Online Safety Act 2023

• (b) a summary of measures mentioned in such transparency reports which OFCOM consider to be good industry practice, and

• (c) any other information from such transparency reports which OFCOM consider it appropriate to include.

• (3) OFCOM’s first transparency report must be published by the end of the period of one year beginning with—

• (a) the day on which the first report under section 77 is published by a provider of a Part 3 service (see subsection (3)(d) of that section), or

• (b) if later, the earliest date specified by OFCOM for submission of a report under section 77 in a notice given to a provider (see subsection (3)(c) of that section).

• (4) OFCOM must publish a transparency report at least once a year after the publication of their first transparency report.

• (5) For further provision about reports under this section, see section 164.

OFCOM’s report about reporting and complaints procedures

160

• (1) OFCOM must produce a report assessing the measures taken or in use by providers of Part 3 services to enable users and others to—

• (a) report particular kinds of content present on such services, and

• (b) make complaints to providers of such services.

• (2) OFCOM’s report must take into account the experiences of users and others in reporting content and making complaints to providers of Part 3 services, including—

• (a) how clear the procedures are for reporting content and making complaints,

• (b) how easy it is to do those things, and

• (c) whether providers are taking appropriate and timely action in response to reports and complaints that are made.

• (3) The report must include advice from OFCOM about whether they consider that the Secretary of State should make regulations under section 217 (duty about alternative dispute resolution procedure).

• (4) In the report, OFCOM may make recommendations that they consider would improve the experiences of users and others in reporting content or making complaints to providers of Part 3 services, or would deliver better outcomes in relation to reports or complaints that are made.

• (5) In preparing the report under this section, OFCOM must consult—

• (a) the Secretary of State,

• (b) persons who appear to OFCOM to represent the interests of United Kingdom users of Part 3 services,

• (c) persons who appear to OFCOM to represent the interests of children (generally or with particular reference to online safety matters),

• (d) the Information Commissioner, and

• (e) such other persons as OFCOM consider appropriate.

• (6) The report may draw on OFCOM’s research under section 14 of the Communications Act (see subsection (6B) of that section).

• (7) The report is not required to address any matters which are the subject of a report by OFCOM under section 158 (report about the availability and treatment of news publisher content and journalistic content).

• (8) OFCOM must publish the report within the period of two years beginning with the day on which this section comes into force.

• (9) OFCOM must send a copy of the report to the Secretary of State, and the Secretary of State must lay it before Parliament.

• (10) The Secretary of State must publish a statement responding to the report within the period of three months beginning with the day on which the report is published, and the statement must include a response to OFCOM’s advice about whether to make regulations under section 217.

• (11) The statement must be published in such manner as the Secretary of State considers appropriate for bringing it to the attention of persons who may be affected by it.

• (12) For further provision about the report under this section, see section 164.

• (13) References in this section to “users and others” are to United Kingdom users and individuals in the United Kingdom.

OFCOM’s report about use of app stores by children

161

• (1) OFCOM must produce a report about the use of app stores by children.

• (2) In particular, the report must—

• (a) assess what role app stores play in children encountering content that is harmful to children, search content that is harmful to children or regulated provider pornographic content by means of regulated apps which the app stores make available,

• (b) assess the extent to which age assurance is currently used by providers of app stores, and how effective it is, and

• (c) explore whether children’s online safety would be better protected by the greater use of age assurance or particular kinds of age assurance by such providers, or by other measures.

• (3) OFCOM must publish the report during the period beginning two years, and ending three years, after the day on which sections 12 and 29 come into force (or if those sections come into force on different days, the later of those days).

• (4) For further provision about the report under this section, see section 164.

• (5) In this section—

• “age assurance” means age verification or age estimation;

• “app” includes an app for use on any kind of device, and “app store” is to be read accordingly;

• “content that is harmful to children” has the same meaning as in Part 3 (see section 60);

• “regulated app” means an app for a regulated service;

• “regulated provider pornographic content” has the same meaning as in Part 5 (see section 79);

• “search content” has the same meaning as in Part 3 (see section 57).

• (6) In this section references to children are to children in the United Kingdom.

OFCOM’s report about researchers’ access to information

162

• (1) OFCOM must produce a report—

• (a) describing how, and to what extent, persons carrying out independent research into online safety matters are currently able to obtain information from providers of regulated services to inform their research,

• (b) exploring the legal and other issues which currently constrain the sharing of information for such purposes, and

• (c) assessing the extent to which greater access to information for such purposes might be achieved.

• (2) For the purposes of this section a person carries out “independent research” if the person carries out research on behalf of a person other than a provider of a regulated service.

• (3) In preparing the report, OFCOM must consult—

• (a) the Information Commissioner,

• (b) the Centre for Data Ethics and Innovation,

• (c) United Kingdom Research and Innovation,

• (d) persons who appear to OFCOM to represent providers of regulated services, and

• (e) such other persons as OFCOM consider appropriate.

• (4) OFCOM must publish the report within the period of 18 months beginning with the day on which this section comes into force.

• (5) OFCOM must send a copy of the report to the Secretary of State, and the Secretary of State must lay it before Parliament.

• (6) For further provision about the report under this section, see section 164.

• (7) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

• (8) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

• (9) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

• (10) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

OFCOM’s report in connection with investigation into a death

163

• (1) Subsection (2) applies if OFCOM receive—

• (a) a notice from a senior coroner under paragraph 1(2) of Schedule 5 to the Coroners and Justice Act 2009 in connection with an investigation into the death of a person;

• (b) a request for information in connection with the investigation of a procurator fiscal into, or an inquiry held or to be held in relation to, the death of a person;

• (c) a notice from a coroner under section 17A(2) of the Coroners Act (Northern Ireland) 1959 (c. 15 (N.I.)) in connection with—

• (i) an investigation to determine whether an inquest into the death of a person is necessary, or

• (ii) an inquest in relation to the death of a person.

