Online Safety Act 2023

Pt.1

Introduction

s.1

Introduction

s.1(1)

This Act provides for a new regulatory framework which has the general purpose of making the use of internet services regulated by this Act safer for individuals in the United Kingdom.

s.1(2)

To achieve that purpose, this Act (among other things)—

s.1(2)(a)

imposes duties which, in broad terms, require providers of services regulated by this Act to identify, mitigate and manage the risks of harm (including risks which particularly affect individuals with a certain characteristic) from—

s.1(2)(a)(i)

illegal content and activity, and

s.1(2)(a)(ii)

content and activity that is harmful to children, and

s.1(2)(b)

confers new functions and powers on the regulator, OFCOM.

s.1(3)

Duties imposed on providers by this Act seek to secure (among other things) that services regulated by this Act are—

s.1(3)(a)

safe by design, and

s.1(3)(b)

designed and operated in such a way that—

s.1(3)(b)(i)

a higher standard of protection is provided for children than for adults,

s.1(3)(b)(ii)

users’ rights to freedom of expression and privacy are protected, and

s.1(3)(b)(iii)

transparency and accountability are provided in relation to those services.

s.2

Overview of Act

s.2(1)

Parts 2 to 9 and 11 and 12 of this Act contain provision about the regulation by OFCOM of certain internet services.

s.2(2)

Part 2 contains key definitions, including the definition of a user-to-user service, a search service, a Part 3 service and a regulated service.

s.2(3)

Part 3 imposes duties of care on providers of user-to-user services and search services and requires OFCOM to issue codes of practice about those duties.

s.2(4)

Part 4 imposes further duties on providers of user-to-user services and search services.

s.2(5)

Part 5 imposes duties on providers of internet services (including user-to-user services and search services) that publish certain pornographic content.

s.2(6)

Part 6, which imposes requirements to pay fees to OFCOM, applies to providers of internet services to which the duties in Part 3, 4 or 5 apply (“regulated services”).

s.2(7)

Part 7 is about OFCOM’s powers and duties in relation to regulated services (including powers to obtain information and enforcement powers).

s.2(8)

Part 8 is about appeals and complaints relating to regulated services.

s.2(9)

Part 9 is about the Secretary of State’s functions in relation to regulated services.

s.2(10)

Part 10 contains communications offences.

s.2(11)

Parts 11 and 12 contain supplementary provisions including an index of terms defined in this Act (see section 237).

Pt.2

Key definitions

s.3

“User-to-user service” and “search service”

s.3(1)

In this Act “user-to-user service” means an internet service by means of which content that is generated directly on the service by a user of the service, or uploaded to or shared on the service by a user of the service, may be encountered by another user, or other users, of the service.

s.3(2)

For the purposes of subsection (1)—

s.3(2)(a)

it does not matter if content is actually shared with another user or users as long as a service has a functionality that allows such sharing;

s.3(2)(b)

it does not matter what proportion of content on a service is content described in that subsection.

s.3(3)

For the meaning of “content” and “encounter”, see section 236.

s.3(4)

In this Act “search service” means an internet service that is, or includes, a search engine (see section 229).

s.3(5)

Subsections (6) and (7) have effect to determine whether an internet service that— is a user-to-user service or a search service for the purposes of this Act.

s.3(5)(a)

is of a kind described in subsection (1), and

s.3(5)(b)

includes a search engine,

s.3(6)

It is a search service if the only content described in subsection (1) that is enabled by the service is content of any of the following kinds—

s.3(6)(a)

content mentioned in paragraph 1, 2 or 3 of Schedule 1 (emails, SMS and MMS messages, one-to-one live aural communications) and related identifying content;

s.3(6)(b)

content arising in connection with any of the activities described in paragraph 4(1) of Schedule 1 (comments etc on provider content);

s.3(6)(c)

content present on a part of the service in relation to which the conditions in paragraph 7(2) of Schedule 1 are met (internal business service conditions).

s.3(7)

Otherwise, it is a user-to-user service.

s.4

“Regulated service”, “Part 3 service” etc

s.4(1)

This section applies for the purposes of this Act.

s.4(2)

A user-to-user service is a “regulated user-to-user service”, and a search service is a “regulated search service”, if the service—

s.4(2)(a)

has links with the United Kingdom (see subsections (5) and (6)), and

s.4(2)(b)

is not—

s.4(2)(b)(i)

a service of a description that is exempt as provided for by Schedule 1, or

s.4(2)(b)(ii)

a service of a kind described in Schedule 2 (services combining user-generated content or search content not regulated by this Act with pornographic content that is regulated).

s.4(3)

“Part 3 service” means a regulated user-to-user service or a regulated search service.

s.4(4)

“Regulated service” means—

s.4(4)(a)

a regulated user-to-user service,

s.4(4)(b)

a regulated search service, or

s.4(4)(c)

an internet service, other than a regulated user-to-user service or a regulated search service, that is within section 80(2) (including a service of a kind described in Schedule 2).

s.4(5)

For the purposes of subsection (2), a user-to-user service or a search service “has links with the United Kingdom” if—

s.4(5)(a)

the service has a significant number of United Kingdom users, or

s.4(5)(b)

United Kingdom users form one of the target markets for the service (or the only target market).

s.4(6)

For the purposes of subsection (2), a user-to-user service or a search service also “has links with the United Kingdom” if—

s.4(6)(a)

the service is capable of being used in the United Kingdom by individuals, and

s.4(6)(b)

there are reasonable grounds to believe that there is a material risk of significant harm to individuals in the United Kingdom presented by—

s.4(6)(b)(i)

in the case of a user-to-user service, user-generated content present on the service or (if the service includes a search engine) search content of the service;

s.4(6)(b)(ii)

in the case of a search service, search content of the service.

s.4(7)

A regulated user-to-user service that includes a public search engine is referred to in this Act as a “combined service”. “Public search engine” means a search engine other than one in relation to which the conditions in paragraph 7(2) of Schedule 1 (internal business service conditions) are met.

s.4(8)

In this section—

s.5

Disapplication of Act to certain parts of services

s.5(1)

This Act does not apply in relation to a part of a Part 3 service if the conditions in paragraph 7(2) of Schedule 1 (internal business service conditions) are met in relation to that part.

s.5(2)

This Act does not apply in relation to a part of a regulated search service if—

s.5(2)(a)

the only user-generated content enabled by that part of the service is content of any of the following kinds—

s.5(2)(a)(i)

content mentioned in paragraph 1, 2 or 3 of Schedule 1 (emails, SMS and MMS messages, one-to-one live aural communications) and related identifying content;

s.5(2)(a)(ii)

content arising in connection with any of the activities described in paragraph 4(1) of Schedule 1 (comments etc on provider content); and

s.5(2)(b)

no regulated provider pornographic content is published or displayed on that part of the service.

s.5(3)

In this section—

Pt.3

Providers of regulated user-to-user services and regulated search services: duties of care

Pt.3 Ch.1

Introduction

s.6

Overview of Part 3

s.6(1)

This Part imposes duties of care on providers of regulated user-to-user services and regulated search services and requires OFCOM to issue codes of practice relating to some of those duties.

s.6(2)

Chapter 2 imposes duties of care on providers of regulated user-to-user services in relation to content and activity on their services.

s.6(3)

Chapter 3 imposes duties of care on providers of regulated search services in relation to content and activity on their services.

s.6(4)

Chapter 4 imposes duties on providers of regulated user-to-user services and regulated search services to assess whether a service is likely to be accessed by children.

s.6(5)

Chapter 5 imposes duties on providers of certain regulated user-to-user services and regulated search services relating to fraudulent advertising.

s.6(6)

Chapter 6 requires OFCOM to issue codes of practice relating to particular duties and explains what effects the codes of practice have.

s.6(7)

Chapter 7 is about the interpretation of this Part, and it includes definitions of the following key terms—

