Legalize / United Kingdom / Public General Act

Online Safety Act 2023

Type Public General Act

Publication 2023-10-26

Last updated 2026-04-07

State In force

Department Statute Law Database

Source legislation.gov.uk

articles Not indexed

Reform history JSON API

(4) OFCOM may appoint a skilled person to provide them with a report about matters relevant to the purpose for which the powers under this section are exercised (“the relevant matters”), and, where OFCOM make such an appointment, they must notify the provider about the appointment and the relevant matters to be explored in the report.

(5) Alternatively, OFCOM may give a notice to the provider—

(a) requiring the provider to appoint a skilled person to provide OFCOM with a report in such form as may be specified in the notice, and

(b) specifying the relevant matters to be explored in the report.

(6) References in this section to a skilled person are to a person—

(a) appearing to OFCOM to have the skills necessary to prepare a report about the relevant matters, and

(b) where the appointment is to be made by the provider, nominated or approved by OFCOM.

(7) It is the duty of—

(a) the provider of the service (“P”),

(b) any person who works for (or used to work for) P, or is providing (or used to provide) services to P related to the relevant matters, and

to give the skilled person all such assistance as the skilled person may reasonably require to prepare the report.

(8) The provider of the service is liable for the payment, directly to the skilled person, of the skilled person’s remuneration and expenses relating to the preparation of the report.

(9) Subsections (10) to (12) apply in relation to an amount due to a skilled person under subsection (8).

(10) In England and Wales, such an amount is recoverable—

(a) if the county court so orders, as if it were payable under an order of that court;

(b) if the High Court so orders, as if it were payable under an order of that court.

(11) In Scotland, such an amount may be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution issued by the sheriff court of any sheriffdom in Scotland.

(12) In Northern Ireland, such an amount is recoverable—

(a) if a county court so orders, as if it were payable under an order of that court;

(b) if the High Court so orders, as if it were payable under an order of that court.

(13) In this section “relevant requirement” means—

(a) a duty or requirement set out in any of the following—

(i) section 9, 11, 26 or 28 (risk assessments);

(ii) section 10 or 27 (illegal content);

(iii) section 12 or 29 (children’s online safety);

(iv) section 14 (assessments related to the adult user empowerment duty set out in section 15(2));

(v) section 15 (user empowerment);

(vi) section 20 or 31 (content reporting);

(vii) section 21 or 32 (complaints procedures);

(viii) section 23 or 34 (record-keeping and review);

(ix) section 36 (children’s access assessments);

(x) section 38 or 39 (fraudulent advertising);

(xi) section 64 (user identity verification);

(xii) section 66 (reporting CSEA content);

(xiii) section 71 or 72 (terms of service);

(xiv) section 75 (deceased child users);

(xv) section 77(3) or (4) (transparency reports);

(xvi) section 81(2) (children’s access to pornographic content);

(b) a requirement under section 83 to notify OFCOM in connection with the charging of fees (see subsections (1), (3) and (5) of that section); or

Investigations and interviews

Investigations

105

(1) If OFCOM open an investigation into whether a provider of a regulated service has failed, or is failing, to comply with any requirement mentioned in subsection (2), the provider must co-operate fully with the investigation.

(2) The requirements are—

(a) a requirement imposed by a notice under section 121(1) (notices to deal with terrorism content and CSEA content), and

(b) an enforceable requirement as defined in section 131 (except the requirement in subsection (1) of this section).

Power to require interviews

106

(1) The power conferred by this section is exercisable by OFCOM for the purposes of an investigation that they are carrying out into the failure, or possible failure, of a provider of a regulated service to comply with a relevant requirement.

(2) OFCOM may give an individual within subsection (4) a notice requiring the individual—

(a) to attend at a time and place specified in the notice, and

(b) to answer questions and provide explanations about any matter relevant to the investigation.

(3) A notice under this section must—

(a) indicate the subject matter and purpose of the interview, and

(b) contain information about the consequences of not complying with the notice.

(4) The individuals within this subsection are—

(a) if the provider of the service is an individual or individuals, that individual or those individuals,

(b) an officer of the provider of the service,

(d) an employee of the provider of the service, and

(e) an individual who was within any of paragraphs (a) to (d) at a time to which the required information or explanation relates.

(5) If OFCOM give a notice to an individual within subsection (4)(b), (c) or (d), they must give a copy of the notice to the provider of the service.

(6) An individual is not required under this section to disclose information in respect of which a claim to legal professional privilege, or (in Scotland) to confidentiality of communications, could be maintained in legal proceedings.

(7) In this section—

“officer”, in relation to an entity, includes a director, a manager, an associate, a secretary or, where the affairs of the entity are managed by its members, a member;

“relevant requirement” has the meaning given by section 104(13).

Powers of entry, inspection and audit

107

Schedule 12 makes provision about—

(a) OFCOM’s powers of entry and inspection, and

(b) the carrying out of audits by OFCOM.

Confirmation decisions: children’s access assessments

108

(1) The Criminal Justice and Police Act 2001 is amended as follows.

(2) In section 57(1) (retention of seized items), after paragraph (t) insert—

(u) paragraph 8 of Schedule 12 to the Online Safety Act 2023.

(3) In section 65 (meaning of “legal privilege”)—

(a) after subsection (8B) insert—

(8C) An item which is, or is comprised in, property which has been seized in exercise or purported exercise of the power of seizure conferred by paragraph 7(f), (j) or (k) of Schedule 12 to the Online Safety Act 2023 is to be taken for the purposes of this Part to be an item subject to legal privilege if, and only if, the seizure of that item was in contravention of paragraph 17(3) of that Schedule (privileged information or documents).

;

(b) in subsection (9)—

(i) at the end of paragraph (d) omit “or”;

(ii) at the end of paragraph (e) insert “or”;

(iii) before the closing words insert—

(g) paragraph 7(f), (j) or (k) of Schedule 12 to the Online Safety Act 2023.

