acthub.

Online Safety Act 2023

Sections519

Online Safety Act 2023

2023 Chapter 50

An Act to make provision for and in connection with the regulation by OFCOM of certain internet services; for and in connection with communications offences; and for connected purposes.

Enacted [26th October 2023]
Be it enacted by the King’s most Excellent Majesty, by and with the advice and consent of the Lords Spiritual and Temporal, and Commons, in this present Parliament assembled, and by the authority of the same, as follows:—

PART 1 Introduction

I8601 Introduction

1 This Act provides for a new regulatory framework which has the general purpose of making the use of internet services regulated by this Act safer for individuals in the United Kingdom.
2 To achieve that purpose, this Act (among other things)—
a imposes duties which, in broad terms, require providers of services regulated by this Act to identify, mitigate and manage the risks of harm (including risks which particularly affect individuals with a certain characteristic) from—
i illegal content and activity, and
ii content and activity that is harmful to children, and
b confers new functions and powers on the regulator, OFCOM.
3 Duties imposed on providers by this Act seek to secure (among other things) that services regulated by this Act are—
a safe by design, and
b designed and operated in such a way that—
i a higher standard of protection is provided for children than for adults,
ii users’ rights to freedom of expression and privacy are protected, and
iii transparency and accountability are provided in relation to those services.

I2942 Overview of Act

1 Parts 2 to 9 and 11 and 12 of this Act contain provision about the regulation by OFCOM of certain internet services.
2 Part 2 contains key definitions, including the definition of a user-to-user service, a search service, a Part 3 service and a regulated service.
3 Part 3 imposes duties of care on providers of user-to-user services and search services and requires OFCOM to issue codes of practice about those duties.
4 Part 4 imposes further duties on providers of user-to-user services and search services.
5 Part 5 imposes duties on providers of internet services (including user-to-user services and search services) that publish certain pornographic content.
6 Part 6, which imposes requirements to pay fees to OFCOM, applies to providers of internet services to which the duties in Part 3, 4 or 5 apply (“regulated services”).
7 Part 7 is about OFCOM’s powers and duties in relation to regulated services (including powers to obtain information and enforcement powers).
8 Part 8 is about appeals and complaints relating to regulated services.
9 Part 9 is about the Secretary of State’s functions in relation to regulated services.
10 Part 10 contains communications offences.
11 Parts 11 and 12 contain supplementary provisions including an index of terms defined in this Act (see section 237).

PART 2 Key definitions

I3463 “User-to-user service” and “search service”

1 In this Act “user-to-user service” means an internet service by means of which content that is generated directly on the service by a user of the service, or uploaded to or shared on the service by a user of the service, may be encountered by another user, or other users, of the service.
2 For the purposes of subsection (1)—
a it does not matter if content is actually shared with another user or users as long as a service has a functionality that allows such sharing;
b it does not matter what proportion of content on a service is content described in that subsection.
3 For the meaning of “content” and “encounter”, see section 236.
4 In this Act “search service” means an internet service that is, or includes, a search engine (see section 229).
5 Subsections (6) and (7) have effect to determine whether an internet service that—
a is of a kind described in subsection (1), and
b includes a search engine,
is a user-to-user service or a search service for the purposes of this Act.
6 It is a search service if the only content described in subsection (1) that is enabled by the service is content of any of the following kinds—
a content mentioned in paragraph 1, 2 or 3 of Schedule 1 (emails, SMS and MMS messages, one-to-one live aural communications) and related identifying content;
b content arising in connection with any of the activities described in paragraph 4(1) of Schedule 1 (comments etc on provider content);
c content present on a part of the service in relation to which the conditions in paragraph 7(2) of Schedule 1 are met (internal business service conditions).
7 Otherwise, it is a user-to-user service.

I4494 “Regulated service”, “Part 3 service” etc

1 This section applies for the purposes of this Act.
2 A user-to-user service is a “regulated user-to-user service”, and a search service is a “regulated search service”, if the service—
a has links with the United Kingdom (see subsections (5) and (6)), and
b is not—
i a service of a description that is exempt as provided for by Schedule 1, or
ii a service of a kind described in Schedule 2 (services combining user-generated content or search content not regulated by this Act with pornographic content that is regulated).
3 “Part 3 service” means a regulated user-to-user service or a regulated search service.
4 “Regulated service” means—
a a regulated user-to-user service,
b a regulated search service, or
c an internet service, other than a regulated user-to-user service or a regulated search service, that is within section 80(2) (including a service of a kind described in Schedule 2).
5 For the purposes of subsection (2), a user-to-user service or a search service “has links with the United Kingdom” if—
a the service has a significant number of United Kingdom users, or
b United Kingdom users form one of the target markets for the service (or the only target market).
6 For the purposes of subsection (2), a user-to-user service or a search service also “has links with the United Kingdom” if—
a the service is capable of being used in the United Kingdom by individuals, and
b there are reasonable grounds to believe that there is a material risk of significant harm to individuals in the United Kingdom presented by—
i in the case of a user-to-user service, user-generated content present on the service or (if the service includes a search engine) search content of the service;
ii in the case of a search service, search content of the service.
7 A regulated user-to-user service that includes a public search engine is referred to in this Act as a “combined service”. “Public search engine” means a search engine other than one in relation to which the conditions in paragraph 7(2) of Schedule 1 (internal business service conditions) are met.
8 In this section—
  • “search content” has the same meaning as in Part 3 (see section 57);
  • “user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

I1625 Disapplication of Act to certain parts of services

1 This Act does not apply in relation to a part of a Part 3 service if the conditions in paragraph 7(2) of Schedule 1 (internal business service conditions) are met in relation to that part.
2 This Act does not apply in relation to a part of a regulated search service if—
a the only user-generated content enabled by that part of the service is content of any of the following kinds—
i content mentioned in paragraph 1, 2 or 3 of Schedule 1 (emails, SMS and MMS messages, one-to-one live aural communications) and related identifying content;
ii content arising in connection with any of the activities described in paragraph 4(1) of Schedule 1 (comments etc on provider content); and
b no regulated provider pornographic content is published or displayed on that part of the service.
3 In this section—
  • “regulated provider pornographic content” and “published or displayed” have the same meaning as in Part 5 (see section 79);
  • “user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

PART 3 Providers of regulated user-to-user services and regulated search services: duties of care

CHAPTER 1 Introduction

I8756 Overview of Part 3

1 This Part imposes duties of care on providers of regulated user-to-user services and regulated search services and requires OFCOM to issue codes of practice relating to some of those duties.
2 Chapter 2 imposes duties of care on providers of regulated user-to-user services in relation to content and activity on their services.
3 Chapter 3 imposes duties of care on providers of regulated search services in relation to content and activity on their services.
4 Chapter 4 imposes duties on providers of regulated user-to-user services and regulated search services to assess whether a service is likely to be accessed by children.
5 Chapter 5 imposes duties on providers of certain regulated user-to-user services and regulated search services relating to fraudulent advertising.
6 Chapter 6 requires OFCOM to issue codes of practice relating to particular duties and explains what effects the codes of practice have.
7 Chapter 7 is about the interpretation of this Part, and it includes definitions of the following key terms—
  • “content that is harmful to children”, “primary priority content that is harmful to children” and “priority content that is harmful to children” (see sections 60 to 62);
  • “illegal content”, “priority offence”, “terrorism content”, “CSEA content” and “priority illegal content” (see section 59);
  • “search content” (see section 57).

CHAPTER 2 Providers of user-to-user services: duties of care

User-to-user services: which duties apply, and scope of duties

I2537 Providers of user-to-user services: duties of care

I6361 Subsections (2) to (6) apply to determine which of the duties set out in this Chapter (and, in the case of combined services, Chapter 3) must be complied with by providers of regulated user-to-user services.
I6362 All providers of regulated user-to-user services must comply with the following duties in relation to each such service which they provide—
a the duties about illegal content risk assessments set out in section 9,
b the duties about illegal content set out in section 10(2) to (8),
c the duty about content reporting set out in section 20,
d the duties about complaints procedures set out in section 21,
e the duties about freedom of expression and privacy set out in section 22(2) and (3), and
f the duties about record-keeping and review set out in section 23(2) to (6).
I6363 Additional duties must be complied with by providers of particular kinds of regulated user-to-user services, as follows.
I6364 All providers of regulated user-to-user services that are likely to be accessed by children must comply with the following duties in relation to each such service which they provide—
a the duties about children’s risk assessments set out in section 11, and
b the duties to protect children’s online safety set out in section 12(2) to (13).
5 All providers of Category 1 services must comply with the following duties in relation to each such service which they provide—
I636a the duty about illegal content risk assessments set out in section 10(9),
I636b the duty about children’s risk assessments set out in section 12(14),
I636c the duties about assessments related to adult user empowerment set out in section 14,
I636d the duties to empower adult users set out in section 15,
I636e the duties to protect content of democratic importance set out in section 17,
f the duties to protect news publisher content set out in section 18,
g the duties to protect journalistic content set out in section 19,
h the duties about freedom of expression and privacy set out in section 22(4), (6) and (7), and
i the duties about record-keeping set out in section 23(9) and (10).
I6366 All providers of combined services must comply with the following duties in relation to the search engine of each such service which they provide—
a if the service is not a Category 2A service and is not likely to be accessed by children, the duties set out in Chapter 3 referred to in section 24(2);
b if the service is not a Category 2A service and is likely to be accessed by children, the duties set out in Chapter 3 referred to in section 24(2) and (4);
c if the service is a Category 2A service not likely to be accessed by children, the duties set out in Chapter 3 referred to in section 24(2) and (5);
d if the service is a Category 2A service likely to be accessed by children, the duties set out in Chapter 3 referred to in section 24(2), (4) and (5).
I6367 For the meaning of “likely to be accessed by children”, see section 37.
I6368 For the meaning of “Category 1 service”, see section 95 (register of categories of services).

I369I518 Scope of duties of care

1 A duty set out in this Chapter which must be complied with in relation to a user-to-user service that includes regulated provider pornographic content does not extend to—
a the regulated provider pornographic content, or
b the design, operation or use of the service so far as relating to that content.
See Part 5 for the duties which relate to regulated provider pornographic content, and the meaning of that term.
2 A duty set out in this Chapter which must be complied with in relation to a combined service does not extend to—
a the search content of the service,
b any other content that, following a search request, may be encountered as a result of subsequent interactions with internet services, or
c anything relating to the design, operation or use of the search engine.
3 A duty set out in this Chapter which must be complied with in relation to a user-to-user service extends only to—
a the design, operation and use of the service in the United Kingdom, and
b in the case of a duty that is expressed to apply in relation to users of a service, the design, operation and use of the service as it affects United Kingdom users of the service.

Illegal content duties for user-to-user services

I510I4699 Illegal content risk assessment duties

1 This section sets out the duties about risk assessments which apply in relation to all regulated user-to-user services.
2 A duty to carry out a suitable and sufficient illegal content risk assessment at a time set out in, or as provided by, Schedule 3.
3 A duty to take appropriate steps to keep an illegal content risk assessment up to date, including when OFCOM make any significant change to a risk profile that relates to services of the kind in question.
4 Before making any significant change to any aspect of a service’s design or operation, a duty to carry out a further suitable and sufficient illegal content risk assessment relating to the impacts of that proposed change.
5 An “illegal content risk assessment” of a service of a particular kind means an assessment of the following matters, taking into account the risk profile that relates to services of that kind—
a the user base;
b the level of risk of individuals who are users of the service encountering the following by means of the service—
i each kind of priority illegal content (with each kind separately assessed), and
ii other illegal content,
taking into account (in particular) algorithms used by the service, and how easily, quickly and widely content may be disseminated by means of the service;
c the level of risk of the service being used for the commission or facilitation of a priority offence;
d the level of risk of harm to individuals presented by illegal content of different kinds or by the use of the service for the commission or facilitation of a priority offence;
e the level of risk of functionalities of the service facilitating the presence or dissemination of illegal content or the use of the service for the commission or facilitation of a priority offence, identifying and assessing those functionalities that present higher levels of risk;
f the different ways in which the service is used, and the impact of such use on the level of risk of harm that might be suffered by individuals;
g the nature, and severity, of the harm that might be suffered by individuals from the matters identified in accordance with paragraphs (b) to (f);
h how the design and operation of the service (including the business model, governance, use of proactive technology, measures to promote users’ media literacy and safe use of the service, and other systems and processes) may reduce or increase the risks identified.
6 In this section references to risk profiles are to the risk profiles for the time being published under section 98 which relate to the risk of harm to individuals presented by illegal content.
7 See also—
a section 23(2) and (10) (records of risk assessments), and
b Schedule 3 (timing of providers’ assessments).

I734I57010 Safety duties about illegal content

1 This section sets out the duties about illegal content which apply in relation to regulated user-to-user services (as indicated by the headings).

All services

2 A duty, in relation to a service, to take or use proportionate measures relating to the design or operation of the service to—
a prevent individuals from encountering priority illegal content by means of the service,
b effectively mitigate and manage the risk of the service being used for the commission or facilitation of a priority offence, as identified in the most recent illegal content risk assessment of the service, and
c effectively mitigate and manage the risks of harm to individuals, as identified in the most recent illegal content risk assessment of the service (see section 9(5)(g)).
3 A duty to operate a service using proportionate systems and processes designed to—
a minimise the length of time for which any priority illegal content is present;
b where the provider is alerted by a person to the presence of any illegal content, or becomes aware of it in any other way, swiftly take down such content.
4 The duties set out in subsections (2) and (3) apply across all areas of a service, including the way it is designed, operated and used as well as content present on the service, and (among other things) require the provider of a service to take or use measures in the following areas, if it is proportionate to do so—
a regulatory compliance and risk management arrangements,
b design of functionalities, algorithms and other features,
c policies on terms of use,
d policies on user access to the service or to particular content present on the service, including blocking users from accessing the service or particular content,
e content moderation, including taking down content,
f functionalities allowing users to control the content they encounter,
g user support measures, and
h staff policies and practices.
5 A duty to include provisions in the terms of service specifying how individuals are to be protected from illegal content, addressing each paragraph of subsection (3), and (in relation to paragraph (a)) separately addressing terrorism content, CSEA content (see section 59 and Schedule 6) and other priority illegal content.
6 A duty to apply the provisions of the terms of service referred to in subsection (5) consistently.
7 A duty to include provisions in the terms of service giving information about any proactive technology used by a service for the purpose of compliance with a duty set out in subsection (2) or (3) (including the kind of technology, when it is used, and how it works).
8 A duty to ensure that the provisions of the terms of service referred to in subsections (5) and (7) are clear and accessible.

Additional duty for Category 1 services

9 A duty to summarise in the terms of service the findings of the most recent illegal content risk assessment of a service (including as to levels of risk and as to nature, and severity, of potential harm to individuals).

Interpretation

10 In determining what is proportionate for the purposes of this section, the following factors, in particular, are relevant—
a all the findings of the most recent illegal content risk assessment (including as to levels of risk and as to nature, and severity, of potential harm to individuals), and
b the size and capacity of the provider of a service.
11 In this section “illegal content risk assessment” has the meaning given by section 9.
12 See also, in relation to duties set out in this section, section 22 (duties about freedom of expression and privacy).

User-to-user services likely to be accessed by children

I870I3111 Children’s risk assessment duties

1 This section sets out the duties about risk assessments which apply in relation to regulated user-to-user services that are likely to be accessed by children (in addition to the duties about risk assessments set out in section 9 and, in the case of services likely to be accessed by children which are Category 1 services, the duties about assessments set out in section 14).
2 A duty to carry out a suitable and sufficient children’s risk assessment at a time set out in, or as provided by, Schedule 3.
3 A duty to take appropriate steps to keep a children’s risk assessment up to date, including when OFCOM make any significant change to a risk profile that relates to services of the kind in question.
4 Before making any significant change to any aspect of a service’s design or operation, a duty to carry out a further suitable and sufficient children’s risk assessment relating to the impacts of that proposed change.
5 Where a children’s risk assessment of a service identifies the presence of non-designated content that is harmful to children, a duty to notify OFCOM of—
a the kinds of such content identified, and
b the incidence of those kinds of content on the service.
6 A “children’s risk assessment” of a service of a particular kind means an assessment of the following matters, taking into account the risk profile that relates to services of that kind—
a the user base, including the number of users who are children in different age groups;
b the level of risk of children who are users of the service encountering the following by means of the service—
i each kind of primary priority content that is harmful to children (with each kind separately assessed),
ii each kind of priority content that is harmful to children (with each kind separately assessed), and
iii non-designated content that is harmful to children,
giving separate consideration to children in different age groups, and taking into account (in particular) algorithms used by the service and how easily, quickly and widely content may be disseminated by means of the service;
c the level of risk of harm to children presented by different kinds of content that is harmful to children, giving separate consideration to children in different age groups;
d the level of risk of harm to children presented by content that is harmful to children which particularly affects individuals with a certain characteristic or members of a certain group;
e the extent to which the design of the service, in particular its functionalities, affects the level of risk of harm that might be suffered by children, identifying and assessing those functionalities that present higher levels of risk, including functionalities—
i enabling adults to search for other users of the service (including children), or
ii enabling adults to contact other users (including children) by means of the service;
f the different ways in which the service is used, including functionalities or other features of the service that affect how much children use the service (for example a feature that enables content to play automatically), and the impact of such use on the level of risk of harm that might be suffered by children;
g the nature, and severity, of the harm that might be suffered by children from the matters identified in accordance with paragraphs (b) to (f), giving separate consideration to children in different age groups;
h how the design and operation of the service (including the business model, governance, use of proactive technology, measures to promote users’ media literacy and safe use of the service, and other systems and processes) may reduce or increase the risks identified.
7 In this section references to risk profiles are to the risk profiles for the time being published under section 98 which relate to the risk of harm to children presented by content that is harmful to children.
8 See also—
a section 23(2) and (10) (records of risk assessments), and
b Schedule 3 (timing of providers’ assessments).

I190I79412 Safety duties protecting children

1 This section sets out the duties to protect children’s online safety which apply in relation to regulated user-to-user services that are likely to be accessed by children (as indicated by the headings).

All services

2 A duty, in relation to a service, to take or use proportionate measures relating to the design or operation of the service to effectively—
a mitigate and manage the risks of harm to children in different age groups, as identified in the most recent children’s risk assessment of the service (see section 11(6)(g)), and
b mitigate the impact of harm to children in different age groups presented by content that is harmful to children present on the service.
3 A duty to operate a service using proportionate systems and processes designed to—
a prevent children of any age from encountering, by means of the service, primary priority content that is harmful to children;
b protect children in age groups judged to be at risk of harm from other content that is harmful to children (or from a particular kind of such content) from encountering it by means of the service.
4 The duty set out in subsection (3)(a) requires a provider to use age verification or age estimation (or both) to prevent children of any age from encountering primary priority content that is harmful to children which the provider identifies on the service.
5 That requirement applies to a provider in relation to a particular kind of primary priority content that is harmful to children in every case except where—
a a term of service indicates (in whatever words) that the presence of that kind of primary priority content that is harmful to children is prohibited on the service, and
b that policy applies in relation to all users of the service.
6 If a provider is required by subsection (4) to use age verification or age estimation for the purpose of compliance with the duty set out in subsection (3)(a), the age verification or age estimation must be of such a kind, and used in such a way, that it is highly effective at correctly determining whether or not a particular user is a child.
7 Age verification or age estimation to identify who is or is not a child user or which age group a child user is in are examples of measures which (if not required by subsection (4)) may be taken or used (among others) for the purpose of compliance with a duty set out in subsection (2) or (3).
8 The duties set out in subsections (2) and (3) apply across all areas of a service, including the way it is designed, operated and used as well as content present on the service, and (among other things) require the provider of a service to take or use measures in the following areas, if it is proportionate to do so—
a regulatory compliance and risk management arrangements,
b design of functionalities, algorithms and other features,
c policies on terms of use,
d policies on user access to the service or to particular content present on the service, including blocking users from accessing the service or particular content,
e content moderation, including taking down content,
f functionalities allowing for control over content that is encountered, especially by children,
g user support measures, and
h staff policies and practices.
9 A duty to include provisions in the terms of service specifying—
a how children of any age are to be prevented from encountering primary priority content that is harmful to children (with each kind of primary priority content separately covered);
b how children in age groups judged to be at risk of harm from priority content that is harmful to children (or from a particular kind of such content) are to be protected from encountering it, where they are not prevented from doing so (with each kind of priority content separately covered);
c how children in age groups judged to be at risk of harm from non-designated content that is harmful to children (or from a particular kind of such content) are to be protected from encountering it, where they are not prevented from doing so.
10 A duty to apply the provisions of the terms of service referred to in subsection (9) consistently.
11 If a provider takes or uses a measure designed to prevent access to the whole of the service or a part of the service by children under a certain age, a duty to—
a include provisions in the terms of service specifying details about the operation of the measure, and
b apply those provisions consistently.
12 A duty to include provisions in the terms of service giving information about any proactive technology used by a service for the purpose of compliance with a duty set out in subsection (2) or (3) (including the kind of technology, when it is used, and how it works).
13 A duty to ensure that the provisions of the terms of service referred to in subsections (9), (11) and (12) are clear and accessible.

Additional duty for Category 1 services

14 A duty to summarise in the terms of service the findings of the most recent children’s risk assessment of a service (including as to levels of risk and as to nature, and severity, of potential harm to children).

I70I34113 Safety duties protecting children: interpretation

1 In determining what is proportionate for the purposes of section 12, the following factors, in particular, are relevant—
a all the findings of the most recent children’s risk assessment (including as to levels of risk and as to nature, and severity, of potential harm to children), and
b the size and capacity of the provider of a service.
2 So far as a duty set out in section 12 relates to non-designated content that is harmful to children, the duty is to be taken to extend only to addressing risks of harm from the kinds of such content that have been identified in the most recent children’s risk assessment (if any have been identified).
3 References in section 12(3)(b) and (9)(b) and (c) to children in age groups judged to be at risk of harm from content that is harmful to children are references to children in age groups judged to be at risk of such harm as assessed by the provider of a service in the most recent children’s risk assessment of the service.
4 The duties set out in section 12(3) and (9) are to be taken to extend only to content that is harmful to children where the risk of harm is presented by the nature of the content (rather than the fact of its dissemination).
5 The duties set out in section 12 extend only to such parts of a service as it is possible for children to access.
6 For the purposes of subsection (5), a provider is only entitled to conclude that it is not possible for children to access a service, or a part of it, if age verification or age estimation is used on the service with the result that children are not normally able to access the service or that part of it.
7 In section 12 and this section “children’s risk assessment” has the meaning given by section 11.
8 See also, in relation to duties set out in section 12, section 22 (duties about freedom of expression and privacy).

Category 1 services

I307I68414 Assessment duties: user empowerment

1 This section sets out the duties about assessments related to adult user empowerment which apply in relation to Category 1 services (in addition to the duties about risk assessments set out in section 9 and, in the case of Category 1 services likely to be accessed by children, section 11).
2 A duty to carry out a suitable and sufficient assessment for the purposes of section 15(2) at a time set out in, or as provided by, Schedule 3.
3 A duty to take appropriate steps to keep such an assessment up to date.
4 Before making any significant change to any aspect of a service’s design or operation, a duty to carry out a further suitable and sufficient assessment for the purposes of section 15(2) relating to the impacts of that proposed change.
5 An assessment of a service “for the purposes of section 15(2)” means an assessment of the following matters—
a the user base;
b the incidence of relevant content on the service;
c the likelihood of adult users of the service encountering, by means of the service, each kind of relevant content (with each kind separately assessed), taking into account (in particular) algorithms used by the service, and how easily, quickly and widely content may be disseminated by means of the service;
d the likelihood of adult users with a certain characteristic or who are members of a certain group encountering relevant content which particularly affects them;
e the likelihood of functionalities of the service facilitating the presence or dissemination of relevant content, identifying and assessing those functionalities more likely to do so;
f the different ways in which the service is used, and the impact of such use on the likelihood of adult users encountering relevant content;
g how the design and operation of the service (including the business model, governance, use of proactive technology, measures to strengthen adult users’ control over their interaction with user-generated content, and other systems and processes) may reduce or increase the likelihood of adult users encountering relevant content.
6 In this section “relevant content” means content to which section 15(2) applies (content to which user empowerment duties set out in that provision apply).
7 See also—
a section 23(9) and (10) (records of assessments), and
b Schedule 3 (timing of providers’ assessments).

I328I7915 User empowerment duties

1 This section sets out the duties to empower adult users which apply in relation to Category 1 services.
2 A duty to include in a service, to the extent that it is proportionate to do so, features which adult users may use or apply if they wish to increase their control over content to which this subsection applies.
3 The features referred to in subsection (2) are those which, if used or applied by a user, result in the use by the service of systems or processes designed to effectively—
a reduce the likelihood of the user encountering content to which subsection (2) applies present on the service, or
b alert the user to content present on the service that is a particular kind of content to which subsection (2) applies.
4 A duty to ensure that all features included in a service in compliance with the duty set out in subsection (2) (“control features”) are made available to all adult users and are easy to access.
5 A duty to operate a service using a system or process which seeks to ensure that all registered adult users are offered the earliest possible opportunity, in relation to each control feature included in the service, to take a step indicating to the provider that—
a the user wishes to retain the default setting for the feature (whether that is that the feature is in use or applied, or is not in use or applied), or
b the user wishes to change the default setting for the feature.
6 The duty set out in subsection (5)—
a continues to apply in relation to a user and a control feature for so long as the user has not yet taken a step mentioned in that subsection in relation to the feature;
b no longer applies in relation to a user once the user has taken such a step in relation to every control feature included in the service.
7 A duty to include clear and accessible provisions in the terms of service specifying which control features are offered and how users may take advantage of them.
8 A duty to summarise in the terms of service the findings of the most recent assessment of a service under section 14 (assessments related to the duty set out in subsection (2)).
9 A duty to include in a service features which adult users may use or apply if they wish to filter out non-verified users.
10 The features referred to in subsection (9) are those which, if used or applied by a user, result in the use by the service of systems or processes designed to effectively—
a prevent non-verified users from interacting with content which that user generates, uploads or shares on the service, and
b reduce the likelihood of that user encountering content which non-verified users generate, upload or share on the service.

I314I50016 User empowerment duties: interpretation

1 In determining what is proportionate for the purposes of section 15(2), the following factors, in particular, are relevant—
a all the findings of the most recent assessment under section 14, and
b the size and capacity of the provider of the service.
2 Section 15(2) applies to content that—
a is regulated user-generated content in relation to the service in question, and
b is within subsection (3), (4) or (5).
3 Content is within this subsection if it encourages, promotes or provides instructions for—
a suicide or an act of deliberate self-injury, or
b an eating disorder or behaviours associated with an eating disorder.
4 Content is within this subsection if it is abusive and the abuse targets any of the following characteristics—
a race,
b religion,
c sex,
d sexual orientation,
e disability, or
f gender reassignment.
5 Content is within this subsection if it incites hatred against people—
a of a particular race, religion, sex or sexual orientation,
b who have a disability, or
c who have the characteristic of gender reassignment.
6 The duty set out in section 15(5) applies in relation to all registered adult users, not just those who begin to use a service after that duty begins to apply.
7 In section 15 and this section—
  • “disability” means any physical or mental impairment;
  • “injury” includes poisoning;
  • “non-verified user” means a user who—
    1. is an individual, whether in the United Kingdom or outside it, and
    2. has not verified their identity to the provider of a service;
  • “race” includes colour, nationality, and ethnic or national origins.
8 In section 15 and this section—
a references to features include references to functionalities and settings, and
b references to religion include references to a lack of religion.
9 For the purposes of section 15 and this section, a person has the characteristic of gender reassignment if the person is proposing to undergo, is undergoing or has undergone a process (or part of a process) for the purpose of reassigning the person’s sex by changing physiological or other attributes of sex, and the reference to gender reassignment in subsection (4) is to be construed accordingly.
10 See also, in relation to duties set out in section 15, section 22 (duties about freedom of expression and privacy).

I32I47417 Duties to protect content of democratic importance

1 This section sets out the duties to protect content of democratic importance which apply in relation to Category 1 services.
2 A duty to operate a service using proportionate systems and processes designed to ensure that the importance of the free expression of content of democratic importance is taken into account when making decisions about—
a how to treat such content (especially decisions about whether to take it down or restrict users’ access to it), and
b whether to take action against a user generating, uploading or sharing such content.
3 A duty to ensure that the systems and processes mentioned in subsection (2) apply in the same way to a wide diversity of political opinion.
4 A duty to include provisions in the terms of service specifying the policies and processes that are designed to take account of the principle mentioned in subsection (2), including, in particular, how that principle is applied to decisions mentioned in that subsection.
5 A duty to ensure that—
a the provisions of the terms of service referred to in subsection (4) are clear and accessible, and
b those provisions are applied consistently.
6 In determining what is proportionate for the purposes of subsection (2), the size and capacity of the provider of a service, in particular, is relevant.
7 For the purposes of this section content is “content of democratic importance”, in relation to a user-to-user service, if—
a the content is—
i news publisher content in relation to that service, or
ii regulated user-generated content in relation to that service; and
b the content is or appears to be specifically intended to contribute to democratic political debate in the United Kingdom or a part or area of the United Kingdom.
8 In this section, the reference to “taking action” against a user is to giving a warning to a user, or suspending or banning a user from using a service, or in any way restricting a user’s ability to use a service.
9 For the meaning of “news publisher content” and “regulated user-generated content”, see section 55.

