Legislation – Online Safety Act 2023

New Search

Introduction

PART 1
Introduction

1 Introduction

2 Overview of Act

PART 2
Key definitions

3 “User-to-user service” and “search service”

4 “Regulated service”, “Part 3 service” etc

5 Disapplication of Act to certain parts of services

PART 3
Providers of regulated user-to-user services and regulated search services: duties of care

CHAPTER 1 Introduction

6 Overview of Part 3

CHAPTER 2 Providers of user-to-user services: duties of care

User-to-user services: which duties apply, and scope of duties

7 Providers of user-to-user services: duties of care

8 Scope of duties of care

Illegal content duties for user-to-user services

9 Illegal content risk assessment duties

10 Safety duties about illegal content

User-to-user services likely to be accessed by children

11 Children’s risk assessment duties

12 Safety duties protecting children

13 Safety duties protecting children: interpretation

Category 1 services

14 Assessment duties: user empowerment

15 User empowerment duties

16 User empowerment duties: interpretation

17 Duties to protect content of democratic importance

18 Duties to protect news publisher content

19 Duties to protect journalistic content

Duties about content reporting and complaints procedures

20 Duty about content reporting

21 Duties about complaints procedures

Cross-cutting duties

22 Duties about freedom of expression and privacy

23 Record-keeping and review duties

CHAPTER 3 Providers of search services: duties of care

Search services: which duties apply, and scope of duties

24 Providers of search services: duties of care

25 Scope of duties of care

Illegal content duties for search services

26 Illegal content risk assessment duties

27 Safety duties about illegal content

Search services likely to be accessed by children

28 Children’s risk assessment duties

29 Safety duties protecting children

30 Safety duties protecting children: interpretation

Duties about content reporting and complaints procedures

31 Duty about content reporting

32 Duties about complaints procedures

Cross-cutting duties

33 Duties about freedom of expression and privacy

34 Record-keeping and review duties

CHAPTER 4 Children’s access assessments

35 Children’s access assessments

36 Duties about children’s access assessments

37 Meaning of “likely to be accessed by children”

CHAPTER 5 Duties about fraudulent advertising

38 Duties about fraudulent advertising: Category 1 services

39 Duties about fraudulent advertising: Category 2A services

40 Fraud etc offences

CHAPTER 6 Codes of practice and guidance

Codes of practice

41 Codes of practice about duties

42 Codes of practice: principles, objectives, content

43 Procedure for issuing codes of practice

44 Secretary of State’s powers of direction

45 Procedure for issuing codes of practice following direction under section 44

46 Publication of codes of practice

47 Review of codes of practice

48 Minor amendments of codes of practice

49 Relationship between duties and codes of practice

50 Effects of codes of practice

51 Duties and the first codes of practice

Guidance

52 OFCOM’s guidance about certain duties in Part 3

53 OFCOM’s guidance: content that is harmful to children and user empowerment

54 OFCOM’s guidance about protecting women and girls

CHAPTER 7 Interpretation of Part 3

55 “Regulated user-generated content”, “user-generated content”, “news publisher content”

56 “Recognised news publisher”

57 “Search content”, “search results” etc

58 Restricting users’ access to content

59 “Illegal content” etc

60 “Content that is harmful to children”

61 “Primary priority content that is harmful to children”

62 “Priority content that is harmful to children”

63 Content harmful to children: OFCOM’s review and report

PART 4
Other duties of providers of regulated user-to-user services and regulated search services

CHAPTER 1 User identity verification

64 User identity verification

65 OFCOM’s guidance about user identity verification

CHAPTER 2 Reporting child sexual exploitation and abuse content

66 Requirement to report CSEA content to the NCA

67 Regulations about reports to the NCA

68 NCA: information sharing

69 Offence in relation to CSEA reporting

70 Interpretation of this Chapter

CHAPTER 3 Terms of service: transparency, accountability and freedom of expression

71 Duty not to act against users except in accordance with terms of service

72 Further duties about terms of service

73 OFCOM’s guidance about duties set out in sections 71 and 72

74 Interpretation of this Chapter

CHAPTER 4 Deceased Child Users

75 Disclosure of information about use of service by deceased child users

76 OFCOM’s guidance about duties set out in section 75

CHAPTER 5 Transparency reporting

77 Transparency reports about certain Part 3 services

78 OFCOM’s guidance about transparency reports

PART 5
Duties of providers of regulated services: certain pornographic content

79 “Provider pornographic content” and “regulated provider pornographic content”

80 Scope of duties about regulated provider pornographic content

81 Duties about regulated provider pornographic content

82 OFCOM’s guidance about duties set out in section 81

PART 6
Duties of providers of regulated services: fees

83 Duty to notify OFCOM

84 Duty to pay fees

85 Regulations by OFCOM about qualifying worldwide revenue etc

86 Threshold figure

87 Secretary of State’s guidance about fees

88 OFCOM’s fees statements

89 Recovery of OFCOM’s initial costs

90 Meaning of “charging year” and “initial charging year”

PART 7
OFCOM’s powers and duties in relation to regulated services

CHAPTER 1 General duties

91 General duties of OFCOM under section 3 of the Communications Act

92 Duties in relation to strategic priorities

93 Duty to carry out impact assessments

CHAPTER 2 Register of categories of regulated user-to-user services and regulated search services

