation to matters to which subsection (2)(g) is relevant, OFCOM must have regard to such of the following as appear to them to be relevant in the circumstances— (a) the risk of harm to citizens presented by regulated services; (b) the need for a higher level of protection for children than for adults; (c) the need for it to be clear to providers of regulated services how they may comply with their duties set out in Chapter 2, 3, 4 or 5 of Part 3, Chapter 1, 3 or 4 of Part 4, or Part 5 of the Online Safety Act 2023; (d) the need to exercise their functions so as to secure that providers of regulated services may comply with such duties by taking measures, or using measures, systems or processes, which are (where relevant) proportionate to— (i) the size or capacity of the provider in question, and (ii) the level of risk of harm presented by the service in question, and the severity of the potential harm; (e) the desirability of promoting the use by providers of regulated services of technologies which are designed to reduce the risk of harm to citizens presented by content on regulated services; (f) the extent to which providers of regulated services demonstrate, in a way that is transparent and accountable, that they are complying with their duties set out in Chapter 2, 3, 4 or 5 of Part 3, Chapter 1, 3 or 4 of Part 4, or Part 5 of the Online Safety Act 2023.

(5) After subsection (5) insert—

(5A) Subsection (4)(c) does not apply in relation to the carrying out of any of OFCOM’s online safety functions.

(6) After subsection (6) insert—

(6ZA) Where it appears to OFCOM, in relation to the carrying out of any of their online safety functions, that any of their general duties conflict with their duty under section 24, priority must be given to their duty under that section.

(7) In subsection (14), at the appropriate places insert—

“content on regulated services” means— regulated user-generated content present on regulated services, search content of regulated services, fraudulent advertisements present on regulated services, and regulated provider pornographic content present on regulated services;

;

“online safety functions” has the meaning given by section 235 of the Online Safety Act 2023, except that it does not include OFCOM’s general duties;

(8) After subsection (14) insert—

(15) In this section the following terms have the same meaning as in the Online Safety Act 2023— - “content” (see section 236 of that Act); - “fraudulent advertisement” (see sections 38 and 39 of that Act); - “harm” (see section 234 of that Act); - “provider”, in relation to a regulated service (see section 226 of that Act); - “regulated user-generated content” (see section 55 of that Act); - “regulated provider pornographic content” (see section 79 of that Act); - “regulated service” (see section 4 of that Act); - “search content” (see section 57 of that Act).

(9) In section 6 of the Communications Act (duties to review regulatory burdens)—

(a) in subsection (2), after “this section” insert “(except their online safety functions)”, and

(b) after subsection (10) insert—

(11) In this section “online safety functions” has the same meaning as in section 3.

Duties in relation to strategic priorities

92

(1) This section applies where a statement has been designated under section 172(1) (Secretary of State’s statement of strategic priorities).

(2) OFCOM must have regard to the statement when carrying out their online safety functions.

(3) Within the period of 40 days beginning with the day on which the statement is designated, or such longer period as the Secretary of State may allow, OFCOM must—

(a) explain in writing what they propose to do in consequence of the statement, and

(b) publish a copy of that explanation.

(4) OFCOM must, as soon as reasonably practicable after the end of—

(a) the period of 12 months beginning with the day on which the first statement is designated under section 172(1), and

(b) every subsequent period of 12 months,

publish a review of what they have done during the period in question in consequence of the statement.

Duty to carry out impact assessments

93

(1) Section 7 of the Communications Act (duty to carry out impact assessments) is amended as follows.

(2) In subsection (2), at the beginning insert “Subject to subsection (2A),”.

(3) After subsection (2) insert—

(2A) A proposal to do any of the following is important for the purposes of this section— (a) to prepare a code of practice under section 41 of the Online Safety Act 2023; (b) to prepare amendments of such a code of practice; or (c) to prepare a code of practice as a replacement for such a code of practice.