• (2) OFCOM may produce a report for use by the coroner or procurator fiscal, dealing with any matters that they consider may be relevant.

• (3) In subsection (1)(b) “inquiry” means an inquiry held, or to be held, under the Inquiries into Fatal Accidents and Sudden Deaths etc. (Scotland) Act 2016 (asp 2).

OFCOM’s reports

164

• (1) OFCOM may from time to time produce and publish reports about online safety matters.

• (2) In publishing a report mentioned in subsection (5), OFCOM must have regard to the need to exclude from publication, so far as that is practicable, the matters which are confidential in accordance with subsections (3) and (4).

• (3) A matter is confidential under this subsection if—

• (a) it relates specifically to the affairs of a particular body, and

• (b) publication of that matter would or might, in OFCOM’s opinion, seriously and prejudicially affect the interests of that body.

• (4) A matter is confidential under this subsection if—

• (a) it relates to the private affairs of an individual, and

• (b) publication of that matter would or might, in OFCOM’s opinion, seriously and prejudicially affect the interests of that individual.

• (5) The reports referred to in subsection (2) are—

• (a) a report under section 128 (report in connection with notices to deal with terrorism content and CSEA content),

• (b) a report under section 157 (report about use of age assurance),

• (c) a report under section 158 (report about news publisher content and journalistic content),

• (d) a report under section 159 (transparency report),

• (e) a report under section 160 (report about reporting and complaints procedures),

• (f) a report under section 161 (report about use of app stores by children),

• (g) a report under section 162 (report about researchers’ access to information), and

• (h) a report produced under this section.

• (6) See also section 116(3) (restriction on publishing intelligence service information).

CHAPTER 8 — Media literacy

Media literacy

165

• (1) Section 11 of the Communications Act is amended in accordance with subsections (2) to (5).

• (2) Before subsection (1) insert—

(A1) In this section— (a) subsection (1) imposes duties on OFCOM which apply in relation to material published by means of the electronic media (including by means of regulated services), and (b) subsections (1A) to (1E) expand on those duties, and impose further duties on OFCOM, in relation to regulated services only.

• (3) After subsection (1) insert—

(1A) OFCOM must take such steps, and enter into such arrangements, as they consider most likely to be effective in heightening the public’s awareness and understanding of ways in which they can protect themselves and others when using regulated services, in particular by helping them to— (a) understand the nature and impact of harmful content and the harmful ways in which regulated services may be used, especially content and activity disproportionately affecting particular groups, including women and girls; (b) reduce their and others’ exposure to harmful content and to the use of regulated services in harmful ways, especially content and activity disproportionately affecting particular groups, including women and girls; (c) use or apply— (i) features included in a regulated service, including features mentioned in section 15(2) of the Online Safety Act 2023, and (ii) tools or apps, including tools such as browser extensions, so as to mitigate the harms mentioned in paragraph (b); (d) establish the reliability, accuracy and authenticity of content; (e) understand the nature and impact of disinformation and misinformation, and reduce their and others’ exposure to it; (f) understand how their personal information may be protected. (1B) OFCOM must take such steps, and enter into such arrangements, as they consider most likely to encourage the development and use of technologies and systems for supporting users of regulated services to protect themselves and others as mentioned in paragraph (a), (b), (c), (d) or (e) of subsection (1A), including technologies and systems which— (a) provide further context to users about content they encounter; (b) help users to identify, and provide further context about, content of democratic importance present on regulated user-to-user services; (c) signpost users to resources, tools or information raising awareness about how to use regulated services so as to mitigate the harms mentioned in subsection (1A)(b). (1C) OFCOM’s duty under subsection (1A) is to be performed in the following ways (among others)— (a) pursuing activities and initiatives, (b) commissioning others to pursue activities and initiatives, (c) taking steps designed to encourage others to pursue activities and initiatives, and (d) making arrangements for the carrying out of research (see section 14(6)(a)). (1D) OFCOM must draw up, and from time to time review and revise, a statement recommending ways in which others, including providers of regulated services, might develop, pursue and evaluate activities or initiatives relevant to media literacy in relation to regulated services. (1E) OFCOM must publish the statement and any revised statement in such manner as they consider appropriate for bringing it to the attention of the persons who, in their opinion, are likely to be affected by it.

• (4) After subsection (2) insert—

(3) In this section and in section 11A, “regulated service” means— (a) a regulated user-to-user service, or (b) a regulated search service. “Regulated user-to-user service” and “regulated search service” have the same meaning as in the Online Safety Act 2023 (see section 4 of that Act). (4) In this section— (a) “content”, in relation to regulated services, means regulated user-generated content, search content or fraudulent advertisements; (b) the following terms have the same meaning as in the Online Safety Act 2023— - “content of democratic importance” (see section 17 of that Act); - “fraudulent advertisement” (see sections 38 and 39 of that Act); - “harm” (see section 234 of that Act) (and “harmful” is to be interpreted consistently with that section); - “provider” (see section 226 of that Act); - “regulated user-generated content” (see section 55 of that Act); - “search content” (see section 57 of that Act).

• (5) In the heading, for “Duty” substitute “Duties”.

• (6) In section 14 of the Communications Act (consumer research), in subsection (6)(a), after “11(1)” insert “, (1A) and (1B)”.