94 Meaning of threshold conditions etc

95 Register of categories of certain Part 3 services

96 Duty to maintain register

97 List of emerging Category 1 services

CHAPTER 3 Risk assessments of regulated user-to-user services and regulated search services

98 OFCOM’s register of risks, and risk profiles, of Part 3 services

99 OFCOM’s guidance about risk assessments

CHAPTER 4 Information

Information powers and information notices

100 Power to require information

101 Information in connection with an investigation into the death of a child

102 Information notices

103 Requirement to name a senior manager

Skilled persons’ reports

104 Reports by skilled persons

Investigations and interviews

105 Investigations

106 Power to require interviews

Powers of entry, inspection and audit

107 Powers of entry, inspection and audit

108 Amendment of Criminal Justice and Police Act 2001

Information offences and penalties

109 Offences in connection with information notices

110 Senior managers’ liability: information offences

111 Offences in connection with notices under Schedule 12

112 Other information offences

113 Penalties for information offences

Disclosure of information

114 Co-operation and disclosure of information: overseas regulators

115 Disclosure of information

116 Intelligence service information

117 Provision of information to the Secretary of State

118 Amendment of Enterprise Act 2002

119 Information for users of regulated services

120 Admissibility of statements

CHAPTER 5 Regulated user-to-user services and regulated search services: notices to deal with terrorism content and CSEA content

