Legalize / United Kingdom / Public General Act

Online Safety Act 2023

Type Public General Act

Publication 2023-10-26

Last updated 2026-04-07

State In force

Department Statute Law Database

Source legislation.gov.uk

articles Not indexed

Reform history JSON API

(a) the prevalence of the use of regulated user-to-user services for the commission or facilitation of that offence,

(b) the risk of harm to individuals in the United Kingdom presented by the use of such services for the commission or facilitation of that offence, and

(6) An offence may not be added to Schedule 7 if—

(a) the offence concerns—

(i) the infringement of intellectual property rights,

(ii) the safety or quality of goods (as opposed to what kind of goods they are), or

(iii) the performance of a service by a person not qualified to perform it; or

(b) it is an offence under Chapter 1 of Part 4 of the Digital Markets, Competition and Consumers Act 2024.

(7) The Secretary of State must consult the Scottish Ministers before making regulations under subsection (3) which—

(a) add an offence that extends only to Scotland, or

(b) amend or remove an entry specifying an offence that extends only to Scotland.

(8) The Secretary of State must consult the Department of Justice in Northern Ireland before making regulations under subsection (3) which—

(a) add an offence that extends only to Northern Ireland, or

(b) amend or remove an entry specifying an offence that extends only to Northern Ireland.

(9) In this section—

(a) “regulated user-generated content” has the same meaning as in Part 3 (see section 55);

(b) “search content” has the same meaning as in Part 3 (see section 57);

(c) references to content that amounts to an offence are to be construed in accordance with section 59 (see subsections (3), (11) and (12) of that section).

Regulations

Power to make consequential provision

223

(1) The Secretary of State may by regulations make provision that is consequential on this Act or regulations under this Act.

(2) The regulations may—

(a) amend or repeal provision made by the Communications Act;

(b) amend or revoke provision made under that Act.

(3) The regulations may make transitional, transitory or saving provision.

Regulations: general

224

(1) Regulations under this Act may make different provision for different purposes and may, in particular—

(a) make different provision with regard to—

(i) user-to-user services,

(ii) search services, and

(iii) internet services, other than regulated user-to-user services or regulated search services, that are within section 80(2);

(b) make different provision with regard to user-to-user services of different kinds;

(d) make different provision with regard to different kinds of services mentioned in paragraph (a)(iii);

(e) make different provision with regard to different kinds of internet services within section 80(2).

(2) A power to make regulations under this Act includes power to make supplementary, incidental, transitional, transitory or saving provision.

This subsection does not apply to regulations under section 223 (consequential provision).

(3) Any power of the Secretary of State or OFCOM under this Act to make regulations is exercisable by statutory instrument.

(4) The Statutory Instruments Act 1946 applies in relation to OFCOM’s powers to make regulations under this Act as if OFCOM were a Minister of the Crown.

(5) The Documentary Evidence Act 1868 (proof of orders and regulations etc) has effect as if—

(a) OFCOM were included in the first column of the Schedule to that Act;

(b) OFCOM and persons authorised to act on their behalf were mentioned in the second column of that Schedule.

(6) This section does not apply to regulations under section 240 (commencement and transitional provision).

Parliamentary procedure for regulations

225

(1) A statutory instrument containing (whether alone or with other provision)—

(a) regulations under section 77(12),

(b) regulations under section 85(1),

(d) regulations under section 169(3),

(e) regulations under section 211(2),

(f) regulations under section 215(1),

(g) regulations under section 217(1),

(h) regulations under section 218(1),

(i) regulations under section 220(1), (2), (4), (6), (7), (9) or (13),

(j) regulations under section 221(1),

(k) regulations under section 222(1) or (3),

(l) regulations under section 223 that amend or repeal provision made by the Communications Act,

(m) regulations under paragraph 7 of Schedule 4,

(n) regulations under paragraph 38 of Schedule 8,

(o) regulations under paragraph 7 of Schedule 10, or

(p) regulations under paragraph 5(9) of Schedule 13,

may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament.

(2) A statutory instrument containing regulations under section 219(1) may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament.

(3) But a statutory instrument mentioned in subsection (2) may be made without a draft of the instrument being laid before, and approved by a resolution of, each House of Parliament if it contains a declaration that the Secretary of State is of the opinion that, because of urgency, it is necessary to make the regulations without a draft being so laid and approved.

(4) After an instrument is made in accordance with subsection (3), it must be laid before Parliament.

(5) Regulations contained in an instrument made in accordance with subsection (3) cease to have effect at the end of the period of 28 days beginning with the day on which the instrument is made unless, during that period, the instrument is approved by a resolution of each House of Parliament.

(6) In calculating the period of 28 days, no account is to be taken of any whole days that fall within a period during which—

(a) Parliament is dissolved or prorogued, or

(b) either House of Parliament is adjourned for more than 4 days.

(7) If regulations cease to have effect as a result of subsection (5), that does not—

(a) affect the validity of anything previously done under or by virtue of the regulations, or

(b) prevent the making of new regulations.

(8) A statutory instrument containing (whether alone or with other provision) the first regulations under the following provisions may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament—

(a) section 154A(1);

(b) paragraph 1(1) of Schedule 11.

(9) Any other statutory instrument containing regulations under a provision mentioned in subsection (8) is subject to annulment in pursuance of a resolution of either House of Parliament.

(10) A statutory instrument containing—

(a) regulations under section 67(1),

(b) regulations under section 85(2),

(ca) regulations under section 101(E1)(a),

(d) regulations under section 170(1),

(e) regulations under section 223 that do not amend or repeal provision made by the Communications Act,

(f) regulations under paragraph 8(1) of Schedule 3, or

(g) regulations under paragraph 1(2) or (3) of Schedule 11,

is subject to annulment in pursuance of a resolution of either House of Parliament.

(11) As soon as a draft of a statutory instrument containing regulations under section 85(1) or paragraph 5(9) of Schedule 13 (whether alone or with provision under section 85(2)) is ready for laying before Parliament, OFCOM must send the draft to the Secretary of State, and the Secretary of State must lay the draft before Parliament.

(12) Immediately after making a statutory instrument containing only regulations under section 85(2), OFCOM must send the instrument to the Secretary of State, and the Secretary of State must lay it before Parliament.