Media literacy strategy and media literacy statement

166

After section 11 of the Communications Act insert—

(11A) (1) OFCOM must prepare and publish a media literacy strategy within the period of one year beginning with the day on which the Online Safety Act 2023 is passed. (2) A media literacy strategy is a plan setting out how OFCOM propose to exercise their functions under section 11 in the period covered by the plan, which must be not more than three years. (3) In particular, a media literacy strategy must state OFCOM’s objectives and priorities for the period it covers. (4) Before the end of the period covered by a media literacy strategy, OFCOM must prepare and publish a media literacy strategy for a further period, ensuring that each successive strategy covers a period beginning immediately after the end of the last one. (5) In preparing or revising a media literacy strategy, OFCOM must consult such persons as they consider appropriate. (6) OFCOM’s annual report must contain a media literacy statement. (7) A media literacy statement is a statement by OFCOM— (a) summarising what they have done in the financial year to which the report relates in the exercise of their functions under section 11, and (b) assessing what progress has been made towards achieving the objectives and priorities set out in their media literacy strategy in that year. (8) A media literacy statement must include a summary and an evaluation of the activities and initiatives pursued or commissioned by OFCOM in the exercise of their functions under section 11 in the financial year to which the report relates. (9) The first annual report that is required to contain a media literacy statement is the report for the financial year during which OFCOM’s first media literacy strategy is published, and that first statement is to relate to the period from publication day until the end of that financial year. (10) But if OFCOM’s first media literacy strategy is published during the second half of a financial year— (a) the first annual report that is required to contain a media literacy statement is the report for the next financial year, and (b) that first statement is to relate to the period from publication day until the end of that financial year. (11) References in this section to OFCOM’s functions under section 11 are to those functions so far as they relate to regulated services. (12) In this section— - “annual report” means OFCOM’s annual report under paragraph 12 of the Schedule to the Office of Communications Act 2002; - “financial year” means a year ending with 31 March.

PART 8 — Appeals and super-complaints

CHAPTER 1 — Appeals

Appeals against OFCOM decisions relating to the register under section 95

167

• (1) This section applies to the following decisions of OFCOM—

• (a) a decision to include a regulated user-to-user service in the part of the register referred to in section 95(2)(a) (Category 1 services);

• (b) a decision not to remove a regulated user-to-user service from that part of the register;

• (c) a decision to include a regulated search service or a combined service in the part of the register referred to in section 95(2)(b) (Category 2A services);

• (d) a decision not to remove a regulated search service or a combined service from that part of the register;

• (e) a decision to include a regulated user-to-user service in the part of the register referred to in section 95(2)(c) (Category 2B services);

• (f) a decision not to remove a regulated user-to-user service from that part of the register.

• (2) The provider of the service to which the decision relates may appeal to the Upper Tribunal against the decision.

• (3) Where an appeal is made under subsection (1)(a), (c) or (e), any special requirements need not be complied with until the determination or withdrawal of the appeal.

• (4) “Special requirement” means—

• (a) in the case of an appeal against a decision mentioned in subsection (1)(a)—

• (i) any duty or requirement of this Act that applies in relation to Category 1 services but not in relation to any other regulated services, or

• (ii) any duty or requirement of this Act that applies in relation to Category 1 services, Category 2A services and Category 2B services but not in relation to any other regulated services;

• (b) in the case of an appeal against a decision mentioned in subsection (1)(c)—

• (i) any duty or requirement of this Act that applies in relation to Category 2A services but not in relation to any other regulated services, or

• (ii) any duty or requirement of this Act that applies in relation to Category 1 services, Category 2A services and Category 2B services but not in relation to any other regulated services;

• (c) in the case of an appeal against a decision mentioned in subsection (1)(e), any duty or requirement of this Act that applies in relation to Category 1 services, Category 2A services and Category 2B services but not in relation to any other regulated services.

• (5) The Upper Tribunal must decide the appeal by applying the same principles as would be applied—

• (a) by the High Court on an application for judicial review, or

• (b) in Scotland, on an application to the supervisory jurisdiction of the Court of Session.

• (6) On an appeal under this section, the Upper Tribunal may—

• (a) dismiss the appeal, or

• (b) quash the decision being challenged.

• (7) Where a decision is quashed, the Upper Tribunal must remit the decision to OFCOM for reconsideration with such directions (if any) as the Tribunal considers appropriate.

Appeals against OFCOM notices

168

• (1) An appeal to the Upper Tribunal against OFCOM’s decision to give to a person—

• (a) a notice under section 121(1) (notices to deal with terrorism content and CSEA content),

• (b) a confirmation decision, or

• (c) a penalty notice,

may be brought by any person with a sufficient interest in the decision.

• (2) An appeal under subsection (1) by a person other than the person given the notice or decision in question may be brought only with the permission (or leave) of the Upper Tribunal.

• (3) The Upper Tribunal must decide the appeal by applying the same principles as would be applied—

• (a) by the High Court on an application for judicial review, or

• (b) in Scotland, on an application to the supervisory jurisdiction of the Court of Session.

• (4) On an appeal under this section, the Upper Tribunal may—

• (a) dismiss the appeal, or

• (b) quash the decision being challenged.

• (5) Where a decision is quashed, the Upper Tribunal must remit the decision to OFCOM for reconsideration with such directions (if any) as the Tribunal considers appropriate.

• (6) In this section “penalty notice” means a penalty notice under section 139, 140(5) or 141(6).