I87118 Duties to protect news publisher content

1 This section sets out the duties to protect news publisher content which apply in relation to Category 1 services.
2 Subject to subsections (4), (5) and (8), a duty, in relation to a service, to take the steps set out in subsection (3) before—
a taking action in relation to content present on the service that is news publisher content, or
b taking action against a user who is a recognised news publisher.
3 The steps referred to in subsection (2) are—
a to give the recognised news publisher in question a notification which—
i specifies the action that the provider is considering taking,
ii gives reasons for that proposed action by reference to each relevant provision of the terms of service,
iii where the proposed action relates to news publisher content that is also journalistic content, explains how the provider took the importance of the free expression of journalistic content into account when deciding on the proposed action, and
iv specifies a reasonable period within which the recognised news publisher may make representations,
b to consider any representations that are made, and
c to notify the recognised news publisher of the decision and the reasons for it (addressing any representations made).
4 If a provider of a service reasonably considers that the provider would incur criminal or civil liability in relation to news publisher content present on the service if it were not taken down swiftly, the provider may take down that content without having taken the steps set out in subsection (3).
5 A provider of a service may also take down news publisher content present on the service without having taken the steps set out in subsection (3) if that content amounts to a relevant offence (see section 59 and also subsection (10) of this section).
6 Subject to subsection (8), if a provider takes action in relation to news publisher content or against a recognised news publisher without having taken the steps set out in subsection (3), a duty to take the steps set out in subsection (7).
7 The steps referred to in subsection (6) are—
a to swiftly notify the recognised news publisher in question of the action taken, giving the provider’s justification for not having first taken the steps set out in subsection (3),
b to specify a reasonable period within which the recognised news publisher may request that the action is reversed, and
c if a request is made as mentioned in paragraph (b)—
i to consider the request and whether the steps set out in subsection (3) should have been taken prior to the action being taken,
ii if the provider concludes that those steps should have been taken, to swiftly reverse the action, and
iii to notify the recognised news publisher of the decision and the reasons for it (addressing any reasons accompanying the request for reversal of the action).
8 If a recognised news publisher has been banned from using a service (and the ban is still in force), the provider of the service may take action in relation to news publisher content present on the service which was generated or originally published or broadcast by the recognised news publisher without complying with the duties set out in this section.
9 For the purposes of this section, a provider is not to be regarded as taking action in relation to news publisher content in the following circumstances—
a a provider takes action in relation to content which is not news publisher content, that action affects related news publisher content, the grounds for the action only relate to the content which is not news publisher content, and it is not technically feasible for the action only to relate to the content which is not news publisher content;
b a provider takes action against a user, and that action affects news publisher content that has been uploaded to or shared on the service by the user.
10 Section 192 (providers’ judgements about the status of content) applies in relation to judgements by providers about whether news publisher content amounts to a relevant offence as it applies in relation to judgements about whether content is illegal content.
11 Any provision of the terms of service has effect subject to this section.
12 In this section—
a references to “news publisher content” are to content that is news publisher content in relation to the service in question;
b references to “taking action” against a person are to giving a warning to a person, or suspending or banning a person from using a service, or in any way restricting a person’s ability to use a service.
13 In this section references to “taking action” in relation to content are to—
a taking down content,
b restricting users’ access to content, or
c adding warning labels to content, except warning labels normally encountered only by child users,
and also include references to taking any other action in relation to content on the grounds that it is content of a kind which is the subject of a relevant term of service (but not otherwise).
14 A “relevant term of service” means a term of service which indicates to users (in whatever words) that the presence of a particular kind of content, from the time it is generated, uploaded or shared on the service, is not tolerated on the service or is tolerated but liable to result in the provider treating it in a way that makes it less likely that other users will encounter it.
15 Taking any step set out in subsection (3) or (7) does not count as “taking action” for the purposes of this section.
16 See—
  • section 19 for the meaning of “journalistic content”;
  • section 55 for the meaning of “news publisher content”;
  • section 56 for the meaning of “recognised news publisher”.

I325I4119 Duties to protect journalistic content

1 This section sets out the duties to protect journalistic content which apply in relation to Category 1 services.

The duties

2 A duty to operate a service using proportionate systems and processes designed to ensure that the importance of the free expression of journalistic content is taken into account when making decisions about—
a how to treat such content (especially decisions about whether to take it down or restrict users’ access to it), and
b whether to take action against a user generating, uploading or sharing such content.
3 A duty, in relation to a decision by a provider to take down content or to restrict access to it, to make a dedicated and expedited complaints procedure available to a person who considers the content to be journalistic content and who is—
a the user who generated, uploaded or shared the content on the service, or
b the creator of the content (see subsections (14) and (15)).
4 A duty to make a dedicated and expedited complaints procedure available to users of a service in relation to a decision by the provider of the service to take action against a user because of content generated, uploaded or shared by the user which the user considers to be journalistic content.
5 A duty to ensure that—
a if a complaint about a decision mentioned in subsection (3) is upheld, the content is swiftly reinstated on the service;
b if a complaint about a decision mentioned in subsection (4) is upheld, the action against the user is swiftly reversed.
6 Subsections (3) and (4) do not require a provider to make a dedicated and expedited complaints procedure available to a recognised news publisher in relation to a decision if the provider has taken the steps set out in section 18(3) in relation to that decision.
7 A duty to include provisions in the terms of service specifying—
a by what methods content present on the service is to be identified as journalistic content;
b how the importance of the free expression of journalistic content is to be taken into account when making decisions mentioned in subsection (2);
c the policies and processes for handling complaints in relation to content which is, or is considered to be, journalistic content.
8 A duty to ensure that—
a the provisions of the terms of service referred to in subsection (7) are clear and accessible, and
b those provisions are applied consistently.

Interpretation

9 In determining what is proportionate for the purposes of subsection (2), the size and capacity of the provider of a service, in particular, is relevant.
10 For the purposes of this Part content is “journalistic content”, in relation to a user-to-user service, if—
a the content is—
i news publisher content in relation to that service, or
ii regulated user-generated content in relation to that service;
b the content is generated for the purposes of journalism; and
c the content is UK-linked.
11 For the purposes of this section content is “UK-linked” if—
a United Kingdom users of the service form one of the target markets for the content (or the only target market), or
b the content is or is likely to be of interest to a significant number of United Kingdom users.
12 In this section references to “taking action” against a user are to giving a warning to a user, or suspending or banning a user from using a service, or in any way restricting a user’s ability to use a service.
13 In this section the reference to the “creator” of content is to be read in accordance with subsections (14) and (15).
14 The creator of news publisher content is the recognised news publisher in question.
15 The creator of content other than news publisher content is—
a an individual who—
i created the content, and
ii is in the United Kingdom; or
b an entity which—
i created the content, and
ii is incorporated or formed under the law of any part of the United Kingdom.
16 For the meaning of “news publisher content”, “regulated user-generated content” and “recognised news publisher”, see sections 55 and 56.

Duties about content reporting and complaints procedures

I57420 Duty about content reporting

I5601 This section sets out the duty about content reporting which applies in relation to all regulated user-to-user services.
I5602 A duty to operate a service using systems and processes that allow users and affected persons to easily report content which they consider to be content of a kind specified below (with the duty extending to different kinds of content depending on the kind of service, as indicated by the headings).

All services

I5603 Illegal content.

Services likely to be accessed by children

I5604 Content that is harmful to children, present on a part of a service that it is possible for children to access.

Interpretation

I5605 In this section “affected person” means a person, other than a user of the service in question, who is in the United Kingdom and who is—
a the subject of the content,
b a member of a class or group of people with a certain characteristic targeted by the content,
c a parent of, or other adult with responsibility for, a child who is a user of the service or is the subject of the content, or
d an adult providing assistance in using the service to another adult who requires such assistance, where that other adult is a user of the service or is the subject of the content.
I5606 For the purposes of subsection (4), a provider is only entitled to conclude that it is not possible for children to access a service, or a part of it, if age verification or age estimation is used on the service with the result that children are not normally able to access the service or that part of it.
7 See also—
I560a section 22 (duties about freedom of expression and privacy), and
b section 72(5)(a) (reporting of content that terms of service allow to be taken down or restricted).

I52221 Duties about complaints procedures

I5551 This section sets out the duties about complaints procedures which apply in relation to all regulated user-to-user services.
I5552 A duty to operate a complaints procedure in relation to a service that—
a allows for relevant kinds of complaint to be made (as set out under the headings below),
b provides for appropriate action to be taken by the provider of the service in response to complaints of a relevant kind, and
c is easy to access, easy to use (including by children) and transparent.
I5553 A duty to include in the terms of service provisions which are easily accessible (including to children) specifying the policies and processes that govern the handling and resolution of complaints of a relevant kind.

All services

I5554 The following kinds of complaint are relevant for all services—
a complaints by users and affected persons about content present on a service which they consider to be illegal content;
b complaints by users and affected persons if they consider that the provider is not complying with a duty set out in—
i section 10 (illegal content),
ii section 20 (content reporting), or
iii section 22(2) or (3) (freedom of expression and privacy);
c complaints by a user who has generated, uploaded or shared content on a service if that content is taken down on the basis that it is illegal content;
d complaints by a user of a service if the provider has given a warning to the user, suspended or banned the user from using the service, or in any other way restricted the user’s ability to use the service, as a result of content generated, uploaded or shared by the user which the provider considers to be illegal content;
e complaints by a user who has generated, uploaded or shared content on a service if—
i the use of proactive technology on the service results in that content being taken down or access to it being restricted, or given a lower priority or otherwise becoming less likely to be encountered by other users, and
ii the user considers that the proactive technology has been used in a way not contemplated by, or in breach of, the terms of service (for example, by affecting content not of a kind specified in the terms of service as a kind of content in relation to which the technology would operate).

Services likely to be accessed by children

I5555 The following kinds of complaint are relevant for services that are likely to be accessed by children—
a complaints by users and affected persons about content, present on a part of a service that it is possible for children to access, which they consider to be content that is harmful to children;
b complaints by users and affected persons if they consider that the provider is not complying with a duty set out in section 12 (children’s online safety);
c complaints by a user who has generated, uploaded or shared content on a service if that content is taken down, or access to it is restricted, on the basis that it is content that is harmful to children;
d complaints by a user of a service if the provider has given a warning to the user, suspended or banned the user from using the service, or in any other way restricted the user’s ability to use the service, as a result of content generated, uploaded or shared by the user which the provider considers to be content that is harmful to children;
e complaints by a user who is unable to access content because measures used to comply with a duty set out in section 12(2) or (3) have resulted in an incorrect assessment of the user’s age.

Category 1 services

6 The relevant kind of complaint for Category 1 services is complaints by users and affected persons if they consider that the provider is not complying with a duty set out in—
I555a section 15 (user empowerment),
I555b section 17 (content of democratic importance),
c section 18 (news publisher content),
I555d section 19 (journalistic content), or
I555e section 22(4), (6) or (7) (freedom of expression and privacy).

Interpretation

I5557 In this section “affected person” has the meaning given by section 20.
I5558 For the purposes of subsection (5)(a), a provider is only entitled to conclude that it is not possible for children to access a service, or a part of it, if age verification or age estimation is used on the service with the result that children are not normally able to access the service or that part of it.
9 See also—
I555a section 22 (duties about freedom of expression and privacy), and
b section 72(6) (complaints procedure relating to content that terms of service allow to be taken down or restricted).

Cross-cutting duties

I911I22122 Duties about freedom of expression and privacy

1 This section sets out the duties about freedom of expression and privacy which apply in relation to regulated user-to-user services (as indicated by the headings).

All services

2 When deciding on, and implementing, safety measures and policies, a duty to have particular regard to the importance of protecting users’ right to freedom of expression within the law.
3 When deciding on, and implementing, safety measures and policies, a duty to have particular regard to the importance of protecting users from a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of a user-to-user service (including, but not limited to, any such provision or rule concerning the processing of personal data).

Additional duties for Category 1 services

4 A duty—
a when deciding on safety measures and policies, to carry out an assessment of the impact that such measures or policies would have on—
i users’ right to freedom of expression within the law, and
ii the privacy of users; and
b to carry out an assessment of the impact of adopted safety measures and policies on the matters mentioned in paragraph (a)(i) and (ii).
5 An impact assessment relating to a service must include a section which considers the impact of the safety measures and policies on the availability and treatment on the service of content which is news publisher content or journalistic content in relation to the service.
6 A duty to—
a keep an impact assessment up to date, and
b publish impact assessments.
7 A duty to specify in a publicly available statement the positive steps that the provider has taken in response to an impact assessment to—
a protect users’ right to freedom of expression within the law, and
b protect the privacy of users.

Interpretation

8 In this section—
  • “impact assessment” means an impact assessment under subsection (4);
  • “safety measures and policies” means measures and policies designed to secure compliance with any of the duties set out in—
    1. section 10 (illegal content),
    2. section 12 (children’s online safety),
    3. section 15 (user empowerment),
    4. section 20 (content reporting), or
    5. section 21 (complaints procedures).
9 Any reference in this section to the privacy of users or steps taken to protect the privacy of users is to be construed in accordance with subsection (3).
10 See—
  • section 19 for the meaning of “journalistic content”;
  • section 55 for the meaning of “news publisher content”.

I9823 Record-keeping and review duties

I6691 This section sets out the record-keeping and review duties which apply in relation to regulated user-to-user services (as indicated by the headings).

All services

I6692 A duty to make and keep a written record, in an easily understandable form, of all aspects of every risk assessment under section 9 or 11, including details about how the assessment was carried out and its findings.
I6693 A duty to make and keep a written record of any measures taken or in use to comply with a relevant duty which—
a are described in a code of practice and recommended for the purpose of compliance with the duty in question, and
b apply in relation to the provider and the service in question.
In this section such measures are referred to as “applicable measures in a code of practice”.
I6694 If alternative measures have been taken or are in use to comply with a relevant duty, a duty to make and keep a written record containing the following information—
a the applicable measures in a code of practice that have not been taken or are not in use,
b the alternative measures that have been taken or are in use,
c how those alternative measures amount to compliance with the duty in question, and
d how the provider has complied with section 49(5) (freedom of expression and privacy).
I6695 If alternative measures have been taken or are in use to comply with a duty set out in section 10(2) or (3) or 12(2) or (3), the record required under subsection (4) of this section must also indicate whether such measures have been taken or are in use in every area listed in section 10(4) or 12(8) (as the case may be) in relation to which there are applicable measures in a code of practice.
I6696 A duty to review compliance with the relevant duties in relation to a service—
a regularly, and
b as soon as reasonably practicable after making any significant change to any aspect of the design or operation of the service.
I6697 OFCOM may provide that particular descriptions of providers of user-to-user services are exempt from any or all of the duties set out in this section, and may revoke such an exemption.
I6698 OFCOM must publish details of any exemption or revocation under subsection (7), including reasons for the revocation of an exemption.

Additional duties for Category 1 services

I6699 A duty to make and keep a written record, in an easily understandable form, of all aspects of every assessment under section 14 (assessments related to the adult user empowerment duty set out in section 15(2)), including details about how the assessment was carried out and its findings.
I66910 As soon as reasonably practicable after making a record of an assessment as required by subsection (2) or (9), or revising such a record, a duty to supply OFCOM with a copy of the record (in full).

Interpretation

I89311 In this section—
  • “alternative measures” means measures other than measures which are (in relation to the provider and the service in question) applicable measures in a code of practice;
  • “code of practice” means a code of practice published under section 46;
  • “relevant duties” means the duties set out in—
    1. section 10 (illegal content),
    2. section 12 (children’s online safety),
    3. section 15 (user empowerment),
    4. section 17 (content of democratic importance),
    5. section 19 (journalistic content),
    6. section 20 (content reporting), and
    7. section 21 (complaints procedures),
    and for the purposes of subsection (6), also includes the duties set out in sections 18 (news publisher content), 71 and 72 (duties about terms of service), and 75 (deceased child users).

CHAPTER 3 Providers of search services: duties of care

Search services: which duties apply, and scope of duties

I603I34224 Providers of search services: duties of care

1 Subsections (2) to (4) apply to determine which of the duties set out in this Chapter must be complied with by providers of regulated search services.
2 All providers of regulated search services must comply with the following duties in relation to each such service which they provide—
a the duties about illegal content risk assessments set out in section 26,
b the duties about illegal content set out in section 27(2) to (8),
c the duty about content reporting set out in section 31,
d the duties about complaints procedures set out in section 32,
e the duties about freedom of expression and privacy set out in section 33, and
f the duties about record-keeping and review set out in section 34(2) to (6).
3 Additional duties must be complied with by providers of particular kinds of regulated search services, as follows.
4 All providers of regulated search services that are likely to be accessed by children must comply with the following duties in relation to each such service which they provide—
a the duties about children’s risk assessments set out in section 28, and
b the duties to protect children’s online safety set out in section 29(2) to (8).
5 All providers of regulated search services that are Category 2A services must comply with the following duties in relation to each such service which they provide—
a the duty about illegal content risk assessments set out in section 27(9),
b the duty about children’s risk assessments set out in section 29(9), and
c the duty about record-keeping set out in section 34(9).
6 For the meaning of “likely to be accessed by children”, see section 37.
7 For the meaning of “Category 2A service”, see section 95 (register of categories of services).

I85I33525 Scope of duties of care

1 A duty set out in this Chapter which must be complied with in relation to a search service extends only to—
a the search content of the service,
b the design, operation and use of the search engine in the United Kingdom, and
c in the case of a duty that is expressed to apply in relation to users of a service, the design, operation and use of the search engine as it affects United Kingdom users of the service.
2 For the purposes of the application of this Chapter in relation to the search engine of a combined service (see section 7(6))—
a a duty set out in this Chapter which requires a matter to be included in a publicly available statement may be satisfied by including the matter in the terms of service;
b references in this Chapter (except in section 24) to a search service are to be read as references to the search engine;
c references in this Chapter (except in section 24) to the provider of a search service are to be read as references to the provider of the combined service.

Illegal content duties for search services

I230I51926 Illegal content risk assessment duties

1 This section sets out the duties about risk assessments which apply in relation to all regulated search services.
2 A duty to carry out a suitable and sufficient illegal content risk assessment at a time set out in, or as provided by, Schedule 3.
3 A duty to take appropriate steps to keep an illegal content risk assessment up to date, including when OFCOM make any significant change to a risk profile that relates to services of the kind in question.
4 Before making any significant change to any aspect of a service’s design or operation, a duty to carry out a further suitable and sufficient illegal content risk assessment relating to the impacts of that proposed change.
5 An “illegal content risk assessment” of a service of a particular kind means an assessment of the following matters, taking into account the risk profile that relates to services of that kind—
a the level of risk of individuals who are users of the service encountering search content of the following kinds—
i each kind of priority illegal content (with each kind separately assessed), and
ii other illegal content,
taking into account (in particular) risks presented by algorithms used by the service, and the way that the service indexes, organises and presents search results;
b the level of risk of functionalities of the service facilitating individuals encountering search content that is illegal content, identifying and assessing those functionalities that present higher levels of risk;
c the nature, and severity, of the harm that might be suffered by individuals from the matters identified in accordance with paragraphs (a) and (b);
d how the design and operation of the service (including the business model, governance, use of proactive technology, measures to promote users’ media literacy and safe use of the service, and other systems and processes) may reduce or increase the risks identified.
6 In this section references to risk profiles are to the risk profiles for the time being published under section 98 which relate to the risk of harm to individuals presented by illegal content.
7 See also—
a section 34(2) and (9) (records of risk assessments), and
b Schedule 3 (timing of providers’ assessments).

I777I46227 Safety duties about illegal content

1 This section sets out the duties about illegal content which apply in relation to regulated search services (as indicated by the headings).

All services

2 A duty, in relation to a service, to take or use proportionate measures relating to the design or operation of the service to effectively mitigate and manage the risks of harm to individuals, as identified in the most recent illegal content risk assessment of the service (see section 26(5)(c)).
3 A duty to operate a service using proportionate systems and processes designed to minimise the risk of individuals encountering search content of the following kinds—
a priority illegal content;
b other illegal content that the provider knows about (having been alerted to it by another person or become aware of it in any other way).
4 The duties set out in subsections (2) and (3) apply across all areas of a service, including the way the search engine is designed, operated and used as well as search content of the service, and (among other things) require the provider of a service to take or use measures in the following areas, if it is proportionate to do so—
a regulatory compliance and risk management arrangements,
b design of functionalities, algorithms and other features relating to the search engine,
c functionalities allowing users to control the content they encounter in search results,
d content prioritisation,
e user support measures, and
f staff policies and practices.
5 A duty to include provisions in a publicly available statement specifying how individuals are to be protected from search content that is illegal content.
6 A duty to apply the provisions of the statement referred to in subsection (5) consistently.
7 A duty to include provisions in a publicly available statement giving information about any proactive technology used by a service for the purpose of compliance with a duty set out in subsection (2) or (3) (including the kind of technology, when it is used, and how it works).
8 A duty to ensure that the provisions of the publicly available statement referred to in subsections (5) and (7) are clear and accessible.

Additional duty for Category 2A services

9 A duty to summarise in a publicly available statement the findings of the most recent illegal content risk assessment of a service (including as to levels of risk and as to nature, and severity, of potential harm to individuals).

Interpretation

10 In determining what is proportionate for the purposes of this section, the following factors, in particular, are relevant—
a all the findings of the most recent illegal content risk assessment (including as to levels of risk and as to nature, and severity, of potential harm to individuals), and
b the size and capacity of the provider of a service.
11 In this section “illegal content risk assessment” has the meaning given by section 26.
12 See also, in relation to duties set out in this section, section 33 (duties about freedom of expression and privacy).

Search services likely to be accessed by children

I824I20328 Children’s risk assessment duties

1 This section sets out the duties about risk assessments which apply in relation to regulated search services that are likely to be accessed by children (in addition to the duties about risk assessments set out in section 26).
2 A duty to carry out a suitable and sufficient children’s risk assessment at a time set out in, or as provided by, Schedule 3.
3 A duty to take appropriate steps to keep a children’s risk assessment up to date, including when OFCOM make any significant change to a risk profile that relates to services of the kind in question.
4 Before making any significant change to any aspect of a service’s design or operation, a duty to carry out a further suitable and sufficient children’s risk assessment relating to the impacts of that proposed change.
5 A “children’s risk assessment” of a service of a particular kind means an assessment of the following matters, taking into account the risk profile that relates to services of that kind—
a the level of risk of children who are users of the service encountering search content of the following kinds—
i each kind of primary priority content that is harmful to children (with each kind separately assessed),
ii each kind of priority content that is harmful to children (with each kind separately assessed), and
iii non-designated content that is harmful to children,
giving separate consideration to children in different age groups, and taking into account (in particular) risks presented by algorithms used by the service and the way that the service indexes, organises and presents search results;
b the level of risk of children who are users of the service encountering search content that is harmful to children which particularly affects individuals with a certain characteristic or members of a certain group;
c the extent to which the design of the service, in particular its functionalities, affects the level of risk of harm that might be suffered by children, identifying and assessing those functionalities that present higher levels of risk, including a functionality that makes suggestions relating to users’ search requests (predictive search functionality);
d the different ways in which the service is used, including functionalities or other features of the service that affect how much children use the service, and the impact of such use on the level of risk of harm that might be suffered by children;
e the nature, and severity, of the harm that might be suffered by children from the matters identified in accordance with paragraphs (a) to (d), giving separate consideration to children in different age groups;
f how the design and operation of the service (including the business model, governance, use of proactive technology, measures to promote users’ media literacy and safe use of the service, and other systems and processes) may reduce or increase the risks identified.
6 In this section references to risk profiles are to the risk profiles for the time being published under section 98 which relate to the risk of harm to children presented by content that is harmful to children.
7 See also—
a section 34(2) and (9) (records of risk assessments), and
b Schedule 3 (timing of providers’ assessments).

I378I17729 Safety duties protecting children

1 This section sets out the duties to protect children’s online safety which apply in relation to regulated search services that are likely to be accessed by children (as indicated by the headings).

All services

2 A duty, in relation to a service, to take or use proportionate measures relating to the design or operation of the service to effectively—
a mitigate and manage the risks of harm to children in different age groups, as identified in the most recent children’s risk assessment of the service (see section 28(5)(e)), and
b mitigate the impact of harm to children in different age groups presented by search content that is harmful to children.
3 A duty to operate a service using proportionate systems and processes designed to—
a minimise the risk of children of any age encountering search content that is primary priority content that is harmful to children;
b minimise the risk of children in age groups judged to be at risk of harm from other content that is harmful to children (or from a particular kind of such content) encountering search content of that kind.
4 The duties set out in subsections (2) and (3) apply across all areas of a service, including the way the search engine is designed, operated and used as well as search content of the service, and (among other things) require the provider of a service to take or use measures in the following areas, if it is proportionate to do so—
a regulatory compliance and risk management arrangements,
b design of functionalities, algorithms and other features relating to the search engine,
c functionalities allowing for control over content that is encountered in search results, especially by children,
d content prioritisation,
e user support measures, and
f staff policies and practices.
5 A duty to include provisions in a publicly available statement specifying how children are to be protected from search content of the following kinds—
a primary priority content that is harmful to children (with each kind of primary priority content separately covered),
b priority content that is harmful to children (with each kind of priority content separately covered), and
c non-designated content that is harmful to children.
6 A duty to apply the provisions of the statement referred to in subsection (5) consistently.
7 A duty to include provisions in a publicly available statement giving information about any proactive technology used by a service for the purpose of compliance with a duty set out in subsection (2) or (3) (including the kind of technology, when it is used, and how it works).
8 A duty to ensure that the provisions of the publicly available statement referred to in subsections (5) and (7) are clear and accessible.

Additional duty for Category 2A services

9 A duty to summarise in a publicly available statement the findings of the most recent children’s risk assessment of a service (including as to levels of risk and as to nature, and severity, of potential harm to children).

I205I54730 Safety duties protecting children: interpretation

1 In determining what is proportionate for the purposes of section 29, the following factors, in particular, are relevant—
a all the findings of the most recent children’s risk assessment (including as to levels of risk and as to nature, and severity, of potential harm to children), and
b the size and capacity of the provider of a service.
2 So far as a duty set out in section 29 relates to non-designated content that is harmful to children, the duty is to be taken to extend only to addressing risks of harm from the kinds of such content that have been identified in the most recent children’s risk assessment (if any have been identified).
3 The reference in section 29(3)(b) to children in age groups judged to be at risk of harm from content that is harmful to children is a reference to children in age groups judged to be at risk of such harm as assessed by the provider of a service in the most recent children’s risk assessment of the service.
4 The duties set out in section 29(3) are to be taken to extend only to content that is harmful to children where the risk of harm is presented by the nature of the content (rather than the fact of its dissemination).
5 The duties set out in section 29 extend only to such parts of a service as it is possible for children to access.
6 For the purposes of subsection (5), a provider is only entitled to conclude that it is not possible for children to access a service, or a part of it, if age verification or age estimation is used on the service with the result that children are not normally able to access the service or that part of it.
7 In section 29 and this section “children’s risk assessment” has the meaning given by section 28.
8 See also, in relation to duties set out in section 29, section 33 (duties about freedom of expression and privacy).

Duties about content reporting and complaints procedures

I242I89931 Duty about content reporting

1 This section sets out the duty about content reporting which applies in relation to all regulated search services.
2 A duty to operate a service using systems and processes that allow users and affected persons to easily report search content which they consider to be content of a kind specified below (with the duty extending to content that is harmful to children depending on the kind of service, as indicated by the headings).

All services

3 Illegal content.

Services likely to be accessed by children

4 Content that is harmful to children.

Interpretation

5 In this section “affected person” means a person, other than a user of the service in question, who is in the United Kingdom and who is—
a the subject of the content,
b a member of a class or group of people with a certain characteristic targeted by the content,
c a parent of, or other adult with responsibility for, a child who is a user of the service or is the subject of the content, or
d an adult providing assistance in using the service to another adult who requires such assistance, where that other adult is a user of the service or is the subject of the content.
6 See also, in relation to the duty set out in this section, section 33 (duties about freedom of expression and privacy).

