Legalize / United Kingdom / Public General Act

Online Safety Act 2023

Type Public General Act

Publication 2023-10-26

Last updated 2026-04-07

State In force

Department Statute Law Database

Source legislation.gov.uk

articles Not indexed

Reform history JSON API

(3) The following provisions of this section set out constraints on OFCOM’s power to include a proactive technology requirement in a confirmation decision in any case not within subsection (2).

(4) A proactive technology requirement may be imposed in a confirmation decision only if the decision is given to the provider of a Part 3 service.

(5) A proactive technology requirement may be imposed in a confirmation decision only for the purpose of complying with, or remedying the failure to comply with, any of the duties set out in—

(a) section 10(2) or (3) (illegal content),

(b) section 12(2) or (3) (children’s online safety),

(d) section 29(2) or (3) (children’s online safety), or

(e) section 38(1) or 39(1) (fraudulent advertising).

(6) Proactive technology may be required to be used on or in relation to any Part 3 service or any part of such a service, but if and to the extent that the technology operates (or may operate) by analysing content that is user-generated content in relation to the service, or metadata relating to such content, the technology may not be required to be used except to analyse—

(a) user-generated content communicated publicly, and

(b) metadata relating to user-generated content communicated publicly.

(7) Before imposing a proactive technology requirement in relation to a service in a confirmation decision, OFCOM must particularly consider the matters mentioned in subsection (8), so far as they are relevant.

(8) The matters are as follows—

(a) the kind of service it is;

(b) the functionalities of the service;

(d) the prevalence of relevant content on the service and the extent of its dissemination by means of the service, or (as the case may be) the prevalence of search content of the service that is relevant content;

(e) the level of risk of harm to individuals in the United Kingdom presented by relevant content present on the service, or (as the case may be) search content of the service that is relevant content, and the severity of that harm;

(f) the degree of accuracy, effectiveness and lack of bias achieved by the kind of technology specified in the decision;

(g) the extent to which the use of the kind of proactive technology specified in the decision would or might result in interference with users’ right to freedom of expression within the law;

(h) the level of risk of the use of the kind of proactive technology specified in the decision resulting in a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of the service (including, but not limited to, any such provision or rule concerning the processing of personal data);

(i) whether the use of any less intrusive measures than the proactive technology specified in the decision would be likely to result in compliance with, or would be likely to effectively remedy the failure to comply with, the duty in question.

(9) A confirmation decision that imposes a proactive technology requirement on a provider may also impose requirements about review of the technology by the provider.

(10) A confirmation decision relating to a service which requires the use of technology of a kind mentioned in subsection (6) must identify the content, or parts of the service that include content, that OFCOM consider is communicated publicly on that service (see section 232).

(11) In this section—

“content that is harmful to children” has the same meaning as in Part 3 (see section 60);

“fraudulent advertisement” has the meaning given by section 38 or 39 (depending on the kind of service in question);

“illegal content” has the same meaning as in Part 3 (see section 59);

“relevant content” means illegal content, content that is harmful to children or content consisting of fraudulent advertisements, or any or all of those kinds of content (depending on the duties (as mentioned in subsection (5)) for the purposes of which the proactive technology requirement is imposed);

“search content” has the same meaning as in Part 3 (see section 57);

“user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

Confirmation decisions: penalties

137

(1) A confirmation decision may require the person to whom it is given to do either or both of the following, depending on what was proposed in the provisional notice of contravention (see paragraph 3 of Schedule 13)—

(a) pay to OFCOM a penalty of a single amount in sterling determined by OFCOM (a “single penalty”) and specified in the confirmation decision;

(b) if the confirmation decision includes a requirement of the kind described in section 133(1)(a) in respect of a continuous failure to comply with a notified requirement, pay a daily rate penalty to OFCOM if that same failure continues after the compliance date.

(2) A “daily rate penalty” means a penalty of an amount in sterling determined by OFCOM and calculated by reference to a daily rate.

(3) A confirmation decision may impose separate single penalties for failure to comply with separate notified requirements specified in the decision.

(4) Where a provisional notice of contravention is given in respect of a period of continuing failure to comply with a notified requirement, no more than one single penalty may be imposed by a confirmation decision in respect of the period of failure specified in the provisional notice of contravention.

(5) A confirmation decision that imposes a penalty must—

(a) give OFCOM’s reasons for their decision to impose the penalty,

(b) specify each notified requirement to which the penalty relates,

(c) specify the period during which the failure to comply with a notified requirement has occurred, and whether the failure is continuing,

(d) state the reasons for the amount of the penalty, including any aggravating or mitigating factors that OFCOM have taken into account,

(e) specify a reasonable period within which the penalty must be paid,

(f) contain details of the rights of appeal under section 168, and

(g) contain information about the consequences of not paying the penalty (including information about the further kinds of enforcement action that it would be open to OFCOM to take).

(6) The period specified under subsection (5)(e) for the payment of a single penalty must be at least 28 days beginning with the day on which the confirmation decision is given.

(7) If a confirmation decision imposes a single penalty and a daily rate penalty, the information mentioned in subsection (5)(a), (b), (d) and (e) must be given in respect of each kind of penalty.

(8) As well as containing the information mentioned in subsection (5), a confirmation decision that imposes a daily rate penalty in respect of a continuous failure to comply with a notified requirement must—

(a) state the daily rate of the penalty and how the penalty is calculated;

(b) state that the person will be liable to pay the penalty if that same failure continues after the compliance date;

(c) state the date from which the penalty begins to be payable, which must not be earlier than the day after the compliance date;

(d) provide for the penalty to continue to be payable at the daily rate until—

(i) the date on which the notified requirement is complied with,

(ii) if the penalty is imposed in respect of a failure to comply with more than one notified requirement, the date on which the last of those requirements is complied with, or

(iii) an earlier date specified in the confirmation decision.