CHAPTER 2 — Super-complaints

Power to make super-complaints

169

• (1) An eligible entity may make a complaint to OFCOM that any feature of one or more regulated services, or any conduct of one or more providers of such services, or any combination of such features and such conduct is, appears to be, or presents a material risk of—

• (a) causing significant harm to users of the services or members of the public, or a particular group of such users or members of the public;

• (b) significantly adversely affecting the right to freedom of expression within the law of users of the services or members of the public, or of a particular group of such users or members of the public; or

• (c) otherwise having a significant adverse impact on users of the services or members of the public, or on a particular group of such users or members of the public.

• (2) But a complaint under subsection (1) that relates to a single regulated service or that relates to a single provider of one or more regulated services is only admissible if OFCOM consider that—

• (a) the complaint is of particular importance, or

• (b) the complaint relates to the impacts on a particularly large number of users of the service or members of the public.

• (3) An entity is an “eligible entity” if the entity meets criteria specified in regulations made by the Secretary of State.

• (4) Regulations under subsection (3) must specify as one of the criteria that the entity must be a body representing the interests of users of regulated services, or members of the public, or a particular group of such users or members of the public.

• (5) Before making regulations under subsection (3), the Secretary of State must consult—

• (a) OFCOM, and

• (b) such other persons as the Secretary of State considers appropriate.

• (6) In this section—

• “conduct” includes acts and omissions;

• “users” means United Kingdom users (see section 227), except in subsection (1)(a) where “users” means individuals in the United Kingdom who are users of a service.

Procedure for super-complaints

170

• (1) The Secretary of State must make regulations containing provision about procedural matters relating to complaints under section 169.

• (2) Such regulations may, in particular, include provision about the following matters—

• (a) notification to OFCOM of an intention to make a complaint under section 169;

• (b) the form and manner of such a complaint, including requirements for supporting evidence in relation to—

• (i) matters mentioned in subsections (1) and (2) of section 169, and

• (ii) criteria specified in regulations under subsection (3) of that section;

• (c) steps that OFCOM must take in relation to such a complaint, including requirements for publication of responses;

• (d) time limits for taking steps in relation to such a complaint (or provision about how such time limits are to be determined) including time limits in relation to the determination of—

• (i) whether a complaint is a complaint that is within section 169(1),

• (ii) where applicable, whether a complaint is admissible under section 169(2), and

• (iii) whether an entity is an eligible entity (see section 169(3)).

• (3) Before making regulations under subsection (1), the Secretary of State must consult—

• (a) OFCOM, and

• (b) such other persons as the Secretary of State considers appropriate.

OFCOM’s guidance about super-complaints

171

• (1) OFCOM must produce guidance about complaints under section 169, which must include guidance about—

• (a) the criteria specified in regulations under section 169(3),

• (b) procedural matters relating to such complaints, and

• (c) any other aspect of such complaints that OFCOM consider it appropriate to include.

• (2) OFCOM must publish the guidance (and any revised or replacement guidance).

PART 9 — Secretary of State's functions in relation to regulated services

Strategic priorities

Statement of strategic priorities

172

• (1) The Secretary of State may designate a statement for the purposes of this section if the requirements set out in section 173 (consultation and parliamentary procedure) are satisfied.

• (2) The statement is a statement prepared by the Secretary of State that sets out strategic priorities of His Majesty’s Government in the United Kingdom relating to online safety matters.

• (3) The statement may, among other things, set out particular outcomes identified with a view to achieving the strategic priorities.

• (4) This section does not restrict the Secretary of State’s powers under any other provision of this Act or any other enactment.

• (5) A statement designated under subsection (1) must be published in such manner as the Secretary of State considers appropriate.

• (6) A statement designated under subsection (1) may be amended (including by replacing the whole or a part of the statement with new material) by a subsequent statement designated under that subsection, and this section and sections 92 and 173 apply in relation to any such subsequent statement as they apply in relation to the original statement.

• (7) Except as provided by subsection (8), no amendment may be made under subsection (6) within the period of five years beginning with the day on which a statement was most recently designated under subsection (1).

• (8) An earlier amendment may be made under subsection (6) if—

• (a) since that day—

• (i) a Parliamentary general election has taken place, or

• (ii) there has been a significant change in the policy of His Majesty’s Government affecting online safety matters, or

• (b) the Secretary of State considers that the statement, or any part of it, conflicts with any of OFCOM’s general duties (within the meaning of section 3 of the Communications Act).

Consultation and parliamentary procedure

173

• (1) This section sets out the requirements that must be satisfied in relation to a statement before the Secretary of State may designate it under section 172.

• (2) The Secretary of State must consult—

• (a) OFCOM, and

• (b) such other persons as the Secretary of State considers appropriate,

on a draft of the statement.

• (3) The Secretary of State must allow OFCOM a period of at least 40 days to respond to any consultation under subsection (2)(a).

• (4) After that period has ended the Secretary of State—

• (a) must make any changes to the draft that appear to the Secretary of State to be necessary in view of responses to the consultation, and

• (b) must then lay the draft before Parliament.

• (5) The Secretary of State must then wait until the end of the 40-day period and may not designate the statement if, within that period, either House of Parliament resolves not to approve it.

• (6) “The 40-day period” is the period of 40 days beginning with the day on which the draft is laid before Parliament (or, if it is not laid before each House on the same day, the later of the days on which it is laid).

• (7) In calculating the 40-day period, no account is to be taken of any period during which Parliament is dissolved or prorogued or during which both Houses are adjourned for more than 4 days.