(4) After subsection (4) insert—

(4A) An assessment under subsection (3)(a) that relates to a proposal mentioned in subsection (2A) must include an assessment of the likely impact of implementing the proposal on small businesses and micro businesses. (4B) An assessment under subsection (3)(a) that relates to a proposal to do anything else for the purposes of, or in connection with, the carrying out of OFCOM’s online safety functions (within the meaning of section 235 of the Online Safety Act 2023) must, so far as the proposal relates to such functions, include an assessment of the likely impact of implementing the proposal on small businesses and micro businesses.

CHAPTER 2 — Register of categories of regulated user-to-user services and regulated search services

Meaning of threshold conditions etc

94

(1) Schedule 11 contains provision about regulations specifying the threshold conditions that a Part 3 service must meet to be included in the relevant part of the register established by OFCOM under section 95, and associated provision about the publication of OFCOM’s advice.

(2) In this Chapter, “Category 1 threshold conditions”, “Category 2A threshold conditions” and “Category 2B threshold conditions” have the same meaning as in Schedule 11 (see paragraph 1(1), (2) and (3) of that Schedule).

(3) For the purposes of this Chapter—

(a) references to a service meeting the Category 1, Category 2A or Category 2B threshold conditions are to a service meeting those conditions in a way specified in regulations under paragraph 1 of Schedule 11 (see paragraph 1(4) of that Schedule);

(b) a regulated user-to-user service meets the Category 1 threshold conditions if those conditions are met in relation to the user-to-user part of the service;

(c) a regulated search service or a combined service meets the Category 2A threshold conditions if those conditions are met in relation to the search engine of the service;

(d) a regulated user-to-user service meets the Category 2B threshold conditions if those conditions are met in relation to the user-to-user part of the service;

(e) a regulated user-to-user service meets the conditions in section 97(2) if those conditions are met in relation to the user-to-user part of the service;

(f) references to OFCOM assessing a service (to determine if it meets, or no longer meets, the relevant threshold conditions or the conditions in section 97(2)) are accordingly to be read as references to OFCOM assessing the relevant part (or parts) of a service.

Register of categories of certain Part 3 services

95

(1) As soon as reasonably practicable after the first regulations under Schedule 11 come into force, OFCOM must comply with subsections (2) to (4).

(2) OFCOM must establish a register of particular categories of Part 3 services with—

(a) one part for regulated user-to-user services meeting the Category 1 threshold conditions,

(b) one part for regulated search services and combined services meeting the Category 2A threshold conditions, and

(3) OFCOM must assess Part 3 services, as follows—

(a) OFCOM must assess each regulated user-to-user service which they consider is likely to meet the Category 1 threshold conditions, to determine whether the service does, or does not, meet those conditions;

(b) OFCOM must assess each regulated search service and combined service which they consider is likely to meet the Category 2A threshold conditions, to determine whether the service does, or does not, meet those conditions;

(c) OFCOM must assess each regulated user-to-user service which they consider is likely to meet the Category 2B threshold conditions, to determine whether the service does, or does not, meet those conditions.

(4) If OFCOM consider that a service meets the relevant threshold conditions, they must add entries relating to that service to the relevant part of the register established under subsection (2).

(5) But—

(a) if OFCOM consider that a regulated user-to-user service meets the Category 1 threshold conditions and the Category 2B threshold conditions (only), entries relating to that service are to be added to the part of the register established under subsection (2)(a) (only);

(b) if OFCOM consider that a combined service meets the Category 1 threshold conditions, the Category 2A threshold conditions and the Category 2B threshold conditions, entries relating to that service are to be added to the parts of the register established under subsection (2)(a) and (b) (only).

(6) If OFCOM consider that a combined service—

(a) meets the Category 2A threshold conditions, and

(b) meets either the Category 1 threshold conditions or the Category 2B threshold conditions (but not both),

entries relating to that service are to be added to the part of the register established under subsection (2)(b) and to the part of the register established under subsection (2)(a) or (c) (whichever applies).

(7) Each part of the register must contain—

(a) the name, and a description, of each service that, in OFCOM’s opinion, meets the relevant threshold conditions, and

(b) the name of the provider of each such service.