(13) Regulations made by the Scottish Ministers under—

(a) section 221(3), and

(b) section 222(2),

are subject to the affirmative procedure (see section 29 of the Interpretation and Legislative Reform (Scotland) Act 2010 (asp 10)).

(14) A statutory instrument containing regulations under section 221(5) may not be made by the Welsh Ministers unless a draft of the instrument has been laid before and approved by a resolution of Senedd Cymru.

(15) The power of the relevant Department to make regulations under section 221(7) is exercisable by statutory rule for the purposes of the Statutory Rules (Northern Ireland) Order 1979 (S.I. 1979/1573 (N.I. 12)).

(16) Regulations may not be made by the relevant Department under section 221(7) unless a draft of the regulations has been laid before and approved by a resolution of the Northern Ireland Assembly.

(17) In subsections (15) and (16), “the relevant Department” has the same meaning as in section 221(7) (see subsection (8) of that section).

PART 12 — Interpretation and final provisions

Interpretation

“Provider” of internet service

226

(1) This section applies to determine who is the “provider” of an internet service for the purposes of this Act.

User-to-user services (other than combined services) 2 The provider of a user-to-user service is to be treated as being the entity that has control over who can use the user-to-user part of the service (and that entity alone). 3 If no entity has control over who can use the user-to-user part of a user-to-user service, but an individual or individuals have control over who can use that part, the provider of the service is to be treated as being that individual or those individuals.

Search services 4 The provider of a search service is to be treated as being the entity that has control over the operations of the search engine (and that entity alone). 5 If no entity has control over the operations of the search engine, but an individual or individuals have control over those operations, the provider of the search service is to be treated as being that individual or those individuals.

Combined services 6 The provider of a combined service is to be treated as being the entity that has control over both— a who can use the user-to-user part of the service, and b the operations of the search engine, (and that entity alone). 7 If no entity has control over the matters mentioned in paragraphs (a) and (b) of subsection (6), but an individual or individuals have control over both those matters, the provider of the combined service is to be treated as being that individual or those individuals.

Internet services other than user-to-user services or search services 8 The provider of an internet service, other than a user-to-user service or a search service, is to be treated as being the entity that has control over which content is published or displayed on the service. 9 If no entity has control over which content is published or displayed on such an internet service, but an individual or individuals have control over which content is published or displayed, the provider of the service is to be treated as being that individual or those individuals.

Machine-generated services 10 The provider of an internet service that is generated by a machine is to be treated as being the entity that controls the machine (and that entity alone). 11 If no entity controls the machine, but an individual or individuals control it, the provider of the internet service is to be treated as being that individual or those individuals.

Interpretation 12 A person who provides an access facility in relation to a user-to-user service, within the meaning of section 146, is not to be regarded as a person who has control over who can use the user-to-user part of the service for the purposes of this section. 13 In this section “operations of the search engine” means operations which— a enable users of a search service or a combined service to make search requests, and b generate responses to those requests. 14 In this section “published or displayed” is to be construed in accordance with section 79(6). 15 For the purposes of subsections (8) and (9), a person who makes available on a service an automated tool or algorithm by means of which content is generated is to be regarded as having control over content so generated.

“User”, “United Kingdom user” and “interested person”

227

(1) For the purposes of this Act a user is a “United Kingdom user” of a service if—

(a) where the user is an individual, the individual is in the United Kingdom;

(b) where the user is an entity, the entity is incorporated or formed under the law of any part of the United Kingdom.

(2) For the purposes of references in this Act to a user of a service it does not matter whether a person is registered to use a service.

(3) References in this Act to a user of a service do not include references to any of the following when acting in the course of the provider’s business—

(a) where the provider of the service is an individual or individuals, that individual or those individuals;

(b) where the provider is an entity, officers of the entity;

(d) any other person providing a business service to the provider such as a contractor, consultant or auditor.

(4) In subsection (3) “acting in the course of the provider’s business” means (as the case may be)—

(a) acting in the course of the provider’s business of providing the service, or

(b) acting in the course of a business, trade, profession or other concern—

(i) carried on (whether or not for profit) by the provider of the service, and

(ii) for the purposes of which the service is provided.

(5) In subsections (1) to (4) “service” (except in the term “business service”) means internet service, user-to-user service or search service.

(6) In subsection (3) “officer” includes a director, manager, partner, associate, secretary or other similar officer.

(7) In this Act “interested person”, in relation to a search service or a combined service, means a person that is responsible for a website or database capable of being searched by the search engine, provided that—

(a) in the case of an individual, the individual is in the United Kingdom;

(b) in the case of an entity, the entity is incorporated or formed under the law of any part of the United Kingdom.

Maximum amount of penalties

228

(1) In this Act “internet service” means a service that is made available by means of the internet.

(2) For the purposes of subsection (1) a service is “made available by means of the internet” even where it is made available by means of a combination of—

(a) the internet, and

(b) an electronic communications service.

(3) “Electronic communications service” has the same meaning as in the Communications Act (see section 32(2) of that Act).

“Search engine”

229

(1) In this Act “search engine”—

(a) includes a service or functionality which enables a person to search some websites or databases (as well as a service or functionality which enables a person to search (in principle) all websites or databases);

(b) does not include a service which enables a person to search just one website or database.

(2) For the purposes of this Act, a search engine is not to be taken to be “included” in an internet service or a user-to-user service if the search engine is controlled by a person who does not control other parts of the service.

“Age verification” and “age estimation”

230

(1) This section applies for the purposes of this Act.

(2) “Age verification” means any measure designed to verify the exact age of users of a regulated service.

(3) “Age estimation” means any measure designed to estimate the age or age-range of users of a regulated service.

(4) A measure which requires a user to self-declare their age (without more) is not to be regarded as age verification or age estimation.

“Proactive technology”

231

(1) In this Act “proactive technology” means—

(a) content identification technology,

(b) user profiling technology, or

but this is subject to subsections (3) and (7).

(2) “Content identification technology” means technology, such as algorithms, keyword matching, image matching or image classification, which analyses content to assess whether it is content of a particular kind (for example, illegal content).

(3) But content identification technology is not to be regarded as proactive technology if it is used in response to a report from a user or other person about particular content.