Directions to OFCOM

“Harm” etc

174

• (1) The Secretary of State may give OFCOM a direction requiring OFCOM to establish a committee to provide them with advice about online safety matters of a kind specified in the direction.

• (2) The Secretary of State must consult OFCOM before giving or varying such a direction.

• (3) A committee required to be established by a direction is to consist of the following members, unless the direction specifies otherwise—

• (a) a chairman appointed by OFCOM, and

• (b) such number of other members appointed by OFCOM as OFCOM consider appropriate.

• (4) A committee required to be established by a direction must, unless the direction specifies otherwise, publish a report within the period of 18 months after being established, and after that must publish periodic reports.

• (5) The Secretary of State may vary or revoke a direction given under this section.

“Internet service”

175

• (1) The Secretary of State may give a direction to OFCOM under subsection (2) or (3) if the Secretary of State has reasonable grounds for believing that circumstances exist that present a threat—

• (a) to the health or safety of the public, or

• (b) to national security.

• (2) A direction under this subsection is a direction requiring OFCOM, in exercising their media literacy functions, to give priority for a specified period to specified objectives designed to address the threat presented by the circumstances mentioned in subsection (1).

• (3) A direction under this subsection is a direction requiring OFCOM to give a public statement notice to—

• (a) a specified provider of a regulated service, or

• (b) providers of regulated services generally.

• (4) A “public statement notice” is a notice requiring a provider of a regulated service to make a publicly available statement, by a date specified in the notice, about steps the provider is taking in response to the threat presented by the circumstances mentioned in subsection (1).

• (5) OFCOM may, by a public statement notice or a subsequent notice, require a provider of a regulated service to provide OFCOM with such information as they may require for the purpose of responding to that threat.

• (6) If a direction under subsection (2) or (3) is given on the ground mentioned in subsection (1)(a), the Secretary of State must publish the reasons for giving the direction.

• (7) The Secretary of State may vary or revoke a direction given under subsection (2) or (3).

• (8) If the Secretary of State varies or revokes a direction given under subsection (3), OFCOM may, in consequence, vary or revoke a public statement notice that they have given by virtue of the direction.

• (9) In subsection (2) “media literacy functions” means OFCOM’s functions under section 11 of the Communications Act (duties to promote media literacy), so far as functions under that section relate to regulated services.

• (10) In subsections (2) and (3) “specified” means specified in a direction under this section.

Guidance

Secretary of State’s guidance

176

• (1) The Secretary of State may issue guidance to OFCOM about—

• (a) OFCOM’s exercise of their functions under this Act,

• (b) OFCOM’s exercise of their powers under section 1(3) of the Communications Act (functions and general powers of OFCOM) to carry out research in connection with online safety matters or to arrange for others to carry out research in connection with such matters, and

• (c) OFCOM’s exercise of their functions under section 11 of the Communications Act (media literacy) in relation to regulated services.

• (2) In the rest of this section, “the guidance” means any such guidance as is mentioned in subsection (1), except that it does not include guidance under section 87 (guidance to OFCOM about fees).

• (3) The Secretary of State must consult OFCOM before issuing, revising or replacing the guidance.

• (4) The guidance may not be revised or replaced more frequently than once every three years unless—

• (a) the guidance needs to be corrected because of an amendment, repeal or modification of any provision of this Act or of section 11 of the Communications Act, or

• (b) the revision or replacement is by agreement between the Secretary of State and OFCOM.

• (5) The guidance must be issued as one document.

• (6) The Secretary of State must lay the guidance (including revised or replacement guidance) before Parliament.

• (7) The Secretary of State must publish the guidance (and any revised or replacement guidance).

• (8) In exercising any functions to which the guidance relates, or deciding whether to exercise them, OFCOM must have regard to the guidance for the time being published under this section.

Annual report

Annual report on the Secretary of State’s functions

177

In section 390 of the Communications Act (annual report on the Secretary of State’s functions), in subsection (2), after paragraph (e) insert—

(f) the Online Safety Act 2023.

Review

Review

178

• (1) The Secretary of State must review the operation of—

• (a) the regulatory framework provided for in this Act, and

• (b) section 11 of the Communications Act, to the extent that that section relates to regulated services.

• (2) The review—

• (a) must not be carried out before the end of the period of two years beginning with the day on which the last of the provisions of Part 3 comes into force, but

• (b) must be carried out before the end of the period of five years beginning with that day.

• (3) The review must, in particular, consider how effective the regulatory framework provided for in this Act is at—

• (a) securing that regulated services are operated using systems and processes that, so far as relevant—

• (i) minimise the risk of harm to individuals in the United Kingdom presented by content on regulated services,

• (ii) provide higher levels of protection for children than for adults,

• (iii) provide transparency and accountability to users in relation to actions taken to comply with duties set out in Chapter 2, 3, 4 or 5 of Part 3, Chapter 1, 3 or 4 of Part 4, or Part 5,

• (iv) protect the right of users and (in the case of search services or combined services) interested persons to freedom of expression within the law, and

• (v) protect users from a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of a regulated service (including, but not limited to, any such provision or rule concerning the processing of personal data); and

• (b) ensuring that regulation of services is proportionate, having regard to the level of risk of harm presented by regulated services of different kinds and to the size and capacity of providers.

• (4) The review must also, in particular, consider—

• (a) the effectiveness of—

• (i) the information gathering and information sharing powers available to OFCOM, and

• (ii) the enforcement powers available to OFCOM; and

• (b) the extent to which OFCOM have had regard to the desirability of encouraging innovation by providers of regulated services.

• (5) In carrying out the review, the Secretary of State must consult—

• (a) OFCOM, and

• (b) such other persons as the Secretary of State considers appropriate.