Pt.3 Ch.2

Providers of user-to-user services: duties of care

Pt.3 Ch.2(crossheading)(usertouser)(services)(which)(duties)(apply)(and)(scope)(of)(duties)

User-to-user services: which duties apply, and scope of duties

s.7

Providers of user-to-user services: duties of care

s.7(1)

Subsections (2) to (6) apply to determine which of the duties set out in this Chapter (and, in the case of combined services, Chapter 3) must be complied with by providers of regulated user-to-user services.

s.7(2)

All providers of regulated user-to-user services must comply with the following duties in relation to each such service which they provide—

s.7(2)(a)

the duties about illegal content risk assessments set out in section 9,

s.7(2)(b)

the duties about illegal content set out in section 10(2) to (8),

s.7(2)(c)

the duty about content reporting set out in section 20,

s.7(2)(d)

the duties about complaints procedures set out in section 21,

s.7(2)(e)

the duties about freedom of expression and privacy set out in section 22(2) and (3), and

s.7(2)(f)

the duties about record-keeping and review set out in section 23(2) to (6).

s.7(3)

Additional duties must be complied with by providers of particular kinds of regulated user-to-user services, as follows.

s.7(4)

All providers of regulated user-to-user services that are likely to be accessed by children must comply with the following duties in relation to each such service which they provide—

s.7(4)(a)

the duties about children’s risk assessments set out in section 11, and

s.7(4)(b)

the duties to protect children’s online safety set out in section 12(2) to (13).

s.7(5)

All providers of Category 1 services must comply with the following duties in relation to each such service which they provide—

s.7(5)(a)

the duty about illegal content risk assessments set out in section 10(9),

s.7(5)(b)

the duty about children’s risk assessments set out in section 12(14),

s.7(5)(c)

the duties about assessments related to adult user empowerment set out in section 14,

s.7(5)(d)

the duties to empower adult users set out in section 15,

s.7(5)(e)

the duties to protect content of democratic importance set out in section 17,

s.7(5)(f)

the duties to protect news publisher content set out in section 18,

s.7(5)(g)

the duties to protect journalistic content set out in section 19,

s.7(5)(h)

the duties about freedom of expression and privacy set out in section 22(4), (6) and (7), and

s.7(5)(i)

the duties about record-keeping set out in section 23(9) and (10).

s.7(6)

All providers of combined services must comply with the following duties in relation to the search engine of each such service which they provide—

s.7(6)(a)

if the service is not a Category 2A service and is not likely to be accessed by children, the duties set out in Chapter 3 referred to in section 24(2);

s.7(6)(b)

if the service is not a Category 2A service and is likely to be accessed by children, the duties set out in Chapter 3 referred to in section 24(2) and (4);

s.7(6)(c)

if the service is a Category 2A service not likely to be accessed by children, the duties set out in Chapter 3 referred to in section 24(2) and (5);

s.7(6)(d)

if the service is a Category 2A service likely to be accessed by children, the duties set out in Chapter 3 referred to in section 24(2), (4) and (5).

s.7(7)

For the meaning of “likely to be accessed by children”, see section 37.

s.7(8)

For the meaning of “Category 1 service”, see section 95 (register of categories of services).

s.8

Scope of duties of care

s.8(1)

A duty set out in this Chapter which must be complied with in relation to a user-to-user service that includes regulated provider pornographic content does not extend to— See Part 5 for the duties which relate to regulated provider pornographic content, and the meaning of that term.

s.8(1)(a)

the regulated provider pornographic content, or

s.8(1)(b)

the design, operation or use of the service so far as relating to that content.

s.8(2)

A duty set out in this Chapter which must be complied with in relation to a combined service does not extend to—

s.8(2)(a)

the search content of the service,

s.8(2)(b)

any other content that, following a search request, may be encountered as a result of subsequent interactions with internet services, or

s.8(2)(c)

anything relating to the design, operation or use of the search engine.

s.8(3)

A duty set out in this Chapter which must be complied with in relation to a user-to-user service extends only to—

s.8(3)(a)

the design, operation and use of the service in the United Kingdom, and

s.8(3)(b)

in the case of a duty that is expressed to apply in relation to users of a service, the design, operation and use of the service as it affects United Kingdom users of the service.

Pt.3 Ch.2(crossheading)(illegal)(content)(duties)(for)(usertouser)(services)

Illegal content duties for user-to-user services

s.9

Illegal content risk assessment duties

s.9(1)

This section sets out the duties about risk assessments which apply in relation to all regulated user-to-user services.

s.9(2)

A duty to carry out a suitable and sufficient illegal content risk assessment at a time set out in, or as provided by, Schedule 3.

s.9(3)

A duty to take appropriate steps to keep an illegal content risk assessment up to date, including when OFCOM make any significant change to a risk profile that relates to services of the kind in question.

s.9(4)

Before making any significant change to any aspect of a service’s design or operation, a duty to carry out a further suitable and sufficient illegal content risk assessment relating to the impacts of that proposed change.

s.9(5)

An “illegal content risk assessment” of a service of a particular kind means an assessment of the following matters, taking into account the risk profile that relates to services of that kind—

s.9(5)(a)

the user base;

s.9(5)(b)

the level of risk of individuals who are users of the service encountering the following by means of the service— taking into account (in particular) algorithms used by the service, and how easily, quickly and widely content may be disseminated by means of the service;

s.9(5)(b)(i)

each kind of priority illegal content (with each kind separately assessed), and

s.9(5)(b)(ii)

other illegal content,

s.9(5)(c)

the level of risk of the service being used for the commission or facilitation of a priority offence;

s.9(5)(d)

the level of risk of harm to individuals presented by illegal content of different kinds or by the use of the service for the commission or facilitation of a priority offence;

s.9(5)(e)

the level of risk of functionalities of the service facilitating the presence or dissemination of illegal content or the use of the service for the commission or facilitation of a priority offence, identifying and assessing those functionalities that present higher levels of risk;

s.9(5)(f)

the different ways in which the service is used, and the impact of such use on the level of risk of harm that might be suffered by individuals;

s.9(5)(g)

the nature, and severity, of the harm that might be suffered by individuals from the matters identified in accordance with paragraphs (b) to (f);

s.9(5)(h)

how the design and operation of the service (including the business model, governance, use of proactive technology, measures to promote users’ media literacy and safe use of the service, and other systems and processes) may reduce or increase the risks identified.

s.9(6)

In this section references to risk profiles are to the risk profiles for the time being published under section 98 which relate to the risk of harm to individuals presented by illegal content.

s.9(7)

See also—

s.9(7)(a)

section 23(2) and (10) (records of risk assessments), and

s.9(7)(b)

Schedule 3 (timing of providers’ assessments).

s.10

Safety duties about illegal content

s.10(1)

This section sets out the duties about illegal content which apply in relation to regulated user-to-user services (as indicated by the headings).