(4) In Part 1 of Schedule 1 (powers of seizure to which section 50 of the Act applies), after paragraph 73U insert—

(73V) Each of the powers of seizure conferred by paragraph 7(f), (j) and (k) of Schedule 12 to the Online Safety Act 2023.

Information offences and penalties

Offences in connection with information notices

109

(1) A person commits an offence if the person fails to comply with a requirement of an information notice.

(2) It is a defence for a person charged with an offence under subsection (1) to show that—

(a) it was not reasonably practicable to comply with the requirements of the information notice at the time required by the notice, but

(b) the person has subsequently taken all of the steps that it was reasonable, and reasonably practicable, to take to comply with those requirements.

(3) A person commits an offence if, in response to an information notice—

(a) the person provides information that is false in a material respect, and

(b) at the time the person provides it, the person knows that it is false in a material respect or is reckless as to whether it is false in a material respect.

(4) A person commits an offence if, in response to an information notice, the person—

(a) provides information which is encrypted such that it is not possible for OFCOM to understand it, or produces a document which is encrypted such that it is not possible for OFCOM to understand the information it contains, and

(b) the person’s intention was to prevent OFCOM from understanding such information.

(5) A person commits an offence if—

(a) the person suppresses, destroys or alters, or causes or permits the suppression, destruction or alteration of, any information required to be provided, or document required to be produced, by an information notice, and

(b) the person’s intention was to prevent OFCOM from being provided with the information or document or (as the case may be) from being provided with it as it was before the alteration.

(6A) A person who is given an information notice under section 101(C1) commits an offence if—

(a) the person deletes or alters, or causes or permits the deletion or alteration of, any information required by the notice to be retained, and

(b) the person’s intention was to prevent the information being available, or (as the case may be) to prevent it being available in unaltered form, for the purposes of any official investigation into the death of the child to whom the notice relates.

(6B) For the purposes of subsection (6A) information has been deleted if it is irrecoverable (however that occurred).

(6) The reference in subsection (5) to suppressing information or a document includes a reference to destroying the means of reproducing information recorded otherwise than in a legible form.

(7) Offences under this section may be committed only in relation to an information notice which—

(a) relates to—

(i) a user-to-user service,

(ii) a search service, or

(iii) an internet service on which regulated provider pornographic content is published or displayed; and

(b) is given to the provider of that service.

(8) If a person is convicted of an offence under this section, the court may, on an application by the prosecutor, make an order requiring the person to comply with a requirement of an information notice within such period as may be specified by the order.

(9) See also section 201 (supplementary provision about defences).

(10) In this section, “regulated provider pornographic content” and “published or displayed” have the same meaning as in Part 5 (see section 79).

Senior managers’ liability: information offences

110

(1) In this section “an individual named as a senior manager of an entity” means an individual who, as required by an information notice, is named as a senior manager of an entity in a response to that notice (see section 103).

(2) An individual named as a senior manager of an entity commits an offence if—

(a) the entity commits an offence under section 109(1) (failure to comply with information notice), and

(b) the individual has failed to take all reasonable steps to prevent that offence being committed.

(3) It is a defence for an individual charged with an offence under subsection (2) to show that the individual was a senior manager within the meaning of section 103 for such a short time after the information notice in question was given that the individual could not reasonably have been expected to take steps to prevent that offence being committed.

(4) An individual named as a senior manager of an entity commits an offence if—

(a) the entity commits an offence under section 109(3) (false information), and

(b) the individual has failed to take all reasonable steps to prevent that offence being committed.

(5) An individual named as a senior manager of an entity commits an offence if—

(a) the entity commits an offence under section 109(4) (encrypted information), and

(b) the individual has failed to take all reasonable steps to prevent that offence being committed.

(6) An individual named as a senior manager of an entity commits an offence if—

(a) the entity commits an offence under section 109(5) (destruction etc of information), and

(b) the individual has failed to take all reasonable steps to prevent that offence being committed.

(6A) An individual named as a senior manager of an entity commits an offence if—

(a) the entity commits an offence under section 109(6A) (deletion etc of information), and

(b) the individual has failed to take all reasonable steps to prevent that offence being committed.

(7) It is a defence for an individual charged with an offence under subsection (4), (5) , (6) or (6A) to show that the individual was not a senior manager within the meaning of section 103 at the time at which the act constituting the offence occurred.

(8) It is a defence for an individual charged with an offence under this section to show that the individual had no knowledge of being named as a senior manager in a response to the information notice in question.

(9) See also section 201 (supplementary provision about defences).

Offences in connection with notices under Schedule 12

111

(1) A person commits an offence if the person fails without reasonable excuse to comply with a requirement of an audit notice.

(2) A person commits an offence if, in response to an audit notice—

(a) the person provides information that is false in a material respect, and

(b) at the time the person provides it, the person knows that it is false in a material respect or is reckless as to whether it is false in a material respect.

(3) A person commits an offence if—

(a) the person suppresses, destroys or alters, or causes or permits the suppression, destruction or alteration of, any information required to be provided, or document required to be produced, by a notice to which this subsection applies, and

(b) the person’s intention was to prevent OFCOM from being provided with the information or document or (as the case may be) from being provided with it as it was before the alteration.

(4) The reference in subsection (3) to suppressing information or a document includes a reference to destroying the means of reproducing information recorded otherwise than in a legible form.

(5) Subsection (3) applies to—

(a) a notice under paragraph 3 of Schedule 12 (information required for inspection), and

(b) an audit notice (see paragraph 4 of that Schedule).

(6) If a person is convicted of an offence under this section, the court may, on an application by the prosecutor, make an order requiring the person, within such period as may be specified by the order, to comply with a requirement of a notice under paragraph 3 of Schedule 12 or an audit notice (as the case may be).