121 Notices to deal with terrorism content or CSEA content (or both)

122 Requirement to obtain skilled person’s report

123 Warning notices

124 Matters relevant to a decision to give a notice under section 121(1)

125 Notices under section 121(1): supplementary

126 Review and further notice under section 121(1)

127 OFCOM’s guidance about functions under this Chapter

128 OFCOM’s annual report

129 Interpretation of this Chapter

CHAPTER 6 Enforcement powers

Provisional notices and confirmation decisions

130 Provisional notice of contravention

131 Requirements enforceable by OFCOM against providers of regulated services

132 Confirmation decisions

133 Confirmation decisions: requirements to take steps

134 Confirmation decisions: risk assessments

135 Confirmation decisions: children’s access assessments

136 Confirmation decisions: proactive technology

137 Confirmation decisions: penalties

138 Confirmation decisions: offences

Penalty notices etc

139 Penalty for failure to comply with confirmation decision

140 Penalty for failure to comply with notice under section 121(1)

141 Non-payment of fee

142 Information to be included in notices under sections 140 and 141

Amount of penalties etc

143 Amount of penalties etc

Business disruption measures

144 Service restriction orders

145 Interim service restriction orders

146 Access restriction orders

147 Interim access restriction orders

148 Interaction with other action by OFCOM

Publication of enforcement action

149 Publication by OFCOM of details of enforcement action

150 Publication by providers of details of enforcement action

Guidance

151 OFCOM’s guidance about enforcement action

CHAPTER 7 Committees, research and reports

152 Advisory committee on disinformation and misinformation

153 Functions of the Content Board

154 Research about users’ experiences of regulated services

154A Information for research about online safety matters

155 Consumer consultation

156 OFCOM’s statement about freedom of expression and privacy

157 OFCOM’s reports about use of age assurance

158 OFCOM’s reports about news publisher content and journalistic content

159 OFCOM’s transparency reports

160 OFCOM’s report about reporting and complaints procedures

161 OFCOM’s report about use of app stores by children

162 OFCOM’s report about researchers’ access to information

163 OFCOM’s report in connection with investigation into a death

164 OFCOM’s reports

CHAPTER 8 Media literacy

165 Media literacy

166 Media literacy strategy and media literacy statement

PART 8
Appeals and super-complaints

CHAPTER 1 Appeals

167 Appeals against OFCOM decisions relating to the register under section 95

168 Appeals against OFCOM notices

CHAPTER 2 Super-complaints

169 Power to make super-complaints

170 Procedure for super-complaints

171 OFCOM’s guidance about super-complaints

PART 9
Secretary of State’s functions in relation to regulated services

172 Statement of strategic priorities

173 Consultation and parliamentary procedure

174 Directions about advisory committees

175 Directions in special circumstances

176 Secretary of State’s guidance

177 Annual report on the Secretary of State’s functions

178 Review

PART 10
Communications offences

179 False communications offence

180 Exemptions from offence under section 179

181 Threatening communications offence

182 Interpretation of sections 179 to 181

183 Offences of sending or showing flashing images electronically

184 Offence of encouraging or assisting serious self-harm

185 Extra-territorial application and jurisdiction

186 Liability of corporate officers

187 Sending etc photograph or film of genitals

188 Sharing or threatening to share intimate photograph or film

189 Repeals in connection with offences under sections 179 and 181

190 Repeals in connection with offences under section 188

191 Consequential amendments

PART 11
Supplementary and general

192 Providers’ judgements about the status of content

193 OFCOM’s guidance about illegal content judgements

194 Time for publishing first guidance under certain provisions of this Act

195 Providers that are not legal persons

196 Individuals providing regulated services: liability

197 Liability of parent entities etc

198 Former providers of regulated services

199 Information offences: supplementary

200 Offence of failure to comply with confirmation decision: supplementary

201 Defences

202 Liability of corporate officers for offences

203 Application of offences to providers that are not legal persons

204 Extra-territorial application

205 Offences: extra-territorial application and jurisdiction

206 Payment of sums into the Consolidated Fund

207 Publication by OFCOM

208 Service of notices

209 Amendments of Part 4B of the Communications Act

210 Repeal of Part 4B of the Communications Act

211 Repeal of Part 4B of the Communications Act: transitional provision etc

212 Repeals: Digital Economy Act 2017

213 Offence under the Obscene Publications Act 1959: OFCOM defence

214 Offences regarding indecent photographs of children: OFCOM defence

215 Power to regulate app stores

216 Power to regulate app stores: supplementary

217 Power to impose duty about alternative dispute resolution procedure

218 Power to amend section 40

219 Powers to amend sections 61 and 62

220 Powers to amend or repeal provisions relating to exempt content or services

221 Powers to amend Part 2 of Schedule 1

222 Powers to amend Schedules 5, 6 and 7

223 Power to make consequential provision

224 Regulations: general

225 Parliamentary procedure for regulations

PART 12
Interpretation and final provisions

226 “Provider” of internet service

227 “User”, “United Kingdom user” and “interested person”

228 “Internet service”

229 “Search engine”

230 “Age verification” and “age estimation”

231 “Proactive technology”

232 Content communicated “publicly” or “privately”

233 “Functionality”

234 “Harm” etc

235 “Online safety functions” and “online safety matters”

236 Interpretation: general

237 Index of defined terms

238 Financial provisions

239 Extent

240 Commencement and transitional provision

241 Short title

SCHEDULES

SCHEDULE 1 Exempt user-to-user and search services

SCHEDULE 2 User-to-user services and search services that include regulated provider pornographic content

SCHEDULE 3 Timing of providers’ assessments

SCHEDULE 4 Codes of practice under section 41: principles, objectives, content

SCHEDULE 5 Terrorism offences

SCHEDULE 6 Child sexual exploitation and abuse offences

SCHEDULE 7 Priority offences

SCHEDULE 8 Transparency reports by providers of Category 1 services, Category 2A services and Category 2B services

SCHEDULE 9 Certain internet services not subject to duties relating to regulated provider pornographic content

SCHEDULE 10 Recovery of OFCOM’s initial costs

SCHEDULE 11 Categories of regulated user-to-user services and regulated search services: regulations

SCHEDULE 12 OFCOM’s powers of entry, inspection and audit

SCHEDULE 13 Penalties imposed by OFCOM under Chapter 6 of Part 7

SCHEDULE 14 Amendments consequential on offences in Part 10 of this Act

SCHEDULE 15 Liability of parent entities etc

SCHEDULE 16 Amendments of Part 4B of the Communications Act

SCHEDULE 17 Video-sharing platform services: transitional provision etc

Changes to legislation:

There are currently no known outstanding effects for the Online Safety Act 2023, PART 12. Help about Changes to Legislation

Close

Changes to Legislation

Revised legislation carried on this site may not be fully up to date. At the current time any known changes or effects made by subsequent legislation have been applied to the text of the legislation you are viewing by the editorial team. Please see ‘Frequently Asked Questions’ for details regarding the timescales for which new effects are identified and recorded on this site.

PART 12Interpretation and final provisions

Interpretation

226“Provider” of internet service

(1)

This section applies to determine who is the “provider” of an internet service for the purposes of this Act.

User-to-user services (other than combined services)

(2)

The provider of a user-to-user service is to be treated as being the entity that has control over who can use the user-to-user part of the service (and that entity alone).

(3)

If no entity has control over who can use the user-to-user part of a user-to-user service, but an individual or individuals have control over who can use that part, the provider of the service is to be treated as being that individual or those individuals.

Search services

(4)

The provider of a search service is to be treated as being the entity that has control over the operations of the search engine (and that entity alone).

(5)

If no entity has control over the operations of the search engine, but an individual or individuals have control over those operations, the provider of the search service is to be treated as being that individual or those individuals.

Combined services

(6)

The provider of a combined service is to be treated as being the entity that has control over both—

(a)

who can use the user-to-user part of the service, and

(b)

the operations of the search engine,

(and that entity alone).

(7)

If no entity has control over the matters mentioned in paragraphs (a) and (b) of subsection (6), but an individual or individuals have control over both those matters, the provider of the combined service is to be treated as being that individual or those individuals.

Internet services other than user-to-user services or search services

(8)

The provider of an internet service, other than a user-to-user service or a search service, is to be treated as being the entity that has control over which content is published or displayed on the service.

(9)

If no entity has control over which content is published or displayed on such an internet service, but an individual or individuals have control over which content is published or displayed, the provider of the service is to be treated as being that individual or those individuals.

Machine-generated services

(10)

The provider of an internet service that is generated by a machine is to be treated as being the entity that controls the machine (and that entity alone).

(11)

If no entity controls the machine, but an individual or individuals control it, the provider of the internet service is to be treated as being that individual or those individuals.

Interpretation

(12)

A person who provides an access facility in relation to a user-to-user service, within the meaning of section 146, is not to be regarded as a person who has control over who can use the user-to-user part of the service for the purposes of this section.