(9) In this section—

“compliance date”, in relation to a notified requirement, means— in a case where the confirmation decision requires steps to be taken immediately to comply with that requirement (see section 133(5)), the date of the confirmation decision; in any other case, the last day of the period specified in the confirmation decision in accordance with section 133(4)(f) for compliance with that requirement;

“notified requirement” has the meaning given by section 132.

Confirmation decisions: offences

138

(1) A person to whom a confirmation decision is given commits an offence if, without reasonable excuse, the person fails to comply with a requirement imposed by the decision which—

(a) is of a kind described in section 133(1), and

(b) is imposed (whether or not exclusively) in relation to a failure to comply with a children’s online safety duty.

(2) A “children’s online safety duty” means a duty set out in—

(a) section 12(3)(a),

(b) section 12(3)(b),

(d) section 81(4).

(3) A person to whom a confirmation decision is given commits an offence if, without reasonable excuse, the person fails to comply with a CSEA requirement imposed by the decision (see section 133(6) and (7)).

(4) A person who commits an offence under this section is liable—

(a) on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);

(b) on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum (or both);

(c) on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);

(d) on conviction on indictment, to imprisonment for a term not exceeding 2 years or a fine (or both).

Penalty notices etc

Penalty for failure to comply with confirmation decision

139

(1) This section applies if—

(a) OFCOM have given a confirmation decision to a person,

(b) the decision includes requirements of a kind described in section 133(1) (requirements to take steps),

(d) OFCOM have not imposed a daily rate penalty under section 137(1)(b) in respect of that failure.

(2) OFCOM may give the person a penalty notice under this section in respect of the failure to comply with the confirmation decision, requiring the person to pay to OFCOM a penalty of a single amount in sterling determined by OFCOM.

(3) But OFCOM may give such a notice to the person only after—

(a) notifying the person that they propose to give a penalty notice under this section, specifying the reasons for doing so and indicating the amount of the proposed penalty, and

(b) giving the person an opportunity to make representations (with any supporting evidence).

(4) A penalty notice under this section must—

(a) give OFCOM’s reasons for their decision to impose the penalty,

(b) state the amount of the penalty,

(c) state the reasons for the amount of the penalty, including any aggravating or mitigating factors that OFCOM have taken into account,

(d) specify the period within which the penalty must be paid,

(e) contain details of the rights of appeal under section 168, and

(f) contain information about the consequences of not paying the penalty (including information about the further kinds of enforcement action that it would be open to OFCOM to take).

(5) The period specified under subsection (4)(d) must be at least 28 days beginning with the day on which the penalty notice is given.

Penalty for failure to comply with notice under section 121(1)

140

(1) This section applies if—

(a) OFCOM have given a notice under section 121(1) relating to a Part 3 service to the provider of that service (notices to deal with terrorism content and CSEA content), and

(b) OFCOM are satisfied that the provider has failed, or is failing, to comply with the notice.

(2) OFCOM may give the provider a notice under this subsection stating that they propose to impose a penalty on the provider in respect of that failure.

(3) The provider may make representations to OFCOM (with any supporting evidence) about the matters contained in the notice.

(4) Subsection (5) applies if—

(a) the period allowed for representations has expired, and

(b) OFCOM are still satisfied as to the failure mentioned in subsection (1).

(5) OFCOM may give the provider a penalty notice under this subsection requiring the provider to pay to OFCOM a penalty of an amount in sterling determined by OFCOM.

(6) The penalty may consist of any of the following, depending on what was specified in the notice about the proposed penalty—

(a) a single amount;

(b) an amount calculated by reference to a daily rate;

(7) See section 142 for information which must be included in notices under this section.

(8) Nothing in this section is to be taken to prevent OFCOM from giving the provider a further notice under section 121(1) (see section 126), as well as giving a penalty notice under subsection (5).

Non-payment of fee

141

(1) This section applies if—

(a) the provider of a regulated service is liable to pay a fee to OFCOM under section 84 or Schedule 10 in respect of the current charging year (within the meaning of Part 6) or a previous charging year, and

(b) in OFCOM’s opinion, the provider has not paid the full amount of the fee that the provider is liable to pay.

(2) OFCOM may give the provider a notice under this subsection specifying—

(a) the outstanding amount of the fee that OFCOM consider the provider is due to pay to them under section 84 or Schedule 10, and

(b) the period within which the provider must pay it.

(3) A notice under subsection (2)—

(a) may be given in respect of liabilities that relate to different charging years;

(b) may also state that OFCOM propose to impose a penalty on the provider.

(4) The provider may make representations to OFCOM (with any supporting evidence) about the matters contained in the notice.

(5) Subsection (6) applies if—

(a) the notice under subsection (2) stated that OFCOM propose to impose a penalty,

(b) the period allowed for representations has expired, and

(6) OFCOM may give the provider a penalty notice under this subsection requiring the provider to pay to OFCOM a penalty of an amount in sterling determined by OFCOM.

(7) The penalty may consist of any of the following, depending on what was specified in the notice about the proposed penalty—

(a) a single amount;

(b) an amount calculated by reference to a daily rate;

(8) A penalty notice under subsection (6) may require the payment of separate single amounts in respect of liabilities that relate to different charging years.

(9) See section 142 for information which must be included in notices under this section.

(10) Nothing in this section affects OFCOM’s power to bring proceedings (whether before or after the imposition of a penalty by a notice under subsection (6)) for the recovery of the whole or part of an amount due to OFCOM under section 84 or Schedule 10.