Other information offences

112

(1) A person commits an offence if the person intentionally obstructs or delays a person in the exercise of the power conferred by section 102(7)(a) (copying a document etc).

(2) A person commits an offence if the person fails without reasonable excuse to comply with a requirement under section 106 (interviews).

(3) A person commits an offence if, in purported compliance with a requirement under section 106—

(a) the person provides information that is false in a material respect, and

(b) at the time the person provides it, the person knows that it is false in a material respect or is reckless as to whether it is false in a material respect.

(4) If a person is convicted of an offence under this section, the court may, on an application by the prosecutor, make an order requiring the person, within such period as may be specified by the order, to permit the making of a copy of a document, or to comply with a requirement under section 106 (as the case may be).

Penalties for information offences

113

(1) A person who commits an offence under section 109(1), 110(2) or 111(1) is liable—

(a) on summary conviction in England and Wales, to a fine;

(b) on summary conviction in Scotland or Northern Ireland, to a fine not exceeding the statutory maximum;

(2) A person who commits an offence under section 109(3), (4), (5) or (6A), 110(4), (5), (6) or (6A), 111(2) or (3) or 112(1) is liable—

(a) on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);

(b) on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum (or both);

(c) on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);

(d) on conviction on indictment, to imprisonment for a term not exceeding 2 years or a fine (or both).

(3) A person who commits an offence under section 112(2) or (3) is liable—

(a) on summary conviction in England and Wales, to a fine;

(b) on summary conviction in Scotland, to a fine not exceeding level 5 on the standard scale;

Disclosure of information

Co-operation and disclosure of information: overseas regulators

114

(1) OFCOM may co-operate with an overseas regulator, including by disclosing online safety information to that regulator, for the purposes of—

(a) facilitating the exercise by the overseas regulator of any of that regulator’s online regulatory functions, or

(b) criminal investigations or proceedings relating to a matter to which the overseas regulator’s online regulatory functions relate.

(2) The power conferred by subsection (1) applies only in relation to an overseas regulator for the time being specified in regulations made by the Secretary of State.

(3) Where information is disclosed to a person in reliance on subsection (1), the person may not—

(a) use the information for a purpose other than the purpose for which it was disclosed, or

(b) further disclose the information,

except with OFCOM’s consent (which may be general or specific) or in accordance with an order of a court or tribunal.

(4) Except as provided by subsection (5), a disclosure of information under subsection (1) does not breach—

(a) any obligation of confidence owed by the person making the disclosure, or

(b) any other restriction on the disclosure of information (however imposed).

(5) Subsection (1) does not authorise a disclosure of information that—

(a) would contravene the restriction imposed by section 116 (intelligence service information),

(b) would contravene the data protection legislation (but in determining whether a disclosure would do so, the power conferred by that subsection is to be taken into account), or

(6) Section 18 of the Anti-terrorism, Crime and Security Act 2001 (restriction on disclosure of information for overseas purposes) has effect in relation to a disclosure authorised by subsection (1)(b) as it has effect in relation to a disclosure authorised by any of the provisions to which section 17 of that Act applies.

(7) In this section—

“online regulatory functions”, in relation to an overseas regulator, means functions of that regulator which correspond to OFCOM’s online safety functions;

“online safety information” means information held by OFCOM in connection with any of OFCOM’s online safety functions;

“overseas regulator” means a person exercising functions in a country outside the United Kingdom which correspond to any of OFCOM’s online safety functions;

Disclosure of information

115

(1) Section 393 of the Communications Act (general restrictions on disclosure of information) is amended as follows.

(2) In subsection (1)—

(a) at the end of paragraph (c) omit “or”,

(b) at the end of paragraph (d) insert “or”, and

(e) the Online Safety Act 2023,

(3) In subsection (2)(e), after “this Act” insert “or the Online Safety Act 2023”.

(4) In subsection (3), after paragraph (h) insert—

(ha) a person appointed under— (i) paragraph 1 of Schedule 3 to the Coroners and Justice Act 2009, or (ii) section 2 of the Coroners Act (Northern Ireland) 1959 (c. 15 (N.I.)); (hb) the procurator fiscal, within the meaning of the enactment mentioned in subsection (5)(s);

(5) In subsection (5)—

(a) before paragraph (d) insert—

(ca) the Coroners Act (Northern Ireland) 1959;

(b) after paragraph (na) insert—

(nb) Part 1 of the Coroners and Justice Act 2009;

, and

(s) the Inquiries into Fatal Accidents and Sudden Deaths etc. (Scotland) Act 2016 (asp 2).

(6) In subsection (6)(a), after “390” insert “, or under section 149 of or Schedule 11 to the Online Safety Act 2023”.

(7) In subsection (6)(b), at the end insert “or the Online Safety Act 2023”.

Intelligence service information

116

(1) OFCOM may not disclose information received (directly or indirectly) from, or that relates to, an intelligence service unless the intelligence service consents to the disclosure.

(2) If OFCOM have disclosed information described in subsection (1) to a person, the person must not further disclose the information unless the intelligence service consents to the disclosure.

(3) If OFCOM would contravene subsection (1) by publishing in its entirety—

(a) a statement required to be published by section 47(5), or

(b) a report mentioned in section 164(5),

OFCOM must, before publication, remove or obscure the information which by reason of subsection (1) they must not disclose.

(4) In this section—

“information” means information held by OFCOM in connection with an online safety matter;

“intelligence service” means— the Security Service, the Secret Intelligence Service, or the Government Communications Headquarters.

Provision of information to the Secretary of State

117

(1) Section 24B of the Communications Act (provision of information to assist in formulation of policy) is amended as follows.