(8) OFCOM must publish the register.

(9) When assessing whether a Part 3 service does, or does not, meet the relevant threshold conditions, OFCOM must take such steps as are reasonably practicable to obtain or generate information or evidence for the purposes of the assessment.

(10) In this Act—

(a) a “Category 1 service” means a regulated user-to-user service for the time being included in the part of the register established under subsection (2)(a);

(b) a “Category 2A service” means a regulated search service or a combined service for the time being included in the part of the register established under subsection (2)(b);

(c) a “Category 2B service” means a regulated user-to-user service for the time being included in the part of the register established under subsection (2)(c).

Penalties for information offences

96

(1) If regulations are made under paragraph 1(1) of Schedule 11 which amend or replace regulations previously made under that provision, OFCOM must, as soon as reasonably practicable after the date on which the amending or replacement regulations come into force—

(a) assess each regulated user-to-user service which they consider is likely to meet the new Category 1 threshold conditions, to determine whether the service does, or does not, meet those conditions, and

(b) make any necessary changes to the register.

(2) If regulations are made under paragraph 1(2) of Schedule 11 which amend or replace regulations previously made under that provision, OFCOM must, as soon as reasonably practicable after the date on which the amending or replacement regulations come into force—

(a) assess each regulated search service and combined service which they consider is likely to meet the new Category 2A threshold conditions, to determine whether the service does, or does not, meet those conditions, and

(b) make any necessary changes to the register.

(3) If regulations are made under paragraph 1(3) of Schedule 11 which amend or replace regulations previously made under that provision, OFCOM must, as soon as reasonably practicable after the date on which the amending or replacement regulations come into force—

(a) assess each regulated user-to-user service which they consider is likely to meet the new Category 2B threshold conditions, to determine whether the service does, or does not, meet those conditions, and

(b) make any necessary changes to the register.

(4) At any other time, if OFCOM consider that a Part 3 service not included in a particular part of the register is likely to meet the threshold conditions relevant to that part, OFCOM must—

(a) assess the service accordingly, and

(b) (subject to section 95(5)) if they consider that the service meets the relevant conditions, add entries relating to that service to that part of the register.

(5) Nothing in subsection (3) or (4) requires OFCOM to assess a Category 1 service to determine whether the service meets the Category 2B threshold conditions.

(6) A provider of a Part 3 service included in the register may at any time request OFCOM to remove entries relating to that service from the register, or from a particular part of the register.

(7) If OFCOM are satisfied, on the basis of evidence submitted by a provider with such a request, that since the registration day there has been a change to the service or to regulations under paragraph 1 of Schedule 11 which appears likely to be relevant, OFCOM must—

(a) assess the service, and

(b) notify the provider of OFCOM’s decision.

(8) OFCOM must remove entries relating to a Part 3 service from the relevant part of the register if, following an assessment of the service, they consider that it no longer meets the threshold conditions relevant to that part.

(9) Section 95(9) applies to an assessment under this section as it applies to an assessment under section 95.

(10) OFCOM must re-publish the register each time a change is made to it.

(11) See section 167 for provision about appeals against a decision to include a service in the register (or in a particular part of the register), or not to remove a service from the register (or from a particular part of the register).

(12) In this section—

“the register” means the register established under section 95;

“the registration day”, in relation to a Part 3 service, means— the day on which entries relating to the service were added to the register, or to the particular part of the register in question, or if later, the day on which OFCOM last completed an assessment of the service under subsection (1), (2), (3) or (7).

List of emerging Category 1 services

97

(1) As soon as reasonably practicable after the first regulations under paragraph 1(1) of Schedule 11 come into force (regulations specifying Category 1 threshold conditions), OFCOM must comply with subsections (2) and (3).