(4) “User profiling technology” means technology which analyses (any or all of)—

(a) relevant content,

(b) user data, or

for the purposes of building a profile of a user to assess characteristics such as age.

(5) Technology which—

(a) analyses data specifically provided by a user for the purposes of the provider verifying or estimating the user’s age in order to decide whether to allow the user to access a service (or part of a service) or particular content, and

(b) does not analyse any other data or content,

is not to be regarded as user profiling technology.

(6) “Behaviour identification technology” means technology which analyses (any or all of)—

(a) relevant content,

(b) user data, or

to assess a user’s online behaviour or patterns of online behaviour (for example, to assess whether a user may be involved in, or be the victim of, illegal activity).

(7) But behaviour identification technology is not to be regarded as proactive technology if it is used in response to concerns identified by another person or an automated tool about a particular user.

(8) “Relevant content” means—

(a) in relation to a user-to-user service, content that is user-generated content in relation to the service;

(b) in relation to a search service, the content of websites and databases capable of being searched by the search engine;

(c) in relation to an internet service within section 80(2), content that is provider pornographic content in relation to the service.

(9) “User data” means—

(a) data provided by users, including personal data (for example, data provided when a user sets up an account), and

(b) data created, compiled or obtained by providers of regulated services and relating to users (for example, data relating to when or where users access a service or how they use it).

(10) References in this Act to proactive technology include content identification technology, user profiling technology or behaviour identification technology which utilises artificial intelligence or machine learning.

(11) Accredited technology that may be required to be used in relation to the detection of terrorism content or CSEA content (or both) by a notice under section 121(1) is an example of content identification technology.

(12) The reference in subsection (8)(b) to a search service includes a reference to the search engine of a combined service.

(13) In this section—

“accredited” technology has the same meaning as in Chapter 5 of Part 7 (see section 125(12));

“illegal content”, “terrorism content” and “CSEA content” have the same meaning as in Part 3 (see section 59);

“user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

Content communicated “publicly” or “privately”

232

(1) This section specifies factors which OFCOM must, in particular, consider when deciding whether content is communicated “publicly” or “privately” by means of a user-to-user service for the purposes of—

(a) section 121 (notice to deal with terrorism content),

(b) section 136 (requirement to use proactive technology), or

(2) The factors are—

(a) the number of individuals in the United Kingdom who are able to access the content by means of the service;

(b) any restrictions on who may access the content by means of the service (for example, a requirement for approval or permission from a user, or the provider, of the service);

(i) users of the service other than those who originally encounter it, or

(ii) users of another internet service.

(3) The following factors do not count as restrictions on access—

(a) a requirement to log in to or register with a service (or part of a service);

(b) a requirement to make a payment or take out a subscription in order to access a service (or part of a service) or to access particular content;

(c) inability to access a service (or part of a service) or to access particular content except by using particular technology or a particular kind of device (as long as that technology or device is generally available to the public).

“Functionality”

233

(1) In this Act “functionality”, in relation to a user-to-user service, includes any feature that enables interactions of any description between users of the service by means of the service, and includes any feature enabling a user to do anything listed in subsection (2).

(2) The things are—

(a) creating a user profile, including an anonymous or pseudonymous profile;

(b) searching within the service for user-generated content or other users of the service;

(d) sharing content on other internet services;

(e) sending direct messages to or speaking to other users of the service, or interacting with them in another way (for example by playing a game);

(f) expressing a view on content, including, for example, by—

(i) applying a “like” or “dislike” button or other button of that nature,

(ii) applying an emoji or symbol of any kind,

(iii) engaging in yes/no voting, or

(iv) rating or scoring content in any way (including giving star or numerical ratings);

(g) sharing current or historic location information with other users of the service, recording a user’s movements, or identifying which other users of the service are nearby;

(h) following or subscribing to particular kinds of content or particular users of the service;

(i) creating lists, collections, archives or directories of content or users of the service;

(j) tagging or labelling content present on the service;

(k) uploading content relating to goods or services;

(l) applying or changing settings on the service which affect the presentation of user-generated content on the service;

(m) accessing other internet services through content present on the service (for example through hyperlinks).

(3) In this Act “functionality”, in relation to a search service, includes (in particular)—

(a) a feature that enables users to search websites or databases;

(b) a feature that makes suggestions relating to users’ search requests (predictive search functionality).

(4) In this section “user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

“Harm” etc

234

(1) This section applies for the purposes of this Act, apart from Part 10 (communications offences).

(2) “Harm” means physical or psychological harm.

(3) References to harm presented by content, and any other references to harm in relation to content, include references to harm arising or that may arise from any one or combination of the following—

(a) the nature of the content;

(b) the fact of its dissemination;

(4) References to harm presented by content, and any other references to harm in relation to content, include references to cumulative harm arising or that may arise in the following circumstances—

(a) where content, or content of a particular kind, is repeatedly encountered by an individual (including, but not limited to, where content, or a kind of content, is sent to an individual by one user or by different users or encountered as a result of algorithms used by, or functionalities of, a service);

(b) where content of a particular kind is encountered by an individual in combination with content of a different kind (including, but not limited to, where a kind of content is sent to an individual by one user or by different users or encountered as a result of algorithms used by, or functionalities of, a service).

(5) References to harm presented by content, and any other references to harm in relation to content, include references to harm arising or that may arise in the following circumstances—

(a) where, as a result of the content, individuals act in a way that results in harm to themselves or that increases the likelihood of harm to themselves;

(b) where, as a result of the content, individuals do or say something to another individual that results in harm to that other individual or that increases the likelihood of such harm (including, but not limited to, where individuals act in such a way as a result of content that is related to that other individual’s characteristics or membership of a group).

(6) References to a risk of harm in relation to functionalities, and references to the risk of functionalities facilitating users encountering particular kinds of content (however expressed), include references to risks arising or that may arise due to multiple functionalities which, used in combination, increase the likelihood of harm arising (for example, as mentioned in subsection (4)).

(7) References to a risk of harm, or to potential harm, are to be read in the same way as references to harm.

(8) In contexts where harm (or a risk of harm or potential harm) relates to children, subsections (4) to (5) are to be read as if they referred to children instead of individuals.