• (6) In carrying out the review, the Secretary of State must take into account any report published by OFCOM under section 158 (reports about news publisher content and journalistic content).

• (7) The Secretary of State must produce and publish a report on the outcome of the review.

• (8) The report must be laid before Parliament.

• (9) In subsection (3) “content on regulated services” means—

• (a) regulated user-generated content present on regulated services,

• (b) search content of regulated services,

• (c) fraudulent advertisements present on regulated services, and

• (d) regulated provider pornographic content published or displayed on regulated services.

• (10) In subsection (9)—

• “fraudulent advertisement” has the meaning given by section 38 or 39 (depending on the kind of service in question);

• “regulated user-generated content” has the same meaning as in Part 3 (see section 55);

• “regulated provider pornographic content” and “published or displayed” have the same meaning as in Part 5 (see section 79);

• “search content” has the same meaning as in Part 3 (see section 57).

PART 10 — Communications offences

False and threatening communications offences

False communications offence

179

• (1) A person commits an offence if—

• (a) the person sends a message (see section 182),

• (b) the message conveys information that the person knows to be false,

• (c) at the time of sending it, the person intended the message, or the information in it, to cause non-trivial psychological or physical harm to a likely audience, and

• (d) the person has no reasonable excuse for sending the message.

• (2) For the purposes of this offence an individual is a “likely audience” of a message if, at the time the message is sent, it is reasonably foreseeable that the individual—

• (a) would encounter the message, or

• (b) in the online context, would encounter a subsequent message forwarding or sharing the content of the message.

• (3) In a case where several or many individuals are a likely audience, it is not necessary for the purposes of subsection (1)(c) that the person intended to cause harm to any one of them in particular (or to all of them).

• (4) See section 180 for exemptions from the offence under this section.

• (5) A person who commits an offence under this section is liable—

• (a) on summary conviction in England and Wales, to imprisonment for a term not exceeding the maximum term for summary offences or a fine (or both);

• (b) on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding level 5 on the standard scale (or both).

• (6) In subsection (5)(a) “the maximum term for summary offences” means—

• (a) if the offence is committed before the time when section 281(5) of the Criminal Justice Act 2003 comes into force, 6 months;

• (b) if the offence is committed after that time, 51 weeks.

• (7) Proceedings for an offence under this section may be brought within the period of 6 months beginning with the date on which evidence sufficient in the opinion of the prosecutor to justify the proceedings comes to the prosecutor’s knowledge.

• (8) But such proceedings may not be brought by virtue of subsection (7) more than 3 years after the commission of the offence.

• (9) A certificate signed by the prosecutor as to the date on which the evidence in question came to the prosecutor’s knowledge is conclusive evidence of the date on which it did so; and a certificate to that effect and purporting to be so signed is to be treated as being so signed unless the contrary is proved.

Exemptions from offence under section 179

180

• (1) A recognised news publisher cannot commit an offence under section 179.

• (2) An offence under section 179 cannot be committed by the holder of a licence under the Broadcasting Act 1990 or 1996 in connection with anything done under the authority of the licence.

• (3) An offence under section 179 cannot be committed by the holder of a multiplex licence in connection with anything done under the authority of the licence.

• (4) An offence under section 179 cannot be committed by the provider of an on-demand programme service in connection with anything done in the course of providing such a service.

• (5) An offence under section 179 cannot be committed in connection with the showing of a film made for cinema to members of the public.

Threatening communications offence

181

• (1) A person commits an offence if—

• (a) the person sends a message (see section 182),

• (b) the message conveys a threat of death or serious harm, and

• (c) at the time of sending it, the person—

• (i) intended an individual encountering the message to fear that the threat would be carried out (whether or not by the person sending the message), or

• (ii) was reckless as to whether an individual encountering the message would fear that the threat would be carried out (whether or not by the person sending the message).

• (2) “Serious harm” means—

• (a) serious injury amounting to grievous bodily harm within the meaning of the Offences against the Person Act 1861,

• (b) rape,

• (c) assault by penetration within the meaning of section 2 of the Sexual Offences Act 2003, or

• (d) serious financial loss.

• (3) In proceedings for an offence under this section relating to a threat of serious financial loss, it is a defence for the person to show that—

• (a) the threat was used to reinforce a reasonable demand, and

• (b) the person reasonably believed that the use of the threat was a proper means of reinforcing the demand.

• (4) If evidence is adduced which is sufficient to raise an issue with respect to the defence under subsection (3), the court must assume that the defence is satisfied unless the prosecution proves beyond reasonable doubt that it is not.

• (5) A person who commits an offence under this section is liable—

• (a) on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);

• (b) on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);

• (c) on conviction on indictment, to imprisonment for a term not exceeding 5 years or a fine (or both).

Interpretation of sections 179 to 181

182

• (1) This section applies for the purposes of sections 179 to 181, and references in this section to an offence are to an offence under section 179 or 181.

• (2) A person “sends a message” if the person—

• (a) sends, transmits or publishes a communication (including an oral communication) by electronic means, or

• (b) sends, or gives to an individual, a letter or a thing of any other description,

and references to a message are to be read accordingly.

• (3) A person also “sends a message” if the person—

• (a) causes a communication (including an oral communication) to be sent, transmitted or published by electronic means, or

• (b) causes a letter or a thing of any other description to be—

• (i) sent, or

• (ii) given to an individual.

• (4) But a provider of an internet service by means of which a communication is sent, transmitted or published is not to be regarded as a person who sends a message.