(2) OFCOM must assess each regulated user-to-user service which does not meet the Category 1 threshold conditions and which they consider is likely to meet each of the following conditions, to determine whether the service does, or does not, meet them—

(a) the first condition is that the number of United Kingdom users of the user-to-user part of the service is at least 75% of the figure specified in any of the Category 1 threshold conditions relating to number of users (calculating the number of users in accordance with the threshold condition in question);

(b) the second condition is that—

(i) at least one of the Category 1 threshold conditions relating to functionalities of the user-to-user part of the service is met, or

(ii) if the regulations under paragraph 1(1) of Schedule 11 specify that a Category 1 threshold condition relating to a functionality of the user-to-user part of the service must be met in combination with a Category 1 threshold condition relating to another characteristic of that part of the service or a factor relating to that part of the service (see paragraph 1(4) of Schedule 11), at least one of those combinations of conditions is met.

(3) OFCOM must prepare a list of regulated user-to-user services which meet the conditions in subsection (2).

(4) If the regulations under paragraph 1(1) of Schedule 11 specify that a service meets the Category 1 threshold conditions if any one condition about number of users or functionality is met (as mentioned in paragraph 1(4)(a) of that Schedule)—

(a) subsection (2) applies as if paragraph (b) were omitted, and

(b) subsections (3) and (8) apply as if the reference to the conditions in subsection (2) were to the condition in subsection (2)(a).

(5) The list must contain the following details about a service included in it—

(a) the name of the service,

(b) a description of the service,

(d) a description of the Category 1 threshold conditions by reference to which the conditions in subsection (2) are met.

(6) OFCOM must take appropriate steps to keep the list up to date, including by carrying out further assessments of regulated user-to-user services.

(7) OFCOM must publish the list when it is first prepared and each time it is revised.

(8) When assessing whether a service does, or does not, meet the conditions in subsection (2), OFCOM must take such steps as are reasonably practicable to obtain or generate information or evidence for the purposes of the assessment.

(9) An assessment for the purposes of this section may be included in an assessment under section 95 or 96 (as the case may be) or carried out separately.

CHAPTER 3 — Risk assessments of regulated user-to-user services and regulated search services

OFCOM’s register of risks, and risk profiles, of Part 3 services

98

(1) OFCOM must carry out risk assessments to identify and assess the following risks of harm presented by Part 3 services of different kinds—

(a) the risks of harm to individuals in the United Kingdom presented by illegal content present on regulated user-to-user services and by the use of such services for the commission or facilitation of priority offences;

(b) the risk of harm to individuals in the United Kingdom presented by search content of regulated search services that is illegal content;

(c) the risk of harm to children in the United Kingdom, in different age groups, presented by content that is harmful to children.

(2) The risk assessments must, among other things, identify characteristics of different kinds of Part 3 services that are relevant to such risks of harm, and assess the impact of those kinds of characteristics on such risks.

(3) OFCOM—

(a) may combine assessment of any or all of the risks of harm mentioned in subsection (1), or may carry out separate assessments of those risks;

(b) in the case of the risk of harm mentioned in subsection (1)(c), may assess regulated user-to-user services and regulated search services separately or together.

(4) The findings of each risk assessment are to be reflected, as soon as reasonably practicable after completion, in a register of risks of Part 3 services prepared and published by OFCOM.

(5) As soon as reasonably practicable after completing their assessment of a risk of harm mentioned in a particular paragraph of subsection (1), OFCOM must prepare risk profiles for Part 3 services which relate to that risk of harm.

(6) For the purposes of the risk profiles, OFCOM may group Part 3 services together in whichever way they consider appropriate, taking into account—

(a) the characteristics of the services, and

(b) the risk levels and other matters identified in the relevant risk assessment.

(7) OFCOM must publish risk profiles prepared under this section.

(8) OFCOM must from time to time review and revise the risk assessments and risk profiles so as to keep them up to date.