Pt.3 Ch.2(crossheading)(usertouser)(services)(likely)(to)(be)(accessed)(by)(children)

User-to-user services likely to be accessed by children

s.11

Children’s risk assessment duties

s.11(1)

This section sets out the duties about risk assessments which apply in relation to regulated user-to-user services that are likely to be accessed by children (in addition to the duties about risk assessments set out in section 9 and, in the case of services likely to be accessed by children which are Category 1 services, the duties about assessments set out in section 14).

s.11(2)

A duty to carry out a suitable and sufficient children’s risk assessment at a time set out in, or as provided by, Schedule 3.

s.11(3)

A duty to take appropriate steps to keep a children’s risk assessment up to date, including when OFCOM make any significant change to a risk profile that relates to services of the kind in question.

s.11(4)

Before making any significant change to any aspect of a service’s design or operation, a duty to carry out a further suitable and sufficient children’s risk assessment relating to the impacts of that proposed change.

s.11(5)

Where a children’s risk assessment of a service identifies the presence of non-designated content that is harmful to children, a duty to notify OFCOM of—

s.11(5)(a)

the kinds of such content identified, and

s.11(5)(b)

the incidence of those kinds of content on the service.

s.11(6)

A “children’s risk assessment” of a service of a particular kind means an assessment of the following matters, taking into account the risk profile that relates to services of that kind—

s.11(6)(a)

the user base, including the number of users who are children in different age groups;

s.11(6)(b)

the level of risk of children who are users of the service encountering the following by means of the service— giving separate consideration to children in different age groups, and taking into account (in particular) algorithms used by the service and how easily, quickly and widely content may be disseminated by means of the service;

s.11(6)(b)(i)

each kind of primary priority content that is harmful to children (with each kind separately assessed),

s.11(6)(b)(ii)

each kind of priority content that is harmful to children (with each kind separately assessed), and

s.11(6)(b)(iii)

non-designated content that is harmful to children,

s.11(6)(c)

the level of risk of harm to children presented by different kinds of content that is harmful to children, giving separate consideration to children in different age groups;

s.11(6)(d)

the level of risk of harm to children presented by content that is harmful to children which particularly affects individuals with a certain characteristic or members of a certain group;

s.11(6)(e)

the extent to which the design of the service, in particular its functionalities, affects the level of risk of harm that might be suffered by children, identifying and assessing those functionalities that present higher levels of risk, including functionalities—

s.11(6)(e)(i)

enabling adults to search for other users of the service (including children), or

s.11(6)(e)(ii)

enabling adults to contact other users (including children) by means of the service;

s.11(6)(f)

the different ways in which the service is used, including functionalities or other features of the service that affect how much children use the service (for example a feature that enables content to play automatically), and the impact of such use on the level of risk of harm that might be suffered by children;

s.11(6)(g)

the nature, and severity, of the harm that might be suffered by children from the matters identified in accordance with paragraphs (b) to (f), giving separate consideration to children in different age groups;

s.11(6)(h)

how the design and operation of the service (including the business model, governance, use of proactive technology, measures to promote users’ media literacy and safe use of the service, and other systems and processes) may reduce or increase the risks identified.

s.11(7)

In this section references to risk profiles are to the risk profiles for the time being published under section 98 which relate to the risk of harm to children presented by content that is harmful to children.

s.11(8)

See also—

s.11(8)(a)

section 23(2) and (10) (records of risk assessments), and

s.11(8)(b)

Schedule 3 (timing of providers’ assessments).

s.12

Safety duties protecting children

s.12(1)

This section sets out the duties to protect children’s online safety which apply in relation to regulated user-to-user services that are likely to be accessed by children (as indicated by the headings).

s.13

Safety duties protecting children: interpretation

s.13(1)

In determining what is proportionate for the purposes of section 12, the following factors, in particular, are relevant—

s.13(1)(a)

all the findings of the most recent children’s risk assessment (including as to levels of risk and as to nature, and severity, of potential harm to children), and

s.13(1)(b)

the size and capacity of the provider of a service.

s.13(2)

So far as a duty set out in section 12 relates to non-designated content that is harmful to children, the duty is to be taken to extend only to addressing risks of harm from the kinds of such content that have been identified in the most recent children’s risk assessment (if any have been identified).

s.13(3)

References in section 12(3)(b) and (9)(b) and (c) to children in age groups judged to be at risk of harm from content that is harmful to children are references to children in age groups judged to be at risk of such harm as assessed by the provider of a service in the most recent children’s risk assessment of the service.

s.13(4)

The duties set out in section 12(3) and (9) are to be taken to extend only to content that is harmful to children where the risk of harm is presented by the nature of the content (rather than the fact of its dissemination).

s.13(5)

The duties set out in section 12 extend only to such parts of a service as it is possible for children to access.

s.13(6)

For the purposes of subsection (5), a provider is only entitled to conclude that it is not possible for children to access a service, or a part of it, if age verification or age estimation is used on the service with the result that children are not normally able to access the service or that part of it.

s.13(7)

In section 12 and this section “children’s risk assessment” has the meaning given by section 11.

s.13(8)

See also, in relation to duties set out in section 12, section 22 (duties about freedom of expression and privacy).

Pt.3 Ch.2(crossheading)(category)(1)(services)

Category 1 services

s.14

Assessment duties: user empowerment

s.14(1)

This section sets out the duties about assessments related to adult user empowerment which apply in relation to Category 1 services (in addition to the duties about risk assessments set out in section 9 and, in the case of Category 1 services likely to be accessed by children, section 11).

s.14(2)

A duty to carry out a suitable and sufficient assessment for the purposes of section 15(2) at a time set out in, or as provided by, Schedule 3.

s.14(3)

A duty to take appropriate steps to keep such an assessment up to date.

s.14(4)

Before making any significant change to any aspect of a service’s design or operation, a duty to carry out a further suitable and sufficient assessment for the purposes of section 15(2) relating to the impacts of that proposed change.

s.14(5)

An assessment of a service “for the purposes of section 15(2)” means an assessment of the following matters—

s.14(5)(a)

the user base;

s.14(5)(b)

the incidence of relevant content on the service;

s.14(5)(c)

the likelihood of adult users of the service encountering, by means of the service, each kind of relevant content (with each kind separately assessed), taking into account (in particular) algorithms used by the service, and how easily, quickly and widely content may be disseminated by means of the service;

s.14(5)(d)

the likelihood of adult users with a certain characteristic or who are members of a certain group encountering relevant content which particularly affects them;

s.14(5)(e)

the likelihood of functionalities of the service facilitating the presence or dissemination of relevant content, identifying and assessing those functionalities more likely to do so;

s.14(5)(f)

the different ways in which the service is used, and the impact of such use on the likelihood of adult users encountering relevant content;

s.14(5)(g)

how the design and operation of the service (including the business model, governance, use of proactive technology, measures to strengthen adult users’ control over their interaction with user-generated content, and other systems and processes) may reduce or increase the likelihood of adult users encountering relevant content.

s.14(6)

In this section “relevant content” means content to which section 15(2) applies (content to which user empowerment duties set out in that provision apply).

s.14(7)

See also—

s.14(7)(a)

section 23(9) and (10) (records of assessments), and

s.14(7)(b)

Schedule 3 (timing of providers’ assessments).

s.15

User empowerment duties

s.15(1)

This section sets out the duties to empower adult users which apply in relation to Category 1 services.

s.15(2)

A duty to include in a service, to the extent that it is proportionate to do so, features which adult users may use or apply if they wish to increase their control over content to which this subsection applies.

s.15(3)

The features referred to in subsection (2) are those which, if used or applied by a user, result in the use by the service of systems or processes designed to effectively—

s.15(3)(a)

reduce the likelihood of the user encountering content to which subsection (2) applies present on the service, or

s.15(3)(b)

alert the user to content present on the service that is a particular kind of content to which subsection (2) applies.

s.15(4)

A duty to ensure that all features included in a service in compliance with the duty set out in subsection (2) (“control features”) are made available to all adult users and are easy to access.

s.15(5)

A duty to operate a service using a system or process which seeks to ensure that all registered adult users are offered the earliest possible opportunity, in relation to each control feature included in the service, to take a step indicating to the provider that—

s.15(5)(a)

the user wishes to retain the default setting for the feature (whether that is that the feature is in use or applied, or is not in use or applied), or

s.15(5)(b)

the user wishes to change the default setting for the feature.

s.15(6)

The duty set out in subsection (5)—

s.15(6)(a)

continues to apply in relation to a user and a control feature for so long as the user has not yet taken a step mentioned in that subsection in relation to the feature;

s.15(6)(b)

no longer applies in relation to a user once the user has taken such a step in relation to every control feature included in the service.

s.15(7)

A duty to include clear and accessible provisions in the terms of service specifying which control features are offered and how users may take advantage of them.

s.15(8)

A duty to summarise in the terms of service the findings of the most recent assessment of a service under section 14 (assessments related to the duty set out in subsection (2)).