I56I26532 Duties about complaints procedures

1 This section sets out the duties about complaints procedures which apply in relation to all regulated search services.
2 A duty to operate a complaints procedure in relation to a service that—
a allows for relevant kinds of complaint to be made (as set out under the headings below),
b provides for appropriate action to be taken by the provider of the service in response to complaints of a relevant kind, and
c is easy to access, easy to use (including by children) and transparent.
3 A duty to make the policies and processes that govern the handling and resolution of complaints of a relevant kind publicly available and easily accessible (including to children).

All services

4 The following kinds of complaint are relevant for all services—
a complaints by users and affected persons about search content which they consider to be illegal content;
b complaints by users and affected persons if they consider that the provider is not complying with a duty set out in—
i section 27 (illegal content),
ii section 31 (content reporting), or
iii section 33 (freedom of expression and privacy);
c complaints by an interested person if the provider of a search service takes or uses measures in order to comply with a duty set out in section 27 that result in content relating to that interested person no longer appearing in search results or being given a lower priority in search results;
d complaints by an interested person if—
i the use of proactive technology on a search service results in content relating to that interested person no longer appearing in search results or being given a lower priority in search results, and
ii the interested person considers that the proactive technology has been used in a way not contemplated by, or in breach of, the provider’s policies on its use (for example, by affecting content not of a kind specified in those policies as a kind of content in relation to which the technology would operate).

Services likely to be accessed by children

5 The following kinds of complaint are relevant for services that are likely to be accessed by children—
a complaints by users and affected persons about search content which they consider to be content that is harmful to children;
b complaints by users and affected persons if they consider that the provider is not complying with a duty set out in section 29 (children’s online safety);
c complaints by an interested person if the provider of a search service takes or uses measures in order to comply with a duty set out in section 29 that result in content relating to that interested person no longer appearing in search results or being given a lower priority in search results;
d complaints by a user who is unable to access content because measures used to comply with a duty set out in section 29(2) or (3) have resulted in an incorrect assessment of the user’s age.

Interpretation

6 In this section—
  • “affected person” has the meaning given by section 31;
  • “interested person” has the meaning given by section 227(7).
7 See also, in relation to duties set out in this section, section 33 (duties about freedom of expression and privacy).

Cross-cutting duties

I468I40833 Duties about freedom of expression and privacy

1 This section sets out the duties about freedom of expression and privacy which apply in relation to all regulated search services.
2 When deciding on, and implementing, safety measures and policies, a duty to have particular regard to the importance of protecting the rights of users and interested persons to freedom of expression within the law.
3 When deciding on, and implementing, safety measures and policies, a duty to have particular regard to the importance of protecting users from a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of a search service (including, but not limited to, any such provision or rule concerning the processing of personal data).
4 In this section—
  • “interested person” has the meaning given by section 227(7);
  • “safety measures and policies” means measures and policies designed to secure compliance with any of the duties set out in—
    1. section 27 (illegal content),
    2. section 29 (children’s online safety),
    3. section 31 (content reporting), or
    4. section 32 (complaints procedures).

I24134 Record-keeping and review duties

I1971 This section sets out the record-keeping and review duties which apply in relation to regulated search services (as indicated by the headings).

All services

I1972 A duty to make and keep a written record, in an easily understandable form, of all aspects of every risk assessment under section 26 or 28, including details about how the assessment was carried out and its findings.
I1973 A duty to make and keep a written record of any measures taken or in use to comply with a relevant duty which—
a are described in a code of practice and recommended for the purpose of compliance with the duty in question, and
b apply in relation to the provider and the service in question.
In this section such measures are referred to as “applicable measures in a code of practice”.
I1974 If alternative measures have been taken or are in use to comply with a relevant duty, a duty to make and keep a written record containing the following information—
a the applicable measures in a code of practice that have not been taken or are not in use,
b the alternative measures that have been taken or are in use,
c how those alternative measures amount to compliance with the duty in question, and
d how the provider has complied with section 49(5) (freedom of expression and privacy).
I1975 If alternative measures have been taken or are in use to comply with a duty set out in section 27(2) or (3) or 29(2) or (3), the record required under subsection (4) of this section must also indicate whether such measures have been taken or are in use in every area listed in subsection (4) of those sections in relation to which there are applicable measures in a code of practice.
I1976 A duty to review compliance with the relevant duties in relation to a service—
a regularly, and
b as soon as reasonably practicable after making any significant change to any aspect of the design or operation of the service.
I1977 OFCOM may provide that particular descriptions of providers of search services are exempt from any or all of the duties set out in this section, and may revoke such an exemption.
I1978 OFCOM must publish details of any exemption or revocation under subsection (7), including reasons for the revocation of an exemption.

Additional duty for Category 2A services

I1979 As soon as reasonably practicable after making a record of a risk assessment as required by subsection (2), or revising such a record, a duty to supply OFCOM with a copy of the record (in full).

Interpretation

I19310 In this section—
  • “alternative measures” means measures other than measures which are (in relation to the provider and the service in question) applicable measures in a code of practice;
  • “code of practice” means a code of practice published under section 46;
  • “relevant duties” means the duties set out in—
    1. section 27 (illegal content),
    2. section 29 (children’s online safety),
    3. section 31 (content reporting), and
    4. section 32 (complaints procedures),
and for the purposes of subsection (6), also includes the duties set out in section 75 (deceased child users).

CHAPTER 4 Children's access assessments

I708I1135 Children’s access assessments

1 In this Part, a “children’s access assessment” means an assessment of a Part 3 service—
a to determine whether it is possible for children to access the service or a part of the service, and
b if it is possible for children to access the service or a part of the service, to determine whether the child user condition is met in relation to the service or a part of the service.
2 A provider is only entitled to conclude that it is not possible for children to access a service, or a part of it, if age verification or age estimation is used on the service with the result that children are not normally able to access the service or that part of it.
3 The “child user condition” is met in relation to a service, or a part of a service, if—
a there is a significant number of children who are users of the service or of that part of it, or
b the service, or that part of it, is of a kind likely to attract a significant number of users who are children.
4 For the purposes of subsection (3)—
a the reference to a “significant” number includes a reference to a number which is significant in proportion to the total number of United Kingdom users of a service or (as the case may be) a part of a service;
b whether the test in paragraph (a) of that subsection is met is to be based on evidence about who actually uses a service, rather than who the intended users of the service are.
5 In this Chapter—
a references to children are to children in the United Kingdom;
b references to a part of a service do not include any part of a service that is not, or is not included in, a user-to-user part of a service or a search engine.

I67I44636 Duties about children’s access assessments

1 A provider of a Part 3 service must carry out the first children’s access assessment at a time set out in, or as provided by, Schedule 3.
2 Subsections (3) and (4) apply to a provider of a Part 3 service during any period when the service is not treated as likely to be accessed by children (see section 37).
3 The provider must carry out children’s access assessments of the service not more than one year apart.
4 The provider must carry out a children’s access assessment of the service—
a before making any significant change to any aspect of the service’s design or operation to which such an assessment is relevant,
b in response to evidence about reduced effectiveness of age verification or age estimation that is used on the service as mentioned in section 35(2), or
c in response to evidence about a significant increase in the number of children using the service.
5 If a person is the provider of more than one Part 3 service, children’s access assessments must be carried out for each service separately.
6 Children’s access assessments must be suitable and sufficient for the purposes of this Part.
7 A provider must make and keep a written record, in an easily understandable form, of every children’s access assessment.

I4I58337 Meaning of “likely to be accessed by children”

1 For the purposes of this Part, a Part 3 service is to be treated as “likely to be accessed by children” in the following three cases (with the result that the duties set out in sections 11 and 12, or (as the case may be) sections 28 and 29, apply in relation to the service).
2 The first case is where a children’s access assessment carried out by the provider of the service concludes that—
a it is possible for children to access the service or a part of it, and
b the child user condition is met in relation to—
i the service, or
ii a part of the service that it is possible for children to access.
This subsection is to be interpreted consistently with section 35.
3 In that case, the service is to be treated as likely to be accessed by children from the date on which the children’s access assessment is completed.
4 The second case is where the provider of the service fails to carry out the first children’s access assessment as required by section 36(1).
5 In that case—
a the service is to be treated as likely to be accessed by children from the date by which the first children’s access assessment was required to have been completed (see Part 1 of Schedule 3), and
b the service is to continue to be treated as likely to be accessed by children by reason of subsection (4) until such time as the provider completes the first children’s access assessment of the service.
6 The third case is where, following an investigation into a failure to comply with a duty set out in section 36, OFCOM determine that a service should be treated as likely to be accessed by children: see section 135(4) and (5).
7 In that case, the service is to be treated as likely to be accessed by children from the date of, or specified in, the confirmation decision given to the provider of the service (as the case may be: see section 135(5)).

CHAPTER 5 Duties about fraudulent advertising

I666I21538 Duties about fraudulent advertising: Category 1 services

1 A provider of a Category 1 service must operate the service using proportionate systems and processes designed to—
a prevent individuals from encountering content consisting of fraudulent advertisements by means of the service;
b minimise the length of time for which any such content is present;
c where the provider is alerted by a person to the presence of such content, or becomes aware of it in any other way, swiftly take down such content.
2 A provider of a Category 1 service must include clear and accessible provisions in the terms of service giving information about any proactive technology used by the service for the purpose of compliance with the duty set out in subsection (1) (including the kind of technology, when it is used, and how it works).
3 In relation to a Category 1 service, an advertisement is a “fraudulent advertisement” if—
a it is a paid-for advertisement (see section 236),
b it amounts to an offence specified in section 40 (construed in accordance with section 59: see subsections (3), (11) and (12) of that section), and
c it is not regulated user-generated content (see section 55) in relation to the service.
4 If a person is the provider of more than one Category 1 service, the duties set out in this section apply in relation to each such service.
5 In determining what is proportionate for the purposes of this section, the following factors, in particular, are relevant—
a the nature, and severity, of potential harm to individuals presented by different kinds of fraudulent advertisement, and
b the degree of control a provider has in relation to the placement of advertisements on the service.
6 In the case of a Category 1 service which is a combined service, the duties set out in this section do not extend to—
a fraudulent advertisements that may be encountered in search results of the service or, following a search request, as a result of subsequent interactions with internet services, or
b anything relating to the design, operation or use of the search engine.
But if the service is also a Category 2A service, the duties set out in section 39 apply as well as the duties set out in this section.
7 The duties set out in this section extend only to the design, operation and use of a Category 1 service in the United Kingdom.
8 For the meaning of “Category 1 service”, see section 95 (register of categories of services).

I288I21639 Duties about fraudulent advertising: Category 2A services

1 A provider of a Category 2A service must operate the service using proportionate systems and processes designed to—
a prevent individuals from encountering content consisting of fraudulent advertisements in or via search results of the service;
b if any such content may be encountered in or via search results of the service, minimise the length of time that that is the case;
c where the provider is alerted by a person to the fact that such content may be so encountered, or becomes aware of that fact in any other way, swiftly ensure that individuals are no longer able to encounter such content in or via search results of the service.
2 A provider of a Category 2A service must include clear and accessible provisions in a publicly available statement giving information about any proactive technology used by the service for the purpose of compliance with the duty set out in subsection (1) (including the kind of technology, when it is used, and how it works).
3 In relation to a Category 2A service, an advertisement is a “fraudulent advertisement” if—
a it is a paid-for advertisement (see section 236), and
b it amounts to an offence specified in section 40 (construed in accordance with section 59: see subsections (3), (11) and (12) of that section).
4 The references to encountering fraudulent advertisements “in or via search results” of a search service—
a are references to encountering fraudulent advertisements—
i in search results of the service, or
ii as a result of interacting with a paid-for advertisement in search results of the service (for example, by clicking on it);
b do not include references to encountering fraudulent advertisements as a result of any subsequent interactions with an internet service other than the search service.
5 If a person is the provider of more than one Category 2A service, the duties set out in this section apply in relation to each such service.
6 In determining what is proportionate for the purposes of this section, the following factors, in particular, are relevant—
a the nature, and severity, of potential harm to individuals presented by different kinds of fraudulent advertisement, and
b the degree of control a provider has in relation to the placement of advertisements on the service.
7 The duties set out in this section extend only to the design, operation and use of a Category 2A service in the United Kingdom.
8 For the meaning of “Category 2A service”, see section 95 (register of categories of services).

I262I66440 Fraud etc offences

1 This section specifies offences for the purposes of this Chapter (see sections 38(3)(b) and 39(3)(b)).
2 An offence under any of the following provisions of the Financial Services and Markets Act 2000—
a section 23 (contravention of prohibition on carrying on regulated activity unless authorised or exempt);
b section 24 (false claims to be authorised or exempt);
c section 25 (contravention of restrictions on financial promotion).
3 An offence under any of the following provisions of the Fraud Act 2006—
a section 2 (fraud by false representation);
b section 4 (fraud by abuse of position);
c section 7 (making or supplying articles for use in frauds);
d section 9 (participating in fraudulent business carried on by sole trader etc).
4 An offence under any of the following provisions of the Financial Services Act 2012—
a section 89 (misleading statements);
b section 90 (misleading impressions).
5 An offence of attempting or conspiring to commit an offence specified in subsection (2), (3) or (4).
6 An offence under Part 2 of the Serious Crime Act 2007 (encouraging or assisting) in relation to an offence specified in subsection (2), (3) or (4), or (in Scotland) inciting a person to commit such an offence.
7 An offence of aiding, abetting, counselling or procuring the commission of an offence specified in subsection (2), (3) or (4), or (in Scotland) being involved art and part in the commission of such an offence.

CHAPTER 6 Codes of practice and guidance

Codes of practice

I49841 Codes of practice about duties

I4981 OFCOM must prepare and issue a code of practice for providers of Part 3 services describing measures recommended for the purpose of compliance with duties set out in section 10 or 27 (illegal content) so far as relating to terrorism content or offences within Schedule 5 (terrorism offences).
I4982 OFCOM must prepare and issue a code of practice for providers of Part 3 services describing measures recommended for the purpose of compliance with duties set out in section 10 or 27 (illegal content) so far as relating to CSEA content or offences within Schedule 6 (child sexual exploitation and abuse offences).
I4983 OFCOM must prepare and issue one or more codes of practice for providers of Part 3 services describing measures recommended for the purpose of compliance with the relevant duties (except to the extent that measures for the purpose of compliance with such duties are described in a code of practice prepared under subsection (1) or (2)).
I7784 OFCOM must prepare and issue a code of practice for providers of Category 1 services and providers of Category 2A services describing measures recommended for the purpose of compliance with the duties set out in Chapter 5 (fraudulent advertising).
I4985 Where a code of practice under this section is in force, OFCOM may—
a prepare a draft of amendments of the code of practice;
b prepare a draft of a code of practice under subsection (1), (2), (3) or (4) as a replacement for a code of practice previously issued under the subsection in question;
c withdraw the code of practice.
I4986 In the course of preparing a draft of a code of practice or amendments of a code of practice under this section, OFCOM must consult—
a the Secretary of State,
b persons who appear to OFCOM to represent providers of Part 3 services,
c persons who appear to OFCOM to represent the interests of United Kingdom users of Part 3 services,
d persons who appear to OFCOM to represent the interests of children (generally or with particular reference to online safety matters),
e persons who appear to OFCOM to represent the interests of persons who have suffered harm as a result of matters to which the code of practice is relevant,
f persons whom OFCOM consider to have relevant expertise in equality issues and human rights, in particular—
i the right to freedom of expression set out in Article 10 of the Convention, and
ii the right to respect for a person’s private and family life, home and correspondence set out in Article 8 of the Convention,
g the Information Commissioner,
h the Children’s Commissioner,
i the Commissioner for Victims and Witnesses,
j the Domestic Abuse Commissioner,
k persons whom OFCOM consider to have expertise in public health, science or medicine that is relevant to online safety matters,
l persons whom OFCOM consider to have expertise in innovation, or emerging technology, that is relevant to online safety matters, and
m such other persons as OFCOM consider appropriate.
I4987 In the course of preparing a draft of a code of practice or amendments to which this subsection applies, OFCOM must also consult persons whom OFCOM consider to have expertise in the enforcement of the criminal law and the protection of national security that is relevant to online safety matters.
I4988 Subsection (7) applies to—
a a code of practice under subsection (1) and amendments of such a code,
b a code of practice under subsection (2) and amendments of such a code,
c a code of practice under subsection (3) that describes measures recommended for the purpose of compliance with duties set out in section 10 or 27 (illegal content),
d amendments of a code of practice under subsection (3), if and to the extent that those amendments relate to measures recommended for the purpose of compliance with duties set out in section 10 or 27, and
e a code of practice under subsection (4) and amendments of such a code.
I4989 Subsections (6) and (7) are subject to section 48 (minor amendments of code of practice).
I49810 In this section “the relevant duties” means the duties set out in—
a sections 10 and 27 (illegal content),
b sections 12 and 29 (children’s online safety),
c section 15 (user empowerment),
d section 17 (content of democratic importance),
e section 19 (journalistic content),
f sections 20 and 31 (content reporting), and
g sections 21 and 32 (complaints procedures).

I88142 Codes of practice: principles, objectives, content

Schedule 4 contains—
a provision about the principles OFCOM must consider when preparing codes of practice under section 41,
b the online safety objectives (and a power for the Secretary of State by regulations to revise those objectives),
c provision about the measures that may be described in codes of practice (including, in particular, constraints on the recommendation of the use of proactive technology), and
d other provision related to codes of practice.

I33843 Procedure for issuing codes of practice

1 Where OFCOM have prepared a draft of a code of practice under section 41, they must submit the draft to the Secretary of State.
2 Unless the Secretary of State intends to give a direction to OFCOM under section 44(1), (2) or (3) in relation to the draft, the Secretary of State must, as soon as reasonably practicable, lay the draft before Parliament.
3 If, within the 40-day period, either House of Parliament resolves not to approve the draft—
a OFCOM must not issue the code of practice in the form of that draft, and
b OFCOM must prepare another draft of the code of practice under section 41.
4 If no such resolution is made within that period—
a OFCOM must issue the code of practice in the form of the draft laid before Parliament, and
b the code of practice comes into force at the end of the period of 21 days beginning with the day on which it is issued.
5 “The 40-day period” is the period of 40 days beginning with the day on which the draft is laid before Parliament (or, if it is not laid before each House of Parliament on the same day, the later of the days on which it is laid).
6 In calculating the 40-day period, no account is to be taken of any period during which Parliament is dissolved or prorogued or during which both Houses are adjourned for more than 4 days.
7 Subsections (1) to (6) apply in relation to a draft of amendments of a code of practice prepared under section 41 as they apply in relation to a draft of a code of practice prepared under that section.
8 This section is subject to section 48 (minor amendments of codes of practice).
9 Subsection (11) applies to—
a a draft of the first code of practice prepared under section 41(1) (terrorism code of practice);
b a draft of the first code of practice prepared under section 41(2) (CSEA code of practice);
c a draft of the first code of practice prepared under section 41(3) relating to a duty set out in section 10 or 27 (illegal content);
d a draft of the first code of practice prepared under section 41(3) relating to a duty set out in section 12 or 29 (children’s online safety);
e a draft of the first code of practice prepared under section 41(3) relating to a duty set out in section 20 or 31 (content reporting);
f a draft of the first code of practice prepared under section 41(3) relating to—
i a duty set out in section 21 (complaints procedures) that concerns complaints of a kind mentioned in subsection (4) or (5) of that section, or
ii a duty set out in section 32 (complaints procedures).
10 For the purposes of paragraphs (c) to (f) of subsection (9) a draft of a code of practice is a draft of the first code of practice relating to a duty if—
a it describes measures recommended for the purpose of compliance with the duty, and
b it is a draft of the first code of practice prepared under section 41(3) that describes measures for that purpose.
11 OFCOM must submit a draft to which this subsection applies to the Secretary of State under subsection (1) within the period of 18 months beginning with the day on which this Act is passed.
12 If OFCOM consider that it is necessary to extend the period mentioned in subsection (11) in relation to a draft mentioned in any of paragraphs (a) to (f) of subsection (9), OFCOM may extend the period in relation to that draft by up to 12 months by making and publishing a statement. But this is subject to subsection (15).
13 A statement under subsection (12) must set out—
a the reasons why OFCOM consider that it is necessary to extend the period mentioned in subsection (11) in relation to the draft concerned, and
b the period of extension.
14 A statement under subsection (12) may be published at the same time as (or incorporate) a statement under section 194(3) (extension of time to prepare certain guidance).
15 But a statement under subsection (12) may not be made in relation to a draft mentioned in a particular paragraph of subsection (9) if—
a a statement has previously been made under subsection (12) (whether in relation to a draft mentioned in the same or a different paragraph of subsection (9)), or
b a statement has previously been made under section 194(3).

I64344 Secretary of State’s powers of direction

1 The Secretary of State may direct OFCOM to modify a draft of a code of practice submitted under section 43(1) if the Secretary of State believes that modifications are required for the purpose of securing compliance with an international obligation of the United Kingdom.
2 The Secretary of State may direct OFCOM to modify a draft of a code of practice, other than a terrorism or CSEA code of practice, submitted under section 43(1) if the Secretary of State believes that modifications are required for exceptional reasons relating to—
a national security,
b public safety,
c public health, or
d relations with the government of a country outside the United Kingdom.
3 The Secretary of State may direct OFCOM to modify a draft of a terrorism or CSEA code of practice submitted under section 43(1) if the Secretary of State believes that modifications are required—
a for reasons of national security or public safety, or
b for exceptional reasons relating to public health or relations with the government of a country outside the United Kingdom.
4 But if a draft of a terrorism or CSEA code of practice is submitted under section 43(1) following a review under section 47(2), the Secretary of State may only direct OFCOM to modify the draft if the Secretary of State believes that modifications are required for reasons of national security or public safety.
5 If, following a review of a terrorism or CSEA code of practice under section 47(2), OFCOM submit a statement to the Secretary of State under section 47(3)(b) (“OFCOM’s review statement”), the Secretary of State may direct OFCOM to modify the code of practice if the Secretary of State believes that modifications are required for reasons of national security or public safety.
6 A direction given under subsection (5)—
a must be given within the period of 45 days beginning with the day on which OFCOM’s review statement is submitted to the Secretary of State, and
b must make particular reference to OFCOM’s review statement.
7 A direction given under this section—
a may not require OFCOM to include in a code of practice provision about a particular measure recommended to be taken or used by providers of Part 3 services,
b must set out the Secretary of State’s reasons for requiring modifications, except in a case where the Secretary of State considers that doing so would be against the interests of national security, public safety or relations with the government of a country outside the United Kingdom, and
c must, as soon as reasonably practicable, be published and laid before Parliament.
8 If the Secretary of State considers that publishing and laying before Parliament a direction given under this section would be against the interests of national security, public safety or relations with the government of a country outside the United Kingdom—
a subsection (7)(c) does not apply in relation to the direction, and
b the Secretary of State must, as soon as reasonably practicable, publish and lay before Parliament a document stating—
i that a direction has been given,
ii the kind of code of practice to which it relates, and
iii the reasons for not publishing it.
9 If the Secretary of State gives a direction under this section, OFCOM must, as soon as reasonably practicable—
a comply with the direction,
b submit to the Secretary of State a draft of the code of practice modified in accordance with the direction,
c submit to the Secretary of State a document containing—
i (except in a case mentioned in subsection (7)(b)) details of the direction, and
ii details about how the draft has been revised in response to the direction,
d publish the document, and
e inform the Secretary of State about modifications that OFCOM have made to the draft that are not in response to the direction (if there are any).
10 The Secretary of State may give OFCOM one or more further directions requiring OFCOM to modify the draft of the code of practice.
11 Such further directions may only be given for the reasons set out in subsection (1), (2), (3), (4) or (5) (as the case may be), and subsections (7) to (9) apply again in relation to such further directions.
12 When the Secretary of State is satisfied that no further modifications to the draft are required, the Secretary of State must, as soon as reasonably practicable, lay before Parliament—
a the modified draft,
b any document submitted by OFCOM as mentioned in subsection (9)(c), and
c in the case of a direction under subsection (5), OFCOM’s review statement.
13 Before laying OFCOM’s review statement before Parliament, the Secretary of State may, with OFCOM’s agreement, remove or obscure information in the statement (whether by redaction or otherwise) in order to prevent the disclosure of matters that the Secretary of State considers would be against the interests of national security, public safety or relations with the government of a country outside the United Kingdom.
14 This section applies in relation to a draft of amendments of a code of practice submitted under section 43(1) as it applies in relation to a draft of a code of practice submitted under that provision.
15 In this section “terrorism or CSEA code of practice” means a code of practice under section 41(1) or (2).

I59545 Procedure for issuing codes of practice following direction under section 44

1 This section sets out the procedure that applies where a draft of a code of practice is laid before Parliament under section 44(12).
2 If the draft contains modifications made following a direction given under section 44(1), (2) or (3)(b), the affirmative procedure applies.
3 If the draft contains modifications made following a direction given under section 44(3)(a), (4) or (5), the negative procedure applies.
4 The “affirmative procedure” is as follows—
a a code of practice in the form of the draft laid before Parliament must not be issued by OFCOM unless the draft has been approved by a resolution of each House of Parliament;
b if the draft is so approved, the code of practice comes into force at the end of the period of 21 days beginning with the day on which it is issued;
c if the draft is not so approved, OFCOM must prepare another draft of the code of practice under section 41.
5 The “negative procedure” is as follows—
a if, within the 40-day period, either House of Parliament resolves not to approve the draft—
i OFCOM must not issue the code of practice in the form of that draft, and
ii OFCOM must prepare another draft of the code of practice under section 41;
b if no such resolution is made within that period—
i OFCOM must issue the code of practice in the form of the draft laid before Parliament, and
ii the code of practice comes into force at the end of the period of 21 days beginning with the day on which it is issued.
6 “The 40-day period” has the same meaning as in section 43 (see subsections (5) and (6) of that section).
7 This section applies in relation to a draft of amendments of a code of practice laid before Parliament under section 44(12) as it applies in relation to a draft of a code of practice laid under that provision.

I7746 Publication of codes of practice

1 OFCOM must publish each code of practice issued under section 43 or 45 within the period of three days beginning with the day on which it is issued.
2 Where amendments of a code of practice are issued under either of those sections, OFCOM must publish the amended code of practice within the period of three days beginning with the day on which the amendments are issued.
3 Where a code of practice is withdrawn, OFCOM must publish a notice to that effect.

I70347 Review of codes of practice

1 OFCOM must keep under review each code of practice published under section 46.
2 The Secretary of State may require OFCOM to review a terrorism or CSEA code of practice published under section 46 if the Secretary of State considers a review to be necessary for reasons of national security or public safety (and the Secretary of State must notify OFCOM whether the reasons fall into the category of national security or public safety).
3 OFCOM must carry out a review of the code of practice under subsection (2) as soon as reasonably practicable, and when it is completed—
a if OFCOM consider that changes are required, they must prepare a draft of amendments to the code of practice or a draft of a replacement code of practice under section 41, or
b if OFCOM consider that no changes are required, they must submit to the Secretary of State a statement which explains the reasons for that conclusion.
4 Subsection (5) applies if—
a OFCOM submit a statement under subsection (3)(b) to the Secretary of State,
b the period of 45 days beginning with the day on which the statement was submitted has elapsed, and
c the Secretary of State has not given a direction under section 44(5).
5 OFCOM must publish the statement as soon as reasonably practicable after the end of the period mentioned in subsection (4)(b), making it clear which code of practice the statement relates to.
6 In advance of publication, the Secretary of State may make representations to OFCOM about the desirability of removing or obscuring information in the statement (whether by redaction or otherwise) in order to prevent the disclosure of matters that the Secretary of State considers would be against the interests of national security, public safety or relations with the government of a country outside the United Kingdom (and see also section 116(3)).
7 In this section “terrorism or CSEA code of practice” means a code of practice under section 41(1) or (2).

I79548 Minor amendments of codes of practice

1 This section applies if—
a OFCOM propose to amend a code of practice under section 41, and
b OFCOM consider that the minor nature of the proposal means that—
i consultation is unnecessary, and
ii the proposed amendments should not be required to be laid before Parliament.
2 OFCOM must notify the Secretary of State of the proposed amendments.
3 If the Secretary of State agrees with OFCOM that it is appropriate—
a the consultation requirements set out in section 41(6) and (7) do not apply in relation to the proposed amendments, and
b section 43 does not apply to the amendments, once prepared.
4 If the Secretary of State agrees with OFCOM as mentioned in subsection (3), OFCOM may prepare and issue the amendments of the code of practice.
5 Amendments of a code of practice issued under this section come into force at the end of the period of 21 days beginning with the day on which the amendments are issued.
6 Section 46(2) applies in relation to amendments of a code of practice issued under this section as it applies in relation to amendments of a code of practice issued under section 43 or 45.