(11) But OFCOM may not bring such proceedings unless a provider has first been given a notice under subsection (2) specifying the amount due to OFCOM.

Information to be included in notices under sections 140 and 141

142

(1) Subsection (2) applies in relation to—

(a) a notice under section 140(2), and

(b) a notice under section 141(2) stating that OFCOM propose to impose a penalty.

(2) Such a notice must—

(a) state the reasons why OFCOM propose to impose the penalty,

(b) state whether OFCOM propose that the penalty should consist of a single amount, an amount calculated by reference to a daily rate, or a combination of the two,

(c) indicate the amount of the proposed penalty, including (in relation to an amount calculated by reference to a daily rate) the daily rate and how the penalty would be calculated,

(d) in relation to an amount calculated by reference to a daily rate, specify or describe the period for which OFCOM propose that the amount should be payable,

(e) state the reasons for proposing a penalty of that amount, including any aggravating or mitigating factors that OFCOM propose to take into account, and

(f) specify the period within which representations in relation to the proposed penalty may be made.

(3) A penalty notice under section 140(5) or 141(6) must—

(a) give OFCOM’s reasons for their decision to impose the penalty,

(b) state whether the penalty consists of a single amount, an amount calculated by reference to a daily rate, or a combination of the two, and how it is calculated,

(d) in relation to an amount calculated by reference to a daily rate, state the daily rate,

(e) state the reasons for the amount of the penalty, including any aggravating or mitigating factors that OFCOM have taken into account,

(f) specify a reasonable period within which the penalty must be paid,

(g) contain details of the rights of appeal under section 168, and

(h) contain information about the consequences of not paying the penalty (including information about the further kinds of enforcement action that it would be open to OFCOM to take).

(4) A penalty notice under section 141(6) must also specify the amount of the fee that is (in OFCOM’s opinion) due to be paid to OFCOM.

(5) The period specified under subsection (3)(f)for the payment of a single amount must be at least 28 days beginning with the day on which the penalty notice is given.

(6) Subsection (7) applies in relation to a penalty notice under section 140(5) or 141(6) that includes a requirement to pay an amount calculated by reference to a daily rate.

(7) Such a notice must—

(a) state the date from which the amount begins to be payable, which must not be earlier than the day after the day on which the notice is given;

(b) provide for the amount to continue to be payable at the daily rate until—

(i) (in the case of a notice under section 140(5)) the date on which OFCOM are satisfied that the provider is complying with the notice under section 121(1), or (in the case of a notice under section 141(6)) the date on which the full amount of the fee (as specified in the penalty notice) has been paid to OFCOM, or

(ii) an earlier date specified in the penalty notice.

Amount of penalties etc

143

Schedule 13 contains provision about the amount of penalties that OFCOM may impose under this Chapter, and makes further provision about such penalties.

Business disruption measures

Service restriction orders

144

(1) OFCOM may apply to the court for an order under this section (a “service restriction order”) in relation to a regulated service where they consider that—

(a) the grounds in subsection (3) apply in relation to the service, or

(b) in the case of a Part 3 service, the grounds in subsection (4) apply in relation to the service.

(2) A service restriction order is an order imposing requirements on one or more persons who provide an ancillary service (whether from within or outside the United Kingdom) in relation to a regulated service (see subsection (11)).

(3) The grounds mentioned in subsection (1)(a) are that—

(a) the provider of the regulated service has failed to comply with an enforceable requirement that applies in relation to the regulated service,

(b) the failure is continuing, and

(i) the provider has failed to comply with a requirement imposed by a confirmation decision that is of a kind described in section 133(1) relating to the failure;

(ii) the provider has failed to pay a penalty imposed by a confirmation decision relating to the failure (and the confirmation decision did not impose any requirements of a kind described in section 133(1));

(iii) the provider would be likely to fail to comply with requirements imposed by a confirmation decision if given;

(iv) the circumstances of the failure or the risks of harm to individuals in the United Kingdom are such that it is appropriate to make the application without having given a provisional notice of contravention, without having given a confirmation decision, or (having given a confirmation decision imposing requirements) without waiting to ascertain compliance with those requirements.

(4) The grounds mentioned in subsection (1)(b) are that—

(a) the provider of the Part 3 service has failed to comply with a notice under section 121(1) that relates to the service (notices to deal with terrorism content and CSEA content), and

(b) the failure is continuing.

(5) An application by OFCOM for a service restriction order must—

(a) specify the regulated service in relation to which the application is made (“the relevant service”),

(b) specify the provider of that service (“the non-compliant provider”),

(d) specify the persons on whom (in OFCOM’s opinion) the requirements of the order should be imposed,

(e) contain evidence as to why OFCOM consider that the persons mentioned in paragraph (d) provide an ancillary service in relation to the relevant service, and specify any such ancillary service provided,

(f) specify the requirements which OFCOM consider that the order should impose on such persons, and

(g) in the case of an application made without notice having been given to the non-compliant provider, or to the persons mentioned in paragraph (d), state why no notice has been given.

(6) The court may make a service restriction order imposing requirements on a person in relation to the relevant service if the court is satisfied—

(a) as to the grounds in subsection (3) or the grounds in subsection (4) (as the case may be),

(b) that the person provides an ancillary service in relation to the relevant service,

(c) that it is appropriate to make the order for the purpose of preventing harm to individuals in the United Kingdom, and the order is proportionate to the risk of such harm,

(d) in the case of an application made on the ground in subsection (3)(c)(iii) or (iv), that it is appropriate to make the order before a provisional notice of contravention or confirmation decision has been given, or before compliance with requirements imposed by a confirmation decision has been ascertained (as the case may be), and

(e) if no notice of the application has been given to the non-compliant provider, or to the persons on whom requirements are being imposed, that it is appropriate to make the order without notice.