• (5) “Encounter”, in relation to a message, means read, view, hear or otherwise experience the message.

• (6) It does not matter whether the content of a message is created by the person who sends it (so for example, in the online context, an offence may be committed by a person who forwards another person’s direct message or shares another person’s post).

• (7) In the application of sections 179 to 181 to the sending by electronic means of a message consisting of or including a hyperlink to other content—

• (a) references to the message are to be read as including references to content accessed directly via the hyperlink, and

• (b) an individual who is a likely audience in relation to the hyperlink for the purposes of section 179 is to be assumed to be a likely audience in relation to the linked content.

• (8) In the application of sections 179 to 181 to the sending of an item on which data is stored electronically, references to the message are to be read as including content accessed by means of the item to which the recipient is specifically directed by the sender (and in this subsection “sending” includes “giving”, and “sender” is to be read accordingly).

• (9) In the online context, the date on which a person commits an offence in relation to a message is the date on which the message is first sent by the person.

• (10) “Recognised news publisher” has the meaning given by section 56.

• (11) “Multiplex licence” means a licence under section 8 of the Wireless Telegraphy Act 2006 which authorises the provision of a multiplex service within the meaning of section 42(6) of that Act.

• (12) “On-demand programme service” has the same meaning as in the Communications Act (see section 368A of that Act), and a person is the “provider” of an on-demand programme service if the person has given notification of the person’s intention to provide that service in accordance with section 368BA of that Act.

Offences of sending or showing flashing images

Offences of sending or showing flashing images electronically

183

• (1) A person (A) commits an offence if—

• (a) A sends a communication by electronic means which consists of or includes flashing images (see subsection (13)),

• (b) either condition 1 or condition 2 is met, and

• (c) A has no reasonable excuse for sending the communication.

• (2) Condition 1 is that—

• (a) at the time the communication is sent, it is reasonably foreseeable that an individual with epilepsy would be among the individuals who would view it, and

• (b) A sends the communication with the intention that such an individual will suffer harm as a result of viewing the flashing images.

• (3) Condition 2 is that, when sending the communication—

• (a) A believes that an individual (B)—

• (i) whom A knows to be an individual with epilepsy, or

• (ii) whom A suspects to be an individual with epilepsy,

will, or might, view it, and

• (b) A intends that B will suffer harm as a result of viewing the flashing images.

• (4) In subsections (2)(a) and (3)(a), references to viewing the communication are to be read as including references to viewing a subsequent communication forwarding or sharing the content of the communication.

• (5) The exemptions contained in section 180 apply to an offence under subsection (1) as they apply to an offence under section 179.

• (6) For the purposes of subsection (1), a provider of an internet service by means of which a communication is sent is not to be regarded as a person who sends a communication.

• (7) In the application of subsection (1) to a communication consisting of or including a hyperlink to other content, references to the communication are to be read as including references to content accessed directly via the hyperlink.

• (8) A person (A) commits an offence if—

• (a) A shows an individual (B) flashing images by means of an electronic communications device,

• (b) when showing the images—

• (i) A knows that B is an individual with epilepsy, or

• (ii) A suspects that B is an individual with epilepsy,

• (c) when showing the images, A intends that B will suffer harm as a result of viewing them, and

• (d) A has no reasonable excuse for showing the images.

• (9) An offence under subsection (1) or (8) cannot be committed by a healthcare professional acting in that capacity.

• (10) A person who commits an offence under subsection (1) or (8) is liable—

• (a) on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);

• (b) on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);

• (c) on conviction on indictment, to imprisonment for a term not exceeding 5 years or a fine (or both).

• (11) It does not matter for the purposes of this section whether flashing images may be viewed at once (for example, a GIF that plays automatically) or only after some action is performed (for example, pressing play).

• (12) In this section—

• (a) references to sending a communication include references to causing a communication to be sent;

• (b) references to showing flashing images include references to causing flashing images to be shown.

• (13) In this section—

• “electronic communications device” means equipment or a device that is capable of transmitting images by electronic means;

• “flashing images” means images which carry a risk that an individual with photosensitive epilepsy who viewed them would suffer a seizure as a result;

• “harm” means— a seizure, or alarm or distress;

• “individual with epilepsy” includes, but is not limited to, an individual with photosensitive epilepsy;

• “send” includes transmit and publish (and related expressions are to be read accordingly).

Offence of encouraging or assisting serious self-harm

Offence of encouraging or assisting serious self-harm

184

• (1) A person (D) commits an offence if—

• (a) D does a relevant act capable of encouraging or assisting the serious self-harm of another person, and

• (b) D’s act was intended to encourage or assist the serious self-harm of another person.

• (2) D “does a relevant act” if D—

• (a) communicates in person,

• (b) sends, transmits or publishes a communication by electronic means,

• (c) shows a person such a communication,

• (d) publishes material by any means other than electronic means,

• (e) sends, gives, shows or makes available to a person—

• (i) material published as mentioned in paragraph (d), or

• (ii) any form of correspondence, or

• (f) sends, gives or makes available to a person an item on which data is stored electronically.

• (3) “Serious self-harm” means self-harm amounting to—

• (a) in England and Wales and Northern Ireland, grievous bodily harm within the meaning of the Offences Against the Person Act 1861, and

• (b) in Scotland, severe injury,

and includes successive acts of self-harm which cumulatively reach that threshold.

• (4) The person referred to in subsection (1)(a) and (b) need not be a specific person (or class of persons) known to, or identified by, D.

• (5) D may commit an offence under this section whether or not serious self-harm occurs.