I121I35349 Relationship between duties and codes of practice

Duties set out in Chapters 2 and 3

1 A provider of a Part 3 service is to be treated as complying with a relevant duty if the provider takes or uses the measures described in a code of practice which are recommended for the purpose of compliance with the duty in question.
2 A provider of a user-to-user service—
a is to be treated as complying with the duty set out in section 22(2) (freedom of expression) if the provider takes or uses such of the relevant recommended measures as incorporate safeguards to protect users’ right to freedom of expression within the law;
b is to be treated as complying with the duty set out in section 22(3) (privacy) if the provider takes or uses such of the relevant recommended measures as incorporate safeguards to protect the privacy of users.
3 A provider of a search service—
a is to be treated as complying with the duty set out in section 33(2) (freedom of expression) if the provider takes or uses such of the relevant recommended measures as incorporate safeguards to protect the rights of users and interested persons to freedom of expression within the law;
b is to be treated as complying with the duty set out in section 33(3) (privacy) if the provider takes or uses such of the relevant recommended measures as incorporate safeguards to protect the privacy of users.

Duties set out in Chapter 5

4 A provider of a Category 1 service or a Category 2A service (or a provider of a service which is both a Category 1 service and a Category 2A service) is to be treated as complying with a duty set out in Chapter 5 if the provider takes or uses the measures described in a fraudulent advertising code of practice which are recommended for the purpose of compliance with the duty in question.

Alternative measures

5 A provider of a Part 3 service who seeks to comply with a relevant duty by acting otherwise than by taking or using a measure described in a code of practice or a fraudulent advertising code of practice which is recommended for the purpose of compliance with the duty must have particular regard to the importance of the following (where relevant)—
a protecting the right of users and (in the case of search services) interested persons to freedom of expression within the law, and
b protecting the privacy of users.
6 When assessing whether a provider of a Part 3 service is compliant with a relevant duty where the provider has acted otherwise than by taking or using a measure described in a code of practice or a fraudulent advertising code of practice which is recommended for the purpose of compliance with the duty, OFCOM must consider the extent to which the alternative measures taken or in use by the provider—
a extend across all areas of a service as mentioned in section 10(4), 12(8), 27(4) or 29(4) (if relevant to the duty in question), and
b (where appropriate) incorporate safeguards for the protection of the matters mentioned in subsection (5)(a) and (b).

Interpretation

7 In subsections (1) to (4), references to taking or using measures recommended for the purpose of compliance with a duty, or to taking or using relevant recommended measures, are to taking or using such of those measures as are relevant to the provider and the service in question.
8 In this section—
a references to protecting the privacy of users are to protecting users from a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of a user-to-user service or search service (including, but not limited to, any such provision or rule concerning the processing of personal data);
b references to a search service include references to a combined service (see section 7(6)).
9 In this section—
  • “Chapter 2 safety duty” means a duty set out in—
    1. section 10 (illegal content), or
    2. section 12 (children’s online safety);
  • “Chapter 3 safety duty” means a duty set out in—
    1. section 27 (illegal content), or
    2. section 29 (children’s online safety);
  • “code of practice” means a code of practice published under section 46, except a fraudulent advertising code of practice;
  • “fraudulent advertising code of practice” means a code of practice prepared under section 41(4) and published under section 46;
  • “relevant duty” means—
    1. a Chapter 2 safety duty,
    2. a Chapter 3 safety duty,
    3. a duty set out in section 15 (user empowerment),
    4. a duty set out in section 17 (content of democratic importance),
    5. a duty set out in section 19 (journalistic content),
    6. a duty set out in section 20 or 31 (content reporting), or
    7. a duty set out in section 21 or 32 (complaints procedures);
  • “relevant recommended measures” means the measures described in a code of practice which are recommended for the purpose of compliance with—
    1. in the case of a user-to-user service—
      1. a Chapter 2 safety duty, or
      2. a duty set out in section 15 (user empowerment);
    2. in the case of a search service, a Chapter 3 safety duty.

I514I4050 Effects of codes of practice

1 A failure by a provider of a Part 3 service to act in accordance with a provision of a code of practice does not of itself make the provider liable to legal proceedings in a court or tribunal.
2 A code of practice is admissible in evidence in legal proceedings.
3 In any proceedings in a court or tribunal, the court or tribunal must take into account a provision of a code of practice in determining a question arising in the proceedings if—
a the question relates to a time when the provision was in force, and
b the provision appears to the court or tribunal to be relevant to the question.
4 OFCOM must take into account a provision of a code of practice in determining a question arising in connection with their exercise of any relevant function if—
a the question relates to a time when the provision was in force, and
b the provision appears to OFCOM to be relevant to the question.
5 In this section—
  • “code of practice” means a code of practice published under section 46;
  • “relevant functions” means OFCOM’s functions under—
    1. Chapter 4 of Part 7 (information),
    2. Chapter 5 of Part 7 (notices to deal with terrorism content and CSEA content),
    3. Chapter 6 of Part 7 (enforcement), and
    4. Chapter 2 of Part 8 (super-complaints).

I567I27251 Duties and the first codes of practice

1 A duty mentioned in subsection (3) applies to providers of Part 3 services from the day on which a code of practice prepared under section 41(3) that is the first code of practice relating to that duty comes into force.
2 In the case of the duties set out in sections 10 and 27, subsection (1) is subject to subsections (5) and (6).
3 The duties referred to in subsection (1) are the duties set out in—
a sections 10 and 27 (illegal content),
b sections 12 and 29 (children’s online safety),
c section 15 (user empowerment),
d section 17 (content of democratic importance),
e section 19 (journalistic content),
f sections 20 and 31 (content reporting), and
g sections 21 and 32 (complaints procedures).
4 For the purposes of subsection (1) a code of practice is the first code of practice relating to a duty if—
a it describes measures recommended for the purpose of compliance with that duty, and
b it is the first code of practice prepared under section 41(3) that describes measures for that purpose.
5 The duties set out in sections 10 and 27, so far as relating to terrorism content or offences within Schedule 5 (terrorism offences), apply to providers of Part 3 services from the day on which the first code of practice prepared under section 41(1) comes into force.
6 The duties set out in sections 10 and 27, so far as relating to CSEA content or offences within Schedule 6 (child sexual exploitation and abuse offences), apply to providers of Part 3 services from the day on which the first code of practice prepared under section 41(2) comes into force.
7 The duties set out in Chapter 5 (fraudulent advertising) apply to providers of a Category 1 service and providers of a Category 2A service (and to providers of a service which is both a Category 1 service and a Category 2A service) from the day on which the first code of practice prepared under section 41(4) comes into force.
8 In relation to the provider of a particular Part 3 service, references in this section to duties applying to providers of Part 3 services (or to providers of Category 1 services or Category 2A services) are to such duties as apply in relation to that service in accordance with sections 7 and 24 or (as the case may be) Chapter 5.
9 This section is subject to Part 2 of Schedule 17 (video-sharing platform services: transitional provision etc).

Guidance

I43052 OFCOM’s guidance about certain duties in Part 3

I1371 OFCOM must produce guidance for providers of Category 1 services to assist them in complying with their duties set out in section 14 (assessments related to the adult user empowerment duty set out in section 15(2)).
I430I1372 OFCOM must produce guidance for providers of Category 1 services to assist them in complying with their duties set out in section 18 (news publisher content).
I4303 OFCOM must produce guidance for providers of Part 3 services to assist them in complying with—
a their duties set out in section 23 or 34, except the duty set out in section 23(10) or 34(9) (record-keeping and review), and
b their duties set out in section 36 (children’s access assessments).
I4304 Before producing guidance under subsection (1) or (3) (including revised or replacement guidance), OFCOM must consult the Information Commissioner.
5 OFCOM must publish guidance under this section (and any revised or replacement guidance).

I72153 OFCOM’s guidance: content that is harmful to children and user empowerment

I7211 OFCOM must produce guidance for providers of Part 3 services which contains examples of content or kinds of content that OFCOM consider to be, or consider not to be—
a primary priority content that is harmful to children, or
b priority content that is harmful to children.
I142 OFCOM must produce guidance for providers of Category 1 services which contains examples of content or kinds of content that OFCOM consider to be, or consider not to be, content to which section 15(2) applies (see section 16).
I7213 Before producing any guidance under this section (including revised or replacement guidance), OFCOM must consult such persons as they consider appropriate.
I7214 OFCOM must publish guidance under this section (and any revised or replacement guidance).

I458I68354 OFCOM’s guidance about protecting women and girls

1 OFCOM must produce guidance for providers of Part 3 services which focuses on content and activity—
a in relation to which such providers have duties set out in this Part or Part 4, and
b which disproportionately affects women and girls.
2 The guidance may, among other things—
a contain advice and examples of best practice for assessing risks of harm to women and girls from content and activity mentioned in subsection (1), and for reducing such risks;
b refer to provisions contained in a code of practice under section 41 which are particularly relevant to the protection of women and girls from such content and activity.
3 Before producing the guidance (including revised or replacement guidance), OFCOM must consult—
a the Commissioner for Victims and Witnesses,
b the Domestic Abuse Commissioner, and
c such other persons as OFCOM consider appropriate.
4 OFCOM must publish the guidance (and any revised or replacement guidance).

CHAPTER 7 Interpretation of Part 3

I76655 “Regulated user-generated content”, “user-generated content”, “news publisher content”

1 This section applies for the purposes of this Part.
2 “Regulated user-generated content”, in relation to a regulated user-to-user service, means user-generated content, except—
a emails,
b SMS messages,
c MMS messages,
d one-to-one live aural communications (see subsection (5)),
e comments and reviews on provider content (see subsection (6)),
f identifying content that accompanies content within any of paragraphs (a) to (e), and
g news publisher content (see subsection (8)).
3 “User-generated content”, in relation to a user-to-user service, means content—
a that is—
i generated directly on the service by a user of the service, or
ii uploaded to or shared on the service by a user of the service, and
b that may be encountered by another user, or other users, of the service by means of the service.
4 For the purposes of subsection (3)—
a the reference to content generated, uploaded or shared by a user includes content generated, uploaded or shared by means of software or an automated tool applied by the user;
b a bot or other automated tool is to be regarded as a user of a service if—
i the functions of the bot or tool include interacting with user-generated content, and
ii the bot or tool is not controlled by or on behalf of the provider of the service.
5 “One-to-one live aural communications”, in relation to a user-to-user service, means content—
a consisting of speech or other sounds conveyed in real time between two users of the service by means of the service,
b that is not a recording, and
c that is not accompanied by user-generated content of any other kind, except identifying content.
6 “Comments and reviews on provider content”, in relation to a user-to-user service, means content present on the service consisting of comments or reviews relating to provider content (together with any further comments on such comments or reviews).
7 In subsection (6) “provider content” means content published on a service by the provider of the service or by a person acting on behalf of the provider, including where the publication of the content is effected or controlled by means of—
a software or an automated tool or algorithm applied by the provider or by a person acting on behalf of the provider, or
b an automated tool or algorithm made available on the service by the provider or by a person acting on behalf of the provider.
For the purposes of subsection (6), content that is user-generated content in relation to a service is not to be regarded as provider content in relation to that service.
8 “News publisher content”, in relation to a regulated user-to-user service, means any content present on the service that is within subsection (9) or (10).
9 Content is within this subsection if it was generated directly on the service by a user of the service that is a recognised news publisher.
10 Content is within this subsection if—
a the content was uploaded to or shared on the service by a user of the service, and
b the content either—
i reproduces in full an article or written item that was originally published by a recognised news publisher (and is not a screenshot or photograph of that article or item or of part of it),
ii is video or audio content that was originally published or broadcast by a recognised news publisher, and is not a clipped or edited form of such content (unless it is the recognised news publisher who has clipped or edited it), or
iii is a link to an article or item within sub-paragraph (i) or to content within sub-paragraph (ii).
11 For the meaning of “recognised news publisher”, see section 56.
12 In this section—
  • “MMS message” means a Multimedia Messaging Service message (that may include images, sounds and short videos) that may be sent between telephone numbers allocated in accordance with a national or international numbering plan;
  • “SMS message” means a Short Message Service text message composed principally of letters or numbers that may be sent between telephone numbers allocated in accordance with a national or international numbering plan.

I67056 “Recognised news publisher”

1 In this Part, “recognised news publisher” means any of the following entities—
a the British Broadcasting Corporation,
b Sianel Pedwar Cymru,
c the holder of a licence under the Broadcasting Act 1990 or 1996 who publishes news-related material in connection with the broadcasting activities authorised under the licence, and
d any other entity which—
i meets all of the conditions in subsection (2),
ii is not an excluded entity (see subsection (3)), and
iii is not a sanctioned entity (see subsection (4)).
2 The conditions referred to in subsection (1)(d)(i) are that the entity—
a has as its principal purpose the publication of news-related material, and such material—
i is created by different persons, and
ii is subject to editorial control,
b publishes such material in the course of a business (whether or not carried on with a view to profit),
c is subject to a standards code,
d has policies and procedures for handling and resolving complaints,
e has a registered office or other business address in the United Kingdom,
f is the person with legal responsibility for material published by it in the United Kingdom, and
g publishes—
i the entity’s name, the address mentioned in paragraph (e) and the entity’s registered number (if any), and
ii the name and address of any person who controls the entity (including, where such a person is an entity, the address of that person’s registered or principal office and that person’s registered number (if any)).
3 An “excluded entity” is an entity—
a which is a proscribed organisation under the Terrorism Act 2000 (see section 3 of that Act), or
b the purpose of which is to support a proscribed organisation under that Act.
4 A “sanctioned entity” is an entity which—
a is designated by name under a power contained in regulations under section 1 of the Sanctions and Anti-Money Laundering Act 2018 that authorises the Secretary of State or the Treasury to designate persons for the purposes of the regulations or of any provisions of the regulations, or
b is a designated person under any provision included in such regulations by virtue of section 13 of that Act (persons named by or under UN Security Council Resolutions).
5 For the purposes of subsection (2)—
a news-related material is “subject to editorial control” if there is a person (whether or not the publisher of the material) who has editorial or equivalent responsibility for the material, including responsibility for how it is presented and the decision to publish it;
b “control” has the same meaning as it has in the Broadcasting Act 1990 by virtue of section 202 of that Act.
6 In this section—
  • “news-related material” means material consisting of—
    1. news or information about current affairs,
    2. opinion about matters relating to the news or current affairs, or
    3. gossip about celebrities, other public figures or other persons in the news;
  • “publish” means publish by any means (including by broadcasting), and references to a publisher and publication are to be construed accordingly;
  • “standards code” means—
    1. a code of standards that regulates the conduct of publishers, that is published by an independent regulator, or
    2. a code of standards that regulates the conduct of the entity in question, that is published by the entity itself.

I71457 “Search content”, “search results” etc

1 This section applies for the purposes of this Part.
2 “Search content” means content that may be encountered in or via search results of a search service, except—
a paid-for advertisements (see section 236),
b content on the website of a recognised news publisher (see section 56), and
c content that—
i reproduces in full an article or written item that was originally published by a recognised news publisher (and is not a screenshot or photograph of that article or item or of part of it),
ii is video or audio content that was originally published or broadcast by a recognised news publisher, and is not a clipped or edited form of such content (unless it is the recognised news publisher who has clipped or edited it), or
iii is a link to an article or item within sub-paragraph (i) or to content within sub-paragraph (ii).
3 “Search results”, in relation to a search service, means content presented to a user of the service by operation of the search engine in response to a search request made by the user.
4 “Search” means search by any means, including by input of text or images or by speech, and references to a search request are to be construed accordingly.
5 In subsection (2), the reference to encountering content “via search results”—
a is to encountering content as a result of interacting with search results (for example, by clicking on them);
b does not include a reference to encountering content as a result of subsequent interactions with an internet service other than the search service.
6 In this section references to a search service include references to a user-to-user service that includes a search engine.

I51758 Restricting users’ access to content

1 This section applies for the purposes of this Part.
2 References to restricting users’ access to content, and related references, include any case where a provider takes or uses a measure which has the effect that—
a a user is unable to access content without taking a prior step (whether or not taking that step might result in access being denied), or
b content is temporarily hidden from a user.
3 But such references do not include any case where—
a the effect mentioned in subsection (2) results from the voluntary use or application by a user of features, functionalities or settings which a provider includes in a service (for example, features, functionalities or settings included in compliance with the duty set out in section 15(2) or (9) (user empowerment)), or
b access to content is controlled by another user, rather than the provider.
4 See also section 236(6).

I8359 “Illegal content” etc

1 This section applies for the purposes of this Part.
2 “Illegal content” means content that amounts to a relevant offence.
3 Content consisting of certain words, images, speech or sounds amounts to a relevant offence if—
a the use of the words, images, speech or sounds amounts to a relevant offence,
b the possession, viewing or accessing of the content constitutes a relevant offence, or
c the publication or dissemination of the content constitutes a relevant offence.
4 “Relevant offence” means—
a a priority offence, or
b an offence within subsection (5).
5 An offence is within this subsection if—
a it is not a priority offence,
b the victim or intended victim of the offence is an individual (or individuals), and
c the offence is created by this Act or, before or after this Act is passed, by—
i another Act,
ii an Order in Council,
iii an order, rules or regulations made under an Act by the Secretary of State or other Minister of the Crown, including such an instrument made jointly with a devolved authority, or
iv devolved subordinate legislation made by a devolved authority with the consent of the Secretary of State or other Minister of the Crown.
6 But an offence is not within subsection (5) if—
a the offence concerns—
i the infringement of intellectual property rights,
ii the safety or quality of goods (as opposed to what kind of goods they are), or
iii the performance of a service by a person not qualified to perform it; or
b it is an offence under Chapter 1 of Part 4 of the Digital Markets, Competition and Consumers Act 2024.
7 “Priority offence” means—
a an offence specified in Schedule 5 (terrorism offences),
b an offence specified in Schedule 6 (offences related to child sexual exploitation and abuse), or
c an offence specified in Schedule 7 (other priority offences).
8 “Terrorism content” means content that amounts to an offence specified in Schedule 5.
9 “CSEA content” means content that amounts to an offence specified in Schedule 6.
10 “Priority illegal content” means—
a terrorism content,
b CSEA content, and
c content that amounts to an offence specified in Schedule 7.
11 For the purposes of determining whether content amounts to an offence, no account is to be taken of whether or not anything done in relation to the content takes place in any part of the United Kingdom.
12 References in subsection (3) to conduct of particular kinds are not to be taken to prevent content generated by a bot or other automated tool from being capable of amounting to an offence (see also section 192(7) (providers’ judgements about the status of content)).
13 Subsection (14) applies in relation to a regulated user-to-user service (but, in the case of a combined service, does not apply in relation to the search content of the service).
14 References to “illegal content”, “terrorism content”, “CSEA content” and “priority illegal content” are to be read as—
a limited to content within the definition in question that is regulated user-generated content in relation to the service, and
b including material which, if it were present on the service, would be content within paragraph (a) (and this section is to be read with such modifications as may be necessary for the purpose of this paragraph).
15 In this section—
  • “devolved authority” means—
    1. the Scottish Ministers,
    2. the Welsh Ministers, or
    3. a Northern Ireland department;
  • “devolved subordinate legislation” means—
    1. an instrument made under an Act of the Scottish Parliament,
    2. an instrument made under an Act or Measure of Senedd Cymru, or
    3. an instrument made under Northern Ireland legislation;
  • “Minister of the Crown” has the meaning given by section 8 of the Ministers of the Crown Act 1975 and also includes the Commissioners for His Majesty’s Revenue and Customs;
  • “offence” means an offence under the law of any part of the United Kingdom.
16 See also section 192 (providers’ judgements about the status of content).

I75360 “Content that is harmful to children”

1 This section and sections 61 and 62 apply for the purposes of this Part.
2 “Content that is harmful to children” means—
a primary priority content that is harmful to children (see section 61),
b priority content that is harmful to children (see section 62), or
c content, not within paragraph (a) or (b), of a kind which presents a material risk of significant harm to an appreciable number of children in the United Kingdom.
3 Content is not to be regarded as within subsection (2)(c) if the risk of harm flows from—
a the content’s potential financial impact,
b the safety or quality of goods featured in the content, or
c the way in which a service featured in the content may be performed (for example, in the case of the performance of a service by a person not qualified to perform it).
4 “Non-designated content that is harmful to children” means content within subsection (2)(c).
5 Subsection (6) applies in relation to a regulated user-to-user service (but, in the case of a combined service, does not apply in relation to the search content of the service).
6 References to “primary priority content that is harmful to children”, “priority content that is harmful to children”, “content that is harmful to children” and “non-designated content that is harmful to children” are to be read as—
a limited to content within the definition in question that is regulated user-generated content in relation to the service, and
b including material which, if it were present on the service, would be content within paragraph (a) (and this section and sections 61 and 62 are to be read with such modifications as may be necessary for the purpose of this paragraph).

I15961 “Primary priority content that is harmful to children”

1 “Primary priority content that is harmful to children” means content of any of the following kinds.
2 Pornographic content, other than content within subsection (6).
3 Content which encourages, promotes or provides instructions for suicide.
4 Content which encourages, promotes or provides instructions for an act of deliberate self-injury.
5 Content which encourages, promotes or provides instructions for an eating disorder or behaviours associated with an eating disorder.
6 Content is within this subsection if it—
a consists only of text, or
b consists only of text accompanied by—
i identifying content which consists only of text,
ii other identifying content which is not itself pornographic content,
iii a GIF which is not itself pornographic content,
iv an emoji or other symbol, or
v any combination of content mentioned in sub-paragraphs (i) to (iv).
7 In this section and section 62 “injury” includes poisoning.

I72462 “Priority content that is harmful to children”

1 “Priority content that is harmful to children” means content of any of the following kinds.
2 Content which is abusive and which targets any of the following characteristics—
a race,
b religion,
c sex,
d sexual orientation,
e disability, or
f gender reassignment.
3 Content which incites hatred against people—
a of a particular race, religion, sex or sexual orientation,
b who have a disability, or
c who have the characteristic of gender reassignment.
4 Content which encourages, promotes or provides instructions for an act of serious violence against a person.
5 Bullying content.
6 Content which—
a depicts real or realistic serious violence against a person;
b depicts the real or realistic serious injury of a person in graphic detail.
7 Content which—
a depicts real or realistic serious violence against an animal;
b depicts the real or realistic serious injury of an animal in graphic detail;
c realistically depicts serious violence against a fictional creature or the serious injury of a fictional creature in graphic detail.
8 Content which encourages, promotes or provides instructions for a challenge or stunt highly likely to result in serious injury to the person who does it or to someone else.
9 Content which encourages a person to ingest, inject, inhale or in any other way self-administer—
a a physically harmful substance;
b a substance in such a quantity as to be physically harmful.
10 In subsections (2) and (3)—
a “disability” means any physical or mental impairment;
b “race” includes colour, nationality, and ethnic or national origins;
c references to religion include references to a lack of religion.
11 For the purposes of subsection (3), a person has the characteristic of gender reassignment if the person is proposing to undergo, is undergoing or has undergone a process (or part of a process) for the purpose of reassigning the person’s sex by changing physiological or other attributes of sex, and the reference to gender reassignment in subsection (2) is to be construed accordingly.
12 For the purposes of subsection (5) content may, in particular, be “bullying content” if it is content targeted against a person which—
a conveys a serious threat;
b is humiliating or degrading;
c forms part of a campaign of mistreatment.
13 In subsection (6) “person” is not limited to a real person.
14 In subsection (7) “animal” is not limited to a real animal.

I81963 Content harmful to children: OFCOM’s review and report

1 OFCOM must carry out reviews of—
a the incidence on regulated user-to-user services of content that is harmful to children,
b the incidence on regulated search services and combined services of search content that is harmful to children, and
c the severity of harm that children in the United Kingdom suffer, or may suffer, as a result of those kinds of content.
2 OFCOM must produce and publish a report on the outcome of each review.
3 The report must include advice as to whether, in OFCOM’s opinion, it is appropriate to make changes to sections 61 and 62, specifying the changes that OFCOM recommend.
4 The reports must be published not more than three years apart.
5 The first report must be published before the end of the period of three years beginning with the day on which this Act is passed.
6 OFCOM must send a copy of each report to the Secretary of State.

PART 4 Other duties of providers of regulated user-to-user services and regulated search services

CHAPTER 1 User identity verification

I65064 User identity verification

1 A provider of a Category 1 service must offer all adult users of the service the option to verify their identity (if identity verification is not required for access to the service).
2 The verification process may be of any kind (and in particular, it need not require documentation to be provided).
3 A provider of a Category 1 service must include clear and accessible provisions in the terms of service explaining how the verification process works.
4 If a person is the provider of more than one Category 1 service, the duties set out in this section apply in relation to each such service.
5 The duty set out in subsection (1) applies in relation to all adult users, not just those who begin to use a service after that duty begins to apply.
6 The duties set out in this section extend only to—
a the user-to-user part of a service, and
b the design, operation and use of a service in the United Kingdom.
7 For the purposes of this section a person is an “adult user” of a service if the person is an adult in the United Kingdom who—
a is a user of the service, or
b seeks to begin to use the service (for example by setting up an account).
8 For the meaning of “Category 1 service”, see section 95 (register of categories of services).

I477I51365 OFCOM’s guidance about user identity verification

1 OFCOM must produce guidance for providers of Category 1 services to assist them in complying with the duty set out in section 64(1).
2 In producing the guidance (including revised or replacement guidance), OFCOM must have particular regard to the desirability of ensuring that providers of Category 1 services offer users a form of identity verification likely to be available to vulnerable adult users.
3 Before producing the guidance (including revised or replacement guidance), OFCOM must consult—
a the Information Commissioner,
b persons whom OFCOM consider to have technological expertise relevant to the duty set out in section 64(1),
c persons who appear to OFCOM to represent the interests of vulnerable adult users of Category 1 services, and
d such other persons as OFCOM consider appropriate.
4 OFCOM must publish the guidance (and any revised or replacement guidance).

CHAPTER 2 Reporting child sexual exploitation and abuse content

I59866 Requirement to report CSEA content to the NCA

I9161 A UK provider of a regulated user-to-user service must operate the service using systems and processes which secure (so far as possible) that the provider reports all detected and unreported CSEA content present on the service to the NCA.
I9162 A non-UK provider of a regulated user-to-user service must operate the service using systems and processes which secure (so far as possible) that the provider reports all detected and unreported UK-linked CSEA content present on the service to the NCA (and does not report to the NCA CSEA content which is not UK-linked).
3 A UK provider of a regulated search service must operate the service using systems and processes which secure (so far as possible) that the provider reports all detected and unreported CSEA content present on websites or databases capable of being searched by the search engine to the NCA.
4 A non-UK provider of a regulated search service must operate the service using systems and processes which secure (so far as possible) that the provider reports all detected and unreported UK-linked CSEA content present on websites or databases capable of being searched by the search engine to the NCA (and does not report to the NCA CSEA content which is not UK-linked).
5 A UK provider of a combined service must comply with the requirement under subsection (3) in relation to the search engine of the service.
6 A non-UK provider of a combined service must comply with the requirement under subsection (4) in relation to the search engine of the service.
I9147 Providers’ reports under this section—
a must meet the requirements set out in regulations under section 67, and
b must be sent to the NCA in the manner, and within the time frames, set out in those regulations.
I9148 If a person is the provider of more than one regulated user-to-user service or regulated search service, requirements under this section apply in relation to each such service.
I9149 Terms used in this section are defined in section 70.
I91410 This section applies only in relation to CSEA content detected on or after the date on which this section comes into force.

I892I59267 Regulations about reports to the NCA

1 The Secretary of State must make regulations in connection with the reports that are to be made to the NCA (including by non-UK providers) as required by section 66.
2 The regulations may make provision about—
a the information to be included in the reports,
b the format of the reports,
c the manner in which the reports must be sent to the NCA,
d the time frames for sending the reports to the NCA (including provision about cases of particular urgency),
e the records that providers must keep in relation to the reports, or the details that providers must retain as evidence that they have made the reports, and
f such other matters relating to the reports as the Secretary of State considers appropriate.
3 The regulations may also—
a require providers to retain, for a specified period, data of a specified description associated with a report, and
b impose restrictions or requirements in relation to the retention of such data (including how the data is to be secured or stored or who may access the data).
4 The power to require the retention of data associated with a report includes power to require the retention of—
a content generated, uploaded or shared by any user mentioned in the report (or metadata relating to such content), and
b user data relating to any such person (or metadata relating to such data).
“User data” here has the meaning given by section 231.
5 Before making regulations under this section, the Secretary of State must consult—
a the NCA,
b OFCOM, and
c such other persons as the Secretary of State considers appropriate.

I50I40268 NCA: information sharing

In section 16 of the Crime and Courts Act 2013 (interpretation of Part 1), in subsection (1), in the definition of “permitted purpose”, after paragraph (o) insert—
.

I533I91769 Offence in relation to CSEA reporting

1 A person commits an offence if, in purported compliance with a requirement under section 66—
a the person provides information that is false in a material respect, and
b at the time the person provides it, the person knows that it is false in a material respect or is reckless as to whether it is false in a material respect.
2 A person who commits an offence under this section is liable—
a on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);
b on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum (or both);
c on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);
d on conviction on indictment, to imprisonment for a term not exceeding 2 years or a fine (or both).