s.15(9)

A duty to include in a service features which adult users may use or apply if they wish to filter out non-verified users.

s.15(10)

The features referred to in subsection (9) are those which, if used or applied by a user, result in the use by the service of systems or processes designed to effectively—

s.15(10)(a)

prevent non-verified users from interacting with content which that user generates, uploads or shares on the service, and

s.15(10)(b)

reduce the likelihood of that user encountering content which non-verified users generate, upload or share on the service.

s.16

User empowerment duties: interpretation

s.16(1)

In determining what is proportionate for the purposes of section 15(2), the following factors, in particular, are relevant—

s.16(1)(a)

all the findings of the most recent assessment under section 14, and

s.16(1)(b)

the size and capacity of the provider of the service.

s.16(2)

Section 15(2) applies to content that—

s.16(2)(a)

is regulated user-generated content in relation to the service in question, and

s.16(2)(b)

is within subsection (3), (4) or (5).

s.16(3)

Content is within this subsection if it encourages, promotes or provides instructions for—

s.16(3)(a)

suicide or an act of deliberate self-injury, or

s.16(3)(b)

an eating disorder or behaviours associated with an eating disorder.

s.16(4)

Content is within this subsection if it is abusive and the abuse targets any of the following characteristics—

s.16(4)(a)

race,

s.16(4)(b)

religion,

s.16(4)(c)

sex,

s.16(4)(d)

sexual orientation,

s.16(4)(e)

disability, or

s.16(4)(f)

gender reassignment.

s.16(5)

Content is within this subsection if it incites hatred against people—

s.16(5)(a)

of a particular race, religion, sex or sexual orientation,

s.16(5)(b)

who have a disability, or

s.16(5)(c)

who have the characteristic of gender reassignment.

s.16(6)

The duty set out in section 15(5) applies in relation to all registered adult users, not just those who begin to use a service after that duty begins to apply.

s.16(7)

In section 15 and this section—

s.16(8)

In section 15 and this section—

s.16(8)(a)

references to features include references to functionalities and settings, and

s.16(8)(b)

references to religion include references to a lack of religion.

s.16(9)

For the purposes of section 15 and this section, a person has the characteristic of gender reassignment if the person is proposing to undergo, is undergoing or has undergone a process (or part of a process) for the purpose of reassigning the person’s sex by changing physiological or other attributes of sex, and the reference to gender reassignment in subsection (4) is to be construed accordingly.

s.16(10)

See also, in relation to duties set out in section 15, section 22 (duties about freedom of expression and privacy).

s.17

Duties to protect content of democratic importance

s.17(1)

This section sets out the duties to protect content of democratic importance which apply in relation to Category 1 services.

s.17(2)

A duty to operate a service using proportionate systems and processes designed to ensure that the importance of the free expression of content of democratic importance is taken into account when making decisions about—

s.17(2)(a)

how to treat such content (especially decisions about whether to take it down or restrict users’ access to it), and

s.17(2)(b)

whether to take action against a user generating, uploading or sharing such content.

s.17(3)

A duty to ensure that the systems and processes mentioned in subsection (2) apply in the same way to a wide diversity of political opinion.

s.17(4)

A duty to include provisions in the terms of service specifying the policies and processes that are designed to take account of the principle mentioned in subsection (2), including, in particular, how that principle is applied to decisions mentioned in that subsection.

s.17(5)

A duty to ensure that—

s.17(5)(a)

the provisions of the terms of service referred to in subsection (4) are clear and accessible, and

s.17(5)(b)

those provisions are applied consistently.

s.17(6)

In determining what is proportionate for the purposes of subsection (2), the size and capacity of the provider of a service, in particular, is relevant.

s.17(7)

For the purposes of this section content is “content of democratic importance”, in relation to a user-to-user service, if—

s.17(7)(a)

the content is—

s.17(7)(a)(i)

news publisher content in relation to that service, or

s.17(7)(a)(ii)

regulated user-generated content in relation to that service; and

s.17(7)(b)

the content is or appears to be specifically intended to contribute to democratic political debate in the United Kingdom or a part or area of the United Kingdom.

s.17(8)

In this section, the reference to “taking action” against a user is to giving a warning to a user, or suspending or banning a user from using a service, or in any way restricting a user’s ability to use a service.

s.17(9)

For the meaning of “news publisher content” and “regulated user-generated content”, see section 55.

s.18

Duties to protect news publisher content

s.18(1)

This section sets out the duties to protect news publisher content which apply in relation to Category 1 services.

s.18(2)

Subject to subsections (4), (5) and (8), a duty, in relation to a service, to take the steps set out in subsection (3) before—

s.18(2)(a)

taking action in relation to content present on the service that is news publisher content, or

s.18(2)(b)

taking action against a user who is a recognised news publisher.

s.18(3)

The steps referred to in subsection (2) are—

s.18(3)(a)

to give the recognised news publisher in question a notification which—

s.18(3)(a)(i)

specifies the action that the provider is considering taking,

s.18(3)(a)(ii)

gives reasons for that proposed action by reference to each relevant provision of the terms of service,

s.18(3)(a)(iii)

where the proposed action relates to news publisher content that is also journalistic content, explains how the provider took the importance of the free expression of journalistic content into account when deciding on the proposed action, and

s.18(3)(a)(iv)

specifies a reasonable period within which the recognised news publisher may make representations,

s.18(3)(b)

to consider any representations that are made, and

s.18(3)(c)

to notify the recognised news publisher of the decision and the reasons for it (addressing any representations made).

s.18(4)

If a provider of a service reasonably considers that the provider would incur criminal or civil liability in relation to news publisher content present on the service if it were not taken down swiftly, the provider may take down that content without having taken the steps set out in subsection (3).

s.18(5)

A provider of a service may also take down news publisher content present on the service without having taken the steps set out in subsection (3) if that content amounts to a relevant offence (see section 59 and also subsection (10) of this section).

s.18(6)

Subject to subsection (8), if a provider takes action in relation to news publisher content or against a recognised news publisher without having taken the steps set out in subsection (3), a duty to take the steps set out in subsection (7).

s.18(7)

The steps referred to in subsection (6) are—

s.18(7)(a)

to swiftly notify the recognised news publisher in question of the action taken, giving the provider’s justification for not having first taken the steps set out in subsection (3),

s.18(7)(b)

to specify a reasonable period within which the recognised news publisher may request that the action is reversed, and

s.18(7)(c)

if a request is made as mentioned in paragraph (b)—

s.18(7)(c)(i)

to consider the request and whether the steps set out in subsection (3) should have been taken prior to the action being taken,

s.18(7)(c)(ii)

if the provider concludes that those steps should have been taken, to swiftly reverse the action, and

s.18(7)(c)(iii)

to notify the recognised news publisher of the decision and the reasons for it (addressing any reasons accompanying the request for reversal of the action).

s.18(8)

If a recognised news publisher has been banned from using a service (and the ban is still in force), the provider of the service may take action in relation to news publisher content present on the service which was generated or originally published or broadcast by the recognised news publisher without complying with the duties set out in this section.

s.18(9)

For the purposes of this section, a provider is not to be regarded as taking action in relation to news publisher content in the following circumstances—

s.18(9)(a)

a provider takes action in relation to content which is not news publisher content, that action affects related news publisher content, the grounds for the action only relate to the content which is not news publisher content, and it is not technically feasible for the action only to relate to the content which is not news publisher content;

s.18(9)(b)

a provider takes action against a user, and that action affects news publisher content that has been uploaded to or shared on the service by the user.

s.18(10)

Section 192 (providers’ judgements about the status of content) applies in relation to judgements by providers about whether news publisher content amounts to a relevant offence as it applies in relation to judgements about whether content is illegal content.

s.18(11)

Any provision of the terms of service has effect subject to this section.

s.18(12)

In this section—

s.18(12)(a)

references to “news publisher content” are to content that is news publisher content in relation to the service in question;

s.18(12)(b)

references to “taking action” against a person are to giving a warning to a person, or suspending or banning a person from using a service, or in any way restricting a person’s ability to use a service.

s.18(13)

In this section references to “taking action” in relation to content are to— and also include references to taking any other action in relation to content on the grounds that it is content of a kind which is the subject of a relevant term of service (but not otherwise).

s.18(13)(a)

taking down content,

s.18(13)(b)

restricting users’ access to content, or

s.18(13)(c)

adding warning labels to content, except warning labels normally encountered only by child users,

s.18(14)

A “relevant term of service” means a term of service which indicates to users (in whatever words) that the presence of a particular kind of content, from the time it is generated, uploaded or shared on the service, is not tolerated on the service or is tolerated but liable to result in the provider treating it in a way that makes it less likely that other users will encounter it.

s.18(15)

Taking any step set out in subsection (3) or (7) does not count as “taking action” for the purposes of this section.

s.18(16)

See—

s.19

Duties to protect journalistic content

s.19(1)

This section sets out the duties to protect journalistic content which apply in relation to Category 1 services.