(2) In subsection (2)—

(a) at the end of paragraph (d) omit “or”,

(b) at the end of paragraph (e) insert “or”, and

(f) the Online Safety Act 2023,

(3) After subsection (3) insert—

(4) Subsection (2) does not apply to information— (a) obtained by OFCOM— (i) in the exercise of a power conferred by section 100 of the Online Safety Act 2023 for the purpose mentioned in subsection (6)(c) of that section (information in connection with a consultation about a threshold figure for the purposes of charging fees under that Act), or (ii) in the exercise of a power conferred by section 175(5) of that Act (information in connection with circumstances presenting a threat), and (b) reasonably required by the Secretary of State.

Amendment of Enterprise Act 2002

118

In Schedule 15 to the Enterprise Act 2002 (enactments relevant to provisions about disclosure of information), at the appropriate place insert—

Online Safety Act 2023.

Information for users of regulated services

119

(1) Section 26 of the Communications Act (publication of information and advice for consumers etc) is amended as follows.

(2) In subsection (2), after paragraph (d) insert—

(da) United Kingdom users of regulated services;

(3) After subsection (6) insert—

(7) In this section the following terms have the same meaning as in the Online Safety Act 2023— - “regulated service” (see section 4 of that Act); - “United Kingdom user” (see section 227 of that Act).

Admissibility of statements

120

(1) An explanation given, or information provided, by a person in response to a requirement imposed under or by virtue of section 100, 101 or 106 or paragraph 2(4)(e) or (f), 3(2), 4(2)(i) or (j) or 7(d) of Schedule 12, may, in criminal proceedings, only be used in evidence against that person—

(a) on a prosecution for an offence under a provision listed in subsection (2), or

(b) on a prosecution for any other offence where—

(i) in giving evidence that person makes a statement inconsistent with that explanation or information, and

(ii) evidence relating to that explanation or information is adduced, or a question relating to it is asked, by that person or on that person’s behalf.

(2) Those provisions are—

(a) section 69(1),

(b) section 109(3),

(d) section 111(2),

(e) section 112(3),

(f) paragraph 18(1)(c) of Schedule 12,

(g) section 5 of the Perjury Act 1911 (false statements made otherwise than on oath),

(h) section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath), and

(i) Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).

CHAPTER 5 — Regulated user-to-user services and regulated search services: notices to deal with terrorism content and CSEA content

Notices to deal with terrorism content or CSEA content (or both)

121

(1) If OFCOM consider that it is necessary and proportionate to do so, they may give a notice described in subsection (2), (3) or (4) relating to a regulated user-to-user service or a regulated search service to the provider of the service.

(2) A notice under subsection (1) that relates to a regulated user-to-user service is a notice requiring the provider of the service—

(a) to do any or all of the following—

(i) use accredited technology to identify terrorism content communicated publicly by means of the service and to swiftly take down that content;

(ii) use accredited technology to prevent individuals from encountering terrorism content communicated publicly by means of the service;

(iii) use accredited technology to identify CSEA content, whether communicated publicly or privately by means of the service, and to swiftly take down that content;

(iv) use accredited technology to prevent individuals from encountering CSEA content, whether communicated publicly or privately, by means of the service; or

(b) to use the provider’s best endeavours to develop or source technology for use on or in relation to the service or part of the service, which—

(i) achieves the purpose mentioned in paragraph (a)(iii) or (iv), and

(ii) meets the standards published by the Secretary of State (see section 125(13)).

(3) A notice under subsection (1) that relates to a regulated search service is a notice requiring the provider of the service—

(a) to do either or both of the following—

(i) use accredited technology to identify search content of the service that is terrorism content and to swiftly take measures designed to secure, so far as possible, that search content of the service no longer includes terrorism content identified by the technology;

(ii) use accredited technology to identify search content of the service that is CSEA content and to swiftly take measures designed to secure, so far as possible, that search content of the service no longer includes CSEA content identified by the technology; or

(b) to use the provider’s best endeavours to develop or source technology for use on or in relation to the service which—

(i) achieves the purpose mentioned in paragraph (a)(ii), and

(ii) meets the standards published by the Secretary of State (see section 125(13)).

(4) A notice under subsection (1) that relates to a combined service is a notice requiring the provider of the service—

(a) to do any or all of the things described in subsection (2)(a) in relation to the user-to-user part of the service, or to use best endeavours to develop or source technology as described in subsection (2)(b) for use on or in relation to that part of the service;

(b) to do either or both of the things described in subsection (3)(a) in relation to the search engine of the service, or to use best endeavours to develop or source technology as described in subsection (3)(b) for use on or in relation to the search engine of the service;

(c) to do any or all of the things described in subsection (2)(a) in relation to the user-to-user part of the service and either or both of the things described in subsection (3)(a) in relation to the search engine of the service; or

(d) to use best endeavours to develop or source—

(i) technology as described in subsection (2)(b) for use on or in relation to the user-to-user part of the service, and

(ii) technology as described in subsection (3)(b) for use on or in relation to the search engine of the service.

(5) For the purposes of subsections (2) and (3), a requirement to use accredited technology may be complied with by the use of the technology alone or by means of the technology together with the use of human moderators.

(6) See—

(a) section 122, which requires OFCOM to obtain a skilled person’s report before giving a notice under subsection (1),

(b) section 123, which requires OFCOM to give a warning notice before giving a notice under subsection (1), and

(7) A notice under subsection (1) that relates to a user-to-user service (or to the user-to-user part of a combined service) and requires the use of technology in relation to terrorism content must identify the content, or parts of the service that include content, that OFCOM consider is communicated publicly on that service (see section 232).

(8) For the meaning of “accredited” technology, see section 125(12) and (13).

Requirement to obtain skilled person’s report

122

(1) OFCOM may give a notice under section 121(1) to a provider only after obtaining a report from a skilled person appointed by OFCOM under section 104(4).

(2) The purpose of the report is to assist OFCOM in deciding whether to give a notice under section 121(1), and to advise about the requirements that might be imposed by such a notice if it were to be given.