I66370 Interpretation of this Chapter

1 This section applies for the purposes of this Chapter.
2 A provider of a regulated user-to-user service or a regulated search service is a “UK provider” of the service if the provider is—
a an individual or individuals who are habitually resident in the United Kingdom, or
b an entity incorporated or formed under the law of any part of the United Kingdom.
3 Otherwise, a provider of a regulated user-to-user service or a regulated search service is a “non-UK provider” of the service.
4 CSEA content is “detected” by a provider when the provider becomes aware of the content, whether by means of the provider’s systems or processes or as a result of another person alerting the provider.
5 CSEA content is “unreported”, in relation to a provider, if the reporting of that content is not covered by arrangements (mandatory or voluntary)—
a by which the provider reports content relating to child sexual exploitation or abuse to a foreign agency, or
b by which an entity that is a group undertaking in relation to the provider reports content relating to child sexual exploitation or abuse to—
i the NCA, or
ii a foreign agency.
6 CSEA content is “UK-linked” if a provider has evidence of a link between the content and the United Kingdom, based on any of the following—
a the place where the content was published, generated, uploaded or shared;
b the nationality of a person suspected of committing the related offence;
c the location of a person suspected of committing the related offence;
d the location of a child who is a suspected victim of the related offence.
For the purposes of paragraphs (b), (c) and (d) an offence is “related” to CSEA content if the content amounts to that offence (construed in accordance with section 59: see subsections (3), (11) and (12) of that section).
7 In this Chapter—
  • “CSEA content” has the same meaning as in Part 3 (see section 59);
  • “foreign agency” means a person exercising functions in a country outside the United Kingdom which correspond to the NCA’s functions insofar as they relate to receiving and disseminating reports about CSEA content;
  • “group undertaking” has the meaning given by section 1161(5) of the Companies Act 2006;
  • “NCA” means the National Crime Agency.
8 Sections 1161(5) and 1162 of, and Schedule 7 to, the Companies Act 2006—
a are to apply in relation to an entity which is not an undertaking (as defined in section 1161(1) of that Act) as they apply in relation to an undertaking, and
b are to be read with any necessary modifications if applied to an entity formed under the law of a country outside the United Kingdom.

CHAPTER 3 Terms of service: transparency, accountability and freedom of expression

I27771 Duty not to act against users except in accordance with terms of service

1 A provider of a Category 1 service must operate the service using proportionate systems and processes designed to ensure that the provider does not—
a take down regulated user-generated content from the service,
b restrict users’ access to regulated user-generated content, or
c suspend or ban users from using the service,
except in accordance with the terms of service.
2 Nothing in subsection (1) is to be read as preventing a provider from taking down content from a service or restricting users’ access to it, or suspending or banning a user, if such an action is taken—
a to comply with the duties set out in—
i section 10(2) or (3) (protecting individuals from illegal content), or
ii section 12(2) or (3) (protecting children from content that is harmful to children), or
b to avoid criminal or civil liability on the part of the provider that might reasonably be expected to arise if such an action were not taken.
3 In addition, nothing in subsection (1) is to be read as preventing a provider from—
a taking down content from a service or restricting users’ access to it on the basis that a user has committed an offence in generating, uploading or sharing it on the service, or
b suspending or banning a user on the basis that—
i the user has committed an offence in generating, uploading or sharing content on the service, or
ii the user is responsible for, or has facilitated, the presence or attempted placement of a fraudulent advertisement on the service.
4 The duty set out in subsection (1) does not apply in relation to—
a consumer content (see section 74);
b terms of service which deal with the treatment of consumer content.
5 If a person is the provider of more than one Category 1 service, the duty set out in subsection (1) applies in relation to each such service.
6 The duty set out in subsection (1) extends only to the design, operation and use of a service in the United Kingdom, and references in this section to users are to United Kingdom users of a service.
7 In this section—
  • “criminal or civil liability” includes such a liability under the law of a country outside the United Kingdom;
  • “fraudulent advertisement” has the meaning given by section 38;
  • “offence” includes an offence under the law of a country outside the United Kingdom.
8 See also section 18 (duties to protect news publisher content).

I71172 Further duties about terms of service

All services

I4601 A provider of a regulated user-to-user service must include clear and accessible provisions in the terms of service informing users about their right to bring a claim for breach of contract if—
a regulated user-generated content which they generate, upload or share is taken down, or access to it is restricted, in breach of the terms of service, or
b they are suspended or banned from using the service in breach of the terms of service.

Category 1 services

2 The duties set out in subsections (3) to (7) apply in relation to a Category 1 service, and references in subsections (3) to (9) to “provider” and “service” are to be read accordingly.
3 A provider must operate a service using proportionate systems and processes designed to ensure that—
a if the terms of service indicate (in whatever words) that the presence of a particular kind of regulated user-generated content is prohibited on the service, the provider takes down such content;
b if the terms of service state that the provider will restrict users’ access to a particular kind of regulated user-generated content in a specified way, the provider does restrict users’ access to such content in that way;
c if the terms of service state cases in which the provider will suspend or ban a user from using the service, the provider does suspend or ban the user in those cases.
4 A provider must ensure that—
a terms of service which make provision about the provider taking down regulated user-generated content from the service or restricting users’ access to such content, or suspending or banning a user from using the service, are—
i clear and accessible, and
ii written in sufficient detail to enable users to be reasonably certain whether the provider would be justified in taking the specified action in a particular case, and
b those terms of service are applied consistently.
5 A provider must operate a service using systems and processes that allow users and affected persons to easily report—
a content which they consider to be relevant content (see section 74);
b a user who they consider should be suspended or banned from using the service in accordance with the terms of service.
6 A provider must operate a complaints procedure in relation to a service that—
a allows for complaints of a kind mentioned in subsection (8) to be made,
b provides for appropriate action to be taken by the provider of the service in response to complaints of those kinds, and
c is easy to access, easy to use (including by children) and transparent.
7 A provider must include in the terms of service provisions which are easily accessible (including to children) specifying the policies and processes that govern the handling and resolution of complaints of a kind mentioned in subsection (8).
8 The kinds of complaints referred to in subsections (6) and (7) are—
a complaints by users and affected persons about content present on a service which they consider to be relevant content;
b complaints by users and affected persons if they consider that the provider is not complying with a duty set out in any of subsections (1) or (3) to (5);
c complaints by a user who has generated, uploaded or shared content on a service if that content is taken down, or access to it is restricted, on the basis that it is relevant content;
d complaints by users who have been suspended or banned from using a service.
9 The duties set out in subsections (3) and (4) do not apply in relation to terms of service which—
a make provision of the kind mentioned in section 10(5) (protecting individuals from illegal content) or 12(9) (protecting children from content that is harmful to children), or
b deal with the treatment of consumer content.

Further provision

I46010 If a person is the provider of more than one regulated user-to-user service or Category 1 service, the duties set out in this section apply in relation to each such service.
I46011 The duties set out in this section extend only to the design, operation and use of a service in the United Kingdom, and references to users are to United Kingdom users of a service.
12 See also section 18 (duties to protect news publisher content).

I600I3473 OFCOM’s guidance about duties set out in sections 71 and 72

1 OFCOM must produce guidance for providers of Category 1 services to assist them in complying with their duties set out in sections 71 and 72(3) to (7).
2 OFCOM must publish the guidance (and any revised or replacement guidance).

I90974 Interpretation of this Chapter

1 This section applies for the purposes of this Chapter.
2 “Regulated user-generated content” has the same meaning as in Part 3 (see section 55), and references to such content are to content that is regulated user-generated content in relation to the service in question.
3 “Consumer content” means—
a regulated user-generated content that constitutes, or is directly connected with content that constitutes, an offer to sell goods or to supply services,
b regulated user-generated content that amounts to an offence under Chapter 1 of Part 4 of the Digital Markets, Competition and Consumers Act 2024 (construed in accordance with section 59: see subsections (3), (11) and (12) of that section), or
c any other regulated user-generated content in relation to which an enforcement authority has functions under that Chapter (see section 231 of that Act).
4 References to restricting users’ access to content, and related references, are to be construed in accordance with sections 58 and 236(6).
5 Content of a particular kind is “relevant content” if—
a a term of service, other than a term of service mentioned in section 72(9), indicates (in whatever words) that the presence of content of that kind is prohibited on the service or that users’ access to content of that kind is restricted, and
b it is regulated user-generated content.
References to relevant content are to content that is relevant content in relation to the service in question.
6 “Affected person” means a person, other than a user of the service in question, who is in the United Kingdom and who is—
a the subject of the content,
b a member of a class or group of people with a certain characteristic targeted by the content,
c a parent of, or other adult with responsibility for, a child who is a user of the service or is the subject of the content, or
d an adult providing assistance in using the service to another adult who requires such assistance, where that other adult is a user of the service or is the subject of the content.
7 In determining what is proportionate for the purposes of sections 71 and 72, the size and capacity of the provider of a service is, in particular, relevant.
8 For the meaning of “Category 1 service”, see section 95 (register of categories of services).

CHAPTER 4 Deceased Child Users

I80875 Disclosure of information about use of service by deceased child users

1 A provider of a relevant service must make it clear in the terms of service what their policy is about dealing with requests from parents of a deceased child for information about the child’s use of the service.
2 A provider of a relevant service must have a dedicated helpline or section of the service, or some similar means, by which parents can easily find out what they need to do to obtain information and updates in those circumstances, and the terms of service must provide details.
3 A provider of a relevant service must include clear and accessible provisions in the terms of service—
a specifying the procedure for parents of a deceased child to request information about the child’s use of the service,
b specifying what evidence (if any) the provider will require about the parent’s identity or relationship to the child, and
c giving sufficient detail to enable child users and their parents to be reasonably certain about what kinds of information would be disclosed and how information would be disclosed.
4 A provider of a relevant service must respond in a timely manner to requests from parents of a deceased child for information about the child’s use of the service or for updates about the progress of such information requests.
5 A provider of a relevant service must operate a complaints procedure in relation to the service that—
a allows for complaints to be made by parents of a deceased child who consider that the provider is not complying with a duty set out in any of subsections (1) to (4),
b provides for appropriate action to be taken by the provider of the service in response to such complaints, and
c is easy to access, easy to use and transparent.
6 A provider of a relevant service must include in the terms of service provisions which are easily accessible specifying the policies and processes that govern the handling and resolution of such complaints.
7 If a person is the provider of more than one relevant service, the duties set out in this section apply in relation to each such service.
8 The duties set out in this section extend only to the design, operation and use of a service in the United Kingdom, and references in this section to children are to children in the United Kingdom.
9 A “relevant service” means—
a a Category 1 service (see section 95(10)(a));
b a Category 2A service (see section 95(10)(b));
c a Category 2B service (see section 95(10)(c)).
10 In this section “parent”, in relation to a child, includes any person who is not the child’s parent but who—
a has parental responsibility for the child within the meaning of section 3 of the Children Act 1989 or Article 6 of the Children (Northern Ireland) Order 1995 (S.I. 1995/755 (N.I. 2)), or
b has parental responsibilities in relation to the child within the meaning of section 1(3) of the Children (Scotland) Act 1995.
11 In the application of this section to a Category 2A service, references to the terms of service include references to a publicly available statement.

I144I2476 OFCOM’s guidance about duties set out in section 75

1 OFCOM must produce guidance for providers of relevant services to assist them in complying with their duties set out in section 75.
2 OFCOM must publish the guidance (and any revised or replacement guidance).
3 In this section “relevant service” has the meaning given by section 75.

CHAPTER 5 Transparency reporting

I863I1077 Transparency reports about certain Part 3 services

1 Once a year, OFCOM must give every provider of a relevant service a notice which requires the provider to produce a report about the service (a “transparency report”).
2 If a person is the provider of more than one relevant service, a notice must be given to the provider in respect of each such service.
3 In response to a notice relating to a relevant service, the provider of the service must produce a transparency report which must—
a contain information of a kind specified or described in the notice,
b be in the format specified in the notice,
c be submitted to OFCOM by the date specified in the notice, and
d be published in the manner and by the date specified in the notice.
4 A provider must ensure that the information provided in a transparency report is—
a complete, and
b accurate in all material respects.
5 A “relevant service” means—
a a Category 1 service (see section 95(10)(a));
b a Category 2A service (see section 95(10)(b));
c a Category 2B service (see section 95(10)(c)).
6 In a notice which relates to a Category 1 service or a Category 2B service, OFCOM may only specify or describe user-to-user information. But in the case of a service described in subsection (9), that subsection applies instead.
7 In a notice which relates to a regulated search service that is a Category 2A service, OFCOM may only specify or describe search engine information.
8 In a notice which relates to a combined service that is a Category 2A service, and is not also a Category 1 service or a Category 2B service, OFCOM may only specify or describe search engine information.
9 In a notice which relates to a combined service that is a Category 2A service, as well as being a Category 1 service or a Category 2B service, OFCOM may specify or describe user-to-user information or search engine information, or both those kinds of information.
10 In subsections (6) to (9)—
a “user-to-user information” means information which—
i is about the matters listed in Part 1 of Schedule 8, and
ii relates to the user-to-user part of a service;
b “search engine information” means information which—
i is about the matters listed in Part 2 of Schedule 8, and
ii relates to the search engine of a service.
11 Part 3 of Schedule 8 makes further provision about transparency reports.
12 The Secretary of State may by regulations amend subsection (1) so as to change the frequency of the transparency reporting process.
13 The Secretary of State must consult OFCOM before making regulations under subsection (12).
14 In this section “notice” means a notice under subsection (1).

I243I17178 OFCOM’s guidance about transparency reports

1 OFCOM must produce guidance about—
a how OFCOM will determine which information they will require transparency reports under section 77 to contain, including—
i the principles that they will apply in relation to each of the factors mentioned in paragraph 37 of Schedule 8, and
ii the steps that they will take to engage with providers of relevant services before requiring information in a notice under section 77(1);
b how information from transparency reports produced by providers of relevant services under section 77 will be used to produce OFCOM’s transparency reports (see section 159); and
c any other matter that OFCOM consider to be relevant to the production and publication of transparency reports under section 77 or 159.
2 Before producing the guidance (including revised or replacement guidance), OFCOM must consult such of the following as they consider appropriate—
a providers of regulated user-to-user services, and of regulated search services,
b persons who appear to OFCOM to represent such providers,
c persons who appear to OFCOM to represent the interests of children (generally or with particular reference to online safety matters),
d persons whom OFCOM consider to have expertise in equality issues and human rights, in particular—
i the right to freedom of expression set out in Article 10 of the Convention, and
ii the right to respect for a person’s private and family life, home and correspondence set out in Article 8 of the Convention,
e the Information Commissioner,
f persons who appear to OFCOM to represent the interests of those with protected characteristics (within the meaning of Part 2 of the Equality Act 2010), and
g persons whom OFCOM consider to have expertise in the enforcement of the criminal law and the protection of national security that is relevant to online safety matters,
and OFCOM must also consult such other persons as OFCOM consider appropriate.
3 OFCOM must publish the guidance (and any revised or replacement guidance).
4 In exercising their functions under section 77 or 159, OFCOM must have regard to the guidance for the time being published under this section.
5 In this section, “relevant service” has the same meaning as in section 77 (see subsection (5) of that section).

PART 5 Duties of providers of regulated services: certain pornographic content

I24679 “Provider pornographic content” and “regulated provider pornographic content”

1 This section applies for the purposes of this Part.
2 “Provider pornographic content”, in relation to an internet service, means pornographic content that is published or displayed on the service by the provider of the service or by a person acting on behalf of the provider, including pornographic content published or displayed on the service by means of—
a software or an automated tool or algorithm applied by the provider or by a person acting on behalf of the provider, or
b an automated tool or algorithm made available on the service by the provider or by a person acting on behalf of the provider.
3 “Regulated provider pornographic content”, in relation to an internet service, means provider pornographic content other than content within subsection (4) or (5).
4 Content is within this subsection if it—
a consists only of text, or
b consists only of text accompanied by—
i a GIF which is not itself pornographic content,
ii an emoji or other symbol, or
iii a combination of content mentioned in sub-paragraphs (i) and (ii).
5 Content is within this subsection if it consists of a paid-for advertisement (see section 236).
6 References to pornographic content that is “published or displayed” on a service—
a include, in particular—
i references to pornographic content that is only visible or audible to users as a result of interacting with content that is blurred, distorted or obscured (for example, by clicking on such content), but only where the pornographic content is present on the service,
ii references to pornographic content that is embedded on the service, and
iii references to pornographic content that is generated on the service by means of an automated tool or algorithm in response to a prompt by a user and is only visible or audible to that user (no matter for how short a time);
b do not include references to pornographic content that appears in search results of a search service or a combined service.
7 Pornographic content that is user-generated content in relation to an internet service is not to be regarded as provider pornographic content in relation to that service.
8 In this section—
  • “search results” has the meaning given by section 57(3);
  • “user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

I23480 Scope of duties about regulated provider pornographic content

I4381 A provider of an internet service within subsection (2) must comply with the duties set out in section 81 in relation to the service.
I4382 An internet service is within this subsection if—
a regulated provider pornographic content is published or displayed on the service,
b the service is not exempt, and
c the service has links with the United Kingdom.
I4383 A service is “exempt” for the purposes of this Part if it is —
a a user-to-user service or a search service of a description that is exempt as provided for by Schedule 1, or
b an internet service of a kind described in Schedule 9.
I2344 A service “has links with the United Kingdom” for the purposes of this Part if either of the following conditions is met in relation to the service—
a the service has a significant number of United Kingdom users, or
b United Kingdom users form one of the target markets for the service (or the only target market).
I4385 This Part does not apply in relation to a part of a regulated service if—
a in the case of a Part 3 service, the conditions in paragraph 7(2) of Schedule 1 (internal business service conditions) are met in relation to that part;
b in the case of an internet service other than a Part 3 service, the conditions in paragraph 1(2) of Schedule 9 (internal business service conditions) are met in relation to that part.
I4386 This Part does not apply in relation to a part of a regulated service if that part is an on-demand programme service or a non-UK on-demand programme service that is a Tier 1 service F4....
6A In subsection (6), “on-demand programme service”, “non-UK on-demand programme service” and “Tier 1 service” have the same meaning as in the Communications Act (see sections 368A, 368AA and 368HA of that Act).
I4387 If a person is the provider of more than one internet service within subsection (2), the duties set out in section 81 apply in relation to each such service.
I4388 The duties set out in section 81 extend only to the design, operation and use of an internet service in the United Kingdom.

I530I22481 Duties about regulated provider pornographic content

1 This section sets out the duties which apply in relation to internet services within section 80(2).
2 A duty to ensure, by the use of age verification or age estimation (or both), that children are not normally able to encounter content that is regulated provider pornographic content in relation to the service.
3 The age verification or age estimation must be of such a kind, and used in such a way, that it is highly effective at correctly determining whether or not a particular user is a child.
4 In relation to the duty set out in subsection (2), a duty to make and keep a written record, in an easily understandable form, of—
a the kinds of age verification or age estimation used, and how they are used, and
b the way in which the provider, when deciding on the kinds of age verification or age estimation and how they should be used, has had regard to the importance of protecting United Kingdom users from a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of a regulated service (including, but not limited to, any such provision or rule concerning the processing of personal data).
5 A duty to summarise the written record in a publicly available statement, so far as the record concerns compliance with the duty set out in subsection (2), including details about which kinds of age verification or age estimation a provider is using and how they are used.

I5782 OFCOM’s guidance about duties set out in section 81

1 OFCOM must produce guidance for providers of internet services within section 80(2) to assist them in complying with their duties set out in section 81.
2 The guidance must include—
a examples of kinds and uses of age verification and age estimation that are, or are not, highly effective at correctly determining whether or not a particular user is a child,
b examples of ways in which a provider may have regard to the importance of protecting users as mentioned in section 81(4)(b),
c principles that OFCOM propose to apply when determining whether a provider has complied with each of the duties set out in section 81, and
d examples of circumstances in which OFCOM are likely to consider that a provider has not complied with each of those duties.
3 The guidance may elaborate on the following principles governing the use of age verification or age estimation for the purpose of compliance with the duty set out in section 81(2)—
a the principle that age verification or age estimation should be easy to use;
b the principle that age verification or age estimation should work effectively for all users regardless of their characteristics or whether they are members of a certain group;
c the principle of interoperability between different kinds of age verification or age estimation.
4 The guidance may refer to industry or technical standards for age verification or age estimation (where they exist).
5 Before producing the guidance (including revised or replacement guidance), OFCOM must consult—
a the Secretary of State,
b persons who appear to OFCOM to represent providers of internet services within section 80(2),
c persons who appear to OFCOM to represent adult users of internet services within section 80(2),
d persons who appear to OFCOM to represent the interests of children (generally or with particular reference to online safety matters),
e the Information Commissioner,
f persons whom OFCOM consider to have expertise in innovation, or emerging technology, that is relevant to online safety matters, and
g such other persons as OFCOM consider appropriate.
6 But if OFCOM propose to revise the guidance, and consider that the minor nature of the proposal means that consultation is unnecessary—
a OFCOM must notify the Secretary of State of the proposed changes, and
b if the Secretary of State agrees that it is appropriate, the consultation requirements set out in subsection (5) do not apply in relation to the proposed changes.
7 OFCOM must keep the guidance under review.
8 OFCOM must publish the guidance (and any revised or replacement guidance).

PART 6 Duties of providers of regulated services: fees

I624I33183 Duty to notify OFCOM

1 A provider of a regulated service must notify OFCOM in relation to a charging year which is—
a the first fee-paying year in relation to that provider, or
b any charging year after the first fee-paying year where—
i the previous charging year was not a fee-paying year in relation to the provider, and the charging year in question is a fee-paying year in relation to the provider, or
ii the previous charging year was a fee-paying year in relation to the provider, and the charging year in question is not a fee-paying year in relation to the provider.
2 A “fee-paying year”, in relation to a provider, means a charging year where both of the following conditions apply—
a the provider’s qualifying worldwide revenue for the qualifying period that relates to that charging year is equal to or greater than the threshold figure that has effect for that charging year (see section 86), and
b the provider is not exempt (see subsection (6)).
3 A notification under subsection (1) in relation to a charging year must include details of all regulated services provided by the provider, and where it is a notification under subsection (1)(a) or (b)(i), it must also include—
a details of the provider’s qualifying worldwide revenue for the qualifying period that relates to that charging year, and
b supporting evidence, documents or other information as required by regulations made by OFCOM under section 85.
4 Section 85 confers power on OFCOM to make regulations about the determination of a provider’s qualifying worldwide revenue, and the meaning of “qualifying period”, for the purposes of this Part.
5 A notification under subsection (1) must be provided to OFCOM—
a in relation to the initial charging year, within four months of the date on which the first regulations under section 86 come into force (first threshold figure);
b in relation to subsequent charging years, at least six months before the beginning of the charging year to which the notification relates.
6 OFCOM may provide that particular descriptions of providers of regulated services are exempt for the purposes of this section and section 84 where—
a OFCOM consider that an exemption for such providers is appropriate, and
b the Secretary of State approves the exemption.
7 OFCOM may revoke such an exemption where they consider that it is no longer appropriate and the Secretary of State approves the revocation.
8 Exemptions, or revocations of exemptions, which are approved by the Secretary of State are to take effect from the beginning of a particular charging year.
9 Details of an exemption or revocation must be published by OFCOM at least six months before the beginning of the first charging year for which the exemption or revocation is to have effect.
10 But subsection (9) does not apply in relation to any exemptions which are to have effect for the initial charging year.
11 For the purposes of this section and section 84, the “provider” of a regulated service, in relation to a charging year, includes a person who is the provider of the service for part of that year.

I814I68284 Duty to pay fees

1 OFCOM may require a provider of a regulated service to pay a fee in respect of a charging year which is a fee-paying year.
2 Where OFCOM require a provider of a regulated service to pay a fee in respect of a charging year, the fee is to be equal to the amount produced by a computation—
a made by reference to—
i the provider’s qualifying worldwide revenue for the qualifying period relating to that charging year, and
ii any other factors that OFCOM consider appropriate, and
b made in the manner that OFCOM consider appropriate.
3 For the purposes of this section and section 83—
a the amount of a provider’s qualifying worldwide revenue for a qualifying period, or
b the amount of a fee to be paid to OFCOM, or of an instalment of such a fee,
is, in the event of a disagreement between the provider and OFCOM, the amount determined by OFCOM.
4 When determining fees payable under this section, OFCOM must do so in accordance with a statement of principles as mentioned in section 88(1).
5 Where a person is the provider of a regulated service for part of a charging year only, OFCOM may refund all or part of a fee paid to OFCOM under this section by that provider in respect of that year.
6 In this section, “fee-paying year” has the same meaning as in section 83.

I620I85385 Regulations by OFCOM about qualifying worldwide revenue etc

1 For the purposes of this Part, OFCOM may by regulations make provision—
a about how the qualifying worldwide revenue of a provider of a regulated service is to be determined, and
b defining the “qualifying period” in relation to a charging year.
2 OFCOM may by regulations also make provision specifying or describing evidence, documents or other information that providers must supply to OFCOM for the purposes of section 83 (see subsection (3)(b) of that section), including provision about the way in which providers must supply the evidence, documents or information.
3 Regulations under subsection (1)(a) may provide that the qualifying worldwide revenue of a provider of a regulated service (P) who is a member of a group during any part of a qualifying period is to include the qualifying worldwide revenue of any entity that—
a is a group undertaking in relation to P for all or part of that period, and
b receives or is due to receive, during that period, any amount referable (to any degree) to a regulated service provided by P.
4 Regulations under subsection (1)(a) may, in particular—
a make provision about circumstances in which amounts do, or do not, count as being referable (to any degree) to a regulated service for the purposes of the determination of the qualifying worldwide revenue of the provider of the service or of an entity that is a group undertaking in relation to the provider;
b provide for cases or circumstances in which amounts that—
i are of a kind specified or described in the regulations, and
ii are not referable to a regulated service,
are to be brought into account in determining the qualifying worldwide revenue of the provider of the service or of an entity that is a group undertaking in relation to the provider.
5 Regulations which make provision of a kind mentioned in subsection (3) may include provision that, in the case of an entity that is a group undertaking in relation to a provider for part (not all) of a qualifying period, only amounts relating to the part of the qualifying period for which the entity was a group undertaking may be brought into account in determining the entity’s qualifying worldwide revenue.
6 Regulations under subsection (1)(a) may make provision corresponding to paragraph 5(8) of Schedule 13.
7 Before making regulations under subsection (1) OFCOM must consult—
a the Secretary of State,
b the Treasury, and
c such other persons as OFCOM consider appropriate.
8 Before making regulations under subsection (2) OFCOM must consult the Secretary of State.
9 Regulations under this section may make provision subject to such exemptions and exceptions as OFCOM consider appropriate.
10 In this section—
  • “group” means a parent undertaking and its subsidiary undertakings, reading those terms in accordance with section 1162 of the Companies Act 2006;
  • “group undertaking” has the meaning given by section 1161(5) of that Act.

I189I60686 Threshold figure

1 OFCOM must carry out a consultation to inform the setting of the threshold figure for the purposes of sections 83 and 84, consulting such persons as they consider appropriate.
2 After the completion of the consultation, and having taken advice from OFCOM, the Secretary of State must make regulations specifying the threshold figure for those purposes.
3 The Secretary of State must keep the threshold figure under review.
4 If the Secretary of State considers that it may be appropriate to revise the threshold figure, the Secretary of State may request OFCOM to carry out a further consultation, and subsections (1) and (2) apply again.
5 Regulations must provide that a threshold figure is to take effect from the beginning of a particular charging year.
6 Regulations specifying a threshold figure must be in force at least nine months before the beginning of the first charging year for which that figure is to have effect.
7 But subsection (6) does not apply in relation to the first regulations made under this section.

I169I38387 Secretary of State’s guidance about fees

1 The Secretary of State must issue guidance to OFCOM about the principles to be included in a statement of principles that OFCOM propose to apply in determining fees payable under section 84 (see section 88).
2 The Secretary of State must consult OFCOM before issuing, revising or replacing the guidance.
3 The guidance may not be revised or replaced more frequently than once every three years unless—
a the guidance needs to be corrected because of an amendment, repeal or modification of any provision of this Part, or
b the revision or replacement is by agreement between the Secretary of State and OFCOM.
4 The Secretary of State must lay the guidance (including revised or replacement guidance) before Parliament.
5 The Secretary of State must publish the guidance (and any revised or replacement guidance).
6 In exercising any functions under this Part, OFCOM must have regard to the guidance for the time being published under this section.