(9) References in this section to Part 3 services—

(a) in the case of a risk assessment or risk profiles which relate only to regulated user-to-user services or to regulated search services, are to be read as references to the kind of service in question;

(b) in the case of a risk assessment or risk profiles which relate only to the risk of harm mentioned in subsection (1)(a), are to be read as references to regulated user-to-user services;

(c) in the case of a risk assessment or risk profiles which relate only to the risk of harm mentioned in subsection (1)(b), are to be read as references to regulated search services.

(10) References in this section to regulated search services include references to the search engine of combined services.

(11) In this section the “characteristics” of a service include its functionalities, user base, business model, governance and other systems and processes.

(12) In this section—

“content that is harmful to children” has the same meaning as in Part 3 (see section 60);

“illegal content” has the same meaning as in Part 3 (see section 59);

“priority offence” has the same meaning as in Part 3 (see section 59).

Confirmation decisions: requirements to take steps

99

(1) As soon as reasonably practicable after OFCOM have published the first risk profiles relating to the illegality risks, OFCOM must produce guidance to assist providers of regulated user-to-user services in complying with their duties to carry out illegal content risk assessments under section 9.

(2) As soon as reasonably practicable after OFCOM have published the first risk profiles relating to the risk of harm from illegal content, OFCOM must produce guidance to assist providers of regulated search services in complying with their duties to carry out illegal content risk assessments under section 26.

(3) As soon as reasonably practicable after OFCOM have published the first risk profiles relating to the risk of harm to children, OFCOM must produce guidance to assist providers of Part 3 services in complying with their duties to carry out children’s risk assessments under section 11 or 28.

(4) Before producing any guidance under this section (including revised or replacement guidance), OFCOM must consult the Information Commissioner.

(5) OFCOM must revise guidance under this section from time to time in response to further risk assessments under section 98 or to revisions of the risk profiles.

(6) OFCOM must publish guidance under this section (and any revised or replacement guidance).

(7) If the risk profiles mentioned in subsection (3) relate to regulated user-to-user services only or to regulated search services only, that subsection is to be read as requiring the production of guidance relating only to regulated user-to-user services or to regulated search services, as the case may be.

(8) References in this section to regulated search services include references to the search engine of combined services.

(9) In this section—

“illegality risks” means the risks mentioned in section 98(1)(a);

“risk of harm from illegal content” means the risk of harm mentioned in section 98(1)(b);

“risk of harm to children” means the risk of harm mentioned in section 98(1)(c);

“risk profiles” means risk profiles prepared under section 98.

CHAPTER 4 — Information

Information powers and information notices

Power to require information

100

(1) OFCOM may by notice under this subsection require a person within subsection (5) to provide them with any information that they require for the purpose of exercising, or deciding whether to exercise, any of their online safety functions.

(2) The power conferred by subsection (1) includes power to require a person within subsection (5) to—

(a) obtain or generate information;

(b) provide information about the use of a service by a named individual.

(3) The power conferred by subsection (1) also includes power to require a person within any of paragraphs (a) to (d) of subsection (5) to take steps so that a person authorised by OFCOM is able to view remotely—

(a) information demonstrating in real time the operation of systems, processes or features, including functionalities and algorithms, used by a service;

(b) information generated by a service in real time by the performance of a test or demonstration of a kind required by a notice under subsection (1).

(4) But the power conferred by subsection (1) must be exercised in a way that is proportionate to the use to which the information is to be put in the exercise of OFCOM’s functions.

(5) The persons within this subsection are—

(a) a provider of a user-to-user service or a search service,

(b) a provider of an internet service on which regulated provider pornographic content is published or displayed,

(c) a person who provides an ancillary service (within the meaning of section 144) in relation to a regulated service (see subsections (11) and (12) of that section),

(d) a person who provides an access facility (within the meaning of section 146) in relation to a regulated service (see subsections (10) and (11) of that section),

(e) a person who was within any of paragraphs (a) to (d) at a time to which the required information relates, and

(f) a person not within any of paragraphs (a) to (e) who appears to OFCOM to have, or to be able to generate or obtain, information required by them as mentioned in subsection (1).