Warning notices

123

(1) OFCOM may give a notice under section 121(1) to a provider relating to a service or part of a service only after giving a warning notice to the provider that they intend to give such a notice relating to that service or that part of it.

(2) A warning notice under subsection (1) relating to the use of accredited technology (see section 121(2)(a) and (3)(a)) must—

(a) contain a summary of the report obtained by OFCOM under section 122,

(b) contain details of the technology that OFCOM are considering requiring the provider to use,

(d) specify any other requirements that OFCOM are considering imposing (see section 125(2) to (4)),

(e) specify the period for which OFCOM are considering imposing the requirements (see section 125(7)),

(f) state that the provider may make representations to OFCOM (with any supporting evidence), and

(g) specify the period within which representations may be made.

(3) A warning notice under subsection (1) relating to the development or sourcing of technology (see section 121(2)(b)and (3)(b)) must—

(a) contain a summary of the report obtained by OFCOM under section 122,

(b) describe the proposed purpose for which the technology must be developed or sourced (see section 121(2)(a)(iii) and (iv) and (3)(a)(ii)),

(c) specify steps that OFCOM consider the provider needs to take in order to comply with the requirement described in section 121(2)(b) or (3)(b), or both those requirements (as the case may be),

(d) specify the proposed period within which the provider must take each of those steps,

(e) specify any other requirements that OFCOM are considering imposing,

(f) state that the provider may make representations to OFCOM (with any supporting evidence), and

(g) specify the period within which representations may be made.

(4) A notice under section 121(1) that relates to both the user-to-user part of a combined service and the search engine of the service (as described in section 121(4)(c) or (d)) may be given to the provider of the service only if—

(a) two separate warning notices have been given to the provider (one relating to the user-to-user part of the service and the other relating to the search engine), or

(b) a single warning notice relating to both the user-to-user part of the service and the search engine has been given to the provider.

(5) A notice under section 121(1) may not be given to a provider until the period allowed by the warning notice for the provider to make representations has expired.

Matters relevant to a decision to give a notice under section 121(1)

124

(1) This section specifies the matters which OFCOM must particularly consider in deciding whether it is necessary and proportionate to give a notice under section 121(1) relating to a Part 3 service to the provider of the service.

(2) In the case of a notice requiring the use of accredited technology, the matters are as follows—

(a) the kind of service it is;

(b) the functionalities of the service;

(d) in the case of a notice relating to a user-to-user service (or to the user-to-user part of a combined service), the prevalence of relevant content on the service, and the extent of its dissemination by means of the service;

(e) in the case of a notice relating to a search service (or to the search engine of a combined service), the prevalence of search content of the service that is relevant content;

(f) the level of risk of harm to individuals in the United Kingdom presented by relevant content, and the severity of that harm;

(g) the systems and processes used by the service which are designed to identify and remove relevant content;

(h) the contents of the skilled person’s report obtained as required by section 122;

(i) the extent to which the use of the specified technology would or might result in interference with users’ right to freedom of expression within the law;

(j) the level of risk of the use of the specified technology resulting in a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of the service (including, but not limited to, any such provision or rule concerning the processing of personal data);

(k) in the case of a notice relating to a user-to-user service (or to the user-to-user part of a combined service), the extent to which the use of the specified technology would or might—

(i) have an adverse impact on the availability of journalistic content on the service, or

(ii) result in a breach of the confidentiality of journalistic sources;

(l) whether the use of any less intrusive measures than the specified technology would be likely to achieve a significant reduction in the amount of relevant content.

(3) The references to relevant content in subsection (2)(f), (g) and (l) are to—

(a) in the case of a user-to-user service (or the user-to-user part of a combined service), relevant content present on the service;

(b) in the case of a search service (or the search engine of a combined service), search content of the service that is relevant content.

(4) In the case of a notice relating to the development or sourcing of technology, subsection (2) applies—

(a) as if references to relevant content were to CSEA content, and

(b) with the omission of paragraphs (i), (j), (k) and (l).

(5) In this section—

“journalistic content” has the meaning given by section 19;

“relevant content” means terrorism content or CSEA content or both those kinds of content (depending on the kind, or kinds, of content in relation to which the specified technology is to operate);

“specified technology” means the technology to be specified in the notice under section 121(1).

Notices under section 121(1): supplementary

125

(1) In this section “a notice” means a notice under section 121(1) (including a further notice under that provision).

(2) If a provider is already using accredited technology in relation to the service in question, a notice may require the provider to use it more effectively (specifying the ways in which that must be done).

(3) A notice relating to a user-to-user service (or to the user-to-user part of a combined service) may also require a provider to operate an effective complaints procedure allowing for United Kingdom users to challenge the provider for taking down content which they have generated, uploaded or shared on the service.

(4) A notice relating to a search service (or to the search engine of a combined service) may also require a provider to operate an effective complaints procedure allowing for an interested person (see section 227(7)) to challenge measures taken or in use by the provider that result in content relating to that interested person no longer appearing in search results of the service.

(5) A notice given to a provider of a Part 3 service requiring the use of accredited technology is to be taken to require the provider to make such changes to the design or operation of the service as are necessary for the technology to be used effectively.

(6) A notice requiring the use of accredited technology must—

(a) give OFCOM’s reasons for their decision to give the notice,

(b) contain details of the requirements imposed by the notice,

(d) contain details about the manner in which the technology is to be implemented,

(e) specify a reasonable period for compliance with the notice,

(f) specify the period for which the notice is to have effect,

(g) contain details of the rights of appeal under section 168,

(h) contain information about when OFCOM intend to review the notice (see section 126), and

(i) contain information about the consequences of not complying with the notice (including information about the further kinds of enforcement action that it would be open to OFCOM to take).