“Online safety functions” and “online safety matters”

235

(1) In this Act references to OFCOM’s “online safety functions”—

(a) are references to—

(i) the functions that OFCOM have under this Act,

(ii) the functions that OFCOM have under the provisions of the Communications Act listed in subsection (2), so far as those functions relate to regulated services or Part 3 services (as the case may be), and

(iii) the functions that OFCOM have under section 3 of the Communications Act (general duties), so far as duties under that section relate to a function which is an online safety function by reason of sub-paragraph (i) or (ii);

(b) include references to OFCOM’s power to do anything appearing to them to be incidental or conducive to the carrying out of any of their functions within paragraph (a)(i) or (ii) (see section 1(3) of the Communications Act).

(2) These are the provisions of the Communications Act referred to in subsection (1)(a)(ii)—

(a) section 6 (duties to review regulatory burdens);

(b) section 7 (duty to carry out impact assessments);

(d) sections 11 and 11A (duties to promote media literacy);

(e) sections 12 and 13 (Content Board);

(f) section 14(6)(a) (research about media literacy);

(g) section 14(6B) (research about users’ experience of regulated services);

(h) section 16 (consumer consultation);

(i) section 20 (advisory committees for different parts of the United Kingdom);

(j) section 21 (advisory committee on elderly and disabled persons);

(k) section 22 (representation on international and other bodies);

(l) section 26 (publication of information and advice for consumers etc).

(3) References to OFCOM’s “online safety functions” also include references to OFCOM’s duty to comply with any of the following, so far as relating to the use of a regulated service by a person who has died—

(a) a notice from a senior coroner under paragraph 1(2) of Schedule 5 to the Coroners and Justice Act 2009 in connection with an investigation into a person’s death;

(b) a request for information in connection with the investigation of a procurator fiscal into, or an inquiry held or to be held in relation to, a person’s death;

(c) a notice from a coroner under section 17A(2) of the Coroners Act (Northern Ireland) 1959 (c. 15 (N.I.)) in connection with—

(i) an investigation to determine whether an inquest into a person’s death is necessary, or

(ii) an inquest in relation to a person’s death.

(4) In this Act “online safety matters” means the matters to which OFCOM’s online safety functions relate.

(5) In subsection (3)(b) “inquiry” means an inquiry held, or to be held, under the Inquiries into Fatal Accidents and Sudden Deaths etc. (Scotland) Act 2016 (asp 2).

Interpretation: general

236

(1) In this Act—

“adult” means a person aged 18 or over;

“audit notice” means a notice given under paragraph 4 of Schedule 12;

“automated tool” includes bot;

“capacity”: any reference to the capacity of a provider of a regulated service is to—the financial resources of the provider, andthe level of technical expertise which is available to the provider, or which it is reasonable to expect would be available to the provider given its size and financial resources;

“child” means a person under the age of 18;

“the Communications Act” means the Communications Act 2003;

“confirmation decision” means a notice given under section 132;

“content” means anything communicated by means of an internet service, whether publicly or privately, including written material or messages, oral communications, photographs, videos, visual images, music and data of any description;

“the Convention” has the meaning given by section 21(1) of the Human Rights Act 1998;

“country” includes territory;

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3(9) of that Act);

“document” means anything in which information (in whatever form) is recorded;

“encounter”, in relation to content, means read, view, hear or otherwise experience content;

“entity” means a body or association of persons or an organisation, regardless of whether the body, association or organisation is—formed under the law of any part of the United Kingdom or of a country outside the United Kingdom, ora legal person under the law under which it is formed;

“freedom of expression”: any reference to freedom of expression (except in sections 41(6)(f) and 78(2)(d)) is to the freedom to receive and impart ideas, opinions or information (referred to in Article 10(1) of the Convention) by means of speech, writing or images;

“identifying content” means content the function of which is to identify a user of an internet service (for example, a user name or profile picture);

“information notice” means a notice given under section 101(C1) or (1) or 101(1);

“measure”: any reference to a measure includes a reference to any system or process relevant to the operation of an internet service or any step or action which may be taken by a provider of an internet service to comply with duties or requirements under this Act;

“notice” means notice in writing;

“notify” means notify in writing, and “notification” is to be construed accordingly;

“OFCOM” means the Office of Communications;

“paid-for advertisement”: an advertisement is a “paid-for advertisement” in relation to an internet service if—the provider of the service receives any consideration (monetary or non-monetary) for the advertisement (whether directly from the advertiser or indirectly from another person), andthe placement of the advertisement is determined by systems or processes that are agreed between the parties entering into the contract relating to the advertisement;

“person” includes (in addition to an individual and a body of persons corporate or unincorporate) any organisation or association of persons;

“personal data” has the meaning given by section 3(2) of the Data Protection Act 2018;

“pornographic content” means content of such a nature that it is reasonable to assume that it was produced solely or principally for the purpose of sexual arousal;

“processing” has the meaning given by section 3(4) of the Data Protection Act 2018;

“provisional notice of contravention” means a notice given under section 130;

“publicly available” means available to members of the public in the United Kingdom;

“systems and/or processes”: any reference to systems and/or processes is to human or automated systems and/or processes, and accordingly includes technologies;

“taking down” (content): any reference to taking down content is to any action that results in content being removed from a user-to-user service or being permanently hidden so users of the service cannot encounter it (and related expressions are to be read accordingly);

“terms of service”, in relation to a user-to-user service, means all documents (whatever they are called) comprising the contract for use of the service (or of part of it) by United Kingdom users;

“user-to-user part”, in relation to a user-to-user service, means the part of the service on which content that is user-generated content in relation to the service is present.

(2) The definitions of “encounter” and “person” in subsection (1) do not apply for the purposes of Part 10 (for the definition of “encounter” in that Part, see section 182(5)).

(3) References in this Act to an individual with a certain characteristic include references to an individual with a combination of characteristics.

(4) References in this Act to a kind of user-to-user service or search service (or Part 3 service) include references to user-to-user services or search services grouped together for the purposes of a risk profile prepared by OFCOM under section 98 (and references to different kinds of user-to-user services or search services (or Part 3 services) are to be read accordingly).

(5) References in this Act to content (or content of a particular kind) present or prevalent on a user-to-user service (or on a part of it), or to the presence, incidence or prevalence of content (or content of a particular kind) on a user-to-user service (or on a part of it), do not include, in the case of a user-to-user service that includes a search engine—

(a) search content, or

(b) any other content that, following a search request, may be encountered as a result of subsequent interactions with internet services.