I654I69888 OFCOM’s fees statements

1 OFCOM may not require a provider of a regulated service to pay a fee under section 84 unless there is in force a statement of the principles that OFCOM propose to apply in determining fees payable under that section.
2 Those principles must be such as appear to OFCOM to be likely to secure, on the basis of such estimates of the likely costs as it is practicable for them to make—
a that on a year by year basis, the aggregate amount of the fees payable to OFCOM under section 84 is sufficient to meet, but does not exceed, the annual cost to OFCOM of the exercise of their online safety functions;
b that the fees required under section 84 are justifiable and proportionate having regard to the functions in respect of which they are imposed;
c that the relationship between meeting the cost of the exercise of those functions and the amounts of the fees is transparent.
3 A statement of principles mentioned in subsection (1) must (among other things)—
a include details relating to the computation model used to calculate fees payable under section 84, including details of factors mentioned in subsection (2)(a)(ii) of that section (if any),
b include details about the meaning of “qualifying worldwide revenue” and “qualifying period” for the purposes of this Part, and
c specify the threshold figure contained in regulations under section 86.
4 Before making or revising such a statement of principles, OFCOM must consult such persons as they consider appropriate.
5 Such a statement of principles may make different provision in relation to different kinds of regulated services.
6 OFCOM must publish such a statement of principles (and any revised or replacement statement).
7 As soon as reasonably practicable after the end of each charging year, OFCOM must publish a statement setting out, in respect of that year—
a the aggregate amount of the fees payable under section 84 for that year that has been received by OFCOM,
b the aggregate amount of the fees payable under that section for that year that remains outstanding and is likely to be paid or recovered, and
c the cost to OFCOM of the exercise of their online safety functions.
8 Any deficit or surplus shown (after applying this subsection for all previous years) by a statement under subsection (7) must be carried forward and taken into account in determining what is required to satisfy the requirement imposed by virtue of subsection (2)(a) in relation to the following year.
9 For the purposes of this section OFCOM’s costs of the exercise of their online safety functions during a charging year include the costs of preparations for the exercise of their online safety functions incurred during that year.

I545I31689 Recovery of OFCOM’s initial costs

Schedule 10 makes provision about fees chargeable to providers of regulated services in connection with OFCOM’s recovery of costs incurred before the first day of the initial charging year.

I34490 Meaning of “charging year” and “initial charging year”

In this Part—
  • “charging year” means any period of 12 months beginning with 1 April, except such a period that falls before the initial charging year;
  • “initial charging year” means the period of 12 months beginning with 1 April specified by OFCOM in a notice published for the purposes of this Part.

PART 7 OFCOM's powers and duties in relation to regulated services

CHAPTER 1 General duties

I19891 General duties of OFCOM under section 3 of the Communications Act

1 Section 3 of the Communications Act (general duties of OFCOM) is amended in accordance with subsections (2) to (8).
2 In subsection (2), after paragraph (f) insert—
3 In subsection (4)(c), at the beginning insert “(subject to subsection (5A))”.
4 After subsection (4) insert—
5 After subsection (5) insert—
6 After subsection (6) insert—
7 In subsection (14), at the appropriate places insert—
;
.
8 After subsection (14) insert—
9 In section 6 of the Communications Act (duties to review regulatory burdens)—
a in subsection (2), after “this section” insert “(except their online safety functions)”, and
b after subsection (10) insert—

I768I66792 Duties in relation to strategic priorities

1 This section applies where a statement has been designated under section 172(1) (Secretary of State’s statement of strategic priorities).
2 OFCOM must have regard to the statement when carrying out their online safety functions.
3 Within the period of 40 days beginning with the day on which the statement is designated, or such longer period as the Secretary of State may allow, OFCOM must—
a explain in writing what they propose to do in consequence of the statement, and
b publish a copy of that explanation.
4 OFCOM must, as soon as reasonably practicable after the end of—
a the period of 12 months beginning with the day on which the first statement is designated under section 172(1), and
b every subsequent period of 12 months,
publish a review of what they have done during the period in question in consequence of the statement.

I52893 Duty to carry out impact assessments

1 Section 7 of the Communications Act (duty to carry out impact assessments) is amended as follows.
2 In subsection (2), at the beginning insert “Subject to subsection (2A),”.
3 After subsection (2) insert—
4 After subsection (4) insert—

CHAPTER 2 Register of categories of regulated user-to-user services and regulated search services

I9594 Meaning of threshold conditions etc

1 Schedule 11 contains provision about regulations specifying the threshold conditions that a Part 3 service must meet to be included in the relevant part of the register established by OFCOM under section 95, and associated provision about the publication of OFCOM’s advice.
2 In this Chapter, “Category 1 threshold conditions”, “Category 2A threshold conditions” and “Category 2B threshold conditions” have the same meaning as in Schedule 11 (see paragraph 1(1), (2) and (3) of that Schedule).
3 For the purposes of this Chapter—
a references to a service meeting the Category 1, Category 2A or Category 2B threshold conditions are to a service meeting those conditions in a way specified in regulations under paragraph 1 of Schedule 11 (see paragraph 1(4) of that Schedule);
b a regulated user-to-user service meets the Category 1 threshold conditions if those conditions are met in relation to the user-to-user part of the service;
c a regulated search service or a combined service meets the Category 2A threshold conditions if those conditions are met in relation to the search engine of the service;
d a regulated user-to-user service meets the Category 2B threshold conditions if those conditions are met in relation to the user-to-user part of the service;
e a regulated user-to-user service meets the conditions in section 97(2) if those conditions are met in relation to the user-to-user part of the service;
f references to OFCOM assessing a service (to determine if it meets, or no longer meets, the relevant threshold conditions or the conditions in section 97(2)) are accordingly to be read as references to OFCOM assessing the relevant part (or parts) of a service.

I431I54895 Register of categories of certain Part 3 services

1 As soon as reasonably practicable after the first regulations under Schedule 11 come into force, OFCOM must comply with subsections (2) to (4).
2 OFCOM must establish a register of particular categories of Part 3 services with—
a one part for regulated user-to-user services meeting the Category 1 threshold conditions,
b one part for regulated search services and combined services meeting the Category 2A threshold conditions, and
c one part for regulated user-to-user services meeting the Category 2B threshold conditions.
3 OFCOM must assess Part 3 services, as follows—
a OFCOM must assess each regulated user-to-user service which they consider is likely to meet the Category 1 threshold conditions, to determine whether the service does, or does not, meet those conditions;
b OFCOM must assess each regulated search service and combined service which they consider is likely to meet the Category 2A threshold conditions, to determine whether the service does, or does not, meet those conditions;
c OFCOM must assess each regulated user-to-user service which they consider is likely to meet the Category 2B threshold conditions, to determine whether the service does, or does not, meet those conditions.
4 If OFCOM consider that a service meets the relevant threshold conditions, they must add entries relating to that service to the relevant part of the register established under subsection (2).
5 But—
a if OFCOM consider that a regulated user-to-user service meets the Category 1 threshold conditions and the Category 2B threshold conditions (only), entries relating to that service are to be added to the part of the register established under subsection (2)(a) (only);
b if OFCOM consider that a combined service meets the Category 1 threshold conditions, the Category 2A threshold conditions and the Category 2B threshold conditions, entries relating to that service are to be added to the parts of the register established under subsection (2)(a) and (b) (only).
6 If OFCOM consider that a combined service—
a meets the Category 2A threshold conditions, and
b meets either the Category 1 threshold conditions or the Category 2B threshold conditions (but not both),
entries relating to that service are to be added to the part of the register established under subsection (2)(b) and to the part of the register established under subsection (2)(a) or (c) (whichever applies).
7 Each part of the register must contain—
a the name, and a description, of each service that, in OFCOM’s opinion, meets the relevant threshold conditions, and
b the name of the provider of each such service.
8 OFCOM must publish the register.
9 When assessing whether a Part 3 service does, or does not, meet the relevant threshold conditions, OFCOM must take such steps as are reasonably practicable to obtain or generate information or evidence for the purposes of the assessment.
10 In this Act—
a a “Category 1 service” means a regulated user-to-user service for the time being included in the part of the register established under subsection (2)(a);
b a “Category 2A service” means a regulated search service or a combined service for the time being included in the part of the register established under subsection (2)(b);
c a “Category 2B service” means a regulated user-to-user service for the time being included in the part of the register established under subsection (2)(c).

I849I32696 Duty to maintain register

1 If regulations are made under paragraph 1(1) of Schedule 11 which amend or replace regulations previously made under that provision, OFCOM must, as soon as reasonably practicable after the date on which the amending or replacement regulations come into force—
a assess each regulated user-to-user service which they consider is likely to meet the new Category 1 threshold conditions, to determine whether the service does, or does not, meet those conditions, and
b make any necessary changes to the register.
2 If regulations are made under paragraph 1(2) of Schedule 11 which amend or replace regulations previously made under that provision, OFCOM must, as soon as reasonably practicable after the date on which the amending or replacement regulations come into force—
a assess each regulated search service and combined service which they consider is likely to meet the new Category 2A threshold conditions, to determine whether the service does, or does not, meet those conditions, and
b make any necessary changes to the register.
3 If regulations are made under paragraph 1(3) of Schedule 11 which amend or replace regulations previously made under that provision, OFCOM must, as soon as reasonably practicable after the date on which the amending or replacement regulations come into force—
a assess each regulated user-to-user service which they consider is likely to meet the new Category 2B threshold conditions, to determine whether the service does, or does not, meet those conditions, and
b make any necessary changes to the register.
4 At any other time, if OFCOM consider that a Part 3 service not included in a particular part of the register is likely to meet the threshold conditions relevant to that part, OFCOM must—
a assess the service accordingly, and
b (subject to section 95(5)) if they consider that the service meets the relevant conditions, add entries relating to that service to that part of the register.
5 Nothing in subsection (3) or (4) requires OFCOM to assess a Category 1 service to determine whether the service meets the Category 2B threshold conditions.
6 A provider of a Part 3 service included in the register may at any time request OFCOM to remove entries relating to that service from the register, or from a particular part of the register.
7 If OFCOM are satisfied, on the basis of evidence submitted by a provider with such a request, that since the registration day there has been a change to the service or to regulations under paragraph 1 of Schedule 11 which appears likely to be relevant, OFCOM must—
a assess the service, and
b notify the provider of OFCOM’s decision.
8 OFCOM must remove entries relating to a Part 3 service from the relevant part of the register if, following an assessment of the service, they consider that it no longer meets the threshold conditions relevant to that part.
9 Section 95(9) applies to an assessment under this section as it applies to an assessment under section 95.
10 OFCOM must re-publish the register each time a change is made to it.
11 See section 167 for provision about appeals against a decision to include a service in the register (or in a particular part of the register), or not to remove a service from the register (or from a particular part of the register).
12 In this section—
  • “the register” means the register established under section 95;
  • “the registration day”, in relation to a Part 3 service, means—
    1. the day on which entries relating to the service were added to the register, or to the particular part of the register in question, or
    2. if later, the day on which OFCOM last completed an assessment of the service under subsection (1), (2), (3) or (7).

I655I54097 List of emerging Category 1 services

1 As soon as reasonably practicable after the first regulations under paragraph 1(1) of Schedule 11 come into force (regulations specifying Category 1 threshold conditions), OFCOM must comply with subsections (2) and (3).
2 OFCOM must assess each regulated user-to-user service which does not meet the Category 1 threshold conditions and which they consider is likely to meet each of the following conditions, to determine whether the service does, or does not, meet them—
a the first condition is that the number of United Kingdom users of the user-to-user part of the service is at least 75% of the figure specified in any of the Category 1 threshold conditions relating to number of users (calculating the number of users in accordance with the threshold condition in question);
b the second condition is that—
i at least one of the Category 1 threshold conditions relating to functionalities of the user-to-user part of the service is met, or
ii if the regulations under paragraph 1(1) of Schedule 11 specify that a Category 1 threshold condition relating to a functionality of the user-to-user part of the service must be met in combination with a Category 1 threshold condition relating to another characteristic of that part of the service or a factor relating to that part of the service (see paragraph 1(4) of Schedule 11), at least one of those combinations of conditions is met.
3 OFCOM must prepare a list of regulated user-to-user services which meet the conditions in subsection (2).
4 If the regulations under paragraph 1(1) of Schedule 11 specify that a service meets the Category 1 threshold conditions if any one condition about number of users or functionality is met (as mentioned in paragraph 1(4)(a) of that Schedule)—
a subsection (2) applies as if paragraph (b) were omitted, and
b subsections (3) and (8) apply as if the reference to the conditions in subsection (2) were to the condition in subsection (2)(a).
5 The list must contain the following details about a service included in it—
a the name of the service,
b a description of the service,
c the name of the provider of the service, and
d a description of the Category 1 threshold conditions by reference to which the conditions in subsection (2) are met.
6 OFCOM must take appropriate steps to keep the list up to date, including by carrying out further assessments of regulated user-to-user services.
7 OFCOM must publish the list when it is first prepared and each time it is revised.
8 When assessing whether a service does, or does not, meet the conditions in subsection (2), OFCOM must take such steps as are reasonably practicable to obtain or generate information or evidence for the purposes of the assessment.
9 An assessment for the purposes of this section may be included in an assessment under section 95 or 96 (as the case may be) or carried out separately.

CHAPTER 3 Risk assessments of regulated user-to-user services and regulated search services

I16398 OFCOM’s register of risks, and risk profiles, of Part 3 services

1 OFCOM must carry out risk assessments to identify and assess the following risks of harm presented by Part 3 services of different kinds—
a the risks of harm to individuals in the United Kingdom presented by illegal content present on regulated user-to-user services and by the use of such services for the commission or facilitation of priority offences;
b the risk of harm to individuals in the United Kingdom presented by search content of regulated search services that is illegal content;
c the risk of harm to children in the United Kingdom, in different age groups, presented by content that is harmful to children.
2 The risk assessments must, among other things, identify characteristics of different kinds of Part 3 services that are relevant to such risks of harm, and assess the impact of those kinds of characteristics on such risks.
3 OFCOM—
a may combine assessment of any or all of the risks of harm mentioned in subsection (1), or may carry out separate assessments of those risks;
b in the case of the risk of harm mentioned in subsection (1)(c), may assess regulated user-to-user services and regulated search services separately or together.
4 The findings of each risk assessment are to be reflected, as soon as reasonably practicable after completion, in a register of risks of Part 3 services prepared and published by OFCOM.
5 As soon as reasonably practicable after completing their assessment of a risk of harm mentioned in a particular paragraph of subsection (1), OFCOM must prepare risk profiles for Part 3 services which relate to that risk of harm.
6 For the purposes of the risk profiles, OFCOM may group Part 3 services together in whichever way they consider appropriate, taking into account—
a the characteristics of the services, and
b the risk levels and other matters identified in the relevant risk assessment.
7 OFCOM must publish risk profiles prepared under this section.
8 OFCOM must from time to time review and revise the risk assessments and risk profiles so as to keep them up to date.
9 References in this section to Part 3 services—
a in the case of a risk assessment or risk profiles which relate only to regulated user-to-user services or to regulated search services, are to be read as references to the kind of service in question;
b in the case of a risk assessment or risk profiles which relate only to the risk of harm mentioned in subsection (1)(a), are to be read as references to regulated user-to-user services;
c in the case of a risk assessment or risk profiles which relate only to the risk of harm mentioned in subsection (1)(b), are to be read as references to regulated search services.
10 References in this section to regulated search services include references to the search engine of combined services.
11 In this section the “characteristics” of a service include its functionalities, user base, business model, governance and other systems and processes.
12 In this section—
  • “content that is harmful to children” has the same meaning as in Part 3 (see section 60);
  • “illegal content” has the same meaning as in Part 3 (see section 59);
  • “priority offence” has the same meaning as in Part 3 (see section 59).

I67499 OFCOM’s guidance about risk assessments

1 As soon as reasonably practicable after OFCOM have published the first risk profiles relating to the illegality risks, OFCOM must produce guidance to assist providers of regulated user-to-user services in complying with their duties to carry out illegal content risk assessments under section 9.
2 As soon as reasonably practicable after OFCOM have published the first risk profiles relating to the risk of harm from illegal content, OFCOM must produce guidance to assist providers of regulated search services in complying with their duties to carry out illegal content risk assessments under section 26.
3 As soon as reasonably practicable after OFCOM have published the first risk profiles relating to the risk of harm to children, OFCOM must produce guidance to assist providers of Part 3 services in complying with their duties to carry out children’s risk assessments under section 11 or 28.
4 Before producing any guidance under this section (including revised or replacement guidance), OFCOM must consult the Information Commissioner.
5 OFCOM must revise guidance under this section from time to time in response to further risk assessments under section 98 or to revisions of the risk profiles.
6 OFCOM must publish guidance under this section (and any revised or replacement guidance).
7 If the risk profiles mentioned in subsection (3) relate to regulated user-to-user services only or to regulated search services only, that subsection is to be read as requiring the production of guidance relating only to regulated user-to-user services or to regulated search services, as the case may be.
8 References in this section to regulated search services include references to the search engine of combined services.
9 In this section—
  • “illegality risks” means the risks mentioned in section 98(1)(a);
  • “risk of harm from illegal content” means the risk of harm mentioned in section 98(1)(b);
  • “risk of harm to children” means the risk of harm mentioned in section 98(1)(c);
  • “risk profiles” means risk profiles prepared under section 98.

CHAPTER 4 Information

Information powers and information notices

I743100 Power to require information

I5591 OFCOM may by notice under this subsection require a person within subsection (5) to provide them with any information that they require for the purpose of exercising, or deciding whether to exercise, any of their online safety functions.
I5592 The power conferred by subsection (1) includes power to require a person within subsection (5) to—
a obtain or generate information;
b provide information about the use of a service by a named individual.
I5593 The power conferred by subsection (1) also includes power to require a person within any of paragraphs (a) to (d) of subsection (5) to take steps so that a person authorised by OFCOM is able to view remotely—
a information demonstrating in real time the operation of systems, processes or features, including functionalities and algorithms, used by a service;
b information generated by a service in real time by the performance of a test or demonstration of a kind required by a notice under subsection (1).
I5594 But the power conferred by subsection (1) must be exercised in a way that is proportionate to the use to which the information is to be put in the exercise of OFCOM’s functions.
I5595 The persons within this subsection are—
a a provider of a user-to-user service or a search service,
b a provider of an internet service on which regulated provider pornographic content is published or displayed,
c a person who provides an ancillary service (within the meaning of section 144) in relation to a regulated service (see subsections (11) and (12) of that section),
d a person who provides an access facility (within the meaning of section 146) in relation to a regulated service (see subsections (10) and (11) of that section),
e a person who was within any of paragraphs (a) to (d) at a time to which the required information relates, and
f a person not within any of paragraphs (a) to (e) who appears to OFCOM to have, or to be able to generate or obtain, information required by them as mentioned in subsection (1).
6 The information that may be required by OFCOM under subsection (1) includes, in particular, information that they require for any one or more of the following purposes—
a the purpose of assessing compliance with—
I534i any duty or requirement set out in Chapter 2, 3, 4 or 5 of Part 3,
ii any duty set out in section 64 (user identity verification),
I918iii any requirement under section 66 (reporting CSEA content),
I367iv any duty set out in section 71 or 72 (terms of service),
v any duty set out in section 75 (deceased child users),
I779vi any requirement relating to transparency reporting (see section 77(3) and (4)), or
I828vii any duty set out in section 81 (provider pornographic content);
I790b the purpose of assessing compliance with a requirement under section 83 (duty to notify OFCOM in relation to the charging of fees);
I790c the purpose of a consultation about a threshold figure as mentioned in section 86 (threshold figure for the purposes of charging fees);
I790d the purpose of ascertaining the amount of a person’s qualifying worldwide revenue for the purposes of—
i Part 6 (fees), or
ii paragraph 4 or 5 of Schedule 13 (amount of penalties etc);
I790e the purpose of assessing compliance with any requirements imposed on a person by—
i a notice under section 121(1) (notices to deal with terrorism content and CSEA content), or
ii a confirmation decision;
I790f the purpose of assessing the accuracy and effectiveness of technology required to be used by—
i a notice under section 121(1), or
ii a confirmation decision;
I790g the purpose of assessing whether to give a notice under section 121(1) relating to the development or sourcing of technology (see subsections (2)(b) and (3)(b) of that section);
I790h the purpose of dealing with complaints made to OFCOM under section 169 (super-complaints);
I790i the purpose of OFCOM’s advice to the Secretary of State about provision to be made by regulations under paragraph 1 of Schedule 11 (threshold conditions for categories of Part 3 services);
I790j the purpose of determining whether a Part 3 service meets threshold conditions specified in regulations under paragraph 1 of Schedule 11;
I790k the purpose of preparing a code of practice under section 41;
I790l the purpose of preparing guidance in relation to online safety matters;
I790m the purpose of carrying out research, or preparing a report, in relation to online safety matters;
I790n the purpose of complying with OFCOM’s duties under section 11 of the Communications Act, so far as relating to regulated services (media literacy).
F397 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
I7078 The reference in subsection (3) to a person authorised by OFCOM is to a person authorised by OFCOM in writing for the purposes of notices that impose requirements of a kind mentioned in that subsection, and such a person must produce evidence of their identity if requested to do so by a person in receipt of such a notice.
8A The power to give a notice conferred by subsection (1) does not include power to require processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, the duty imposed by the notice is to be taken into account).
I7079 The power conferred by subsection (1) does not include power to require the provision of information in respect of which a claim to legal professional privilege, or (in Scotland) to confidentiality of communications, could be maintained in legal proceedings.
I70710 In this section—
  • “information” includes documents, and any reference to providing information includes a reference to producing a document (and see also section 102(11));
  • “regulated provider pornographic content” and “published or displayed” have the same meaning as in Part 5 (see section 79).

I340I444101 Information in connection with an investigation into the death of a child

A1 Subsection (C1) applies if a senior coroner (in England and Wales), a procurator fiscal (in Scotland) or a coroner (in Northern Ireland) (“the investigating authority”)—
a notifies OFCOM that they are conducting an investigation in connection with the death of a child, and
b provides OFCOM with the details in subsection (B1).
B1 The details are—
a the name of the child who has died,
b the child’s date of birth,
c any email addresses used by the child (so far as the investigating authority knows), and
d if any regulated service has been brought to the attention of the investigating authority as being of interest in connection with the child’s death, the name of the service.
C1 Where this subsection applies, OFCOM—
a must give a notice to the provider of a service within subsection (E1) requiring the provider to ensure the retention of information relating to the use of the service by the child who has died, and
b may give a notice to any other relevant person requiring the person to ensure the retention of information relating to the use of a service within subsection (E1) by that child.
D1 The references in subsection (C1) to ensuring the retention of information relating to the child’s use of a service include taking all reasonable steps, without delay, to prevent the deletion of such information by the routine operation of systems or processes.
E1 A service is within this subsection if it is—
a a regulated service of a kind described in regulations made by the Secretary of State, or
b a regulated service notified to OFCOM by the investigating authority as described in subsection (B1)(d).
F1 A notice under subsection (C1) may require information described in that subsection to be retained only if it is information—
a of a kind which OFCOM have power to require under a notice under subsection (1) (see, in particular, subsection (2)(a) to (d)), or
b which a person might need to retain to enable the person to provide information in response to a notice under subsection (1) (if such a notice were given).
G1 OFCOM must share with the investigating authority any information they receive in response to requirements mentioned in section 102(5A)(d) that are included in a notice under subsection (C1).
1 OFCOM may by notice under this subsection require a relevant person to provide them with information for the purpose of—
a responding to a notice given by a senior coroner under paragraph 1(2) of Schedule 5 to the Coroners and Justice Act 2009 in connection with an investigation into the death of a child, or preparing a report under section 163 in connection with such an investigation;
b responding to a request for information in connection with the investigation of a procurator fiscal into, or an inquiry held or to be held in relation to, the death of a child, or preparing a report under section 163 in connection with such an inquiry;
c responding to a notice given by a coroner under section 17A(2) of the Coroners Act (Northern Ireland) 1959 (c. 15 (N.I.)) in connection with—
i an investigation to determine whether an inquest into the death of a child is necessary, or
ii an inquest in relation to the death of a child,
or preparing a report under section 163 in connection with such an investigation or inquest.
2 The power conferred by subsection (1) includes power to require a relevant person to provide OFCOM with information about the use of a regulated service by the child whose death is under investigation, including, in particular—
a content encountered by the child by means of the service,
b how the content came to be encountered by the child (including the role of algorithms or particular functionalities),
c how the child interacted with the content (for example, by viewing, sharing or storing it or enlarging or pausing on it), and
d content generated, uploaded or shared by the child.
3 The powers conferred by this section include power to require a relevant person to obtain or generate information.
4 The power conferred by subsection (1) must be exercised in a way that is proportionate to the purpose mentioned in that subsection.
5 The power conferred by subsection (1) does not include power to require the provision of information in respect of which a claim to legal professional privilege, or (in Scotland) to confidentiality of communications, could be maintained in legal proceedings.
5A The powers to give a notice conferred by this section do not include power to require processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, the duty imposed by the notice is to be taken into account).
6 Nothing in this section limits the power conferred on OFCOM by section 100.
7 In this section—
  • “information” includes documents, and any reference to providing information includes a reference to producing a document (and see also section 102(11));
  • “inquiry” means an inquiry held, or to be held, under the Inquiries into Fatal Accidents and Sudden Deaths etc. (Scotland) Act 2016 (asp 2);
  • “relevant person” means a person within any of paragraphs (a) to (e) of section 100(5).

I877I157I33102 Information notices

1 A notice given under section 100(1) or 101(C1) or (1) is referred to in this Act as an information notice.
2 An information notice may require information in any form (including in electronic form).
3 An information notice under section 100(1) or 101(1) must—
a specify or describe the information to be provided,
b specify why OFCOM require the information,
c specify the form and manner in which it must be provided, F5...
ca specify when the information must be provided (which may be on or by a specified date, within a specified period, or at specified intervals), and
d contain information about the consequences of not complying with the notice.
F184 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5 An information notice requiring a person to take steps of a kind mentioned in section 100(3) must give the person at least seven days’ notice before the steps are required to be taken.
5A An information notice under section 101(C1) must—
a specify or describe the information to be retained,
b specify why OFCOM require the information to be retained,
c require the information to be retained for the period of one year beginning with the date of the notice,
d require the person to whom the notice is given—
i if the child to whom the notice relates used the service in question, to notify OFCOM by a specified date of steps taken to ensure the retention of information;
ii if the child did not use the service, or the person does not hold any information of the kind required, to notify OFCOM of that fact by a specified date, and
e contain information about the consequences of not complying with the notice.
5B If OFCOM give an information notice to a person under section 101(C1), they may, in response to information received from the investigating authority, extend the period for which the person is required to retain information by a maximum period of six months.
5C The power conferred by subsection (5B) is exercisable—
a by giving the person a notice varying the notice under section 101(C1) and stating the further period for which information must be retained and the reason for the extension;
b any number of times.
6 An information notice may specify a place at which, and a person to whom, information is to be provided.
7 A person to whom a document is produced in response to an information notice may—
a take copies of, or extracts from, the document;
b require the person producing the document, or a person who is or was an officer of that person, or (in the case of a partnership) a person who is or was a partner, to give an explanation of it.
8 A person to whom an information notice is given has a duty—
a to act in accordance with the requirements of the notice, and
b to ensure that the information provided is accurate in all material respects.
9 OFCOM may cancel an information notice by notice to the person to whom it was given.
9A OFCOM must cancel an information notice under section 101(C1) by notice to the person to whom it was given if advised by the investigating authority that the information in question no longer needs to be retained.
10 In this section—
  • “information” includes documents, and any reference to providing information includes a reference to producing a document;
  • “the investigating authority” has the same meaning as in section 101;
  • “officer”, in relation to an entity, includes a director, a manager, an associate, a secretary or, where the affairs of the entity are managed by its members, a member.
11 In relation to information recorded otherwise than in a legible form, references in this section to producing a document are to producing a copy of the information—
a in a legible form, or
b in a form from which it can readily be produced in a legible form.

I364I713103 Requirement to name a senior manager

1 This section applies where—
a OFCOM give a provider of a regulated service an information notice, and
b the provider is an entity.
2 OFCOM may include in the information notice a requirement that the provider must name, in their response to the notice, an individual who the provider considers to be a senior manager of the entity and who may reasonably be expected to be in a position to ensure compliance with the requirements of the notice.
3 If OFCOM impose a requirement to name an individual, the information notice must—
a require the provider to inform such an individual, and
b include information about the consequences for such an individual of the entity’s failure to comply with the requirements of the notice (see section 110).
4 An individual is a “senior manager” of an entity if the individual plays a significant role in—
a the making of decisions about how the entity’s relevant activities are to be managed or organised, or
b the actual managing or organising of the entity’s relevant activities.
5 An entity’s “relevant activities” are activities relating to the entity’s compliance with the regulatory requirements imposed by this Act in connection with the regulated service to which the information notice in question relates.