(7) A notice requiring the use of accredited technology may impose requirements for a period of up to 36 months beginning with the last day of the period specified in the notice in accordance with subsection (6)(e).

(8) A notice relating to the development or sourcing of technology must—

(a) give OFCOM’s reasons for their decision to give the notice,

(b) describe the purpose for which technology is required to be developed or sourced (see section 121(2)(a)(iii) and (iv) and (3)(a)(ii),

(c) specify steps that the provider is required to take (including steps relating to the use of a system or process) in order to comply with the requirement described in section 121(2)(b) or (3)(b), or both those requirements (as the case may be),

(d) specify a reasonable period within which each of the steps specified in the notice must be taken,

(e) contain details of any other requirements imposed by the notice,

(f) contain details of the rights of appeal under section 168,

(g) contain information about when OFCOM intend to review the notice (see section 126), and

(h) contain information about the consequences of not complying with the notice (including information about the further kinds of enforcement action that it would be open to OFCOM to take).

(9) In deciding what period or periods to specify for steps to be taken in accordance with subsection (8)(d), OFCOM must, in particular, consider—

(a) the size and capacity of the provider, and

(b) the state of development of technology capable of achieving the purpose described in the notice in accordance with subsection (8)(b).

(10) A notice may impose requirements only in relation to the design and operation of a Part 3 service—

(a) in the United Kingdom, or

(b) as it affects United Kingdom users of the service.

(11) OFCOM may vary or revoke a notice given to a provider by notifying the provider to that effect.

(12) For the purposes of this Chapter, technology is “accredited” if it is accredited (by OFCOM or another person appointed by OFCOM) as meeting minimum standards of accuracy in the detection of terrorism content or CSEA content (as the case may be).

(13) Those minimum standards of accuracy must be such standards as are for the time being approved and published by the Secretary of State, following advice from OFCOM.

Review and further notice under section 121(1)

126

(1) This section applies where OFCOM have given a provider of a Part 3 service a notice under section 121(1).

(2) The power conferred by section 125(11) includes power to revoke the notice if there are reasonable grounds for believing that the provider is failing to comply with it.

(3) If a notice is revoked as mentioned in subsection (2), OFCOM may give the provider a further notice under section 121(1) if they consider that it is necessary and proportionate to do so (taking into account the matters mentioned in section 124).

(4) Except where a notice under section 121(1) is revoked as mentioned in subsection (2), OFCOM must carry out a review of the provider’s compliance with the notice—

(a) in the case of a notice requiring the use of accredited technology, before the end of the period for which the notice has effect;

(b) in the case of a notice relating to the development or sourcing of technology, before the last date by which any step specified in the notice is required to be taken.

(5) In the case of a notice requiring the use of accredited technology, the review must consider—

(a) the extent to which the technology specified in the notice has been used, and

(b) the effectiveness of its use.

(6) Following the review, and after consultation with the provider, OFCOM may give the provider a further notice under section 121(1) if they consider that it is necessary and proportionate to do so (taking into account the matters mentioned in section 124).

(7) If a further notice under section 121(1) is given, subsections (3) to (6) apply again.

(8) A further notice under section 121(1) may impose different requirements from an earlier notice under that provision.

(9) Sections 122 (skilled person’s report) and 123 (warning notices) do not apply in relation to a further notice under section 121(1).

OFCOM’s guidance about functions under this Chapter

127

(1) OFCOM must produce guidance for providers of Part 3 services about how OFCOM propose to exercise their functions under this Chapter.

(2) Before producing the guidance (including revised or replacement guidance), OFCOM must consult the Information Commissioner.

(3) OFCOM must keep the guidance under review.

(4) OFCOM must publish the guidance (and any revised or replacement guidance).

(5) In exercising their functions under this Chapter, or deciding whether to exercise them, OFCOM must have regard to the guidance for the time being published under this section.

OFCOM’s annual report

128

(1) OFCOM must produce and publish an annual report about—

(a) the exercise of their functions under this Chapter, and

(b) technology which meets, or is in the process of development so as to meet, minimum standards of accuracy (see subsections (12) and (13) of section 125) for the purposes of this Chapter.

(2) OFCOM must send a copy of the report to the Secretary of State, and the Secretary of State must lay it before Parliament.

(3) For further provision about reports under this section, see section 164.

Interpretation of this Chapter

129

In this Chapter—

“search content” has the same meaning as in Part 3 (see section 57);

“search results” has the meaning given by section 57(3);

“terrorism content” and “CSEA content” have the same meaning as in Part 3 (see section 59).

CHAPTER 6 — Enforcement powers

Provisional notices and confirmation decisions

Provisional notice of contravention

130

(1) OFCOM may give a notice under this section (a “provisional notice of contravention”) relating to a regulated service to the provider of the service if they consider that there are reasonable grounds for believing that the provider has failed, or is failing, to comply with any enforceable requirement (see section 131) that applies in relation to the service.

(2) OFCOM may also give a provisional notice of contravention to a person on either of the grounds in subsection (3).

(3) The grounds are that—

(a) the person has been given an information notice and OFCOM consider that there are reasonable grounds for believing that the person has failed, or is failing, to comply with either of the duties set out in section 102(8) (duties in relation to information notices), or

(b) the person is required by a skilled person appointed under section 104 to give assistance to the skilled person, and OFCOM consider that there are reasonable grounds for believing that the person has failed, or is failing, to comply with the duty set out in subsection (7) of that section to give such assistance.

(4) A provisional notice of contravention given to a person must—

(a) specify the duty or requirement with which (in OFCOM’s opinion) the person has failed, or is failing, to comply, and

(b) give OFCOM’s reasons for their opinion that the person has failed, or is failing, to comply with it.

(5) A provisional notice of contravention may also contain details as mentioned in subsection (6) or (7), or both.