In this subsection “search content” and “search request” have the same meaning as in Part 3 (see section 57).

(6) For the purposes of this Act—

(a) any reference to the use of or access to a service, or to content present, published or displayed on a service, is to be taken to include use of or access to the service or content on registering or on the making of a payment or on subscription;

(b) any reference to content that is made available or that may be accessed, encountered or shared, is to be taken to include content that is made available or that may be accessed, encountered or shared for a limited period of time only;

and references to restrictions on access to a service or to content are to be read accordingly.

(7) For the purposes of this Act, content that is user-generated content in relation to an internet service does not cease to be such content in relation to the service when published or displayed on the service by means of—

(a) software or an automated tool or algorithm applied by the provider of the service or by a person acting on behalf of the provider, or

(b) an automated tool or algorithm made available on the service by the provider or by a person acting on behalf of the provider.

(8) Nothing in this Act (other than section 212) affects any prohibition or restriction in relation to pornographic content, or powers in relation to such content, under another enactment or rule of law.

(9) In this section, “user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

Index of defined terms

237

The following table sets out terms defined or explained for this Act or for a Part of this Act.

Term	Provision
adult	section 236
age estimation	section 230
age verification	section 230
audit notice	section 236
automated tool	section 236
capacity (of a provider)	section 236
Category 1 service	section 95(10)(a)
Category 2A service	section 95(10)(b)
Category 2B service	section 95(10)(c)
charging year (in Part 6)	section 90
child	section 236
children’s access assessment (in Part 3)	section 35
combined service	section 4(7)
the Communications Act	section 236
confirmation decision	section 236
content	section 236
content that is harmful to children (in Part 3)	section 60
the Convention	section 236
country	section 236
CSEA content (in Part 3)	section 59
the data protection legislation	section 236
document	section 236
encounter (content) (except in Part 10)	section 236
entity	section 236
freedom of expression	section 236
functionality	section 233
harm (except in Part 10)	section 234
identifying content	section 236
illegal content (in Part 3)	section 59
information notice	section 236
initial charging year (in Part 6)	section 90
interested person	section 227
internet service	section 228 (see also section 204(1))
journalistic content (in Part 3)	section 19
likely to be accessed by children (in Part 3)	section 37
measure	section 236
news publisher content (in Part 3)	section 55(8) to (10)
non-designated content that is harmful to children (in Part 3)	section 60
notice	section 236
notify, notification	section 236
OFCOM	section 236
online safety functions	section 235
online safety matters	section 235
paid-for advertisement	section 236
Part 3 service	section 4(3)
person (except in Part 10)	section 236
personal data	section 236
pornographic content	section 236
primary priority content that is harmful to children (in Part 3)	section 61
priority content that is harmful to children (in Part 3)	section 62
priority illegal content (in Part 3)	section 59
priority offence (in Part 3)	section 59
proactive technology	section 231
processing (of data)	section 236
provider	section 226
provider pornographic content (in Part 5)	section 79
provisional notice of contravention	section 236
publicly available	section 236
publicly/privately (in relation to communication of content)	section 232
published or displayed (in relation to pornographic content) (in Part 5)	section 79
recognised news publisher (in Part 3)	section 56
regulated provider pornographic content (in Part 5)	section 79
regulated search service	section 4(2)
regulated service	section 4(4)
regulated user-generated content (in Part 3)	section 55
regulated user-to-user service	section 4(2)
restricting users’ access to content (in Part 3)	section 58
search	section 57
search content	section 57
search engine	section 229
search request	section 57
search results	section 57
search service	section 3 (see also section 204(1))
systems and/or processes	section 236
taking down (content)	section 236
terms of service	section 236
terrorism content (in Part 3)	section 59
United Kingdom user	section 227
user	section 227
user-generated content (in Part 3)	section 55(3) and (4)
user-to-user part (of a service)	section 236
user-to-user service	section 3 (see also section 204(1))

Final provisions

Financial provisions

238

There is to be paid out of money provided by Parliament—

(a) any expenditure incurred under or by virtue of this Act by the Secretary of State, and

(b) any increase attributable to this Act in the sums payable under any other Act out of money so provided.

Extent

239

(1) Subject to the following provisions of this section, this Act extends to England and Wales, Scotland and Northern Ireland.

(2) The following provisions extend to England and Wales and Northern Ireland—

(a) sections 179 to 183;

(b) section 189(1).

(3) The following provisions extend to England and Wales only—

(a) section 187;

(b) section 188;

(d) section 190;

(e) section 213;

(f) section 214(1) to (3).

(4) Section 214(4) to (6) extends to Scotland only.

(5) The following provisions extend to Northern Ireland only—

(a) section 189(3);

(b) section 214(7) to (9).

(6) An amendment or repeal made by Schedule 14 has the same extent within the United Kingdom as the provision amended or repealed.

(7) His Majesty may by Order in Council provide for any of the provisions of this Act to extend, with or without modifications, to the Bailiwick of Guernsey or to the Isle of Man.

(8) Subsections (1) and (2) of section 224 apply to an Order in Council under subsection (7) as they apply to regulations under this Act.

(9) The power conferred by section 411(6) of the Communications Act may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment or repeal made by or under this Act of any part of that Act (with or without modifications).

(10) The power conferred by section 338 of the Criminal Justice Act 2003 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man the amendments of provisions of that Act made by paragraph 17 of Schedule 14.

(11) The power conferred by section 60(6) of the Modern Slavery Act 2015 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man the amendments of Schedule 4 to that Act made by paragraph 19 of Schedule 14.

(12) The power conferred by section 415(1) of the Sentencing Act 2020 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man the amendments of Schedule 18 to that Act made by paragraph 20 of Schedule 14.

Commencement and transitional provision

240

(1) Except as provided by subsection (4), this Act comes into force on such day as the Secretary of State may by regulations appoint.

(2) The power to make regulations under subsection (1) includes power to appoint different days for different purposes.

(3) Regulations under subsection (1) may not bring section 210 into force before the end of the period of six months beginning with the date specified in regulations under paragraph 8(1) of Schedule 3.