Pt.3 Ch.2(crossheading)(duties)(about)(content)(reporting)(and)(complaints)(procedures)

Duties about content reporting and complaints procedures

s.20

Duty about content reporting

s.20(1)

This section sets out the duty about content reporting which applies in relation to all regulated user-to-user services.

s.20(2)

A duty to operate a service using systems and processes that allow users and affected persons to easily report content which they consider to be content of a kind specified below (with the duty extending to different kinds of content depending on the kind of service, as indicated by the headings).

s.20A

Reporting of intimate image content

s.20A(1)

The duty in section 20(2) includes a duty to operate a service using systems and processes that allow users and affected persons to easily make an intimate image content report to the provider.

s.20A(2)

An “intimate image content report” is a report which—

s.20A(2)(a)

declares that content present on the service is intimate image content,

s.20A(2)(b)

declares that the report is made by—

s.20A(2)(b)(i)

the subject of the content, or

s.20A(2)(b)(ii)

a person acting on that person’s behalf,

s.20A(2)(c)

declares that the report—

s.20A(2)(c)(i)

is made in good faith, and

s.20A(2)(c)(ii)

to the best of the knowledge and belief of the person making the report, is true,

s.20A(2)(d)

provides sufficient information about the content for the provider to identify it,

s.20A(2)(e)

provides contact details for the person making the report, and

s.20A(2)(f)

complies with any other requirements specified in regulations made by the Secretary of State.

s.20A(3)

The Secretary of State may by regulations make provision about how the requirements in subsection (2)(a) to (e) are to be met.

s.21

Duties about complaints procedures

s.21(1)

This section sets out the duties about complaints procedures which apply in relation to all regulated user-to-user services.

s.21(2)

A duty to operate a complaints procedure in relation to a service that—

s.21(2)(a)

allows for relevant kinds of complaint to be made (as set out under the headings below),

s.21(2)(b)

provides for appropriate action to be taken by the provider of the service in response to complaints of a relevant kind, and

s.21(2)(c)

is easy to access, easy to use (including by children) and transparent.

s.21(2A)

The duty in subsection (2) includes a duty to operate an expedited complaints procedure in relation to complaints within subsection (4)(a), (b)(i) or (b)(ii) that—

s.21(2A)(a)

are made by users or affected persons who have made an intimate image content report (see section 20A(2)), and

s.21(2A)(b)

are about the content to which the report relates.

s.21(3)

A duty to include in the terms of service provisions which are easily accessible (including to children) specifying the policies and processes that govern the handling and resolution of complaints of a relevant kind.

Pt.3 Ch.2(crossheading)(crosscutting)(duties)

Cross-cutting duties

s.22

Duties about freedom of expression and privacy

s.22(1)

This section sets out the duties about freedom of expression and privacy which apply in relation to regulated user-to-user services (as indicated by the headings).

s.23

Record-keeping and review duties

s.23(1)

This section sets out the record-keeping and review duties which apply in relation to regulated user-to-user services (as indicated by the headings).

Pt.3 Ch.3

Providers of search services: duties of care

Pt.3 Ch.3(crossheading)(search)(services)(which)(duties)(apply)(and)(scope)(of)(duties)

Search services: which duties apply, and scope of duties

s.24

Providers of search services: duties of care

s.24(1)

Subsections (2) to (4) apply to determine which of the duties set out in this Chapter must be complied with by providers of regulated search services.

s.24(2)

All providers of regulated search services must comply with the following duties in relation to each such service which they provide—

s.24(2)(a)

the duties about illegal content risk assessments set out in section 26,

s.24(2)(b)

the duties about illegal content set out in section 27(2) to (8),

s.24(2)(c)

the duty about content reporting set out in section 31,

s.24(2)(d)

the duties about complaints procedures set out in section 32,

s.24(2)(e)

the duties about freedom of expression and privacy set out in section 33, and

s.24(2)(f)

the duties about record-keeping and review set out in section 34(2) to (6).

s.24(3)

Additional duties must be complied with by providers of particular kinds of regulated search services, as follows.

s.24(4)

All providers of regulated search services that are likely to be accessed by children must comply with the following duties in relation to each such service which they provide—

s.24(4)(a)

the duties about children’s risk assessments set out in section 28, and

s.24(4)(b)

the duties to protect children’s online safety set out in section 29(2) to (8).

s.24(5)

All providers of regulated search services that are Category 2A services must comply with the following duties in relation to each such service which they provide—

s.24(5)(a)

the duty about illegal content risk assessments set out in section 27(9),

s.24(5)(b)

the duty about children’s risk assessments set out in section 29(9), and

s.24(5)(c)

the duty about record-keeping set out in section 34(9).

s.24(6)

For the meaning of “likely to be accessed by children”, see section 37.

s.24(7)

For the meaning of “Category 2A service”, see section 95 (register of categories of services).

s.25

Scope of duties of care

s.25(1)

A duty set out in this Chapter which must be complied with in relation to a search service extends only to—

s.25(1)(a)

the search content of the service,

s.25(1)(b)

the design, operation and use of the search engine in the United Kingdom, and

s.25(1)(c)

in the case of a duty that is expressed to apply in relation to users of a service, the design, operation and use of the search engine as it affects United Kingdom users of the service.

s.25(2)

For the purposes of the application of this Chapter in relation to the search engine of a combined service (see section 7(6))—

s.25(2)(a)

a duty set out in this Chapter which requires a matter to be included in a publicly available statement may be satisfied by including the matter in the terms of service;

s.25(2)(b)

references in this Chapter (except in section 24) to a search service are to be read as references to the search engine;

s.25(2)(c)

references in this Chapter (except in section 24) to the provider of a search service are to be read as references to the provider of the combined service.