(6) The information that may be required by OFCOM under subsection (1) includes, in particular, information that they require for any one or more of the following purposes—

(a) the purpose of assessing compliance with—

(i) any duty or requirement set out in Chapter 2, 3, 4 or 5 of Part 3,

(ii) any duty set out in section 64 (user identity verification),

(iii) any requirement under section 66 (reporting CSEA content),

(iv) any duty set out in section 71 or 72 (terms of service),

(v) any duty set out in section 75 (deceased child users),

(vi) any requirement relating to transparency reporting (see section 77(3) and (4)), or

(vii) any duty set out in section 81 (provider pornographic content);

(b) the purpose of assessing compliance with a requirement under section 83 (duty to notify OFCOM in relation to the charging of fees);

(c) the purpose of a consultation about a threshold figure as mentioned in section 86 (threshold figure for the purposes of charging fees);

(d) the purpose of ascertaining the amount of a person’s qualifying worldwide revenue for the purposes of—

(i) Part 6 (fees), or

(ii) paragraph 4 or 5 of Schedule 13 (amount of penalties etc);

(e) the purpose of assessing compliance with any requirements imposed on a person by—

(i) a notice under section 121(1) (notices to deal with terrorism content and CSEA content), or

(ii) a confirmation decision;

(f) the purpose of assessing the accuracy and effectiveness of technology required to be used by—

(i) a notice under section 121(1), or

(ii) a confirmation decision;

(g) the purpose of assessing whether to give a notice under section 121(1) relating to the development or sourcing of technology (see subsections (2)(b) and (3)(b) of that section);

(h) the purpose of dealing with complaints made to OFCOM under section 169 (super-complaints);

(i) the purpose of OFCOM’s advice to the Secretary of State about provision to be made by regulations under paragraph 1 of Schedule 11 (threshold conditions for categories of Part 3 services);

(j) the purpose of determining whether a Part 3 service meets threshold conditions specified in regulations under paragraph 1 of Schedule 11;

(k) the purpose of preparing a code of practice under section 41;

(l) the purpose of preparing guidance in relation to online safety matters;

(m) the purpose of carrying out research, or preparing a report, in relation to online safety matters;

(n) the purpose of complying with OFCOM’s duties under section 11 of the Communications Act, so far as relating to regulated services (media literacy).

(7) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(8) The reference in subsection (3) to a person authorised by OFCOM is to a person authorised by OFCOM in writing for the purposes of notices that impose requirements of a kind mentioned in that subsection, and such a person must produce evidence of their identity if requested to do so by a person in receipt of such a notice.

(8A) The power to give a notice conferred by subsection (1) does not include power to require processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, the duty imposed by the notice is to be taken into account).

(9) The power conferred by subsection (1) does not include power to require the provision of information in respect of which a claim to legal professional privilege, or (in Scotland) to confidentiality of communications, could be maintained in legal proceedings.

(10) In this section—

“information” includes documents, and any reference to providing information includes a reference to producing a document (and see also section 102(11));

“regulated provider pornographic content” and “published or displayed” have the same meaning as in Part 5 (see section 79).

Information in connection with an investigation into the death of a child

101

(A1) Subsection (C1) applies if a senior coroner (in England and Wales), a procurator fiscal (in Scotland) or a coroner (in Northern Ireland) (“the investigating authority”)—

(a) notifies OFCOM that they are conducting an investigation in connection with the death of a child, and

(b) provides OFCOM with the details in subsection (B1).

(B1) The details are—

(a) the name of the child who has died,

(b) the child’s date of birth,

(d) if any regulated service has been brought to the attention of the investigating authority as being of interest in connection with the child’s death, the name of the service.

(C1) Where this subsection applies, OFCOM—

(a) must give a notice to the provider of a service within subsection (E1) requiring the provider to ensure the retention of information relating to the use of the service by the child who has died, and

(b) may give a notice to any other relevant person requiring the person to ensure the retention of information relating to the use of a service within subsection (E1) by that child.