(4) The following provisions come into force on the day on which this Act is passed—

(a) Parts 1 and 2;

(b) Chapter 1 of Part 3;

(d) section 42 and Schedule 4;

(e) sections 43 to 48;

(f) section 52(3), (4) and (5);

(g) section 53, except subsection (2) of that section;

(h) Chapter 7 of Part 3 and Schedules 5, 6 and 7;

(i) section 70;

(j) section 74;

(k) section 79;

(l) section 80(4);

(m) section 82;

(n) sections 90 and 91;

(o) section 93;

(p) section 94 and Schedule 11;

(q) Chapter 3 of Part 7;

(r) sections 115 to 117;

(s) section 129;

(t) section 151;

(u) section 154 so far as relating to a duty imposed on OFCOM under Schedule 11;

(v) sections 169 and 170;

(w) section 193, except subsection (2)(b) of that section;

(x) section 194;

(y) section 204(1);

(z) section 207;

(z1) section 212;

(z2) section 214;

(z3) section 219;

(z4) sections 221 to 225;

(z5) this Part.

(5) The Secretary of State may by regulations make transitional, transitory or saving provision in connection with the coming into force of any provision of this Act.

(6) The power to make regulations under subsection (5) includes power to make different provision for different purposes.

(7) Regulations under this section are to be made by statutory instrument.

Short title

241

This Act may be cited as the Online Safety Act 2023.

SCHEDULE 1

PART 1 — Descriptions of services which are exempt

Email services

1

A user-to-user service is exempt if emails are the only user-generated content (other than identifying content) enabled by the service.

SMS and MMS services

2

(1) A user-to-user service is exempt if SMS messages are the only user-generated content (other than identifying content) enabled by the service.

(2) A user-to-user service is exempt if MMS messages are the only user-generated content (other than identifying content) enabled by the service.

(3) A user-to-user service is exempt if SMS messages and MMS messages are the only user-generated content (other than identifying content) enabled by the service.

(4) “SMS message” and “MMS message” have the meaning given by section 55(12).

Services offering only one-to-one live aural communications

3

(1) A user-to-user service is exempt if one-to-one live aural communications are the only user-generated content (other than identifying content) enabled by the service.

(2) “One-to-one live aural communications” has the meaning given by section 55(5).

Limited functionality services

4

(1) A user-to-user service is exempt if the functionalities of the service are limited, such that users are able to communicate by means of the service only in the following ways—

(a) posting comments or reviews relating to provider content;

(b) sharing such comments or reviews on a different internet service;

(i) applying a “like” or “dislike” button or other button of that nature,

(ii) applying an emoji or symbol of any kind,

(iii) engaging in yes/no voting, or

(iv) rating or scoring the content (or the comments or reviews) in any way (including giving star or numerical ratings);

(d) producing or displaying identifying content in connection with any of the activities described in paragraphs (a) to (c).

(2) In sub-paragraph (1), “provider content” means content published on a service by the provider of the service or by a person acting on behalf of the provider, including where the publication of the content is effected or controlled by means of—

(a) software or an automated tool or algorithm applied by the provider or by a person acting on behalf of the provider, or

(b) an automated tool or algorithm made available on the service by the provider or by a person acting on behalf of the provider.

(3) For the purposes of this paragraph, content that is user-generated content in relation to a service is not to be regarded as provider content in relation to that service.

Services which enable combinations of user-generated content

5

A user-to-user service is exempt if the only user-generated content enabled by the service is content of the following kinds—

(a) content mentioned in paragraph 1, 2 or 3 and related identifying content;

(b) content arising in connection with any of the activities described in paragraph 4(1).

Exception to exemptions in paragraphs 1 to 5

6

But a a user-to-user service described in any of paragraphs 1 to 5 is not exempt if—

(a) regulated provider pornographic content is published or displayed on the service, and

(b) the service has links with the United Kingdom within the meaning of section 80(4).

Internal business services (entire user-to-user service or search service)

7

(1) A user-to-user service or a search service is exempt if the conditions in sub-paragraph (2) are met in relation to the service.

(2) The conditions are—

(a) the user-to-user service or search service is an internal resource or tool for a business, or for more than one business carried on by the same person,

(b) the person carrying on the business (or businesses) (“P”) is the provider of the user-to-user service or search service, and

(c) the user-to-user service or search service is available only to a closed group of people comprising some or all of the following—

(i) where P is an individual or individuals, that individual or those individuals,

(ii) where P is an entity, officers of P,

(iii) persons who work for P (including as employees or volunteers) for the purposes of any activities of the business (or any of the businesses) in question, and

(iv) any other persons authorised by a person within sub-paragraph (i), (ii) or (iii) to use the service for the purposes of any activities of the business (or any of the businesses) in question (for example, a contractor, consultant or auditor, or in the case of an educational institution, pupils or students).

(3) In this paragraph—

“business” includes trade, profession, educational institution or other concern (whether or not carried on for profit);

“officer” includes a director, manager, partner, associate, secretary, governor, trustee or other similar officer.

Internal business services (part of user-to-user service or search service)

8

(1) A user-to-user service is exempt if—

(a) the conditions in paragraph 7(2) are met in relation to a part of the service,

(b) no user-generated content is enabled by the rest of the service, and

(2) A user-to-user service is also exempt if—

(a) the conditions in paragraph 7(2) are met in relation to a part of the service,

(b) the only user-generated content enabled by the rest of the service is—

(i) content mentioned in paragraph 1, 2 or 3 and related identifying content, or

(ii) content arising in connection with any of the activities described in paragraph 4(1), and

(3) A search service is exempt if—

(a) the conditions in paragraph 7(2) are met in relation to a part of the service that is a search engine,

(b) the service does not include a public search engine, and

(4) In this paragraph—

“public search engine” means a search engine other than one in relation to which the conditions in paragraph 7(2) are met;

“the rest of the service” means all parts of the user-to-user service or search service other than the part in relation to which the conditions in paragraph 7(2) are met.