Pt.3 Ch.3(crossheading)(illegal)(content)(duties)(for)(search)(services)

Illegal content duties for search services

s.26

Illegal content risk assessment duties

s.26(1)

This section sets out the duties about risk assessments which apply in relation to all regulated search services.

s.26(2)

A duty to carry out a suitable and sufficient illegal content risk assessment at a time set out in, or as provided by, Schedule 3.

s.26(3)

A duty to take appropriate steps to keep an illegal content risk assessment up to date, including when OFCOM make any significant change to a risk profile that relates to services of the kind in question.

s.26(4)

Before making any significant change to any aspect of a service’s design or operation, a duty to carry out a further suitable and sufficient illegal content risk assessment relating to the impacts of that proposed change.

s.26(5)

An “illegal content risk assessment” of a service of a particular kind means an assessment of the following matters, taking into account the risk profile that relates to services of that kind—

s.26(5)(a)

the level of risk of individuals who are users of the service encountering search content of the following kinds— taking into account (in particular) risks presented by algorithms used by the service, and the way that the service indexes, organises and presents search results;

s.26(5)(a)(i)

each kind of priority illegal content (with each kind separately assessed), and

s.26(5)(a)(ii)

other illegal content,

s.26(5)(b)

the level of risk of functionalities of the service facilitating individuals encountering search content that is illegal content, identifying and assessing those functionalities that present higher levels of risk;

s.26(5)(c)

the nature, and severity, of the harm that might be suffered by individuals from the matters identified in accordance with paragraphs (a) and (b);

s.26(5)(d)

how the design and operation of the service (including the business model, governance, use of proactive technology, measures to promote users’ media literacy and safe use of the service, and other systems and processes) may reduce or increase the risks identified.

s.26(6)

In this section references to risk profiles are to the risk profiles for the time being published under section 98 which relate to the risk of harm to individuals presented by illegal content.

s.26(7)

See also—

s.26(7)(a)

section 34(2) and (9) (records of risk assessments), and

s.26(7)(b)

Schedule 3 (timing of providers’ assessments).

s.27

Safety duties about illegal content

s.27(1)

This section sets out the duties about illegal content which apply in relation to regulated search services (as indicated by the headings).

Pt.3 Ch.3(crossheading)(search)(services)(likely)(to)(be)(accessed)(by)(children)

Search services likely to be accessed by children

s.28

Children’s risk assessment duties

s.28(1)

This section sets out the duties about risk assessments which apply in relation to regulated search services that are likely to be accessed by children (in addition to the duties about risk assessments set out in section 26).

s.28(2)

A duty to carry out a suitable and sufficient children’s risk assessment at a time set out in, or as provided by, Schedule 3.

s.28(3)

A duty to take appropriate steps to keep a children’s risk assessment up to date, including when OFCOM make any significant change to a risk profile that relates to services of the kind in question.

s.28(4)

Before making any significant change to any aspect of a service’s design or operation, a duty to carry out a further suitable and sufficient children’s risk assessment relating to the impacts of that proposed change.

s.28(5)

A “children’s risk assessment” of a service of a particular kind means an assessment of the following matters, taking into account the risk profile that relates to services of that kind—

s.28(5)(a)

the level of risk of children who are users of the service encountering search content of the following kinds— giving separate consideration to children in different age groups, and taking into account (in particular) risks presented by algorithms used by the service and the way that the service indexes, organises and presents search results;

s.28(5)(a)(i)

each kind of primary priority content that is harmful to children (with each kind separately assessed),

s.28(5)(a)(ii)

each kind of priority content that is harmful to children (with each kind separately assessed), and

s.28(5)(a)(iii)

non-designated content that is harmful to children,

s.28(5)(b)

the level of risk of children who are users of the service encountering search content that is harmful to children which particularly affects individuals with a certain characteristic or members of a certain group;

s.28(5)(c)

the extent to which the design of the service, in particular its functionalities, affects the level of risk of harm that might be suffered by children, identifying and assessing those functionalities that present higher levels of risk, including a functionality that makes suggestions relating to users’ search requests (predictive search functionality);

s.28(5)(d)

the different ways in which the service is used, including functionalities or other features of the service that affect how much children use the service, and the impact of such use on the level of risk of harm that might be suffered by children;

s.28(5)(e)

the nature, and severity, of the harm that might be suffered by children from the matters identified in accordance with paragraphs (a) to (d), giving separate consideration to children in different age groups;

s.28(5)(f)

how the design and operation of the service (including the business model, governance, use of proactive technology, measures to promote users’ media literacy and safe use of the service, and other systems and processes) may reduce or increase the risks identified.

s.28(6)

In this section references to risk profiles are to the risk profiles for the time being published under section 98 which relate to the risk of harm to children presented by content that is harmful to children.

s.28(7)

See also—

s.28(7)(a)

section 34(2) and (9) (records of risk assessments), and

s.28(7)(b)

Schedule 3 (timing of providers’ assessments).

s.29

Safety duties protecting children

s.29(1)

This section sets out the duties to protect children’s online safety which apply in relation to regulated search services that are likely to be accessed by children (as indicated by the headings).

s.30

Safety duties protecting children: interpretation

s.30(1)

In determining what is proportionate for the purposes of section 29, the following factors, in particular, are relevant—

s.30(1)(a)

all the findings of the most recent children’s risk assessment (including as to levels of risk and as to nature, and severity, of potential harm to children), and

s.30(1)(b)

the size and capacity of the provider of a service.

s.30(2)

So far as a duty set out in section 29 relates to non-designated content that is harmful to children, the duty is to be taken to extend only to addressing risks of harm from the kinds of such content that have been identified in the most recent children’s risk assessment (if any have been identified).

s.30(3)

The reference in section 29(3)(b) to children in age groups judged to be at risk of harm from content that is harmful to children is a reference to children in age groups judged to be at risk of such harm as assessed by the provider of a service in the most recent children’s risk assessment of the service.

s.30(4)

The duties set out in section 29(3) are to be taken to extend only to content that is harmful to children where the risk of harm is presented by the nature of the content (rather than the fact of its dissemination).

s.30(5)

The duties set out in section 29 extend only to such parts of a service as it is possible for children to access.

s.30(6)

For the purposes of subsection (5), a provider is only entitled to conclude that it is not possible for children to access a service, or a part of it, if age verification or age estimation is used on the service with the result that children are not normally able to access the service or that part of it.

s.30(7)

In section 29 and this section “children’s risk assessment” has the meaning given by section 28.

s.30(8)

See also, in relation to duties set out in section 29, section 33 (duties about freedom of expression and privacy).

Pt.3 Ch.3(crossheading)(duties)(about)(content)(reporting)(and)(complaints)(procedures)

Duties about content reporting and complaints procedures

s.31

Duty about content reporting

s.31(1)

This section sets out the duty about content reporting which applies in relation to all regulated search services.

s.31(2)

A duty to operate a service using systems and processes that allow users and affected persons to easily report search content which they consider to be content of a kind specified below (with the duty extending to content that is harmful to children depending on the kind of service, as indicated by the headings).

s.31A

Reporting of intimate image content

s.31A(1)

The duty in section 31(2) includes a duty to operate a service using systems and processes that allow users and affected persons to easily make an intimate image content report to the provider.

s.31A(2)

An “intimate image content report” is a report which—

s.31A(2)(a)

declares that search content is intimate image content,

s.31A(2)(b)

declares that the report is made by—

s.31A(2)(b)(i)

the subject of the content, or

s.31A(2)(b)(ii)

a person acting on that person’s behalf,

s.31A(2)(c)

declares that the report—

s.31A(2)(c)(i)

is made in good faith, and

s.31A(2)(c)(ii)

to the best of the knowledge and belief of the person making the report, is true,

s.31A(2)(d)

provides sufficient information about the search content for the provider to identify it,

s.31A(2)(e)

provides contact details for the person making the report, and

s.31A(2)(f)

complies with any other requirements specified in regulations made by the Secretary of State.

s.31A(3)

The Secretary of State may by regulations make provision about how the requirements in subsection (2)(a) to (e) are to be met.

s.32

Duties about complaints procedures

s.32(1)

This section sets out the duties about complaints procedures which apply in relation to all regulated search services.

s.32(2)

A duty to operate a complaints procedure in relation to a service that—

s.32(2)(a)

allows for relevant kinds of complaint to be made (as set out under the headings below),

s.32(2)(b)

provides for appropriate action to be taken by the provider of the service in response to complaints of a relevant kind, and

s.32(2)(c)

is easy to access, easy to use (including by children) and transparent.

s.32(2A)

The duty in subsection (2) includes a duty to operate an expedited complaints procedure in relation to complaints within subsection (4)(a), (b)(i) or (b)(ii) that—

s.32(2A)(a)

are made by users or affected persons who have made an intimate image content report (see section 31A(2)), and

s.32(2A)(b)

are about the search content to which the report relates.

s.32(3)

A duty to make the policies and processes that govern the handling and resolution of complaints of a relevant kind publicly available and easily accessible (including to children).