(6) A provisional notice of contravention may specify steps that OFCOM consider the person needs to take in order to—

(a) comply with the duty or requirement, or

(b) remedy the failure to comply with it.

(7) A provisional notice of contravention may state that OFCOM propose to impose a penalty on the person, and in such a case the notice must—

(a) state the reasons why OFCOM propose to impose a penalty,

(b) state whether OFCOM propose to impose a penalty of a single amount, a penalty calculated by reference to a daily rate, or both penalties (see section 137(1)),

(c) indicate the amount of a penalty that OFCOM propose to impose, including (in relation to a penalty calculated by reference to a daily rate) the daily rate and how the penalty would be calculated,

(d) in relation to a penalty calculated by reference to a daily rate, specify or describe the period for which OFCOM propose that the penalty should be payable, and

(e) state the reasons for proposing a penalty of that amount, including any aggravating or mitigating factors that OFCOM propose to take into account.

(8) A provisional notice of contravention given to a person must—

(a) state that the person may make representations to OFCOM (with any supporting evidence) about the matters contained in the notice, and

(b) specify the period within which such representations may be made.

(9) A provisional notice of contravention may be given in respect of a failure to comply with more than one enforceable requirement.

(10) Where a provisional notice of contravention is given in respect of a continuing failure, the notice may be given in respect of any period during which the failure has continued, and must specify that period.

(11) Where a provisional notice of contravention is given to a person in respect of a failure to comply with a duty or requirement (“the first notice”), a further provisional notice of contravention in respect of a failure to comply with that same duty or requirement may be given to the person only—

(a) in respect of a separate instance of the failure after the first notice was given,

(b) where a period was specified in the first notice in accordance with subsection (10), in respect of the continuation of the failure after the end of that period, or

(c) if the first notice has been withdrawn (without a confirmation decision being given to the person in respect of the failure).

Requirements enforceable by OFCOM against providers of regulated services

131

(1) References in this Chapter to “enforceable requirements” are to—

(a) the duties or requirements set out in the provisions of this Act specified in the table in subsection (2), and

(b) the requirements mentioned in subsection (3).

(2) Here is the table—

Provision	Subject matter
Section 9	Illegal content risk assessments
Section 10	Illegal content
Section 11	Children’s risk assessments
Section 12	Children’s online safety
Section 14	Assessments related to duty in section 15(2)
Section 15	User empowerment
Section 17	Content of democratic importance
Section 18	News publisher content
Section 19	Journalistic content
Section 20	Content reporting
Section 21	Complaints procedures
Section 22	Freedom of expression and privacy
Section 23	Record-keeping and review
Section 26	Illegal content risk assessments
Section 27	Illegal content
Section 28	Children’s risk assessments
Section 29	Children’s online safety
Section 31	Content reporting
Section 32	Complaints procedures
Section 33	Freedom of expression and privacy
Section 34	Record-keeping and review
Section 36	Children’s access assessments
Section 38	Fraudulent advertising
Section 39	Fraudulent advertising
Section 64	User identity verification
Section 66	Reporting CSEA content to NCA
Section 71	Acting against users only in accordance with terms of service
Section 72	Terms of service
Section 75	Information about use of service by deceased child users
Section 77(3) and (4)	Transparency reports
Section 81	Provider pornographic content
Section 83	Fees: notification of OFCOM
Section 102(8)	Information notices
Section 104(7)	Assistance to skilled person
Section 105(1)	Co-operation with investigation

(3) The requirements referred to in subsection (1)(b) are—

(a) requirements of a notice under section 104(5)(a) to appoint a skilled person;

(b) requirements of a notice given by virtue of section 175(3) (duty to make public statement);

(d) requirements imposed by a person acting—

(i) in the exercise of powers conferred by paragraph 2 of Schedule 12 (entry and inspection without warrant), or

(ii) in the execution of a warrant issued under paragraph 5 of that Schedule.

Confirmation decisions

132

(1) This section applies if—

(a) OFCOM have given a provisional notice of contravention to a person in relation to a failure to comply with a duty or requirement (or with duties or requirements), and

(b) the period allowed for representations has expired.

A duty or requirement to which the provisional notice of contravention relates is referred to in this section as a “notified requirement”.

(2) If, after considering any representations and evidence, OFCOM decide not to give the person a notice under this section, they must inform the person of that fact.

(3) If OFCOM are satisfied that the person has failed, or has been failing, to comply with a notified requirement, OFCOM may give the person a notice under this section (a “confirmation decision”) confirming that that is OFCOM’s opinion.

(4) A confirmation decision and a notice under section 121(1) may be given in respect of the same failure.

(5) A confirmation decision given to a person may—

(a) require the person to take steps as mentioned in section 133;

(b) require the person to pay a penalty as mentioned in section 137;

(6) See sections 134 and 135 for further provision which a confirmation decision may include in cases of failure to comply with duties about risk assessments or children’s access assessments.

Confirmation decisions: requirements to take steps

133

(1) A confirmation decision may require the person to whom it is given to take such steps as OFCOM consider appropriate (including steps relating to the use of a system or process) for either or both of the following purposes—

(a) complying with a notified requirement;

(b) remedying the failure to comply with a notified requirement.

(2) But see section 136 in relation to OFCOM’s power to include in a confirmation decision requirements as described in subsection (1) relating to the use of proactive technology.

(3) A confirmation decision may impose requirements as described in subsection (1) only in relation to the design or operation of a regulated service—

(a) in the United Kingdom, or

(b) as it affects United Kingdom users of the service.