Services provided by public bodies

9

(1) A user-to-user service or a search service is exempt if—

(a) both of the following conditions are met in relation to the service—

(i) the provider of the service is a public authority within the meaning of section 6 of the Human Rights Act 1998, and

(ii) the service is provided in the exercise of public functions only,

(b) the provider of the service is Parliament, either House of Parliament, the Scottish Parliament, Senedd Cymru, the Northern Ireland Assembly or a person acting on behalf of any of those institutions,

(d) both of the following conditions are met in relation to the service—

(i) the provider of the service is an entity formed under the law of a country outside the United Kingdom, which exercises functions of a public nature, and

(ii) the service is provided in the exercise of such functions only.

(2) But a user-to-user service or a search service is not exempt under this paragraph if—

(a) the provider of the service is a person providing education or childcare, and

(b) the service is provided for the purposes of that education or childcare.

See paragraph 10 for an exemption for services provided by persons providing education or childcare of particular descriptions.

(3) This paragraph is without prejudice to the fact that this Act does not apply in relation to a user-to-user or search service provided by the Crown.

(4) In this paragraph, “public function” means a function that is a function of a public nature for the purposes of the Human Rights Act 1998.

Services provided by persons providing education or childcare

10

(1) A user-to-user service or a search service is exempt if—

(a) the provider of the service is—

(i) the person with legal responsibility for education or childcare of a description listed in Part 2 of this Schedule (“the responsible person”), or where the responsible person is a body, a member of that body, or

(ii) a person who is employed or engaged to provide education or childcare of a description listed in Part 2 of this Schedule, and who is subject to safeguarding duties which relate to the provision of that education or childcare, and

(b) the service is provided for the purposes of that education or childcare.

(2) In sub-paragraph (1)(a)(ii), “safeguarding duties” means duties or requirements which are related to the safeguarding of children arising under enactments other than this Act, under guidance or requirements (however referred to) produced under enactments other than this Act, or as a result of contractual arrangements made by the responsible person.

(3) For the purposes of this paragraph, the person with legal responsibility for education or childcare of a particular description is the person with legal responsibility for its day-to-day provision (for example, the person with legal responsibility for a particular school), rather than any other person who has a duty to ensure that, in general, education or childcare of that description (or education or childcare which includes education or childcare of that description) is provided.

Interpretation

11

In Part 1 of this Schedule—

“enactment” includes—an enactment contained in subordinate legislation (within the meaning of the Interpretation Act 1978),an enactment contained in, or in an instrument made under, an Act of the Scottish Parliament,an enactment contained in, or in an instrument made under, a Measure or Act of Senedd Cymru, andan enactment contained in, or in an instrument made under, Northern Ireland legislation;

“regulated provider pornographic content” and “published or displayed” have the same meaning as in Part 5 (see section 79);

“user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

PART 2 — Paragraph 10 exemption: descriptions of education and childcare

England

12

Early years childminding by an early years childminder registered under Chapter 2 of Part 3 of the Childcare Act 2006.

13

Early years provision by a person registered under Chapter 2 of Part 3 of that Act.

14

Later years childminding by a later years childminder registered under Chapter 3 of Part 3 of that Act.

15

Later years provision by a person registered under Chapter 3 of Part 3 of that Act.

16

Education or childcare in a maintained nursery school within the meaning of section 22 of the School Standards and Framework Act 1998.

17

Education or childcare in—

(a) an Academy school, within the meaning of section 1A of the Academies Act 2010;

(b) an alternate provision Academy, within the meaning of section 1C of that Act;

(c) a maintained school, within the meaning of the School Standards and Framework Act 1998 (see section 20(7) of that Act);

(d) a non-maintained special school, being a school that is approved under section 342 of the Education Act 1996;

(e) an independent educational institution registered on the register maintained under section 95 of the Education and Skills Act 2008;

(f) a pupil referral unit, within the meaning of section 19 of the Education Act 1996.

18

Education in—

(a) an institution in England within the further education sector, within the meaning of the Further and Higher Education Act 1992 (see section 91(3) of that Act);

(b) a 16 to 19 Academy, within the meaning of section 1B of the Academies Act 2010;

(c) a special post-16 institution, within the meaning of Part 3 of the Children and Families Act 2014 (see section 83(2) of that Act).

19

Education provided by an independent training provider.

20

Further education for persons under 19 provided by a local authority in England.

21

In paragraphs 12 to 15, “early years childminding”, “early years provision”, “later years childminding” and “later years provision” have the same meaning as in Part 3 of the Childcare Act 2006 (see section 98 of that Act).

22

In paragraph 19, “independent training provider” means a provider—

(a) that is a provider of post-16 education or training carried on, or partly carried on, in England—

(i) to which Chapter 3 of Part 8 of the Education and Inspections Act 2006 (inspection of further education and training etc) applies, and

(ii) which is funded, wholly or partly, by the Secretary of State, a local authority in England or a combined authority, but

(b) that is not—

(i) an employer who only provides such education or training to its employees,

(ii) a 16 to 19 Academy (within the meaning of section 1B of the Academies Act 2010),

(iii) a school,

(iv) a local authority in England,

(v) an institution within the further education sector (within the meaning given by section 91(3) of the Further and Higher Education Act 1992), or

(vi) a higher education provider (within the meaning given by section 83(1) of the Higher Education and Research Act 2017).

23

In paragraphs 20 and 22, “local authority in England” has the same meaning as in the Education Act 1996 (see sections 579(1) and 581 of that Act).

24

In paragraph 22—

“combined authority” means a combined authority established under section 103 of the Local Democracy, Economic Development and Construction Act 2009;

“school” has the meaning given by section 4(1) of the Education Act 1996.

Scotland

25

Early learning and childcare, within the meaning of Part 6 of the Children and Young People (Scotland) Act 2014 (asp 8) (see section 46 of that Act).

26

Child minding, within the meaning of Part 5 of the Public Services Reform (Scotland) Act 2010 (asp 8) (see paragraph 12 of Schedule 12 to that Act).

27

Day care of children, within the meaning of Part 5 of that Act (see paragraph 13 of Schedule 12 to that Act).

28

Primary education, secondary education or childcare in—

(a) a school, or

(b) a hostel used mainly by pupils attending a school;

and in this paragraph “school” has the same meaning as in the Education (Scotland) Act 1980 (see section 135(1) of that Act).

29

Further education provided by a body listed under the heading “Institutions formerly eligible for funding by the Scottish Further Education Funding Council” or under the heading “Other institutions” in Schedule 2 to the Further and Higher Education (Scotland) Act 2005 (asp 6).