(7) When considering whether to make a service restriction order in relation to the relevant service, and when considering what provision it should contain, the court must take into account (among other things) the rights and obligations of all relevant parties, including those of—

(a) the non-compliant provider,

(b) the person or persons on whom the court is considering imposing the requirements, and

(8) A service restriction order made in relation to the relevant service must—

(a) identify the non-compliant provider,

(b) identify the persons on whom the requirements are imposed, and any ancillary service to which the requirements relate,

(c) require such persons to take the steps specified in the order, or to put in place arrangements, that have the effect of withdrawing the ancillary service to the extent that it relates to the relevant service (or part of it), or preventing the ancillary service from promoting or displaying content that relates to the relevant service (or part of it) in any way,

(d) specify the date by which the requirements in the order must be complied with, and

(e) specify the date on which the order expires, or the period for which the order has effect.

(9) The steps that may be specified or arrangements that may be required to be put in place—

(a) include steps or arrangements that will or may require the termination of an agreement (whether or not made before the coming into force of this section), or the prohibition of the performance of such an agreement, and

(b) are limited, so far as that is possible, to steps or arrangements relating to the operation of the relevant service as it affects United Kingdom users.

(10) OFCOM must inform the Secretary of State as soon as reasonably practicable after a service restriction order has been made.

(11) For the purposes of this section, a service is an “ancillary service” in relation to a regulated service if the service facilitates the provision of the regulated service (or part of it), whether directly or indirectly, or displays or promotes content relating to the regulated service (or to part of it).

(12) Examples of ancillary services include—

(a) services, provided (directly or indirectly) in the course of a business, which enable funds to be transferred in relation to a regulated service,

(b) search engines which generate search results displaying or promoting content relating to a regulated service,

(d) services which use technology to facilitate the display of advertising on a regulated service (for example, an ad server or an ad network).

(13) In this section “the court” means—

(a) in England and Wales, the High Court or the county court,

(b) in Scotland, the Court of Session or a sheriff, and

Interim service restriction orders

145

(1) OFCOM may apply to the court for an interim order under this section (an “interim service restriction order”) in relation to a regulated service where they consider that—

(a) the grounds in subsection (3) apply in relation to the service, or

(b) in the case of a Part 3 service, the grounds in subsection (4) apply in relation to the service.

(2) An interim service restriction order is an interim order imposing requirements on one or more persons who provide an ancillary service (whether from within or outside the United Kingdom) in relation to a regulated service (see subsection (9)).

(3) The grounds mentioned in subsection (1)(a) are that—

(a) it is likely that the provider of the regulated service is failing to comply with an enforceable requirement that applies in relation to the regulated service, and

(b) the level of risk of harm to individuals in the United Kingdom relating to the likely failure, and the nature and severity of that harm, are such that it would not be appropriate to wait to establish the failure before applying for the order.

(4) The grounds mentioned in subsection (1)(b) are that—

(a) it is likely that the provider of the Part 3 service is failing to comply with a notice under section 121(1) that relates to the service (notices to deal with terrorism content and CSEA content), and

(b) the level of risk of harm to individuals in the United Kingdom relating to the likely failure, and the nature and severity of that harm, are such that it would not be appropriate to wait to establish the failure before applying for the order.

(5) An application by OFCOM for an interim service restriction order must—

(a) specify the regulated service in relation to which the application is made (“the relevant service”),

(b) specify the provider of that service (“the non-compliant provider”),

(d) specify the persons on whom (in OFCOM’s opinion) the requirements of the order should be imposed,

(e) contain evidence as to why OFCOM consider that the persons mentioned in paragraph (d) provide an ancillary service in relation to the relevant service, and specify any such ancillary service provided,

(f) specify the requirements which OFCOM consider that the order should impose on such persons, and

(g) in the case of an application made without notice having been given to the non-compliant provider, or to the persons mentioned in paragraph (d), state why no notice has been given.

(6) The court may make an interim service restriction order imposing requirements on a person in relation to the relevant service if the court is satisfied—

(a) as to the ground in subsection (3)(a) or the ground in subsection (4)(a) (as the case may be),

(b) that the person provides an ancillary service in relation to the relevant service,

(c) that there are prima facie grounds to suggest that an application for a service restriction order under section 144 would be successful,

(d) that the level of risk of harm to individuals in the United Kingdom relating to the likely failure mentioned in subsection (3)(a) or (4)(a) (whichever applies), and the nature and severity of that harm, are such that it is not appropriate to wait for the failure to be established before making the order, and

(e) if no notice of the application has been given to the non-compliant provider, or to the persons on whom requirements are being imposed, that it is appropriate to make the order without notice.

(7) An interim service restriction order ceases to have effect on the earlier of—

(a) the date specified in the order, or the date on which the period specified in the order expires (as the case may be), and

(b) the date on which the court makes a service restriction order under section 144 in relation to the relevant service that imposes requirements on the same persons on whom requirements are imposed by the interim order, or dismisses the application for such an order.

(8) Subsections (7) to (10) of section 144 apply in relation to an interim service restriction order under this section as they apply in relation to a service restriction order under that section.

(9) In this section, “ancillary service” and “the court” have the same meaning as in section 144 (see subsections (11), (12) and (13) of that section).