(13)

In this section “operations of the search engine” means operations which—

(a)

enable users of a search service or a combined service to make search requests, and

(b)

generate responses to those requests.

(14)

In this section “published or displayed” is to be construed in accordance with section 79(6).

(15)

For the purposes of subsections (8) and (9), a person who makes available on a service an automated tool or algorithm by means of which content is generated is to be regarded as having control over content so generated.

Annotations:
Commencement Information

I1S. 226 in force at Royal Assent, see s. 240(z5)

227“User”, “United Kingdom user” and “interested person”

(1)

For the purposes of this Act a user is a “United Kingdom user” of a service if—

(a)

where the user is an individual, the individual is in the United Kingdom;

(b)

where the user is an entity, the entity is incorporated or formed under the law of any part of the United Kingdom.

(2)

For the purposes of references in this Act to a user of a service it does not matter whether a person is registered to use a service.

(3)

References in this Act to a user of a service do not include references to any of the following when acting in the course of the provider’s business—

(a)

where the provider of the service is an individual or individuals, that individual or those individuals;

(b)

where the provider is an entity, officers of the entity;

(c)

persons who work for the provider (including as employees or volunteers);

(d)

any other person providing a business service to the provider such as a contractor, consultant or auditor.

(4)

In subsection (3)acting in the course of the provider’s business” means (as the case may be)—

(a)

acting in the course of the provider’s business of providing the service, or

(b)

acting in the course of a business, trade, profession or other concern—

(i)

carried on (whether or not for profit) by the provider of the service, and

(ii)

for the purposes of which the service is provided.

(5)

In subsections (1) to (4)service” (except in the term “business service”) means internet service, user-to-user service or search service.

(6)

In subsection (3)officer” includes a director, manager, partner, associate, secretary or other similar officer.

(7)

In this Act “interested person”, in relation to a search service or a combined service, means a person that is responsible for a website or database capable of being searched by the search engine, provided that—

(a)

in the case of an individual, the individual is in the United Kingdom;

(b)

in the case of an entity, the entity is incorporated or formed under the law of any part of the United Kingdom.

Annotations:
Commencement Information

I2S. 227 in force at Royal Assent, see s. 240(z5)

228“Internet service”

(1)

In this Act “internet service” means a service that is made available by means of the internet.

(2)

For the purposes of subsection (1) a service is “made available by means of the internet” even where it is made available by means of a combination of—

(a)

the internet, and

(b)

an electronic communications service.

(3)

Electronic communications service” has the same meaning as in the Communications Act (see section 32(2) of that Act).

Annotations:
Commencement Information

I3S. 228 in force at Royal Assent, see s. 240(z5)

229“Search engine”

(1)

In this Act “search engine”—

(a)

includes a service or functionality which enables a person to search some websites or databases (as well as a service or functionality which enables a person to search (in principle) all websites or databases);

(b)

does not include a service which enables a person to search just one website or database.

(2)

For the purposes of this Act, a search engine is not to be taken to be “included” in an internet service or a user-to-user service if the search engine is controlled by a person who does not control other parts of the service.

Annotations:
Commencement Information

I4S. 229 in force at Royal Assent, see s. 240(z5)

230“Age verification” and “age estimation”

(1)

This section applies for the purposes of this Act.

(2)

Age verification” means any measure designed to verify the exact age of users of a regulated service.

(3)

Age estimation” means any measure designed to estimate the age or age-range of users of a regulated service.

(4)

A measure which requires a user to self-declare their age (without more) is not to be regarded as age verification or age estimation.

Annotations:
Commencement Information

I5S. 230 in force at Royal Assent, see s. 240(z5)

231“Proactive technology”

(1)

In this Act “proactive technology” means—

(a)

content identification technology,

(b)

user profiling technology, or

(c)

behaviour identification technology,

but this is subject to subsections (3) and (7).

(2)

Content identification technology” means technology, such as algorithms, keyword matching, image matching or image classification, which analyses content to assess whether it is content of a particular kind (for example, illegal content).

(3)

But content identification technology is not to be regarded as proactive technology if it is used in response to a report from a user or other person about particular content.

(4)

User profiling technology” means technology which analyses (any or all of)—

(a)

relevant content,

(b)

user data, or

(c)

metadata relating to relevant content or user data,

for the purposes of building a profile of a user to assess characteristics such as age.

(5)

Technology which—

(a)

analyses data specifically provided by a user for the purposes of the provider verifying or estimating the user’s age in order to decide whether to allow the user to access a service (or part of a service) or particular content, and

(b)

does not analyse any other data or content,

is not to be regarded as user profiling technology.

(6)

Behaviour identification technology” means technology which analyses (any or all of)—

(a)

relevant content,

(b)

user data, or

(c)

metadata relating to relevant content or user data,

to assess a user’s online behaviour or patterns of online behaviour (for example, to assess whether a user may be involved in, or be the victim of, illegal activity).

(7)

But behaviour identification technology is not to be regarded as proactive technology if it is used in response to concerns identified by another person or an automated tool about a particular user.