30

Further education provided by a college of further education which is assigned to a regional strategic body by an order made under section 7C(1) of that Act.

Wales

31

Child minding by a person who is registered as a child minder under Part 2 of the Children and Families (Wales) Measure 2010 (nawm 1).

32

Day care for children by a person who is registered to provide day care for children under Part 2 of that Measure.

33

Primary education, secondary education or childcare in a school in Wales, within the meaning of the Education Act 1996 as it applies in relation to Wales (see section 4 of that Act).

34

Education provided in accordance with section 19A of the Education Act 1996.

35

Further education in an institution in Wales within the further education sector, within the meaning of the Further and Higher Education Act 1992 (see section 91(3) of that Act).

36

(1) Any further education or training in Wales that is—

(a) funded or otherwise secured by the Commission for Tertiary Education and Research,

(b) funded or otherwise secured by the Welsh Ministers, or

(2) Sub-paragraph (1) does not include further education or training in Wales provided by—

(a) an institution in Wales within the higher education sector, within the meaning of the Further and Higher Education Act 1992 (see section 91(5) of that Act), or

(b) a person who is a provider of such education or training only by reason of providing it to the person’s employees.

(3) In this paragraph, the references to “further education” and “training” have the meanings given by section 144(2), (4) and (5) of the Tertiary Education and Research (Wales) Act 2022.

37

In paragraphs 31 and 32, “child minding” and “day care for children” have the same meaning as in Part 2 of the Children and Families (Wales) Measure 2010 (see section 19 of that Measure).

Northern Ireland

38

Childcare by persons who act as child minders or provide day care for children within the meaning of the Children (Northern Ireland) Order 1995 (S.I. 1995/755 (N.I. 2)), and who are registered under Article 118 of that Order.

39

Pre-school education, within the meaning of Part 5 of the Education (Northern Ireland) Order 1998 (S.I. 1998/1759 (N.I. 13)) (see Article 17(8) of that Order).

40

Education in a nursery school, within the meaning of the Education and Libraries (Northern Ireland) Order 1986 (S.I. 1986/594 (N.I. 3)) (see Article 2(2) of that Order).

41

Education or childcare in a school, within the meaning of the Education and Libraries (Northern Ireland) Order 1986 (see Article 2(2) of that Order).

42

Education which is suitable education otherwise than at school provided in accordance with Article 86 of the Education (Northern Ireland) Order 1998.

43

Education in an institution of further education, within the meaning of the Further Education (Northern Ireland) Order 1997 (S.I. 1997/1772 (N.I. 15)) (see Article 2(2) of that Order).

44

Education in agriculture and related subjects.

PART 3 — Interpretation

45

The following definitions apply for the purposes of this Schedule.

46

“Childcare”—

(a) in relation to provision in England, has same meaning as in the Childcare Act 2006 (see section 18 of that Act);

(b) in relation to provision in Scotland, means early learning and childcare within the meaning of Part 6 of the Children and Young People (Scotland) Act 2014 (see section 46 of that Act), and any form of care provided outside school hours or during school holidays to children who are in attendance at an educational establishment (and in this paragraph, “educational establishment” has the same meaning as in the Education (Scotland) Act 1980 (see section 135(1) of that Act));

(c) in relation to provision in Wales, means anything that amounts to child minding or day care for children for the purposes of Part 2 of the Children and Families (Wales) Measure 2010 (see section 19(2) to (4) of that Measure), and any form of care provided by a school outside school hours or during school holidays (and in this paragraph “school” has the same meaning as in the Education Act 1996 as it applies in relation to Wales (see section 4 of that Act));

(d) in relation to provision in Northern Ireland, means anything that amounts to child minding or day care for the purposes of Part 11 of the Children (Northern Ireland) Order 1995, and any form of care provided by a school outside school hours or during school holidays (and in this paragraph “school” has the same meaning as in the Education and Libraries (Northern Ireland) Order (see Article 2(2) of that Order)).

47

“Education”—

(a) in relation to provision in England, Wales and Scotland, means primary education, secondary education, further education or higher education;

(b) in relation to provision in Northern Ireland, means primary education, secondary education, further education, higher education or education in agriculture and related subjects.

48

“Education in agriculture and related subjects”, in relation to provision in Northern Ireland, means education consisting of instruction in agriculture and related subjects provided by the Department of Agriculture, Environment and Rural Affairs in Northern Ireland under section 5(2)(a) of the Agriculture Act (Northern Ireland) 1949 (c. 2 (N.I.)), but not where the instruction is provided only to the Department’s employees.

49

“Further education”—

(a) in relation to provision in England and Wales, has the same meaning as in the Education Act 1996 (see section 2 of that Act);

(b) in relation to provision in Scotland, has the same meaning as in Part 1 of the Further and Higher Education (Scotland) Act 1992 (see sections 1(3) and 6 of that Act);

(c) in relation to provision in Northern Ireland, has the same meaning as in the Further Education (Northern Ireland) Order 1997 (see Article 3 of that Order).

50

“Higher education”—

(a) in relation to provision in England and Wales, has the same meaning as in the Education Act 1996 (see section 579(1) of that Act);

(b) in relation to provision in Scotland, has the same meaning as in Part 2 of the Further and Higher Education (Scotland) Act 1992 (see section 38 of that Act);

(i) “higher education” within the meaning of the Further Education (Northern Ireland) Order 1997 (see Article 2(2) of that Order), and

(ii) any other education provided by a higher education institution within the meaning of the Education and Libraries (Northern Ireland) Order 1993 (S.I. 1993/2810 (N.I. 12)) (see Article 30 of that Order).

51

“Primary education” and “secondary education”—

(a) in relation to provision in England and Wales, have the same meaning as in the Education Act 1996 (see section 2 of that Act);

Reading this document does not replace reading the official text published on legislation.gov.uk. Contains public sector information licensed under the Open Government Licence v3.0. We assume no responsibility for any inaccuracies arising from the conversion of the original CLML XML to this format.

This text is published under legislation.gov.uk's own terms of reuse, not a Legalize or public-domain licence. legislation.gov.uk
Open Government Licence v3.0 (attribution required)
© Crown and database right. Derived from content available under the Open Government Licence v3.0 from legislation.gov.uk.