Access restriction orders

146

(1) OFCOM may apply to the court for an order under this section (an “access restriction order”) in relation to a regulated service where they consider that—

(a) the grounds in section 144(3) or (4) apply in relation to the service, and

(b) either—

(i) a service restriction order under section 144 or an interim service restriction order under section 145 has been made in relation to the failure, and it was not sufficient to prevent significant harm arising to individuals in the United Kingdom as a result of the failure, or

(ii) the likely consequences of the failure are such that if a service restriction order or an interim service restriction order were to be made, it would be unlikely to be sufficient to prevent significant harm arising to individuals in the United Kingdom as a result of the failure,

and in this paragraph, “the failure” means the failure mentioned in section 144(3)(a) or (4)(a) (as the case may be).

(2) An access restriction order is an order imposing requirements on one or more persons who provide an access facility (whether from within or outside the United Kingdom) in relation to a regulated service (see subsection (10)).

(3) An application by OFCOM for an access restriction order must—

(a) specify the regulated service in relation to which the application is made (“the relevant service”),

(b) specify the provider of that service (“the non-compliant provider”),

(d) specify the persons on whom (in OFCOM’s opinion) the requirements of the order should be imposed,

(e) contain evidence as to why OFCOM consider that the persons mentioned in paragraph (d) provide an access facility in relation to the relevant service, and specify any such access facility provided,

(f) specify the requirements which OFCOM consider that the order should impose on such persons, and

(g) in the case of an application made without notice having been given to the non-compliant provider, or to the persons mentioned in paragraph (d), state why no notice has been given.

(4) The court may make an access restriction order imposing requirements on a person in relation to the relevant service if the court is satisfied—

(a) as to the grounds in subsection (1),

(b) that the person provides an access facility in relation to the relevant service,

(c) that it is appropriate to make the order for the purpose of preventing significant harm to individuals in the United Kingdom, and the order is proportionate to the risk of such harm,

(d) in the case of an application made on the ground in subsection (3)(c)(iii) or (iv) of section 144 (by virtue of subsection (1)(a)), that it is appropriate to make the order before a provisional notice of contravention or confirmation decision has been given, or before compliance with requirements imposed by a confirmation decision has been ascertained (as the case may be), and

(e) if no notice of the application has been given to the non-compliant provider, or to the persons on whom requirements are being imposed, that it is appropriate to make the order without notice.

(5) When considering whether to make an access restriction order in relation to the relevant service, and when considering what provision it should contain, the court must take into account (among other things) the rights and obligations of all relevant parties, including those of—

(a) the non-compliant provider,

(b) the person or persons on whom the court is considering imposing the requirements, and

(6) An access restriction order made in relation to the relevant service must—

(a) identify the non-compliant provider,

(b) identify the persons on whom the requirements are imposed, and any access facility to which the requirements relate,

(c) require such persons to take the steps specified in the order, or to put in place arrangements, to withdraw, adapt or manipulate the access facility in order to impede users’ access (by means of that facility) to the relevant service (or to part of it),

(d) specify the date by which the requirements in the order must be complied with, and

(e) specify the date on which the order expires, or the period for which the order has effect.

(7) The steps that may be specified or arrangements that may be required to be put in place—

(a) include steps or arrangements that will or may require the termination of an agreement (whether or not made before the coming into force of this section), or the prohibition of the performance of such an agreement,

(b) are limited, so far as that is possible, to steps or arrangements that impede the access of United Kingdom users, and

(c) are limited, so far as that is possible, to steps or arrangements that do not affect such users’ ability to access any other internet services.

(8) OFCOM must inform the Secretary of State as soon as reasonably practicable after an access restriction order has been made.

(9) Where a person who provides an access facility takes steps or puts in place arrangements required by an access restriction order, OFCOM may, by notice, require that person to (where possible) notify persons in the United Kingdom who attempt to access the relevant service via that facility of the access restriction order (and where a confirmation decision has been given to the non-compliant provider, the notification must refer to that decision).

(10) For the purposes of this section, a facility is an “access facility” in relation to a regulated service if the person who provides the facility is able to withdraw, adapt or manipulate it in such a way as to impede access (by means of that facility) to the regulated service (or to part of it) by United Kingdom users of that service.

(11) Examples of access facilities include—

(a) internet access services by means of which a regulated service is made available, and

(b) app stores through which a mobile app for a regulated service may be downloaded or otherwise accessed.

(12) In this section—

“the court” means— in England and Wales, the High Court or the county court, in Scotland, the Court of Session or a sheriff, and in Northern Ireland, the High Court or a county court;

“facility” means any kind of service, infrastructure or apparatus enabling users of a regulated service to access the regulated service;

“internet access service” means a service that provides access to virtually all (or just some) of the end points of the internet.

Interim access restriction orders

147

(1) OFCOM may apply to the court for an interim order under this section (an “interim access restriction order”) in relation to a regulated service where they consider that—

(a) the grounds in section 145(3) or (4) apply in relation to the service, and

(b) either—

(i) a service restriction order under section 144 or an interim service restriction order under section 145 has been made in relation to the likely failure, and it was not sufficient to prevent significant harm arising to individuals in the United Kingdom as a result of the failure, or

(ii) the likely consequences of such a failure would be such that if a service restriction order or an interim service restriction order were to be made, it would be unlikely to be sufficient to prevent significant harm arising to individuals in the United Kingdom as a result of the failure,

and in this section, “the likely failure” means the likely failure mentioned in section 145(3)(a) or (4)(a) (as the case may be).

(2) An interim access restriction order is an interim order imposing requirements on one or more persons who provide an access facility (whether from within or outside the United Kingdom) in relation to a regulated service (see subsection (8)).