(8)

Relevant content” means—

(a)

in relation to a user-to-user service, content that is user-generated content in relation to the service;

(b)

in relation to a search service, the content of websites and databases capable of being searched by the search engine;

(c)

in relation to an internet service within section 80(2), content that is provider pornographic content in relation to the service.

(9)

User data” means—

(a)

data provided by users, including personal data (for example, data provided when a user sets up an account), and

(b)

data created, compiled or obtained by providers of regulated services and relating to users (for example, data relating to when or where users access a service or how they use it).

(10)

References in this Act to proactive technology include content identification technology, user profiling technology or behaviour identification technology which utilises artificial intelligence or machine learning.

(11)

Accredited technology that may be required to be used in relation to the detection of terrorism content or CSEA content (or both) by a notice under section 121(1) is an example of content identification technology.

(12)

The reference in subsection (8)(b) to a search service includes a reference to the search engine of a combined service.

(13)

In this section—

“accredited” technology has the same meaning as in Chapter 5 of Part 7 (see section 125(12));

illegal content”, “terrorism content” and “CSEA content” have the same meaning as in Part 3 (see section 59);

user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

Annotations:
Commencement Information

I6S. 231 in force at Royal Assent, see s. 240(z5)

232Content communicated “publicly” or “privately”

(1)

This section specifies factors which OFCOM must, in particular, consider when deciding whether content is communicated “publicly” or “privately” by means of a user-to-user service for the purposes of—

(a)

section 121 (notice to deal with terrorism content),

(b)

section 136 (requirement to use proactive technology), or

(c)

paragraph 13(4) of Schedule 4 (recommendation of proactive technology in codes of practice).

(2)

The factors are—

(a)

the number of individuals in the United Kingdom who are able to access the content by means of the service;

(b)

any restrictions on who may access the content by means of the service (for example, a requirement for approval or permission from a user, or the provider, of the service);

(c)

the ease with which the content may be forwarded to or shared with—

(i)

users of the service other than those who originally encounter it, or

(ii)

users of another internet service.

(3)

The following factors do not count as restrictions on access—

(a)

a requirement to log in to or register with a service (or part of a service);

(b)

a requirement to make a payment or take out a subscription in order to access a service (or part of a service) or to access particular content;

(c)

inability to access a service (or part of a service) or to access particular content except by using particular technology or a particular kind of device (as long as that technology or device is generally available to the public).

Annotations:
Commencement Information

I7S. 232 in force at Royal Assent, see s. 240(z5)

233“Functionality”

(1)

In this Act “functionality”, in relation to a user-to-user service, includes any feature that enables interactions of any description between users of the service by means of the service, and includes any feature enabling a user to do anything listed in subsection (2).

(2)

The things are—

(a)

creating a user profile, including an anonymous or pseudonymous profile;

(b)

searching within the service for user-generated content or other users of the service;

(c)

forwarding content to, or sharing content with, other users of the service;

(d)

sharing content on other internet services;

(e)

sending direct messages to or speaking to other users of the service, or interacting with them in another way (for example by playing a game);

(f)

expressing a view on content, including, for example, by—

(i)

applying a “like” or “dislike” button or other button of that nature,

(ii)

applying an emoji or symbol of any kind,

(iii)

engaging in yes/no voting, or

(iv)

rating or scoring content in any way (including giving star or numerical ratings);

(g)

sharing current or historic location information with other users of the service, recording a user’s movements, or identifying which other users of the service are nearby;

(h)

following or subscribing to particular kinds of content or particular users of the service;

(i)

creating lists, collections, archives or directories of content or users of the service;

(j)

tagging or labelling content present on the service;

(k)

uploading content relating to goods or services;

(l)

applying or changing settings on the service which affect the presentation of user-generated content on the service;

(m)

accessing other internet services through content present on the service (for example through hyperlinks).

(3)

In this Act “functionality”, in relation to a search service, includes (in particular)—

(a)

a feature that enables users to search websites or databases;

(b)

a feature that makes suggestions relating to users’ search requests (predictive search functionality).

(4)

In this section “user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

Annotations:
Commencement Information

I8S. 233 in force at Royal Assent, see s. 240(z5)

234“Harm” etc

(1)

This section applies for the purposes of this Act, apart from Part 10 (communications offences).

(2)

Harm” means physical or psychological harm.

(3)

References to harm presented by content, and any other references to harm in relation to content, include references to harm arising or that may arise from any one or combination of the following—

(a)

the nature of the content;

(b)

the fact of its dissemination;

(c)

the manner of its dissemination.

(4)

References to harm presented by content, and any other references to harm in relation to content, include references to cumulative harm arising or that may arise in the following circumstances—

(a)

where content, or content of a particular kind, is repeatedly encountered by an individual (including, but not limited to, where content, or a kind of content, is sent to an individual by one user or by different users or encountered as a result of algorithms used by, or functionalities of, a service);

(b)

where content of a particular kind is encountered by an individual in combination with content of a different kind (including, but not limited to, where a kind of content is sent to an individual by one user or by different users or encountered as a result of algorithms used by, or functionalities of, a service).

(5)

References to harm presented by content, and any other references to harm in relation to content, include references to harm arising or that may arise in the following circumstances—

(a)

where, as a result of the content, individuals act in a way that results in harm to themselves or that increases the likelihood of harm to themselves;

(b)

where, as a result of the content, individuals do or say something to another individual that results in harm to that other individual or that increases the likelihood of such harm (including, but not limited to, where individuals act in such a way as a result of content that is related to that other individual’s characteristics or membership of a group).