(D1) The references in subsection (C1) to ensuring the retention of information relating to the child’s use of a service include taking all reasonable steps, without delay, to prevent the deletion of such information by the routine operation of systems or processes.

(E1) A service is within this subsection if it is—

(a) a regulated service of a kind described in regulations made by the Secretary of State, or

(b) a regulated service notified to OFCOM by the investigating authority as described in subsection (B1)(d).

(F1) A notice under subsection (C1) may require information described in that subsection to be retained only if it is information—

(a) of a kind which OFCOM have power to require under a notice under subsection (1) (see, in particular, subsection (2)(a) to (d)), or

(b) which a person might need to retain to enable the person to provide information in response to a notice under subsection (1) (if such a notice were given).

(G1) OFCOM must share with the investigating authority any information they receive in response to requirements mentioned in section 102(5A)(d) that are included in a notice under subsection (C1).

(1) OFCOM may by notice under this subsection require a relevant person to provide them with information for the purpose of—

(a) responding to a notice given by a senior coroner under paragraph 1(2) of Schedule 5 to the Coroners and Justice Act 2009 in connection with an investigation into the death of a child, or preparing a report under section 163 in connection with such an investigation;

(b) responding to a request for information in connection with the investigation of a procurator fiscal into, or an inquiry held or to be held in relation to, the death of a child, or preparing a report under section 163 in connection with such an inquiry;

(c) responding to a notice given by a coroner under section 17A(2) of the Coroners Act (Northern Ireland) 1959 (c. 15 (N.I.)) in connection with—

(i) an investigation to determine whether an inquest into the death of a child is necessary, or

(ii) an inquest in relation to the death of a child,

or preparing a report under section 163 in connection with such an investigation or inquest.

(2) The power conferred by subsection (1) includes power to require a relevant person to provide OFCOM with information about the use of a regulated service by the child whose death is under investigation, including, in particular—

(a) content encountered by the child by means of the service,

(b) how the content came to be encountered by the child (including the role of algorithms or particular functionalities),

(c) how the child interacted with the content (for example, by viewing, sharing or storing it or enlarging or pausing on it), and

(d) content generated, uploaded or shared by the child.

(3) The powers conferred by this section include power to require a relevant person to obtain or generate information.

(4) The power conferred by subsection (1) must be exercised in a way that is proportionate to the purpose mentioned in that subsection.

(5) The power conferred by subsection (1) does not include power to require the provision of information in respect of which a claim to legal professional privilege, or (in Scotland) to confidentiality of communications, could be maintained in legal proceedings.

(5A) The powers to give a notice conferred by this section do not include power to require processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, the duty imposed by the notice is to be taken into account).

(6) Nothing in this section limits the power conferred on OFCOM by section 100.

(7) In this section—

“information” includes documents, and any reference to providing information includes a reference to producing a document (and see also section 102(11));

“inquiry” means an inquiry held, or to be held, under the Inquiries into Fatal Accidents and Sudden Deaths etc. (Scotland) Act 2016 (asp 2);

“relevant person” means a person within any of paragraphs (a) to (e) of section 100(5).

OFCOM’s annual report

102

(1) A notice given under section 100(1) or 101(C1) or (1) is referred to in this Act as an information notice.

(2) An information notice may require information in any form (including in electronic form).

(3) An information notice under section 100(1) or 101(1) must—

(a) specify or describe the information to be provided,

(b) specify why OFCOM require the information,

(ca) specify when the information must be provided (which may be on or by a specified date, within a specified period, or at specified intervals), and

(d) contain information about the consequences of not complying with the notice.

(4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(5) An information notice requiring a person to take steps of a kind mentioned in section 100(3) must give the person at least seven days’ notice before the steps are required to be taken.

(5A) An information notice under section 101(C1) must—

(a) specify or describe the information to be retained,

(b) specify why OFCOM require the information to be retained,

(d) require the person to whom the notice is given—

(i) if the child to whom the notice relates used the service in question, to notify OFCOM by a specified date of steps taken to ensure the retention of information;

(ii) if the child did not use the service, or the person does not hold any information of the kind required, to notify OFCOM of that fact by a specified date, and

(e) contain information about the consequences of not complying with the notice.