(3) An application by OFCOM for an interim access restriction order must—

(a) specify the regulated service in relation to which the application is made (“the relevant service”),

(b) specify the provider of that service (“the non-compliant provider”),

(d) specify the persons on whom (in OFCOM’s opinion) the requirements of the order should be imposed,

(e) contain evidence as to why OFCOM consider that the persons mentioned in paragraph (d) provide an access facility in relation to the relevant service, and specify any such access facility provided,

(f) specify the requirements which OFCOM consider that the order should impose on such persons, and

(g) in the case of an application made without notice having been given to the non-compliant provider, or to the persons mentioned in paragraph (d), state why no notice has been given.

(4) The court may make an interim access restriction order imposing requirements on a person in relation to the relevant service if the court is satisfied—

(a) that the ground in section 145(3)(a) or (4)(a) (as the case may be) applies in relation to the service,

(b) as to the ground in subsection (1)(b)(i) or (ii),

(d) that there are prima facie grounds to suggest that an application for an access restriction order under section 146 would be successful,

(e) that the level of risk of harm to individuals in the United Kingdom relating to the likely failure, and the nature and severity of that harm, are such that it is not appropriate to wait for the failure to be established before making the order, and

(f) if no notice of the application has been given to the non-compliant provider, or to the persons on whom requirements are being imposed, that it is appropriate to make the order without notice.

(5) An interim access restriction order ceases to have effect on the earlier of—

(a) the date specified in the order, or the date on which the period specified in the order expires (as the case may be), and

(b) the date on which the court makes an access restriction order under section 146 in relation to the relevant service that imposes requirements on the same persons on whom requirements are imposed by the interim order, or dismisses an application for such an order.

(6) Subsections (5) to (8) of section 146 apply in relation to an interim access restriction order under this section as they apply in relation to an access restriction order under that section.

(7) Where a person who provides an access facility takes steps or puts in place arrangements required by an interim access restriction order, OFCOM may, by notice, require that person to (where possible) notify persons in the United Kingdom who attempt to access the relevant service via that facility of the interim access restriction order.

(8) In this section, “access facility” and “the court” have the same meaning as in section 146 (see subsections (10), (11) and (12) of that section).

Interaction with other action by OFCOM

148

(1) Where OFCOM apply for a business disruption order in respect of a failure by a provider of a regulated service to comply with an enforceable requirement, nothing in sections 144 to 147 is to be taken to prevent OFCOM also giving the provider—

(a) a confirmation decision in respect of the failure, or

(b) a penalty notice under section 139 in relation to a confirmation decision in respect of the failure.

(2) Where OFCOM apply for a business disruption order in respect of a failure by a provider of a Part 3 service to comply with a notice under section 121(1) (notices to deal with terrorism content and CSEA content), nothing in sections 144 to 147 is to be taken to prevent OFCOM also giving the provider either or both of the following—

(a) a further notice under section 121(1) (see section 126);

(b) a penalty notice under section 140(5).

(3) In this section, a “business disruption order” means—

(a) a service restriction order under section 144,

(b) an interim service restriction order under section 145,

(d) an interim access restriction order under section 147.

Publication of enforcement action

Publication by OFCOM of details of enforcement action

149

(1) Subsections (2) and (3) apply where OFCOM have given a person (and not withdrawn) any of the following—

(a) a confirmation decision;

(b) a penalty notice under section 139;

(d) a penalty notice under section 141(6).

(2) OFCOM must publish details identifying the person and describing—

(a) the failure (or failures) to which the decision or notice relates, and

(b) OFCOM’s response.

(3) But OFCOM may not publish anything that, in OFCOM’s opinion—

(a) is confidential in accordance with subsections (4) and (5), or

(b) is otherwise not appropriate for publication.

(4) A matter is confidential under this subsection if—

(a) it relates specifically to the affairs of a particular body, and

(b) publication of that matter would or might, in OFCOM’s opinion, seriously and prejudicially affect the interests of that body.

(5) A matter is confidential under this subsection if—

(a) it relates to the private affairs of an individual, and

(b) publication of that matter would or might, in OFCOM’s opinion, seriously and prejudicially affect the interests of that individual.

(6) Where OFCOM have given a person a provisional notice of contravention but have not given the person a confirmation decision, OFCOM may publish details identifying the person and describing the reasons for the provisional notice.

(7) OFCOM must notify the person concerned that information has been published under this section.

Publication by providers of details of enforcement action

150

(1) This section applies where—

(a) OFCOM have given a person (and not withdrawn) any of the following—

(i) a confirmation decision;

(ii) a penalty notice under section 139;

(iii) a penalty notice under section 140(5);

(iv) a penalty notice under section 141(6), and

(b) the appeal period in relation to the decision or notice has ended.

(2) OFCOM may give to the person a notice (a “publication notice”) requiring the person to—

(a) publish details describing—

(i) the failure (or failures) to which the decision or notice mentioned in subsection (1)(a) relates, and

(ii) OFCOM’s response, or

(b) otherwise notify users of the service to which the decision or notice mentioned in subsection (1)(a) relates of those details.

(3) A publication notice may require a person to publish details under subsection (2)(a) or give notification of details under subsection (2)(b) or both.

(4) A publication notice must—

(a) specify the decision or notice mentioned in subsection (1)(a) to which it relates,

(b) specify or describe the details that must be published or notified,

(d) specify a date by which the details must be published or notified, and

(e) contain information about the consequences of not complying with the notice.

(5) Where a publication notice requires a person to publish details under subsection (2)(a) the notice may also specify a period during which publication in the specified form and manner must continue.

(6) Where a publication notice requires a person to give notification of details under subsection (2)(b) the notice may only require that notification to be given to United Kingdom users of the service (see section 227).