(6)

References to a risk of harm in relation to functionalities, and references to the risk of functionalities facilitating users encountering particular kinds of content (however expressed), include references to risks arising or that may arise due to multiple functionalities which, used in combination, increase the likelihood of harm arising (for example, as mentioned in subsection (4)).

(7)

References to a risk of harm, or to potential harm, are to be read in the same way as references to harm.

(8)

In contexts where harm (or a risk of harm or potential harm) relates to children, subsections (4) to (5) are to be read as if they referred to children instead of individuals.

Annotations:
Commencement Information

I9S. 234 in force at Royal Assent, see s. 240(z5)

235“Online safety functions” and “online safety matters”

(1)

In this Act references to OFCOM’s “online safety functions”—

(a)

are references to—

(i)

the functions that OFCOM have under this Act,

(ii)

the functions that OFCOM have under the provisions of the Communications Act listed in subsection (2), so far as those functions relate to regulated services or Part 3 services (as the case may be), and

(iii)

the functions that OFCOM have under section 3 of the Communications Act (general duties), so far as duties under that section relate to a function which is an online safety function by reason of sub-paragraph (i) or (ii);

(b)

include references to OFCOM’s power to do anything appearing to them to be incidental or conducive to the carrying out of any of their functions within paragraph (a)(i) or (ii) (see section 1(3) of the Communications Act).

(2)

These are the provisions of the Communications Act referred to in subsection (1)(a)(ii)

(a)

section 6 (duties to review regulatory burdens);

(b)

section 7 (duty to carry out impact assessments);

(c)

section 8 (duty to publish and meet promptness standards);

(d)

sections 11 and 11A (duties to promote media literacy);

(e)

sections 12 and 13 (Content Board);

(f)

section 14(6)(a) (research about media literacy);

(g)

section 14(6B) (research about users’ experience of regulated services);

(h)

section 16 (consumer consultation);

(i)

section 20 (advisory committees for different parts of the United Kingdom);

(j)

section 21 (advisory committee on elderly and disabled persons);

(k)

section 22 (representation on international and other bodies);

(l)

section 26 (publication of information and advice for consumers etc).

(3)

References to OFCOM’s “online safety functions” also include references to OFCOM’s duty to comply with any of the following, so far as relating to the use of a regulated service by a person who has died—

(a)

a notice from a senior coroner under paragraph 1(2) of Schedule 5 to the Coroners and Justice Act 2009 in connection with an investigation into a person’s death;

(b)

a request for information in connection with the investigation of a procurator fiscal into, or an inquiry held or to be held in relation to, a person’s death;

(c)

a notice from a coroner under section 17A(2) of the Coroners Act (Northern Ireland) 1959 (c. 15 (N.I.)) in connection with—

(i)

an investigation to determine whether an inquest into a person’s death is necessary, or

(ii)

an inquest in relation to a person’s death.

(4)

In this Act “online safety matters” means the matters to which OFCOM’s online safety functions relate.

(5)

In subsection (3)(b)inquiry” means an inquiry held, or to be held, under the Inquiries into Fatal Accidents and Sudden Deaths etc. (Scotland) Act 2016 (asp 2).

Annotations:
Commencement Information

I10S. 235 in force at Royal Assent, see s. 240(z5)

236Interpretation: general

(1)

In this Act—

adult” means a person aged 18 or over;

audit notice” means a notice given under paragraph 4 of Schedule 12;

automated tool” includes bot;

“capacity”: any reference to the capacity of a provider of a regulated service is to—

(a)

the financial resources of the provider, and

(b)

the level of technical expertise which is available to the provider, or which it is reasonable to expect would be available to the provider given its size and financial resources;

child” means a person under the age of 18;

the Communications Act” means the Communications Act 2003;

confirmation decision” means a notice given under section 132;

content” means anything communicated by means of an internet service, whether publicly or privately, including written material or messages, oral communications, photographs, videos, visual images, music and data of any description;

the Convention” has the meaning given by section 21(1) of the Human Rights Act 1998;

country” includes territory;

F1the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3(9) of that Act);

document” means anything in which information (in whatever form) is recorded;

encounter”, in relation to content, means read, view, hear or otherwise experience content;

entity” means a body or association of persons or an organisation, regardless of whether the body, association or organisation is—

(a)

formed under the law of any part of the United Kingdom or of a country outside the United Kingdom, or

(b)

a legal person under the law under which it is formed;

“freedom of expression”: any reference to freedom of expression (except in sections 41(6)(f) and 78(2)(d)) is to the freedom to receive and impart ideas, opinions or information (referred to in Article 10(1) of the Convention) by means of speech, writing or images;

identifying content” means content the function of which is to identify a user of an internet service (for example, a user name or profile picture);

information notice” means a notice given under section F2101(C1) or (1) or 101(1);

“measure”: any reference to a measure includes a reference to any system or process relevant to the operation of an internet service or any step or action which may be taken by a provider of an internet service to comply with duties or requirements under this Act;

notice” means notice in writing;

notify” means notify in writing, and “notification” is to be construed accordingly;