(4) A confirmation decision that includes requirements as described in subsection (1) must—

(a) specify the steps that are required,

(b) give OFCOM’s reasons for their decision to impose those requirements,

(c) specify which of those requirements (if any) have been designated as CSEA requirements (see subsections (6) and (7)),

(d) specify each notified requirement to which the steps relate,

(e) specify the period during which the failure to comply with a notified requirement has occurred, and whether the failure is continuing,

(f) specify a reasonable period within which each of the steps specified in the decision must be taken or, if a step requires the use of a system or process, a reasonable period within which the system or process must begin to be used (but see subsection (5) in relation to information duties),

(g) (if relevant) specify the period for which a system or process must be used,

(h) contain details of the rights of appeal under section 168, and

(i) contain information about the consequences of not complying with the requirements included in the decision (including information about the further kinds of enforcement action that it would be open to OFCOM to take).

(5) A confirmation decision that requires a person to take steps for the purpose of complying with an information duty may require the person to take those steps immediately.

(6) If the condition in subsection (7) is met in relation to a requirement imposed by a confirmation decision which is of a kind described in subsection (1), OFCOM must designate the requirement as a “CSEA requirement” for the purposes of section 138(3) (offence of failure to comply with confirmation decision).

(7) The condition referred to in subsection (6) is that the requirement is imposed (whether or not exclusively) in relation to either or both of the following—

(a) a failure to comply with section 10(2)(a) or (3)(a) in respect of CSEA content, or in respect of priority illegal content which includes CSEA content;

(b) a failure to comply with section 10(2)(b) in respect of an offence specified in Schedule 6 (CSEA offences), or in respect of priority offences which include such an offence.

(8) A person to whom a confirmation decision is given has a duty to comply with requirements included in the decision which are of a kind described in subsection (1).

(9) The duty under subsection (8) is enforceable in civil proceedings by OFCOM—

(a) for an injunction,

(b) for specific performance of a statutory duty under section 45 of the Court of Session Act 1988, or

(10) In this section—

“CSEA content”, “priority illegal content” and “priority offence” have the same meaning as in Part 3 (see section 59);

“information duty” means a duty set out in section 102(8);

“notified requirement” has the meaning given by section 132.

Confirmation decisions: risk assessments

134

(1) This section applies if—

(a) OFCOM are satisfied that a provider of a Part 3 service has failed to comply with a risk assessment duty,

(b) based on evidence resulting from OFCOM’s investigation into that failure, OFCOM have identified a risk of serious harm to individuals in the United Kingdom arising from a particular aspect of the service (“the identified risk”), and

(2) A confirmation decision given to the provider of the service—

(a) if the identified risk relates to matters required to be covered by an illegal content risk assessment, may include a determination that the duty set out in section 10(2)(b) or (c) or 27(2) (as the case may be) applies as if an illegal content risk assessment carried out by the provider had identified that risk;

(b) if the identified risk relates to matters required to be covered by a children’s risk assessment, may include a determination that the duty set out in section 12(2)(a) or 29(2)(a) (as the case may be) applies as if a children’s risk assessment carried out by the provider had identified that risk.

(3) A confirmation decision which includes a determination as mentioned in subsection (2) must—

(a) give details of the identified risk,

(b) specify the duty to which the determination relates, and

(c) specify the date by which measures (at the provider’s discretion) to comply with that duty must be taken or must begin to be used.

(4) A determination as mentioned in subsection (2) ceases to have effect on the date on which the provider of the service complies with the risk assessment duty with which the provider had previously failed to comply (and accordingly, from that date the duty to which the determination relates applies without the modification mentioned in that subsection).

(5) In this section—

“children’s risk assessment” has the meaning given by section 11 or 28 (as the case may be);

“illegal content risk assessment” has the meaning given by section 9 or 26 (as the case may be);

“risk assessment duty” means a duty set out in— section 9, section 11, section 26, or section 28.

Confirmation decisions: children’s access assessments

135

(1) This section applies if OFCOM are satisfied that a provider of a Part 3 service has failed to comply with a duty set out in section 36 (duties about children’s access assessments).

(2) If OFCOM include in a confirmation decision a requirement to take steps relating to the carrying out of a children’s access assessment of a service, they must require that assessment to be completed within three months of the date of the confirmation decision.

(3) OFCOM may vary a confirmation decision which includes a requirement as mentioned in subsection (2) to extend the deadline for completion of a children’s access assessment.

(4) Subsection (5) applies if, based on evidence that OFCOM have about a service resulting from their investigation into compliance with a duty set out in section 36, OFCOM consider that—

(a) it is possible for children to access the service or a part of it, and

(b) the child user condition is met in relation to—

(i) the service, or

(ii) a part of the service that it is possible for children to access.

(5) OFCOM may include in the confirmation decision given to the provider of the service—

(a) a determination that the duties set out in sections 11 and 12, or (as the case may be) sections 28 and 29, must be complied with—

(i) from the date of the confirmation decision, or

(ii) from a later date specified in that decision;

(b) provision about the circumstances in which that determination may be treated as no longer applying in relation to the service.

(6) Subsection (4) is to be interpreted consistently with section 35.

(7) In this section, “children’s access assessment” has the meaning given by section 35.

Confirmation decisions: proactive technology

136

(1) This section sets out what powers OFCOM have to include in a confirmation decision a requirement to take steps to use a kind, or one of the kinds, of proactive technology specified in the decision (a “proactive technology requirement”).

(2) A proactive technology requirement may be imposed in a confirmation decision if—

(a) the decision is given to the provider of an internet service within section 80(2), and

(b) the decision is imposed for the purpose of complying with, or remedying the failure to comply with, the duty set out in section 81(2) (provider pornographic content).

Reading this document does not replace reading the official text published on legislation.gov.uk. Contains public sector information licensed under the Open Government Licence v3.0. We assume no responsibility for any inaccuracies arising from the conversion of the original CLML XML to this format.

This text is published under legislation.gov.uk's own terms of reuse, not a Legalize or public-domain licence. legislation.gov.uk
Open Government Licence v3.0 (attribution required)
© Crown and database right. Derived from content available under the Open Government Licence v3.0 from legislation.gov.uk.