Pt.3 Ch.3(crossheading)(crosscutting)(duties)

Cross-cutting duties

s.33

Duties about freedom of expression and privacy

s.33(1)

This section sets out the duties about freedom of expression and privacy which apply in relation to all regulated search services.

s.33(2)

When deciding on, and implementing, safety measures and policies, a duty to have particular regard to the importance of protecting the rights of users and interested persons to freedom of expression within the law.

s.33(3)

When deciding on, and implementing, safety measures and policies, a duty to have particular regard to the importance of protecting users from a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of a search service (including, but not limited to, any such provision or rule concerning the processing of personal data).

s.33(4)

In this section—

s.34

Record-keeping and review duties

s.34(1)

This section sets out the record-keeping and review duties which apply in relation to regulated search services (as indicated by the headings).

Pt.3 Ch.4

Children's access assessments

s.35

Children’s access assessments

s.35(1)

In this Part, a “children’s access assessment” means an assessment of a Part 3 service—

s.35(1)(a)

to determine whether it is possible for children to access the service or a part of the service, and

s.35(1)(b)

if it is possible for children to access the service or a part of the service, to determine whether the child user condition is met in relation to the service or a part of the service.

s.35(2)

A provider is only entitled to conclude that it is not possible for children to access a service, or a part of it, if age verification or age estimation is used on the service with the result that children are not normally able to access the service or that part of it.

s.35(3)

The “child user condition” is met in relation to a service, or a part of a service, if—

s.35(3)(a)

there is a significant number of children who are users of the service or of that part of it, or

s.35(3)(b)

the service, or that part of it, is of a kind likely to attract a significant number of users who are children.

s.35(4)

For the purposes of subsection (3)—

s.35(4)(a)

the reference to a “significant” number includes a reference to a number which is significant in proportion to the total number of United Kingdom users of a service or (as the case may be) a part of a service;

s.35(4)(b)

whether the test in paragraph (a) of that subsection is met is to be based on evidence about who actually uses a service, rather than who the intended users of the service are.

s.35(5)

In this Chapter—

s.35(5)(a)

references to children are to children in the United Kingdom;

s.35(5)(b)

references to a part of a service do not include any part of a service that is not, or is not included in, a user-to-user part of a service or a search engine.

s.36

Duties about children’s access assessments

s.36(1)

A provider of a Part 3 service must carry out the first children’s access assessment at a time set out in, or as provided by, Schedule 3.

s.36(2)

Subsections (3) and (4) apply to a provider of a Part 3 service during any period when the service is not treated as likely to be accessed by children (see section 37).

s.36(3)

The provider must carry out children’s access assessments of the service not more than one year apart.

s.36(4)

The provider must carry out a children’s access assessment of the service—

s.36(4)(a)

before making any significant change to any aspect of the service’s design or operation to which such an assessment is relevant,

s.36(4)(b)

in response to evidence about reduced effectiveness of age verification or age estimation that is used on the service as mentioned in section 35(2), or

s.36(4)(c)

in response to evidence about a significant increase in the number of children using the service.

s.36(5)

If a person is the provider of more than one Part 3 service, children’s access assessments must be carried out for each service separately.

s.36(6)

Children’s access assessments must be suitable and sufficient for the purposes of this Part.

s.36(7)

A provider must make and keep a written record, in an easily understandable form, of every children’s access assessment.

s.37

Meaning of “likely to be accessed by children”

s.37(1)

For the purposes of this Part, a Part 3 service is to be treated as “likely to be accessed by children” in the following three cases (with the result that the duties set out in sections 11 and 12, or (as the case may be) sections 28 and 29, apply in relation to the service).

s.37(2)

The first case is where a children’s access assessment carried out by the provider of the service concludes that— This subsection is to be interpreted consistently with section 35.

s.37(2)(a)

it is possible for children to access the service or a part of it, and

s.37(2)(b)

the child user condition is met in relation to—

s.37(2)(b)(i)

the service, or

s.37(2)(b)(ii)

a part of the service that it is possible for children to access.

s.37(3)

In that case, the service is to be treated as likely to be accessed by children from the date on which the children’s access assessment is completed.

s.37(4)

The second case is where the provider of the service fails to carry out the first children’s access assessment as required by section 36(1).

s.37(5)

In that case—

s.37(5)(a)

the service is to be treated as likely to be accessed by children from the date by which the first children’s access assessment was required to have been completed (see Part 1 of Schedule 3), and

s.37(5)(b)

the service is to continue to be treated as likely to be accessed by children by reason of subsection (4) until such time as the provider completes the first children’s access assessment of the service.

s.37(6)

The third case is where, following an investigation into a failure to comply with a duty set out in section 36, OFCOM determine that a service should be treated as likely to be accessed by children: see section 135(4) and (5).

s.37(7)

In that case, the service is to be treated as likely to be accessed by children from the date of, or specified in, the confirmation decision given to the provider of the service (as the case may be: see section 135(5)).

Pt.3 Ch.5

Duties about fraudulent advertising

s.38

Duties about fraudulent advertising: Category 1 services

s.38(1)

A provider of a Category 1 service must operate the service using proportionate systems and processes designed to—

s.38(1)(a)

prevent individuals from encountering content consisting of fraudulent advertisements by means of the service;

s.38(1)(b)

minimise the length of time for which any such content is present;

s.38(1)(c)

where the provider is alerted by a person to the presence of such content, or becomes aware of it in any other way, swiftly take down such content.

s.38(2)

A provider of a Category 1 service must include clear and accessible provisions in the terms of service giving information about any proactive technology used by the service for the purpose of compliance with the duty set out in subsection (1) (including the kind of technology, when it is used, and how it works).

s.38(3)

In relation to a Category 1 service, an advertisement is a “fraudulent advertisement” if—

s.38(3)(a)

it is a paid-for advertisement (see section 236),

s.38(3)(b)

it amounts to an offence specified in section 40 (construed in accordance with section 59: see subsections (3), (11) and (12) of that section), and

s.38(3)(c)

it is not regulated user-generated content (see section 55) in relation to the service.

s.38(4)

If a person is the provider of more than one Category 1 service, the duties set out in this section apply in relation to each such service.

s.38(5)

In determining what is proportionate for the purposes of this section, the following factors, in particular, are relevant—

s.38(5)(a)

the nature, and severity, of potential harm to individuals presented by different kinds of fraudulent advertisement, and

s.38(5)(b)

the degree of control a provider has in relation to the placement of advertisements on the service.

s.38(6)

In the case of a Category 1 service which is a combined service, the duties set out in this section do not extend to— But if the service is also a Category 2A service, the duties set out in section 39 apply as well as the duties set out in this section.

s.38(6)(a)

fraudulent advertisements that may be encountered in search results of the service or, following a search request, as a result of subsequent interactions with internet services, or

s.38(6)(b)

anything relating to the design, operation or use of the search engine.

s.38(7)

The duties set out in this section extend only to the design, operation and use of a Category 1 service in the United Kingdom.

s.38(8)

For the meaning of “Category 1 service”, see section 95 (register of categories of services).

s.39

Duties about fraudulent advertising: Category 2A services

s.39(1)

A provider of a Category 2A service must operate the service using proportionate systems and processes designed to—

s.39(1)(a)

prevent individuals from encountering content consisting of fraudulent advertisements in or via search results of the service;

s.39(1)(b)

if any such content may be encountered in or via search results of the service, minimise the length of time that that is the case;

s.39(1)(c)

where the provider is alerted by a person to the fact that such content may be so encountered, or becomes aware of that fact in any other way, swiftly ensure that individuals are no longer able to encounter such content in or via search results of the service.

s.39(2)

A provider of a Category 2A service must include clear and accessible provisions in a publicly available statement giving information about any proactive technology used by the service for the purpose of compliance with the duty set out in subsection (1) (including the kind of technology, when it is used, and how it works).