OFCOM” means the Office of Communications;

“paid-for advertisement”: an advertisement is a “paid-for advertisement” in relation to an internet service if—

(a)

the provider of the service receives any consideration (monetary or non-monetary) for the advertisement (whether directly from the advertiser or indirectly from another person), and

(b)

the placement of the advertisement is determined by systems or processes that are agreed between the parties entering into the contract relating to the advertisement;

person” includes (in addition to an individual and a body of persons corporate or unincorporate) any organisation or association of persons;

personal data” has the meaning given by section 3(2) of the Data Protection Act 2018;

pornographic content” means content of such a nature that it is reasonable to assume that it was produced solely or principally for the purpose of sexual arousal;

processing” has the meaning given by section 3(4) of the Data Protection Act 2018;

provisional notice of contravention” means a notice given under section 130;

publicly available” means available to members of the public in the United Kingdom;

“systems and/or processes”: any reference to systems and/or processes is to human or automated systems and/or processes, and accordingly includes technologies;

taking down” (content): any reference to taking down content is to any action that results in content being removed from a user-to-user service or being permanently hidden so users of the service cannot encounter it (and related expressions are to be read accordingly);

terms of service”, in relation to a user-to-user service, means all documents (whatever they are called) comprising the contract for use of the service (or of part of it) by United Kingdom users;

user-to-user part”, in relation to a user-to-user service, means the part of the service on which content that is user-generated content in relation to the service is present.

(2)

The definitions of “encounter” and “person” in subsection (1) do not apply for the purposes of Part 10 (for the definition of “encounter” in that Part, see section 182(5)).

(3)

References in this Act to an individual with a certain characteristic include references to an individual with a combination of characteristics.

(4)

References in this Act to a kind of user-to-user service or search service (or Part 3 service) include references to user-to-user services or search services grouped together for the purposes of a risk profile prepared by OFCOM under section 98 (and references to different kinds of user-to-user services or search services (or Part 3 services) are to be read accordingly).

(5)

References in this Act to content (or content of a particular kind) present or prevalent on a user-to-user service (or on a part of it), or to the presence, incidence or prevalence of content (or content of a particular kind) on a user-to-user service (or on a part of it), do not include, in the case of a user-to-user service that includes a search engine—

(a)

search content, or

(b)

any other content that, following a search request, may be encountered as a result of subsequent interactions with internet services.

In this subsection “search content” and “search request” have the same meaning as in Part 3 (see section 57).

(6)

For the purposes of this Act—

(a)

any reference to the use of or access to a service, or to content present, published or displayed on a service, is to be taken to include use of or access to the service or content on registering or on the making of a payment or on subscription;

(b)

any reference to content that is made available or that may be accessed, encountered or shared, is to be taken to include content that is made available or that may be accessed, encountered or shared for a limited period of time only;

and references to restrictions on access to a service or to content are to be read accordingly.

(7)

For the purposes of this Act, content that is user-generated content in relation to an internet service does not cease to be such content in relation to the service when published or displayed on the service by means of—

(a)

software or an automated tool or algorithm applied by the provider of the service or by a person acting on behalf of the provider, or

(b)

an automated tool or algorithm made available on the service by the provider or by a person acting on behalf of the provider.

(8)

Nothing in this Act (other than section 212) affects any prohibition or restriction in relation to pornographic content, or powers in relation to such content, under another enactment or rule of law.

(9)

In this section, “user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

237Index of defined terms

The following table sets out terms defined or explained for this Act or for a Part of this Act.

Term

Provision

adult

section 236

age estimation

section 230

age verification

section 230

audit notice

section 236

automated tool

section 236

capacity (of a provider)

section 236

Category 1 service

section 95(10)(a)

Category 2A service

section 95(10)(b)

Category 2B service

section 95(10)(c)

charging year (in Part 6)

section 90

child

section 236

children’s access assessment (in Part 3)

section 35

combined service

section 4(7)

the Communications Act

section 236

confirmation decision

section 236

content

section 236

content that is harmful to children (in Part 3)

section 60

the Convention

section 236

country

section 236

CSEA content (in Part 3)

section 59

F3the data protection legislation

section 236

document

section 236

encounter (content) (except in Part 10)

section 236

entity

section 236

freedom of expression

section 236

functionality

section 233

harm (except in Part 10)

section 234

identifying content

section 236

illegal content (in Part 3)

section 59

information notice

section 236

initial charging year (in Part 6)

section 90

interested person

section 227

internet service

section 228 (see also section 204(1))

journalistic content (in Part 3)

section 19

likely to be accessed by children (in Part 3)

section 37

measure

section 236

news publisher content (in Part 3)

section 55(8) to (10)

non-designated content that is harmful to children (in Part 3)

section 60

notice

section 236

notify, notification

section 236

OFCOM

section 236

online safety functions

section 235

online safety matters

section 235

paid-for advertisement

section 236

Part 3 service

section 4(3)

person (except in Part 10)

section 236

personal data

section 236

pornographic content

section 236

primary priority content that is harmful to children (in Part 3)

section 61

priority content that is harmful to children (in Part 3)

section 62

priority illegal content (in Part 3)