(7) A publication notice may not require a person to publish or give notification of anything that, in OFCOM’s opinion—

(a) is confidential in accordance with subsections (8) and (9), or

(b) is otherwise not appropriate for publication or notification.

(8) A matter is confidential under this subsection if—

(a) it relates specifically to the affairs of a particular body, and

(b) publication or notification of that matter would or might, in OFCOM’s opinion, seriously and prejudicially affect the interests of that body.

(9) A matter is confidential under this subsection if—

(a) it relates to the private affairs of an individual, and

(b) publication or notification of that matter would or might, in OFCOM’s opinion, seriously and prejudicially affect the interests of that individual.

(10) A person to whom a publication notice is given has a duty to comply with it.

(11) The duty under subsection (10) is enforceable in civil proceedings by OFCOM—

(a) for an injunction,

(b) for specific performance of a statutory duty under section 45 of the Court of Session Act 1988, or

(12) For the purposes of subsection (1)(b) “the appeal period”, in relation to a decision or notice mentioned in subsection (1)(a), means—

(a) the period during which any appeal relating to the decision or notice may be made, or

(b) where such an appeal has been made, the period ending with the determination or withdrawal of that appeal.

Guidance

OFCOM’s guidance about enforcement action

151

(1) OFCOM must produce guidance for providers of regulated services about how OFCOM propose to exercise their functions under this Chapter.

(2) The guidance must, in particular, give information about the factors that OFCOM would consider it appropriate to take into account when taking, or considering taking, enforcement action relating to a person’s failure to comply with different kinds of enforceable requirements.

(3) In relation to any enforcement action by OFCOM which relates to a failure by a provider of a regulated service to comply with a relevant duty, the guidance must include provision explaining how OFCOM will take into account the impact (or possible impact) of such a failure on children.

(4) Before producing the guidance (including revised or replacement guidance), OFCOM must consult—

(a) the Secretary of State,

(b) the Information Commissioner, and

(5) OFCOM must publish the guidance (and any revised or replacement guidance).

(6) Guidelines prepared by OFCOM under section 392 of the Communications Act (amount of penalties) may, so far as relating to penalties imposed under this Chapter, be included in the same document as guidance under this section.

(7) In exercising their functions under this Chapter, or deciding whether to exercise them, OFCOM must have regard to the guidance for the time being published under this section.

(8) In this section, a “relevant duty” means—

(a) a duty set out in section 10 or 27 (illegal content),

(b) a duty set out in section 12 or 29 (children’s online safety), or

CHAPTER 7 — Committees, research and reports

Advisory committee on disinformation and misinformation

152

(1) OFCOM must, in accordance with the following provisions of this section, exercise their powers under paragraph 14 of the Schedule to the Office of Communications Act 2002 (committees of OFCOM) to establish and maintain a committee to provide the advice specified in this section.

(2) The committee is to consist of—

(a) a chairman appointed by OFCOM, and

(b) such number of other members appointed by OFCOM as OFCOM consider appropriate.

(3) In appointing persons to be members of the committee, OFCOM must have regard to the desirability of ensuring that the members of the committee include—

(a) persons representing the interests of United Kingdom users of regulated services,

(b) persons representing providers of regulated services, and

(4) The function of the committee is to provide advice to OFCOM (including other committees established by OFCOM) about—

(a) how providers of regulated services should deal with disinformation and misinformation on such services,

(b) OFCOM’s exercise of the power conferred by section 77 to require information about a matter listed in Part 1 or 2 of Schedule 8, so far as relating to disinformation and misinformation, and

(c) OFCOM’s exercise of their functions under section 11 of the Communications Act (duties to promote media literacy) in relation to countering disinformation and misinformation on regulated services.

(5) The committee must publish a report within the period of 18 months after being established, and after that must publish periodic reports.

Functions of the Content Board

153

(1) Section 13 of the Communications Act (functions of the Content Board) is amended as follows.

(2) At the beginning of subsection (2), insert “Subject to subsection (3A),”.

(3) After subsection (3) insert—

(3A) OFCOM may, but need not, confer on the Content Board functions in relation to matters that concern the nature or kind of online content in relation to which OFCOM have functions under the Online Safety Act 2023 (see Parts 3 and 5 of that Act).

(4) After subsection (7) insert—

(8) In this section references to “matters mentioned in subsection (2)” do not include references to the matters mentioned in subsection (3A).

Research about users’ experiences of regulated services

154

(1) Section 14 of the Communications Act (consumer research) is amended as follows.

(2) After subsection (6A) insert—

(6B) OFCOM must make arrangements for ascertaining— (a) the state of public opinion from time to time concerning providers of regulated services and their manner of operating their services; (b) the experiences of United Kingdom users of regulated services in relation to their use of such services; (c) the experiences of United Kingdom users of regulated user-to-user services and regulated search services in relation to the handling of complaints made by them to providers of such services; and (d) the interests and experiences of United Kingdom users of regulated services in relation to matters that are incidental to or otherwise connected with their experiences of using such services. (6C) OFCOM’s report under paragraph 12 of the Schedule to the Office of Communications Act 2002 for each financial year must contain a statement by OFCOM about the research that has been carried out in that year under subsection (6B).

(3) After subsection (8) insert—

(8A) In subsection (6B) the following terms have the same meaning as in the Online Safety Act 2023— - “provider” (see section 226 of that Act); - “regulated service”, “regulated user-to-user service” and “regulated search service” (see section 4 of that Act); - “United Kingdom user” (see section 227 of that Act).

Consumer consultation

155

(1) Section 16 of the Communications Act (consumer consultation) is amended as follows.