• (6) If a person (D1) arranges for a person (D2) to do an act that is capable of encouraging or assisting the serious self-harm of another person and D2 does that act, D1 is to be treated as also having done it.

• (7) In the application of subsection (1) to an act by D involving an electronic communication or a publication in physical form, it does not matter whether the content of the communication or publication is created by D (so for example, in the online context, the offence under this section may be committed by forwarding another person’s direct message or sharing another person’s post).

• (8) In the application of subsection (1) to the sending, transmission or publication by electronic means of a communication consisting of or including a hyperlink to other content, the reference in subsection (2)(b) to the communication is to be read as including a reference to content accessed directly via the hyperlink.

• (9) In the application of subsection (1) to an act by D involving an item on which data is stored electronically, the reference in subsection (2)(f) to the item is to be read as including a reference to content accessed by means of the item to which the person in receipt of the item is specifically directed by D.

• (10) A provider of an internet service by means of which a communication is sent, transmitted or published is not to be regarded as a person who sends, transmits or publishes it.

• (11) Any reference in this section to doing an act that is capable of encouraging the serious self-harm of another person includes a reference to doing so by threatening another person or otherwise putting pressure on another person to seriously self-harm.

“Seriously self-harm” is to be interpreted consistently with subsection (3).

• (12) Any reference to an act in this section, except in subsection (3), includes a reference to a course of conduct, and references to doing an act are to be read accordingly.

• (13) In subsection (3) “act” includes omission.

• (14) A person who commits an offence under this section is liable—

• (a) on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);

• (b) on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum (or both);

• (c) on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);

• (d) on conviction on indictment, to imprisonment for a term not exceeding 5 years or a fine (or both).

Further provision

Extra-territorial application and jurisdiction

185

• (1) Sections 179(1), 181(1) and 183(1) apply to an act done outside the United Kingdom, but only if the act is done by a person within subsection (2).

• (2) A person is within this subsection if the person is—

• (a) an individual who is habitually resident in England and Wales or Northern Ireland, or

• (b) a body incorporated or constituted under the law of England and Wales or Northern Ireland.

• (3) Section 184(1) applies to an act done outside the United Kingdom, but only if the act is done by a person within subsection (4).

• (4) A person is within this subsection if the person is—

• (a) an individual who is habitually resident in the United Kingdom, or

• (b) a body incorporated or constituted under the law of any part of the United Kingdom.

• (5) Proceedings for an offence committed under section 179, 181 or 183(1) outside the United Kingdom may be taken, and the offence may for incidental purposes be treated as having been committed, at any place in England and Wales or Northern Ireland.

• (6) Proceedings for an offence committed under section 184 outside the United Kingdom may be taken, and the offence may for incidental purposes be treated as having been committed, at any place in the United Kingdom.

• (7) In the application of subsection (6) to Scotland, any such proceedings against a person may be taken, and the offence may for incidental purposes be treated as having been committed—

• (a) in any sheriff court district in which the person is apprehended or is in custody, or

• (b) in such sheriff court district as the Lord Advocate may determine.

• (8) In subsection (7) “sheriff court district” is to be construed in accordance with the Criminal Procedure (Scotland) Act 1995 (see section 307(1) of that Act).

Liability of corporate officers

186

• (1) If an offence under section 179, 181, 183 or 184 is committed by a body corporate and it is proved that the offence—

• (a) has been committed with the consent or connivance of an officer of the body corporate, or

• (b) is attributable to any neglect on the part of an officer of the body corporate,

the officer (as well as the body corporate) commits the offence and is liable to be proceeded against and punished accordingly.

• (2) “Officer”, in relation to a body corporate, means—

• (a) a director, manager, associate, secretary or other similar officer, or

• (b) a person purporting to act in any such capacity.

In paragraph (a) “director”, in relation to a body corporate whose affairs are managed by its members, means a member of the body corporate.

• (3) If an offence under section 184 is committed by a Scottish partnership and it is proved that the offence—

• (a) has been committed with the consent or connivance of a partner of the partnership, or

• (b) is attributable to any neglect on the part of a partner of the partnership,

the partner (as well as the partnership) commits the offence and is liable to be proceeded against and punished accordingly.

• (4) “Partner”, in relation to a Scottish partnership, includes any person who was purporting to act as a partner.

Offences to be inserted into Sexual Offences Act 2003

Sending etc photograph or film of genitals

187

In the Sexual Offences Act 2003, after section 66 insert—

(66A) (1) A person (A) who intentionally sends or gives a photograph or film of any person’s genitals to another person (B) commits an offence if— (a) A intends that B will see the genitals and be caused alarm, distress or humiliation, or (b) A sends or gives such a photograph or film for the purpose of obtaining sexual gratification and is reckless as to whether B will be caused alarm, distress or humiliation. (2) References to sending or giving such a photograph or film to another person include, in particular— (a) sending it to another person by any means, electronically or otherwise, (b) showing it to another person, and (c) placing it for a particular person to find. (3) “Photograph” includes the negative as well as the positive version. (4) “Film” means a moving image. (5) References to a photograph or film also include— (a) an image, whether made or altered by computer graphics or in any other way, which appears to be a photograph or film, (b) a copy of a photograph, film or image within paragraph (a), and (c) data stored by any means which is capable of conversion into a photograph, film or image within paragraph (a). (6) A person who commits an offence under this section is liable— (a) on summary conviction, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both); (b) on conviction on indictment, to imprisonment for a term not exceeding two years.

Sharing or threatening to share intimate photograph or film

188

In the Sexual Offences Act 2003, after section 66A (inserted by section 187), insert—