section 59

priority offence (in Part 3)

section 59

proactive technology

section 231

processing (of data)

section 236

provider

section 226

provider pornographic content (in Part 5)

section 79

provisional notice of contravention

section 236

publicly available

section 236

publicly/privately (in relation to communication of content)

section 232

published or displayed (in relation to pornographic content) (in Part 5)

section 79

recognised news publisher (in Part 3)

section 56

regulated provider pornographic content (in Part 5)

section 79

regulated search service

section 4(2)

regulated service

section 4(4)

regulated user-generated content (in Part 3)

section 55

regulated user-to-user service

section 4(2)

restricting users’ access to content (in Part 3)

section 58

search

section 57

search content

section 57

search engine

section 229

search request

section 57

search results

section 57

search service

section 3 (see also section 204(1))

systems and/or processes

section 236

taking down (content)

section 236

terms of service

section 236

terrorism content (in Part 3)

section 59

United Kingdom user

section 227

user

section 227

user-generated content (in Part 3)

section 55(3) and (4)

user-to-user part (of a service)

section 236

user-to-user service

section 3 (see also section 204(1))

Final provisions

238Financial provisions

There is to be paid out of money provided by Parliament—

(a)

any expenditure incurred under or by virtue of this Act by the Secretary of State, and

(b)

any increase attributable to this Act in the sums payable under any other Act out of money so provided.

Annotations:
Commencement Information

I13S. 238 in force at Royal Assent, see s. 240(z5)

239Extent

(1)

Subject to the following provisions of this section, this Act extends to England and Wales, Scotland and Northern Ireland.

(2)

The following provisions extend to England and Wales and Northern Ireland—

(a)

sections 179 to 183;

(b)

section 189(1).

(3)

The following provisions extend to England and Wales only—

(a)

section 187;

(b)

section 188;

(c)

section 189(2);

(d)

section 190;

(e)

section 213;

(f)

section 214(1) to (3).

(4)

Section 214(4) to (6) extends to Scotland only.

(5)

The following provisions extend to Northern Ireland only—

(a)

section 189(3);

(b)

section 214(7) to (9).

(6)

An amendment or repeal made by Schedule 14 has the same extent within the United Kingdom as the provision amended or repealed.

(7)

His Majesty may by Order in Council provide for any of the provisions of this Act to extend, with or without modifications, to the Bailiwick of Guernsey or to the Isle of Man.

(8)

Subsections (1) and (2) of section 224 apply to an Order in Council under subsection (7) as they apply to regulations under this Act.

(9)

The power conferred by section 411(6) of the Communications Act may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment or repeal made by or under this Act of any part of that Act (with or without modifications).

(10)

The power conferred by section 338 of the Criminal Justice Act 2003 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man the amendments of provisions of that Act made by paragraph 17 of Schedule 14.

(11)

The power conferred by section 60(6) of the Modern Slavery Act 2015 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man the amendments of Schedule 4 to that Act made by paragraph 19 of Schedule 14.

(12)

The power conferred by section 415(1) of the Sentencing Act 2020 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man the amendments of Schedule 18 to that Act made by paragraph 20 of Schedule 14.

240Commencement and transitional provision

(1)

Except as provided by subsection (4), this Act comes into force on such day as the Secretary of State may by regulations appoint.

(2)

The power to make regulations under subsection (1) includes power to appoint different days for different purposes.

(3)

Regulations under subsection (1) may not bring section 210 into force before the end of the period of six months beginning with the date specified in regulations under paragraph 8(1) of Schedule 3.

(4)

The following provisions come into force on the day on which this Act is passed—

(a)

Parts 1 and 2;

(b)

Chapter 1 of Part 3;

(c)

section 41, except subsection (4) of that section;

(d)

section 42 and Schedule 4;

(e)

sections 43 to 48;

(f)

section 52(3), (4) and (5);

(g)

section 53, except subsection (2) of that section;

(h)

Chapter 7 of Part 3 and Schedules 5, 6 and 7;

(i)

section 70;

(j)

section 74;

(k)

section 79;

(l)

section 80(4);

(m)

section 82;

(n)

sections 90 and 91;

(o)

section 93;

(p)

section 94 and Schedule 11;

(q)

Chapter 3 of Part 7;

(r)

sections 115 to 117;

(s)

section 129;

(t)

section 151;

(u)

section 154 so far as relating to a duty imposed on OFCOM under Schedule 11;

(v)

sections 169 and 170;

(w)

section 193, except subsection (2)(b) of that section;

(x)

section 194;

(y)

section 204(1);

(z)

section 207;

z1

section 212;

z2

section 214;

z3

section 219;

z4

sections 221 to 225;

z5

this Part.

(5)

The Secretary of State may by regulations make transitional, transitory or saving provision in connection with the coming into force of any provision of this Act.

(6)

The power to make regulations under subsection (5) includes power to make different provision for different purposes.

(7)

Regulations under this section are to be made by statutory instrument.

Annotations:
Commencement Information

I15S. 240 in force at Royal Assent, see s. 240(z5)

241Short title

This Act may be cited as the Online Safety Act 2023.

Annotations:
Commencement Information

I16S. 241 in force at Royal Assent, see s. 240(z5)