(5B) If OFCOM give an information notice to a person under section 101(C1), they may, in response to information received from the investigating authority, extend the period for which the person is required to retain information by a maximum period of six months.

(5C) The power conferred by subsection (5B) is exercisable—

(a) by giving the person a notice varying the notice under section 101(C1) and stating the further period for which information must be retained and the reason for the extension;

(b) any number of times.

(6) An information notice may specify a place at which, and a person to whom, information is to be provided.

(7) A person to whom a document is produced in response to an information notice may—

(a) take copies of, or extracts from, the document;

(b) require the person producing the document, or a person who is or was an officer of that person, or (in the case of a partnership) a person who is or was a partner, to give an explanation of it.

(8) A person to whom an information notice is given has a duty—

(a) to act in accordance with the requirements of the notice, and

(b) to ensure that the information provided is accurate in all material respects.

(9) OFCOM may cancel an information notice by notice to the person to whom it was given.

(9A) OFCOM must cancel an information notice under section 101(C1) by notice to the person to whom it was given if advised by the investigating authority that the information in question no longer needs to be retained.

(10) In this section—

“information” includes documents, and any reference to providing information includes a reference to producing a document;

“the investigating authority” has the same meaning as in section 101;

“officer”, in relation to an entity, includes a director, a manager, an associate, a secretary or, where the affairs of the entity are managed by its members, a member.

(11) In relation to information recorded otherwise than in a legible form, references in this section to producing a document are to producing a copy of the information—

(a) in a legible form, or

(b) in a form from which it can readily be produced in a legible form.

Requirement to name a senior manager

103

(1) This section applies where—

(a) OFCOM give a provider of a regulated service an information notice, and

(b) the provider is an entity.

(2) OFCOM may include in the information notice a requirement that the provider must name, in their response to the notice, an individual who the provider considers to be a senior manager of the entity and who may reasonably be expected to be in a position to ensure compliance with the requirements of the notice.

(3) If OFCOM impose a requirement to name an individual, the information notice must—

(a) require the provider to inform such an individual, and

(b) include information about the consequences for such an individual of the entity’s failure to comply with the requirements of the notice (see section 110).

(4) An individual is a “senior manager” of an entity if the individual plays a significant role in—

(a) the making of decisions about how the entity’s relevant activities are to be managed or organised, or

(b) the actual managing or organising of the entity’s relevant activities.

(5) An entity’s “relevant activities” are activities relating to the entity’s compliance with the regulatory requirements imposed by this Act in connection with the regulated service to which the information notice in question relates.

Skilled persons' reports

Reports by skilled persons

104

(1) OFCOM may exercise the powers in this section where they consider that it is necessary to do so for either of the following purposes—

(a) assisting OFCOM in identifying and assessing a failure, or possible failure, by a provider of a regulated service to comply with a relevant requirement, or

(b) developing OFCOM’s understanding of—

(i) the nature and level of risk of a provider of a regulated service failing to comply with a relevant requirement, and

(ii) ways to mitigate such a risk.

(2) But the powers in this section may be exercised for a purpose mentioned in subsection (1)(b) only where OFCOM consider that the provider in question may be at risk of failing to comply with a relevant requirement.

(3) Section 122 requires OFCOM to exercise the power in subsection (4) for the purpose of assisting OFCOM in connection with a notice under section 121(1).

Reading this document does not replace reading the official text published on legislation.gov.uk. Contains public sector information licensed under the Open Government Licence v3.0. We assume no responsibility for any inaccuracies arising from the conversion of the original CLML XML to this format.

This text is published under legislation.gov.uk's own terms of reuse, not a Legalize or public-domain licence. legislation.gov.uk
Open Government Licence v3.0 (attribution required)
© Crown and database right. Derived from content available under the Open Government Licence v3.0 from legislation.gov.uk.