s.39(3)

In relation to a Category 2A service, an advertisement is a “fraudulent advertisement” if—

s.39(3)(a)

it is a paid-for advertisement (see section 236), and

s.39(3)(b)

it amounts to an offence specified in section 40 (construed in accordance with section 59: see subsections (3), (11) and (12) of that section).

s.39(4)

The references to encountering fraudulent advertisements “in or via search results” of a search service—

s.39(4)(a)

are references to encountering fraudulent advertisements—

s.39(4)(a)(i)

in search results of the service, or

s.39(4)(a)(ii)

as a result of interacting with a paid-for advertisement in search results of the service (for example, by clicking on it);

s.39(4)(b)

do not include references to encountering fraudulent advertisements as a result of any subsequent interactions with an internet service other than the search service.

s.39(5)

If a person is the provider of more than one Category 2A service, the duties set out in this section apply in relation to each such service.

s.39(6)

In determining what is proportionate for the purposes of this section, the following factors, in particular, are relevant—

s.39(6)(a)

the nature, and severity, of potential harm to individuals presented by different kinds of fraudulent advertisement, and

s.39(6)(b)

the degree of control a provider has in relation to the placement of advertisements on the service.

s.39(7)

The duties set out in this section extend only to the design, operation and use of a Category 2A service in the United Kingdom.

s.39(8)

For the meaning of “Category 2A service”, see section 95 (register of categories of services).

s.40

Fraud etc offences

s.40(1)

This section specifies offences for the purposes of this Chapter (see sections 38(3)(b) and 39(3)(b)).

s.40(2)

An offence under any of the following provisions of the Financial Services and Markets Act 2000—

s.40(2)(a)

section 23 (contravention of prohibition on carrying on regulated activity unless authorised or exempt);

s.40(2)(b)

section 24 (false claims to be authorised or exempt);

s.40(2)(c)

section 25 (contravention of restrictions on financial promotion).

s.40(3)

An offence under any of the following provisions of the Fraud Act 2006—

s.40(3)(a)

section 2 (fraud by false representation);

s.40(3)(b)

section 4 (fraud by abuse of position);

s.40(3)(c)

section 7 (making or supplying articles for use in frauds);

s.40(3)(d)

section 9 (participating in fraudulent business carried on by sole trader etc).

s.40(4)

An offence under any of the following provisions of the Financial Services Act 2012—

s.40(4)(a)

section 89 (misleading statements);

s.40(4)(b)

section 90 (misleading impressions).

s.40(5)

An offence of attempting or conspiring to commit an offence specified in subsection (2), (3) or (4).

s.40(6)

An offence under Part 2 of the Serious Crime Act 2007 (encouraging or assisting) in relation to an offence specified in subsection (2), (3) or (4), or (in Scotland) inciting a person to commit such an offence.

s.40(7)

An offence of aiding, abetting, counselling or procuring the commission of an offence specified in subsection (2), (3) or (4), or (in Scotland) being involved art and part in the commission of such an offence.

Pt.3 Ch.6

Codes of practice and guidance

Pt.3 Ch.6(crossheading)(codes)(of)(practice)

Codes of practice

s.41

Codes of practice about duties

s.41(1)

OFCOM must prepare and issue a code of practice for providers of Part 3 services describing measures recommended for the purpose of compliance with duties set out in section 10 or 27 (illegal content) so far as relating to terrorism content or offences within Schedule 5 (terrorism offences).

s.41(2)

OFCOM must prepare and issue a code of practice for providers of Part 3 services describing measures recommended for the purpose of compliance with duties set out in section 10 or 27 (illegal content) so far as relating to CSEA content or offences within Schedule 6 (child sexual exploitation and abuse offences).

s.41(3)

OFCOM must prepare and issue one or more codes of practice for providers of Part 3 services describing measures recommended for the purpose of compliance with the relevant duties (except to the extent that measures for the purpose of compliance with such duties are described in a code of practice prepared under subsection (1) or (2)).

s.41(4)

OFCOM must prepare and issue a code of practice for providers of Category 1 services and providers of Category 2A services describing measures recommended for the purpose of compliance with the duties set out in Chapter 5 (fraudulent advertising).

s.41(5)

Where a code of practice under this section is in force, OFCOM may—

s.41(5)(a)

prepare a draft of amendments of the code of practice;

s.41(5)(b)

prepare a draft of a code of practice under subsection (1), (2), (3) or (4) as a replacement for a code of practice previously issued under the subsection in question;

s.41(5)(c)

withdraw the code of practice.

s.41(6)

In the course of preparing a draft of a code of practice or amendments of a code of practice under this section, OFCOM must consult—

s.41(6)(a)

the Secretary of State,

s.41(6)(b)

persons who appear to OFCOM to represent providers of Part 3 services,

s.41(6)(c)

persons who appear to OFCOM to represent the interests of United Kingdom users of Part 3 services,

s.41(6)(d)

persons who appear to OFCOM to represent the interests of children (generally or with particular reference to online safety matters),

s.41(6)(e)

persons who appear to OFCOM to represent the interests of persons who have suffered harm as a result of matters to which the code of practice is relevant,

s.41(6)(f)

persons whom OFCOM consider to have relevant expertise in equality issues and human rights, in particular—

s.41(6)(f)(i)

the right to freedom of expression set out in Article 10 of the Convention, and

s.41(6)(f)(ii)

the right to respect for a person’s private and family life, home and correspondence set out in Article 8 of the Convention,

s.41(6)(g)

the Information Commissioner,

s.41(6)(h)

the Children’s Commissioner,

s.41(6)(i)

the Commissioner for Victims and Witnesses,

s.41(6)(j)

the Domestic Abuse Commissioner,

s.41(6)(k)

persons whom OFCOM consider to have expertise in public health, science or medicine that is relevant to online safety matters,

s.41(6)(l)

persons whom OFCOM consider to have expertise in innovation, or emerging technology, that is relevant to online safety matters, and

s.41(6)(m)

such other persons as OFCOM consider appropriate.

s.41(7)

In the course of preparing a draft of a code of practice or amendments to which this subsection applies, OFCOM must also consult persons whom OFCOM consider to have expertise in the enforcement of the criminal law and the protection of national security that is relevant to online safety matters.

s.41(8)

Subsection (7) applies to—

s.41(8)(a)

a code of practice under subsection (1) and amendments of such a code,

s.41(8)(b)

a code of practice under subsection (2) and amendments of such a code,

s.41(8)(c)

a code of practice under subsection (3) that describes measures recommended for the purpose of compliance with duties set out in section 10 or 27 (illegal content),

s.41(8)(d)

amendments of a code of practice under subsection (3), if and to the extent that those amendments relate to measures recommended for the purpose of compliance with duties set out in section 10 or 27, and

s.41(8)(e)

a code of practice under subsection (4) and amendments of such a code.

s.41(9)

Subsections (6) and (7) are subject to section 48 (minor amendments of code of practice).

s.41(10)

In this section “the relevant duties” means the duties set out in—

s.41(10)(a)

sections 10 and 27 (illegal content),

s.41(10)(b)

sections 12 and 29 (children’s online safety),

s.41(10)(c)

section 15 (user empowerment),

s.41(10)(d)

section 17 (content of democratic importance),

s.41(10)(e)

section 19 (journalistic content),

s.41(10)(f)

sections 20 and 31 (content reporting), and

s.41(10)(g)

sections 21 and 32 (complaints procedures).

s.42

Codes of practice: principles, objectives, content

Schedule 4 contains—

s.42(a)

provision about the principles OFCOM must consider when preparing codes of practice under section 41,

s.42(b)

the online safety objectives (and a power for the Secretary of State by regulations to revise those objectives),

s.42(c)

provision about the measures that may be described in codes of practice (including, in particular, constraints on the recommendation of the use of proactive technology), and