Skilled persons' reports

I412104 Reports by skilled persons

I3221 OFCOM may exercise the powers in this section where they consider that it is necessary to do so for either of the following purposes—
a assisting OFCOM in identifying and assessing a failure, or possible failure, by a provider of a regulated service to comply with a relevant requirement, or
b developing OFCOM’s understanding of—
i the nature and level of risk of a provider of a regulated service failing to comply with a relevant requirement, and
ii ways to mitigate such a risk.
I3222 But the powers in this section may be exercised for a purpose mentioned in subsection (1)(b) only where OFCOM consider that the provider in question may be at risk of failing to comply with a relevant requirement.
I3223 Section 122 requires OFCOM to exercise the power in subsection (4) for the purpose of assisting OFCOM in connection with a notice under section 121(1).
I3224 OFCOM may appoint a skilled person to provide them with a report about matters relevant to the purpose for which the powers under this section are exercised (“the relevant matters”), and, where OFCOM make such an appointment, they must notify the provider about the appointment and the relevant matters to be explored in the report.
I3225 Alternatively, OFCOM may give a notice to the provider—
a requiring the provider to appoint a skilled person to provide OFCOM with a report in such form as may be specified in the notice, and
b specifying the relevant matters to be explored in the report.
I3226 References in this section to a skilled person are to a person—
a appearing to OFCOM to have the skills necessary to prepare a report about the relevant matters, and
b where the appointment is to be made by the provider, nominated or approved by OFCOM.
I3227 It is the duty of—
a the provider of the service (“P”),
b any person who works for (or used to work for) P, or is providing (or used to provide) services to P related to the relevant matters, and
c other providers of internet services,
to give the skilled person all such assistance as the skilled person may reasonably require to prepare the report.
I3228 The provider of the service is liable for the payment, directly to the skilled person, of the skilled person’s remuneration and expenses relating to the preparation of the report.
I3229 Subsections (10) to (12) apply in relation to an amount due to a skilled person under subsection (8).
I32210 In England and Wales, such an amount is recoverable—
a if the county court so orders, as if it were payable under an order of that court;
b if the High Court so orders, as if it were payable under an order of that court.
I32211 In Scotland, such an amount may be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution issued by the sheriff court of any sheriffdom in Scotland.
I32212 In Northern Ireland, such an amount is recoverable—
a if a county court so orders, as if it were payable under an order of that court;
b if the High Court so orders, as if it were payable under an order of that court.
13 In this section “relevant requirement” means—
a a duty or requirement set out in any of the following—
I558i section 9, 11, 26 or 28 (risk assessments);
I558ii section 10 or 27 (illegal content);
I558iii section 12 or 29 (children’s online safety);
I558iv section 14 (assessments related to the adult user empowerment duty set out in section 15(2));
I558v section 15 (user empowerment);
I558vi section 20 or 31 (content reporting);
I558vii section 21 or 32 (complaints procedures);
I558viii section 23 or 34 (record-keeping and review);
I558ix section 36 (children’s access assessments);
I558x section 38 or 39 (fraudulent advertising);
xi section 64 (user identity verification);
I919xii section 66 (reporting CSEA content);
I80xiii section 71 or 72 (terms of service);
xiv section 75 (deceased child users);
xv section 77(3) or (4) (transparency reports);
I146xvi section 81(2) (children’s access to pornographic content);
b a requirement under section 83 to notify OFCOM in connection with the charging of fees (see subsections (1), (3) and (5) of that section); or
I558c a requirement imposed by a notice under section 121(1) (notices to deal with terrorism content and CSEA content).

Investigations and interviews

I148I196105 Investigations

1 If OFCOM open an investigation into whether a provider of a regulated service has failed, or is failing, to comply with any requirement mentioned in subsection (2), the provider must co-operate fully with the investigation.
2 The requirements are—
a a requirement imposed by a notice under section 121(1) (notices to deal with terrorism content and CSEA content), and
b an enforceable requirement as defined in section 131 (except the requirement in subsection (1) of this section).

I124I672106 Power to require interviews

1 The power conferred by this section is exercisable by OFCOM for the purposes of an investigation that they are carrying out into the failure, or possible failure, of a provider of a regulated service to comply with a relevant requirement.
2 OFCOM may give an individual within subsection (4) a notice requiring the individual—
a to attend at a time and place specified in the notice, and
b to answer questions and provide explanations about any matter relevant to the investigation.
3 A notice under this section must—
a indicate the subject matter and purpose of the interview, and
b contain information about the consequences of not complying with the notice.
4 The individuals within this subsection are—
a if the provider of the service is an individual or individuals, that individual or those individuals,
b an officer of the provider of the service,
c if the provider of the service is a partnership, a partner,
d an employee of the provider of the service, and
e an individual who was within any of paragraphs (a) to (d) at a time to which the required information or explanation relates.
5 If OFCOM give a notice to an individual within subsection (4)(b), (c) or (d), they must give a copy of the notice to the provider of the service.
6 An individual is not required under this section to disclose information in respect of which a claim to legal professional privilege, or (in Scotland) to confidentiality of communications, could be maintained in legal proceedings.
7 In this section—
  • “officer”, in relation to an entity, includes a director, a manager, an associate, a secretary or, where the affairs of the entity are managed by its members, a member;
  • “relevant requirement” has the meaning given by section 104(13).

Powers of entry, inspection and audit

I223I758107 Powers of entry, inspection and audit

Schedule 12 makes provision about—
a OFCOM’s powers of entry and inspection, and
b the carrying out of audits by OFCOM.

I822I175108 Amendment of Criminal Justice and Police Act 2001

1 The Criminal Justice and Police Act 2001 is amended as follows.
2 In section 57(1) (retention of seized items), after paragraph (t) insert—
3 In section 65 (meaning of “legal privilege”)—
a after subsection (8B) insert—
;
b in subsection (9)—
i at the end of paragraph (d) omit “or”;
ii at the end of paragraph (e) insert “or”;
iii before the closing words insert—
4 In Part 1 of Schedule 1 (powers of seizure to which section 50 of the Act applies), after paragraph 73U insert—

Information offences and penalties

I348I597109 Offences in connection with information notices

1 A person commits an offence if the person fails to comply with a requirement of an information notice.
2 It is a defence for a person charged with an offence under subsection (1) to show that—
a it was not reasonably practicable to comply with the requirements of the information notice at the time required by the notice, but
b the person has subsequently taken all of the steps that it was reasonable, and reasonably practicable, to take to comply with those requirements.
3 A person commits an offence if, in response to an information notice—
a the person provides information that is false in a material respect, and
b at the time the person provides it, the person knows that it is false in a material respect or is reckless as to whether it is false in a material respect.
4 A person commits an offence if, in response to an information notice, the person—
a provides information which is encrypted such that it is not possible for OFCOM to understand it, or produces a document which is encrypted such that it is not possible for OFCOM to understand the information it contains, and
b the person’s intention was to prevent OFCOM from understanding such information.
5 A person commits an offence if—
a the person suppresses, destroys or alters, or causes or permits the suppression, destruction or alteration of, any information required to be provided, or document required to be produced, by an information notice, and
b the person’s intention was to prevent OFCOM from being provided with the information or document or (as the case may be) from being provided with it as it was before the alteration.
6A A person who is given an information notice under section 101(C1) commits an offence if—
a the person deletes or alters, or causes or permits the deletion or alteration of, any information required by the notice to be retained, and
b the person’s intention was to prevent the information being available, or (as the case may be) to prevent it being available in unaltered form, for the purposes of any official investigation into the death of the child to whom the notice relates.
6B For the purposes of subsection (6A) information has been deleted if it is irrecoverable (however that occurred).
6 The reference in subsection (5) to suppressing information or a document includes a reference to destroying the means of reproducing information recorded otherwise than in a legible form.
7 Offences under this section may be committed only in relation to an information notice which—
a relates to—
i a user-to-user service,
ii a search service, or
iii an internet service on which regulated provider pornographic content is published or displayed; and
b is given to the provider of that service.
8 If a person is convicted of an offence under this section, the court may, on an application by the prosecutor, make an order requiring the person to comply with a requirement of an information notice within such period as may be specified by the order.
9 See also section 201 (supplementary provision about defences).
10 In this section, “regulated provider pornographic content” and “published or displayed” have the same meaning as in Part 5 (see section 79).

I622I580110 Senior managers’ liability: information offences

1 In this section “an individual named as a senior manager of an entity” means an individual who, as required by an information notice, is named as a senior manager of an entity in a response to that notice (see section 103).
2 An individual named as a senior manager of an entity commits an offence if—
a the entity commits an offence under section 109(1) (failure to comply with information notice), and
b the individual has failed to take all reasonable steps to prevent that offence being committed.
3 It is a defence for an individual charged with an offence under subsection (2) to show that the individual was a senior manager within the meaning of section 103 for such a short time after the information notice in question was given that the individual could not reasonably have been expected to take steps to prevent that offence being committed.
4 An individual named as a senior manager of an entity commits an offence if—
a the entity commits an offence under section 109(3) (false information), and
b the individual has failed to take all reasonable steps to prevent that offence being committed.
5 An individual named as a senior manager of an entity commits an offence if—
a the entity commits an offence under section 109(4) (encrypted information), and
b the individual has failed to take all reasonable steps to prevent that offence being committed.
6 An individual named as a senior manager of an entity commits an offence if—
a the entity commits an offence under section 109(5) (destruction etc of information), and
b the individual has failed to take all reasonable steps to prevent that offence being committed.
6A An individual named as a senior manager of an entity commits an offence if—
a the entity commits an offence under section 109(6A) (deletion etc of information), and
b the individual has failed to take all reasonable steps to prevent that offence being committed.
7 It is a defence for an individual charged with an offence under subsection (4), (5) , (6) or (6A) to show that the individual was not a senior manager within the meaning of section 103 at the time at which the act constituting the offence occurred.
8 It is a defence for an individual charged with an offence under this section to show that the individual had no knowledge of being named as a senior manager in a response to the information notice in question.
9 See also section 201 (supplementary provision about defences).

I107I29111 Offences in connection with notices under Schedule 12

1 A person commits an offence if the person fails without reasonable excuse to comply with a requirement of an audit notice.
2 A person commits an offence if, in response to an audit notice—
a the person provides information that is false in a material respect, and
b at the time the person provides it, the person knows that it is false in a material respect or is reckless as to whether it is false in a material respect.
3 A person commits an offence if—
a the person suppresses, destroys or alters, or causes or permits the suppression, destruction or alteration of, any information required to be provided, or document required to be produced, by a notice to which this subsection applies, and
b the person’s intention was to prevent OFCOM from being provided with the information or document or (as the case may be) from being provided with it as it was before the alteration.
4 The reference in subsection (3) to suppressing information or a document includes a reference to destroying the means of reproducing information recorded otherwise than in a legible form.
5 Subsection (3) applies to—
a a notice under paragraph 3 of Schedule 12 (information required for inspection), and
b an audit notice (see paragraph 4 of that Schedule).
6 If a person is convicted of an offence under this section, the court may, on an application by the prosecutor, make an order requiring the person, within such period as may be specified by the order, to comply with a requirement of a notice under paragraph 3 of Schedule 12 or an audit notice (as the case may be).

I618I895112 Other information offences

1 A person commits an offence if the person intentionally obstructs or delays a person in the exercise of the power conferred by section 102(7)(a) (copying a document etc).
2 A person commits an offence if the person fails without reasonable excuse to comply with a requirement under section 106 (interviews).
3 A person commits an offence if, in purported compliance with a requirement under section 106—
a the person provides information that is false in a material respect, and
b at the time the person provides it, the person knows that it is false in a material respect or is reckless as to whether it is false in a material respect.
4 If a person is convicted of an offence under this section, the court may, on an application by the prosecutor, make an order requiring the person, within such period as may be specified by the order, to permit the making of a copy of a document, or to comply with a requirement under section 106 (as the case may be).

I554I776113 Penalties for information offences

1 A person who commits an offence under section 109(1), 110(2) or 111(1) is liable—
a on summary conviction in England and Wales, to a fine;
b on summary conviction in Scotland or Northern Ireland, to a fine not exceeding the statutory maximum;
c on conviction on indictment, to a fine.
2 A person who commits an offence under section 109(3), (4), (5) or (6A), 110(4), (5), (6) or (6A), 111(2) or (3) or 112(1) is liable—
a on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);
b on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum (or both);
c on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);
d on conviction on indictment, to imprisonment for a term not exceeding 2 years or a fine (or both).
3 A person who commits an offence under section 112(2) or (3) is liable—
a on summary conviction in England and Wales, to a fine;
b on summary conviction in Scotland, to a fine not exceeding level 5 on the standard scale;
c on summary conviction in Northern Ireland, to a fine not exceeding level 5 on the standard scale.

Disclosure of information

I76114 Co-operation and disclosure of information: overseas regulators

I6871 OFCOM may co-operate with an overseas regulator, including by disclosing online safety information to that regulator, for the purposes of—
a facilitating the exercise by the overseas regulator of any of that regulator’s online regulatory functions, or
b criminal investigations or proceedings relating to a matter to which the overseas regulator’s online regulatory functions relate.
I1822 The power conferred by subsection (1) applies only in relation to an overseas regulator for the time being specified in regulations made by the Secretary of State.
I6873 Where information is disclosed to a person in reliance on subsection (1), the person may not—
a use the information for a purpose other than the purpose for which it was disclosed, or
b further disclose the information,
except with OFCOM’s consent (which may be general or specific) or in accordance with an order of a court or tribunal.
I6874 Except as provided by subsection (5), a disclosure of information under subsection (1) does not breach—
a any obligation of confidence owed by the person making the disclosure, or
b any other restriction on the disclosure of information (however imposed).
I6875 Subsection (1) does not authorise a disclosure of information that—
a would contravene the restriction imposed by section 116 (intelligence service information),
b would contravene the data protection legislation (but in determining whether a disclosure would do so, the power conferred by that subsection is to be taken into account), or
c is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.
I6876 Section 18 of the Anti-terrorism, Crime and Security Act 2001 (restriction on disclosure of information for overseas purposes) has effect in relation to a disclosure authorised by subsection (1)(b) as it has effect in relation to a disclosure authorised by any of the provisions to which section 17 of that Act applies.
I1827 In this section—
  • “online regulatory functions”, in relation to an overseas regulator, means functions of that regulator which correspond to OFCOM’s online safety functions;
  • “online safety information” means information held by OFCOM in connection with any of OFCOM’s online safety functions;
  • “overseas regulator” means a person exercising functions in a country outside the United Kingdom which correspond to any of OFCOM’s online safety functions;
  • F3...

I856115 Disclosure of information

1 Section 393 of the Communications Act (general restrictions on disclosure of information) is amended as follows.
2 In subsection (1)—
a at the end of paragraph (c) omit “or”,
b at the end of paragraph (d) insert “or”, and
c after paragraph (d) insert—
.
3 In subsection (2)(e), after “this Act” insert “or the Online Safety Act 2023”.
4 In subsection (3), after paragraph (h) insert—
.
5 In subsection (5)—
a before paragraph (d) insert—
,
b after paragraph (na) insert—
, and
c after paragraph (r) insert—
6 In subsection (6)(a), after “390” insert “, or under section 149 of or Schedule 11 to the Online Safety Act 2023”.
7 In subsection (6)(b), at the end insert “or the Online Safety Act 2023”.

I329116 Intelligence service information

1 OFCOM may not disclose information received (directly or indirectly) from, or that relates to, an intelligence service unless the intelligence service consents to the disclosure.
2 If OFCOM have disclosed information described in subsection (1) to a person, the person must not further disclose the information unless the intelligence service consents to the disclosure.
3 If OFCOM would contravene subsection (1) by publishing in its entirety—
a a statement required to be published by section 47(5), or
b a report mentioned in section 164(5),
OFCOM must, before publication, remove or obscure the information which by reason of subsection (1) they must not disclose.
4 In this section—
  • “information” means information held by OFCOM in connection with an online safety matter;
  • “intelligence service” means—
    1. the Security Service,
    2. the Secret Intelligence Service, or
    3. the Government Communications Headquarters.

I888117 Provision of information to the Secretary of State

1 Section 24B of the Communications Act (provision of information to assist in formulation of policy) is amended as follows.
2 In subsection (2)—
a at the end of paragraph (d) omit “or”,
b at the end of paragraph (e) insert “or”, and
c after paragraph (e) insert—
.
3 After subsection (3) insert—

I258I125118 Amendment of Enterprise Act 2002

In Schedule 15 to the Enterprise Act 2002 (enactments relevant to provisions about disclosure of information), at the appropriate place insert—

I416I129119 Information for users of regulated services

1 Section 26 of the Communications Act (publication of information and advice for consumers etc) is amended as follows.
2 In subsection (2), after paragraph (d) insert—
.
3 After subsection (6) insert—

I115120 Admissibility of statements

I6291 An explanation given, or information provided, by a person in response to a requirement imposed under or by virtue of section 100, 101 or 106 or paragraph 2(4)(e) or (f), 3(2), 4(2)(i) or (j) or 7(d) of Schedule 12, may, in criminal proceedings, only be used in evidence against that person—
a on a prosecution for an offence under a provision listed in subsection (2), or
b on a prosecution for any other offence where—
i in giving evidence that person makes a statement inconsistent with that explanation or information, and
ii evidence relating to that explanation or information is adduced, or a question relating to it is asked, by that person or on that person’s behalf.
2 Those provisions are—
I920a section 69(1),
I629b section 109(3),
I629c section 110(4),
I629d section 111(2),
I629e section 112(3),
I629f paragraph 18(1)(c) of Schedule 12,
I629g section 5 of the Perjury Act 1911 (false statements made otherwise than on oath),
I629h section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath), and
I629i Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).

CHAPTER 5 Regulated user-to-user services and regulated search services: notices to deal with terrorism content and CSEA content

I54I165121 Notices to deal with terrorism content or CSEA content (or both)

1 If OFCOM consider that it is necessary and proportionate to do so, they may give a notice described in subsection (2), (3) or (4) relating to a regulated user-to-user service or a regulated search service to the provider of the service.
2 A notice under subsection (1) that relates to a regulated user-to-user service is a notice requiring the provider of the service—
a to do any or all of the following—
i use accredited technology to identify terrorism content communicated publicly by means of the service and to swiftly take down that content;
ii use accredited technology to prevent individuals from encountering terrorism content communicated publicly by means of the service;
iii use accredited technology to identify CSEA content, whether communicated publicly or privately by means of the service, and to swiftly take down that content;
iv use accredited technology to prevent individuals from encountering CSEA content, whether communicated publicly or privately, by means of the service; or
b to use the provider’s best endeavours to develop or source technology for use on or in relation to the service or part of the service, which—
i achieves the purpose mentioned in paragraph (a)(iii) or (iv), and
ii meets the standards published by the Secretary of State (see section 125(13)).
3 A notice under subsection (1) that relates to a regulated search service is a notice requiring the provider of the service—
a to do either or both of the following—
i use accredited technology to identify search content of the service that is terrorism content and to swiftly take measures designed to secure, so far as possible, that search content of the service no longer includes terrorism content identified by the technology;
ii use accredited technology to identify search content of the service that is CSEA content and to swiftly take measures designed to secure, so far as possible, that search content of the service no longer includes CSEA content identified by the technology; or
b to use the provider’s best endeavours to develop or source technology for use on or in relation to the service which—
i achieves the purpose mentioned in paragraph (a)(ii), and
ii meets the standards published by the Secretary of State (see section 125(13)).
4 A notice under subsection (1) that relates to a combined service is a notice requiring the provider of the service—
a to do any or all of the things described in subsection (2)(a) in relation to the user-to-user part of the service, or to use best endeavours to develop or source technology as described in subsection (2)(b) for use on or in relation to that part of the service;
b to do either or both of the things described in subsection (3)(a) in relation to the search engine of the service, or to use best endeavours to develop or source technology as described in subsection (3)(b) for use on or in relation to the search engine of the service;
c to do any or all of the things described in subsection (2)(a) in relation to the user-to-user part of the service and either or both of the things described in subsection (3)(a) in relation to the search engine of the service; or
d to use best endeavours to develop or source—
i technology as described in subsection (2)(b) for use on or in relation to the user-to-user part of the service, and
ii technology as described in subsection (3)(b) for use on or in relation to the search engine of the service.
5 For the purposes of subsections (2) and (3), a requirement to use accredited technology may be complied with by the use of the technology alone or by means of the technology together with the use of human moderators.
6 See—
a section 122, which requires OFCOM to obtain a skilled person’s report before giving a notice under subsection (1),
b section 123, which requires OFCOM to give a warning notice before giving a notice under subsection (1), and
c section 124 for provision about matters which OFCOM must consider before giving a notice under subsection (1).
7 A notice under subsection (1) that relates to a user-to-user service (or to the user-to-user part of a combined service) and requires the use of technology in relation to terrorism content must identify the content, or parts of the service that include content, that OFCOM consider is communicated publicly on that service (see section 232).
8 For the meaning of “accredited” technology, see section 125(12) and (13).

I251I868122 Requirement to obtain skilled person’s report

1 OFCOM may give a notice under section 121(1) to a provider only after obtaining a report from a skilled person appointed by OFCOM under section 104(4).
2 The purpose of the report is to assist OFCOM in deciding whether to give a notice under section 121(1), and to advise about the requirements that might be imposed by such a notice if it were to be given.

I564I780123 Warning notices

1 OFCOM may give a notice under section 121(1) to a provider relating to a service or part of a service only after giving a warning notice to the provider that they intend to give such a notice relating to that service or that part of it.
2 A warning notice under subsection (1) relating to the use of accredited technology (see section 121(2)(a) and (3)(a)) must—
a contain a summary of the report obtained by OFCOM under section 122,
b contain details of the technology that OFCOM are considering requiring the provider to use,
c specify whether the technology is to be required in relation to terrorism content or CSEA content (or both),
d specify any other requirements that OFCOM are considering imposing (see section 125(2) to (4)),
e specify the period for which OFCOM are considering imposing the requirements (see section 125(7)),
f state that the provider may make representations to OFCOM (with any supporting evidence), and
g specify the period within which representations may be made.
3 A warning notice under subsection (1) relating to the development or sourcing of technology (see section 121(2)(b)and (3)(b)) must—
a contain a summary of the report obtained by OFCOM under section 122,
b describe the proposed purpose for which the technology must be developed or sourced (see section 121(2)(a)(iii) and (iv) and (3)(a)(ii)),
c specify steps that OFCOM consider the provider needs to take in order to comply with the requirement described in section 121(2)(b) or (3)(b), or both those requirements (as the case may be),
d specify the proposed period within which the provider must take each of those steps,
e specify any other requirements that OFCOM are considering imposing,
f state that the provider may make representations to OFCOM (with any supporting evidence), and
g specify the period within which representations may be made.
4 A notice under section 121(1) that relates to both the user-to-user part of a combined service and the search engine of the service (as described in section 121(4)(c) or (d)) may be given to the provider of the service only if—
a two separate warning notices have been given to the provider (one relating to the user-to-user part of the service and the other relating to the search engine), or
b a single warning notice relating to both the user-to-user part of the service and the search engine has been given to the provider.
5 A notice under section 121(1) may not be given to a provider until the period allowed by the warning notice for the provider to make representations has expired.

I102I812124 Matters relevant to a decision to give a notice under section 121(1)

1 This section specifies the matters which OFCOM must particularly consider in deciding whether it is necessary and proportionate to give a notice under section 121(1) relating to a Part 3 service to the provider of the service.
2 In the case of a notice requiring the use of accredited technology, the matters are as follows—
a the kind of service it is;
b the functionalities of the service;
c the user base of the service;
d in the case of a notice relating to a user-to-user service (or to the user-to-user part of a combined service), the prevalence of relevant content on the service, and the extent of its dissemination by means of the service;
e in the case of a notice relating to a search service (or to the search engine of a combined service), the prevalence of search content of the service that is relevant content;
f the level of risk of harm to individuals in the United Kingdom presented by relevant content, and the severity of that harm;
g the systems and processes used by the service which are designed to identify and remove relevant content;
h the contents of the skilled person’s report obtained as required by section 122;
i the extent to which the use of the specified technology would or might result in interference with users’ right to freedom of expression within the law;
j the level of risk of the use of the specified technology resulting in a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of the service (including, but not limited to, any such provision or rule concerning the processing of personal data);
k in the case of a notice relating to a user-to-user service (or to the user-to-user part of a combined service), the extent to which the use of the specified technology would or might—
i have an adverse impact on the availability of journalistic content on the service, or
ii result in a breach of the confidentiality of journalistic sources;
l whether the use of any less intrusive measures than the specified technology would be likely to achieve a significant reduction in the amount of relevant content.
3 The references to relevant content in subsection (2)(f), (g) and (l) are to—
a in the case of a user-to-user service (or the user-to-user part of a combined service), relevant content present on the service;
b in the case of a search service (or the search engine of a combined service), search content of the service that is relevant content.
4 In the case of a notice relating to the development or sourcing of technology, subsection (2) applies—
a as if references to relevant content were to CSEA content, and
b with the omission of paragraphs (i), (j), (k) and (l).
5 In this section—
  • “journalistic content” has the meaning given by section 19;
  • “relevant content” means terrorism content or CSEA content or both those kinds of content (depending on the kind, or kinds, of content in relation to which the specified technology is to operate);
  • “specified technology” means the technology to be specified in the notice under section 121(1).

I266I232125 Notices under section 121(1): supplementary

1 In this section “a notice” means a notice under section 121(1) (including a further notice under that provision).
2 If a provider is already using accredited technology in relation to the service in question, a notice may require the provider to use it more effectively (specifying the ways in which that must be done).
3 A notice relating to a user-to-user service (or to the user-to-user part of a combined service) may also require a provider to operate an effective complaints procedure allowing for United Kingdom users to challenge the provider for taking down content which they have generated, uploaded or shared on the service.
4 A notice relating to a search service (or to the search engine of a combined service) may also require a provider to operate an effective complaints procedure allowing for an interested person (see section 227(7)) to challenge measures taken or in use by the provider that result in content relating to that interested person no longer appearing in search results of the service.
5 A notice given to a provider of a Part 3 service requiring the use of accredited technology is to be taken to require the provider to make such changes to the design or operation of the service as are necessary for the technology to be used effectively.
6 A notice requiring the use of accredited technology must—
a give OFCOM’s reasons for their decision to give the notice,
b contain details of the requirements imposed by the notice,
c contain details of the technology to be used,
d contain details about the manner in which the technology is to be implemented,
e specify a reasonable period for compliance with the notice,
f specify the period for which the notice is to have effect,
g contain details of the rights of appeal under section 168,
h contain information about when OFCOM intend to review the notice (see section 126), and
i contain information about the consequences of not complying with the notice (including information about the further kinds of enforcement action that it would be open to OFCOM to take).
7 A notice requiring the use of accredited technology may impose requirements for a period of up to 36 months beginning with the last day of the period specified in the notice in accordance with subsection (6)(e).
8 A notice relating to the development or sourcing of technology must—
a give OFCOM’s reasons for their decision to give the notice,
b describe the purpose for which technology is required to be developed or sourced (see section 121(2)(a)(iii) and (iv) and (3)(a)(ii),
c specify steps that the provider is required to take (including steps relating to the use of a system or process) in order to comply with the requirement described in section 121(2)(b) or (3)(b), or both those requirements (as the case may be),
d specify a reasonable period within which each of the steps specified in the notice must be taken,
e contain details of any other requirements imposed by the notice,
f contain details of the rights of appeal under section 168,
g contain information about when OFCOM intend to review the notice (see section 126), and
h contain information about the consequences of not complying with the notice (including information about the further kinds of enforcement action that it would be open to OFCOM to take).
9 In deciding what period or periods to specify for steps to be taken in accordance with subsection (8)(d), OFCOM must, in particular, consider—
a the size and capacity of the provider, and
b the state of development of technology capable of achieving the purpose described in the notice in accordance with subsection (8)(b).
10 A notice may impose requirements only in relation to the design and operation of a Part 3 service—
a in the United Kingdom, or
b as it affects United Kingdom users of the service.
11 OFCOM may vary or revoke a notice given to a provider by notifying the provider to that effect.
12 For the purposes of this Chapter, technology is “accredited” if it is accredited (by OFCOM or another person appointed by OFCOM) as meeting minimum standards of accuracy in the detection of terrorism content or CSEA content (as the case may be).
13 Those minimum standards of accuracy must be such standards as are for the time being approved and published by the Secretary of State, following advice from OFCOM.