(2) In subsection (4), after paragraph (d) insert—

(da) regulated services;

(3) After subsection (5) insert—

(5A) As regards OFCOM’s functions under the Online Safety Act 2023 in relation to regulated services— (a) the reference in subsection (5) to “the contents” of a thing includes a reference to specific pieces of online content, but (b) subsection (5) is not to be read as preventing the Consumer Panel from being able to give advice about any matter that more generally concerns— (i) different kinds of online content in relation to which OFCOM have functions under that Act (see Parts 3 and 5 of that Act), and (ii) the impact that different kinds of such content may have on United Kingdom users of regulated services.

(4) After subsection (12) insert—

(12A) OFCOM’s report under paragraph 12 of the Schedule to the Office of Communications Act 2002 for each financial year must contain a statement by OFCOM about the arrangements for consultation that have been made in that year under this section, so far as the arrangements relate to regulated services.

(5) In subsection (13), in the definition of “domestic and small business consumer”, in paragraph (b)(i), after “available” insert “or a provider of a regulated service”.

(6) After subsection (13) insert—

(14) In this section the following terms have the same meaning as in the Online Safety Act 2023— - “provider”, in relation to a regulated service (see section 226 of that Act); - “regulated service” (see section 4 of that Act); - “United Kingdom user” (see section 227 of that Act).

OFCOM’s statement about freedom of expression and privacy

156

OFCOM’s report under paragraph 12 of the Schedule to the Office of Communications Act 2002 for each financial year must contain a statement by OFCOM about the steps they have taken, and the processes they operate, to ensure that their online safety functions have been exercised in that year compatibly with Articles 8 and 10 of the Convention (so far as relevant).

OFCOM’s reports about use of age assurance

157

(1) OFCOM must produce and publish a report assessing—

(a) how providers of regulated services have used age assurance for the purpose of compliance with their duties set out in this Act,

(b) how effective the use of age assurance has been for that purpose, and

(c) whether there are factors that have prevented or hindered the effective use of age assurance, or a particular kind of age assurance, for that purpose,

(and in this section, references to a report are to a report described in this subsection).

(2) A report must, in particular, consider whether the following have prevented or hindered the effective use of age assurance—

(a) the costs to providers of using it, and

(b) the need to protect users from a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of a regulated service (including, but not limited to, any such provision or rule concerning the processing of personal data).

(3) Unless the Secretary of State requires the production of a further report (see subsection (6)), the requirement in subsection (1) is met by producing and publishing one report within the period of 18 months beginning with the day on which sections 12 and 81(2) come into force (or if those provisions come into force on different days, the period of 18 months beginning with the later of those days).

(4) In preparing a report, OFCOM must consult—

(a) the Information Commissioner, and

(b) such other persons as OFCOM consider appropriate.

(5) OFCOM must send a copy of a report to the Secretary of State, and the Secretary of State must lay it before Parliament.

(6) The Secretary of State may require OFCOM to produce and publish a further report in response to—

(a) the development of age assurance technology, or

(b) evidence of the reduced effectiveness of such technology.

(7) But such a requirement may not be imposed—

(a) within the period of three years beginning with the date on which the first report is published, or

(b) more frequently than once every three years.

(8) For further provision about reports under this section, see section 164.

(9) In this section “age assurance” means age verification or age estimation.

OFCOM’s reports about news publisher content and journalistic content

158

(1) OFCOM must produce and publish a report assessing the impact of the regulatory framework provided for in this Act on the availability and treatment of news publisher content and journalistic content on Category 1 services (and in this section, references to a report are to a report described in this subsection).

(2) Unless the Secretary of State requires the production of a further report (see subsection (6)), the requirement in subsection (1) is met by producing and publishing one report within the period of two years beginning with the day on which sections 18 and 19 come into force (or if those sections come into force on different days, the period of two years beginning with the later of those days).

(3) A report must, in particular, consider how effective the duties to protect such content set out in sections 18 and 19 are at protecting it.

(4) In preparing a report, OFCOM must consult—

(a) persons who represent recognised news publishers,

(b) persons who appear to OFCOM to represent creators of journalistic content,

(d) such other persons as OFCOM consider appropriate.

(5) OFCOM must send a copy of a report to the Secretary of State, and the Secretary of State must lay it before Parliament.

(6) The Secretary of State may require OFCOM to produce and publish a further report if the Secretary of State considers that the regulatory framework provided for in this Act is, or may be, having a detrimental effect on the availability and treatment of news publisher content or journalistic content on Category 1 services.

(7) But such a requirement may not be imposed—

(a) within the period of three years beginning with the date on which the first report is published, or

(b) more frequently than once every three years.

(8) For further provision about reports under this section, see section 164.

(9) In this section—

“journalistic content” has the meaning given by section 19;

“news publisher content” has the meaning given by section 55;

“recognised news publisher” has the meaning given by section 56.

(10) For the meaning of “Category 1 service”, see section 95 (register of categories of services).

OFCOM’s transparency reports

159

(1) OFCOM must produce transparency reports based on information contained in the transparency reports produced by providers of Part 3 services under section 77.

(2) OFCOM’s transparency reports must contain—

(a) a summary of conclusions drawn from the transparency reports produced under section 77 regarding patterns or trends which OFCOM have identified in such reports,

Reading this document does not replace reading the official text published on legislation.gov.uk. Contains public sector information licensed under the Open Government Licence v3.0. We assume no responsibility for any inaccuracies arising from the conversion of the original CLML XML to this format.

This text is published under legislation.gov.uk's own terms of reuse, not a Legalize or public-domain licence. legislation.gov.uk
Open Government Licence v3.0 (attribution required)
© Crown and database right. Derived from content available under the Open Government Licence v3.0 from legislation.gov.uk.