I584I105126 Review and further notice under section 121(1)

1 This section applies where OFCOM have given a provider of a Part 3 service a notice under section 121(1).
2 The power conferred by section 125(11) includes power to revoke the notice if there are reasonable grounds for believing that the provider is failing to comply with it.
3 If a notice is revoked as mentioned in subsection (2), OFCOM may give the provider a further notice under section 121(1) if they consider that it is necessary and proportionate to do so (taking into account the matters mentioned in section 124).
4 Except where a notice under section 121(1) is revoked as mentioned in subsection (2), OFCOM must carry out a review of the provider’s compliance with the notice—
a in the case of a notice requiring the use of accredited technology, before the end of the period for which the notice has effect;
b in the case of a notice relating to the development or sourcing of technology, before the last date by which any step specified in the notice is required to be taken.
5 In the case of a notice requiring the use of accredited technology, the review must consider—
a the extent to which the technology specified in the notice has been used, and
b the effectiveness of its use.
6 Following the review, and after consultation with the provider, OFCOM may give the provider a further notice under section 121(1) if they consider that it is necessary and proportionate to do so (taking into account the matters mentioned in section 124).
7 If a further notice under section 121(1) is given, subsections (3) to (6) apply again.
8 A further notice under section 121(1) may impose different requirements from an earlier notice under that provision.
9 Sections 122 (skilled person’s report) and 123 (warning notices) do not apply in relation to a further notice under section 121(1).

I101I86127 OFCOM’s guidance about functions under this Chapter

1 OFCOM must produce guidance for providers of Part 3 services about how OFCOM propose to exercise their functions under this Chapter.
2 Before producing the guidance (including revised or replacement guidance), OFCOM must consult the Information Commissioner.
3 OFCOM must keep the guidance under review.
4 OFCOM must publish the guidance (and any revised or replacement guidance).
5 In exercising their functions under this Chapter, or deciding whether to exercise them, OFCOM must have regard to the guidance for the time being published under this section.

I114I269128 OFCOM’s annual report

1 OFCOM must produce and publish an annual report about—
a the exercise of their functions under this Chapter, and
b technology which meets, or is in the process of development so as to meet, minimum standards of accuracy (see subsections (12) and (13) of section 125) for the purposes of this Chapter.
2 OFCOM must send a copy of the report to the Secretary of State, and the Secretary of State must lay it before Parliament.
3 For further provision about reports under this section, see section 164.

I249129 Interpretation of this Chapter

In this Chapter—
  • “search content” has the same meaning as in Part 3 (see section 57);
  • “search results” has the meaning given by section 57(3);
  • “terrorism content” and “CSEA content” have the same meaning as in Part 3 (see section 59).

CHAPTER 6 Enforcement powers

Provisional notices and confirmation decisions

I362I404130 Provisional notice of contravention

1 OFCOM may give a notice under this section (a “provisional notice of contravention”) relating to a regulated service to the provider of the service if they consider that there are reasonable grounds for believing that the provider has failed, or is failing, to comply with any enforceable requirement (see section 131) that applies in relation to the service.
2 OFCOM may also give a provisional notice of contravention to a person on either of the grounds in subsection (3).
3 The grounds are that—
a the person has been given an information notice and OFCOM consider that there are reasonable grounds for believing that the person has failed, or is failing, to comply with either of the duties set out in section 102(8) (duties in relation to information notices), or
b the person is required by a skilled person appointed under section 104 to give assistance to the skilled person, and OFCOM consider that there are reasonable grounds for believing that the person has failed, or is failing, to comply with the duty set out in subsection (7) of that section to give such assistance.
4 A provisional notice of contravention given to a person must—
a specify the duty or requirement with which (in OFCOM’s opinion) the person has failed, or is failing, to comply, and
b give OFCOM’s reasons for their opinion that the person has failed, or is failing, to comply with it.
5 A provisional notice of contravention may also contain details as mentioned in subsection (6) or (7), or both.
6 A provisional notice of contravention may specify steps that OFCOM consider the person needs to take in order to—
a comply with the duty or requirement, or
b remedy the failure to comply with it.
7 A provisional notice of contravention may state that OFCOM propose to impose a penalty on the person, and in such a case the notice must—
a state the reasons why OFCOM propose to impose a penalty,
b state whether OFCOM propose to impose a penalty of a single amount, a penalty calculated by reference to a daily rate, or both penalties (see section 137(1)),
c indicate the amount of a penalty that OFCOM propose to impose, including (in relation to a penalty calculated by reference to a daily rate) the daily rate and how the penalty would be calculated,
d in relation to a penalty calculated by reference to a daily rate, specify or describe the period for which OFCOM propose that the penalty should be payable, and
e state the reasons for proposing a penalty of that amount, including any aggravating or mitigating factors that OFCOM propose to take into account.
8 A provisional notice of contravention given to a person must—
a state that the person may make representations to OFCOM (with any supporting evidence) about the matters contained in the notice, and
b specify the period within which such representations may be made.
9 A provisional notice of contravention may be given in respect of a failure to comply with more than one enforceable requirement.
10 Where a provisional notice of contravention is given in respect of a continuing failure, the notice may be given in respect of any period during which the failure has continued, and must specify that period.
11 Where a provisional notice of contravention is given to a person in respect of a failure to comply with a duty or requirement (“the first notice”), a further provisional notice of contravention in respect of a failure to comply with that same duty or requirement may be given to the person only—
a in respect of a separate instance of the failure after the first notice was given,
b where a period was specified in the first notice in accordance with subsection (10), in respect of the continuation of the failure after the end of that period, or
c if the first notice has been withdrawn (without a confirmation decision being given to the person in respect of the failure).

I594I283131 Requirements enforceable by OFCOM against providers of regulated services

1 References in this Chapter to “enforceable requirements” are to—
a the duties or requirements set out in the provisions of this Act specified in the table in subsection (2), and
b the requirements mentioned in subsection (3).
2 Here is the table—
ProvisionSubject matter
Section 9Illegal content risk assessments
Section 10Illegal content
Section 11Children’s risk assessments
Section 12Children’s online safety
Section 14Assessments related to duty in section 15(2)
Section 15User empowerment
Section 17Content of democratic importance
Section 18News publisher content
Section 19Journalistic content
Section 20Content reporting
Section 21Complaints procedures
Section 22Freedom of expression and privacy
Section 23Record-keeping and review
Section 26Illegal content risk assessments
Section 27Illegal content
Section 28Children’s risk assessments
Section 29Children’s online safety
Section 31Content reporting
Section 32Complaints procedures
Section 33Freedom of expression and privacy
Section 34Record-keeping and review
Section 36Children’s access assessments
Section 38Fraudulent advertising
Section 39Fraudulent advertising
Section 64User identity verification
Section 66Reporting CSEA content to NCA
Section 71Acting against users only in accordance with terms of service
Section 72Terms of service
Section 75Information about use of service by deceased child users
Section 77(3) and (4)Transparency reports
Section 81Provider pornographic content
Section 83Fees: notification of OFCOM
Section 102(8)Information notices
Section 104(7)Assistance to skilled person
Section 105(1)Co-operation with investigation
3 The requirements referred to in subsection (1)(b) are—
a requirements of a notice under section 104(5)(a) to appoint a skilled person;
b requirements of a notice given by virtue of section 175(3) (duty to make public statement);
c requirements of a notice under section 175(5) (information in connection with circumstances presenting a threat);
d requirements imposed by a person acting—
i in the exercise of powers conferred by paragraph 2 of Schedule 12 (entry and inspection without warrant), or
ii in the execution of a warrant issued under paragraph 5 of that Schedule.

I62I631132 Confirmation decisions

1 This section applies if—
a OFCOM have given a provisional notice of contravention to a person in relation to a failure to comply with a duty or requirement (or with duties or requirements), and
b the period allowed for representations has expired.
A duty or requirement to which the provisional notice of contravention relates is referred to in this section as a “notified requirement”.
2 If, after considering any representations and evidence, OFCOM decide not to give the person a notice under this section, they must inform the person of that fact.
3 If OFCOM are satisfied that the person has failed, or has been failing, to comply with a notified requirement, OFCOM may give the person a notice under this section (a “confirmation decision”) confirming that that is OFCOM’s opinion.
4 A confirmation decision and a notice under section 121(1) may be given in respect of the same failure.
5 A confirmation decision given to a person may—
a require the person to take steps as mentioned in section 133;
b require the person to pay a penalty as mentioned in section 137;
c require the person to do both those things (or neither of them).
6 See sections 134 and 135 for further provision which a confirmation decision may include in cases of failure to comply with duties about risk assessments or children’s access assessments.

I792I204133 Confirmation decisions: requirements to take steps

1 A confirmation decision may require the person to whom it is given to take such steps as OFCOM consider appropriate (including steps relating to the use of a system or process) for either or both of the following purposes—
a complying with a notified requirement;
b remedying the failure to comply with a notified requirement.
2 But see section 136 in relation to OFCOM’s power to include in a confirmation decision requirements as described in subsection (1) relating to the use of proactive technology.
3 A confirmation decision may impose requirements as described in subsection (1) only in relation to the design or operation of a regulated service—
a in the United Kingdom, or
b as it affects United Kingdom users of the service.
4 A confirmation decision that includes requirements as described in subsection (1) must—
a specify the steps that are required,
b give OFCOM’s reasons for their decision to impose those requirements,
c specify which of those requirements (if any) have been designated as CSEA requirements (see subsections (6) and (7)),
d specify each notified requirement to which the steps relate,
e specify the period during which the failure to comply with a notified requirement has occurred, and whether the failure is continuing,
f specify a reasonable period within which each of the steps specified in the decision must be taken or, if a step requires the use of a system or process, a reasonable period within which the system or process must begin to be used (but see subsection (5) in relation to information duties),
g (if relevant) specify the period for which a system or process must be used,
h contain details of the rights of appeal under section 168, and
i contain information about the consequences of not complying with the requirements included in the decision (including information about the further kinds of enforcement action that it would be open to OFCOM to take).
5 A confirmation decision that requires a person to take steps for the purpose of complying with an information duty may require the person to take those steps immediately.
6 If the condition in subsection (7) is met in relation to a requirement imposed by a confirmation decision which is of a kind described in subsection (1), OFCOM must designate the requirement as a “CSEA requirement” for the purposes of section 138(3) (offence of failure to comply with confirmation decision).
7 The condition referred to in subsection (6) is that the requirement is imposed (whether or not exclusively) in relation to either or both of the following—
a a failure to comply with section 10(2)(a) or (3)(a) in respect of CSEA content, or in respect of priority illegal content which includes CSEA content;
b a failure to comply with section 10(2)(b) in respect of an offence specified in Schedule 6 (CSEA offences), or in respect of priority offences which include such an offence.
8 A person to whom a confirmation decision is given has a duty to comply with requirements included in the decision which are of a kind described in subsection (1).
9 The duty under subsection (8) is enforceable in civil proceedings by OFCOM—
a for an injunction,
b for specific performance of a statutory duty under section 45 of the Court of Session Act 1988, or
c for any other appropriate remedy or relief.
10 In this section—
  • “CSEA content”, “priority illegal content” and “priority offence” have the same meaning as in Part 3 (see section 59);
  • “information duty” means a duty set out in section 102(8);
  • “notified requirement” has the meaning given by section 132.

I72I201134 Confirmation decisions: risk assessments

1 This section applies if—
a OFCOM are satisfied that a provider of a Part 3 service has failed to comply with a risk assessment duty,
b based on evidence resulting from OFCOM’s investigation into that failure, OFCOM have identified a risk of serious harm to individuals in the United Kingdom arising from a particular aspect of the service (“the identified risk”), and
c OFCOM consider that the identified risk is not effectively mitigated or managed.
2 A confirmation decision given to the provider of the service—
a if the identified risk relates to matters required to be covered by an illegal content risk assessment, may include a determination that the duty set out in section 10(2)(b) or (c) or 27(2) (as the case may be) applies as if an illegal content risk assessment carried out by the provider had identified that risk;
b if the identified risk relates to matters required to be covered by a children’s risk assessment, may include a determination that the duty set out in section 12(2)(a) or 29(2)(a) (as the case may be) applies as if a children’s risk assessment carried out by the provider had identified that risk.
3 A confirmation decision which includes a determination as mentioned in subsection (2) must—
a give details of the identified risk,
b specify the duty to which the determination relates, and
c specify the date by which measures (at the provider’s discretion) to comply with that duty must be taken or must begin to be used.
4 A determination as mentioned in subsection (2) ceases to have effect on the date on which the provider of the service complies with the risk assessment duty with which the provider had previously failed to comply (and accordingly, from that date the duty to which the determination relates applies without the modification mentioned in that subsection).
5 In this section—
  • “children’s risk assessment” has the meaning given by section 11 or 28 (as the case may be);
  • “illegal content risk assessment” has the meaning given by section 9 or 26 (as the case may be);
  • “risk assessment duty” means a duty set out in—
    1. section 9,
    2. section 11,
    3. section 26, or
    4. section 28.

I797I22135 Confirmation decisions: children’s access assessments

1 This section applies if OFCOM are satisfied that a provider of a Part 3 service has failed to comply with a duty set out in section 36 (duties about children’s access assessments).
2 If OFCOM include in a confirmation decision a requirement to take steps relating to the carrying out of a children’s access assessment of a service, they must require that assessment to be completed within three months of the date of the confirmation decision.
3 OFCOM may vary a confirmation decision which includes a requirement as mentioned in subsection (2) to extend the deadline for completion of a children’s access assessment.
4 Subsection (5) applies if, based on evidence that OFCOM have about a service resulting from their investigation into compliance with a duty set out in section 36, OFCOM consider that—
a it is possible for children to access the service or a part of it, and
b the child user condition is met in relation to—
i the service, or
ii a part of the service that it is possible for children to access.
5 OFCOM may include in the confirmation decision given to the provider of the service—
a a determination that the duties set out in sections 11 and 12, or (as the case may be) sections 28 and 29, must be complied with—
i from the date of the confirmation decision, or
ii from a later date specified in that decision;
b provision about the circumstances in which that determination may be treated as no longer applying in relation to the service.
6 Subsection (4) is to be interpreted consistently with section 35.
7 In this section, “children’s access assessment” has the meaning given by section 35.

I764136 Confirmation decisions: proactive technology

I5881 This section sets out what powers OFCOM have to include in a confirmation decision a requirement to take steps to use a kind, or one of the kinds, of proactive technology specified in the decision (a “proactive technology requirement”).
2 A proactive technology requirement may be imposed in a confirmation decision if—
I588a the decision is given to the provider of an internet service within section 80(2), and
I84b the decision is imposed for the purpose of complying with, or remedying the failure to comply with, the duty set out in section 81(2) (provider pornographic content).
I5883 The following provisions of this section set out constraints on OFCOM’s power to include a proactive technology requirement in a confirmation decision in any case not within subsection (2).
I5884 A proactive technology requirement may be imposed in a confirmation decision only if the decision is given to the provider of a Part 3 service.
I5885 A proactive technology requirement may be imposed in a confirmation decision only for the purpose of complying with, or remedying the failure to comply with, any of the duties set out in—
a section 10(2) or (3) (illegal content),
b section 12(2) or (3) (children’s online safety),
c section 27(2) or (3) (illegal content),
d section 29(2) or (3) (children’s online safety), or
e section 38(1) or 39(1) (fraudulent advertising).
I5886 Proactive technology may be required to be used on or in relation to any Part 3 service or any part of such a service, but if and to the extent that the technology operates (or may operate) by analysing content that is user-generated content in relation to the service, or metadata relating to such content, the technology may not be required to be used except to analyse—
a user-generated content communicated publicly, and
b metadata relating to user-generated content communicated publicly.
I5887 Before imposing a proactive technology requirement in relation to a service in a confirmation decision, OFCOM must particularly consider the matters mentioned in subsection (8), so far as they are relevant.
I5888 The matters are as follows—
a the kind of service it is;
b the functionalities of the service;
c the user base of the service;
d the prevalence of relevant content on the service and the extent of its dissemination by means of the service, or (as the case may be) the prevalence of search content of the service that is relevant content;
e the level of risk of harm to individuals in the United Kingdom presented by relevant content present on the service, or (as the case may be) search content of the service that is relevant content, and the severity of that harm;
f the degree of accuracy, effectiveness and lack of bias achieved by the kind of technology specified in the decision;
g the extent to which the use of the kind of proactive technology specified in the decision would or might result in interference with users’ right to freedom of expression within the law;
h the level of risk of the use of the kind of proactive technology specified in the decision resulting in a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of the service (including, but not limited to, any such provision or rule concerning the processing of personal data);
i whether the use of any less intrusive measures than the proactive technology specified in the decision would be likely to result in compliance with, or would be likely to effectively remedy the failure to comply with, the duty in question.
I5889 A confirmation decision that imposes a proactive technology requirement on a provider may also impose requirements about review of the technology by the provider.
I58810 A confirmation decision relating to a service which requires the use of technology of a kind mentioned in subsection (6) must identify the content, or parts of the service that include content, that OFCOM consider is communicated publicly on that service (see section 232).
I58811 In this section—
  • “content that is harmful to children” has the same meaning as in Part 3 (see section 60);
  • “fraudulent advertisement” has the meaning given by section 38 or 39 (depending on the kind of service in question);
  • “illegal content” has the same meaning as in Part 3 (see section 59);
  • “relevant content” means illegal content, content that is harmful to children or content consisting of fraudulent advertisements, or any or all of those kinds of content (depending on the duties (as mentioned in subsection (5)) for the purposes of which the proactive technology requirement is imposed);
  • “search content” has the same meaning as in Part 3 (see section 57);
  • “user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

I132I380137 Confirmation decisions: penalties

1 A confirmation decision may require the person to whom it is given to do either or both of the following, depending on what was proposed in the provisional notice of contravention (see paragraph 3 of Schedule 13)—
a pay to OFCOM a penalty of a single amount in sterling determined by OFCOM (a “single penalty”) and specified in the confirmation decision;
b if the confirmation decision includes a requirement of the kind described in section 133(1)(a) in respect of a continuous failure to comply with a notified requirement, pay a daily rate penalty to OFCOM if that same failure continues after the compliance date.
2 A “daily rate penalty” means a penalty of an amount in sterling determined by OFCOM and calculated by reference to a daily rate.
3 A confirmation decision may impose separate single penalties for failure to comply with separate notified requirements specified in the decision.
4 Where a provisional notice of contravention is given in respect of a period of continuing failure to comply with a notified requirement, no more than one single penalty may be imposed by a confirmation decision in respect of the period of failure specified in the provisional notice of contravention.
5 A confirmation decision that imposes a penalty must—
a give OFCOM’s reasons for their decision to impose the penalty,
b specify each notified requirement to which the penalty relates,
c specify the period during which the failure to comply with a notified requirement has occurred, and whether the failure is continuing,
d state the reasons for the amount of the penalty, including any aggravating or mitigating factors that OFCOM have taken into account,
e specify a reasonable period within which the penalty must be paid,
f contain details of the rights of appeal under section 168, and
g contain information about the consequences of not paying the penalty (including information about the further kinds of enforcement action that it would be open to OFCOM to take).
6 The period specified under subsection (5)(e) for the payment of a single penalty must be at least 28 days beginning with the day on which the confirmation decision is given.
7 If a confirmation decision imposes a single penalty and a daily rate penalty, the information mentioned in subsection (5)(a), (b), (d) and (e) must be given in respect of each kind of penalty.
8 As well as containing the information mentioned in subsection (5), a confirmation decision that imposes a daily rate penalty in respect of a continuous failure to comply with a notified requirement must—
a state the daily rate of the penalty and how the penalty is calculated;
b state that the person will be liable to pay the penalty if that same failure continues after the compliance date;
c state the date from which the penalty begins to be payable, which must not be earlier than the day after the compliance date;
d provide for the penalty to continue to be payable at the daily rate until—
i the date on which the notified requirement is complied with,
ii if the penalty is imposed in respect of a failure to comply with more than one notified requirement, the date on which the last of those requirements is complied with, or
iii an earlier date specified in the confirmation decision.
9 In this section—
  • “compliance date”, in relation to a notified requirement, means—
    1. in a case where the confirmation decision requires steps to be taken immediately to comply with that requirement (see section 133(5)), the date of the confirmation decision;
    2. in any other case, the last day of the period specified in the confirmation decision in accordance with section 133(4)(f) for compliance with that requirement;
  • “notified requirement” has the meaning given by section 132.

I327138 Confirmation decisions: offences

I3341 A person to whom a confirmation decision is given commits an offence if, without reasonable excuse, the person fails to comply with a requirement imposed by the decision which—
a is of a kind described in section 133(1), and
b is imposed (whether or not exclusively) in relation to a failure to comply with a children’s online safety duty.
2 A “children’s online safety duty” means a duty set out in—
I334a section 12(3)(a),
I334b section 12(3)(b),
I103c section 81(2), or
I103d section 81(4).
I3343 A person to whom a confirmation decision is given commits an offence if, without reasonable excuse, the person fails to comply with a CSEA requirement imposed by the decision (see section 133(6) and (7)).
I3344 A person who commits an offence under this section is liable—
a on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);
b on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum (or both);
c on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);
d on conviction on indictment, to imprisonment for a term not exceeding 2 years or a fine (or both).

Penalty notices etc

I866I769139 Penalty for failure to comply with confirmation decision

1 This section applies if—
a OFCOM have given a confirmation decision to a person,
b the decision includes requirements of a kind described in section 133(1) (requirements to take steps),
c OFCOM are satisfied that the person has failed to comply with one or more of those requirements, and
d OFCOM have not imposed a daily rate penalty under section 137(1)(b) in respect of that failure.
2 OFCOM may give the person a penalty notice under this section in respect of the failure to comply with the confirmation decision, requiring the person to pay to OFCOM a penalty of a single amount in sterling determined by OFCOM.
3 But OFCOM may give such a notice to the person only after—
a notifying the person that they propose to give a penalty notice under this section, specifying the reasons for doing so and indicating the amount of the proposed penalty, and
b giving the person an opportunity to make representations (with any supporting evidence).
4 A penalty notice under this section must—
a give OFCOM’s reasons for their decision to impose the penalty,
b state the amount of the penalty,
c state the reasons for the amount of the penalty, including any aggravating or mitigating factors that OFCOM have taken into account,
d specify the period within which the penalty must be paid,
e contain details of the rights of appeal under section 168, and
f contain information about the consequences of not paying the penalty (including information about the further kinds of enforcement action that it would be open to OFCOM to take).
5 The period specified under subsection (4)(d) must be at least 28 days beginning with the day on which the penalty notice is given.

I195I897140 Penalty for failure to comply with notice under section 121(1)

1 This section applies if—
a OFCOM have given a notice under section 121(1) relating to a Part 3 service to the provider of that service (notices to deal with terrorism content and CSEA content), and
b OFCOM are satisfied that the provider has failed, or is failing, to comply with the notice.
2 OFCOM may give the provider a notice under this subsection stating that they propose to impose a penalty on the provider in respect of that failure.
3 The provider may make representations to OFCOM (with any supporting evidence) about the matters contained in the notice.
4 Subsection (5) applies if—
a the period allowed for representations has expired, and
b OFCOM are still satisfied as to the failure mentioned in subsection (1).
5 OFCOM may give the provider a penalty notice under this subsection requiring the provider to pay to OFCOM a penalty of an amount in sterling determined by OFCOM.
6 The penalty may consist of any of the following, depending on what was specified in the notice about the proposed penalty—
a a single amount;
b an amount calculated by reference to a daily rate;
c a combination of a single amount and an amount calculated by reference to a daily rate.
7 See section 142 for information which must be included in notices under this section.
8 Nothing in this section is to be taken to prevent OFCOM from giving the provider a further notice under section 121(1) (see section 126), as well as giving a penalty notice under subsection (5).

I388I117141 Non-payment of fee

1 This section applies if—
a the provider of a regulated service is liable to pay a fee to OFCOM under section 84 or Schedule 10 in respect of the current charging year (within the meaning of Part 6) or a previous charging year, and
b in OFCOM’s opinion, the provider has not paid the full amount of the fee that the provider is liable to pay.
2 OFCOM may give the provider a notice under this subsection specifying—
a the outstanding amount of the fee that OFCOM consider the provider is due to pay to them under section 84 or Schedule 10, and
b the period within which the provider must pay it.
3 A notice under subsection (2)—
a may be given in respect of liabilities that relate to different charging years;
b may also state that OFCOM propose to impose a penalty on the provider.
4 The provider may make representations to OFCOM (with any supporting evidence) about the matters contained in the notice.
5 Subsection (6) applies if—
a the notice under subsection (2) stated that OFCOM propose to impose a penalty,
b the period allowed for representations has expired, and
c OFCOM are satisfied that an amount of the fee is still due to them.
6 OFCOM may give the provider a penalty notice under this subsection requiring the provider to pay to OFCOM a penalty of an amount in sterling determined by OFCOM.
7 The penalty may consist of any of the following, depending on what was specified in the notice about the proposed penalty—
a a single amount;
b an amount calculated by reference to a daily rate;
c a combination of a single amount and an amount calculated by reference to a daily rate.
8 A penalty notice under subsection (6) may require the payment of separate single amounts in respect of liabilities that relate to different charging years.
9 See section 142 for information which must be included in notices under this section.
10 Nothing in this section affects OFCOM’s power to bring proceedings (whether before or after the imposition of a penalty by a notice under subsection (6)) for the recovery of the whole or part of an amount due to OFCOM under section 84 or Schedule 10.
11 But OFCOM may not bring such proceedings unless a provider has first been given a notice under subsection (2) specifying the amount due to OFCOM.

I842I907142 Information to be included in notices under sections 140 and 141

1 Subsection (2) applies in relation to—
a a notice under section 140(2), and
b a notice under section 141(2) stating that OFCOM propose to impose a penalty.
2 Such a notice must—
a state the reasons why OFCOM propose to impose the penalty,
b state whether OFCOM propose that the penalty should consist of a single amount, an amount calculated by reference to a daily rate, or a combination of the two,
c indicate the amount of the proposed penalty, including (in relation to an amount calculated by reference to a daily rate) the daily rate and how the penalty would be calculated,
d in relation to an amount calculated by reference to a daily rate, specify or describe the period for which OFCOM propose that the amount should be payable,
e state the reasons for proposing a penalty of that amount, including any aggravating or mitigating factors that OFCOM propose to take into account, and
f specify the period within which representations in relation to the proposed penalty may be made.
3 A penalty notice under section 140(5) or 141(6) must—
a give OFCOM’s reasons for their decision to impose the penalty,
b state whether the penalty consists of a single amount, an amount calculated by reference to a daily rate, or a combination of the two, and how it is calculated,
c in relation to a single amount, state that amount,
d in relation to an amount calculated by reference to a daily rate, state the daily rate,
e state the reasons for the amount of the penalty, including any aggravating or mitigating factors that OFCOM have taken into account,
f specify a reasonable period within which the penalty must be paid,
g contain details of the rights of appeal under section 168, and
h contain information about the consequences of not paying the penalty (including information about the further kinds of enforcement action that it would be open to OFCOM to take).
4 A penalty notice under section 141(6) must also specify the amount of the fee that is (in OFCOM’s opinion) due to be paid to OFCOM.
5 The period specified under subsection (3)(f) for the payment of a single amount must be at least 28 days beginning with the day on which the penalty notice is given.
6 Subsection (7) applies in relation to a penalty notice under section 140(5) or 141(6) that includes a requirement to pay an amount calculated by reference to a daily rate.
7 Such a notice must—
a state the date from which the amount begins to be payable, which must not be earlier than the day after the day on which the notice is given;
b provide for the amount to continue to be payable at the daily rate until—
i (in the case of a notice under section 140(5)) the date on which OFCOM are satisfied that the provider is complying with the notice under section 121(1), or (in the case of a notice under section 141(6)) the date on which the full amount of the fee (as specified in the penalty notice) has been paid to OFCOM, or
ii an earlier date specified in the penalty notice.

Amount of penalties etc

I480I608143 Amount of penalties etc

Schedule 13 contains provision about the amount of penalties that OFCOM may impose under this Chapter, and makes further provision about such penalties.

Business disruption measures

I347I128144 Service restriction orders

1 OFCOM may apply to the court for an order under this section (a “service restriction order”) in relation to a regulated service where they consider that—
a the grounds in subsection (3) apply in relation to the service, or
b in the case of a Part 3 service, the grounds in subsection (4) apply in relation to the service.
2 A service restriction order is an order imposing requirements on one or more persons who provide an ancillary service (whether from within or outside the United Kingdom) in relation to a regulated service (see subsection (11)).
3 The grounds mentioned in subsection (1)(a) are that—
a the provider of the regulated service has failed to comply with an enforceable requirement that applies in relation to the regulated service,
b the failure is continuing, and
c any of the following applies—
i the provider has failed to comply with a requirement imposed by a confirmation decision that is of a kind described in section 133(1) relating to the failure;
ii the provider has failed to pay a penalty imposed by a confirmation decision relating to the failure (and the confirmation decision did not impose any requirements of a kind described in section 133(1));
iii the provider would be likely to fail to comply with requirements imposed by a confirmation decision if given;
iv the circumstances of the failure or the risks of harm to individuals in the United Kingdom are such that it is appropriate to make the application without having given a provisional notice of contravention, without having given a confirmation decision, or (having given a confirmation decision imposing requirements) without waiting to ascertain compliance with those requirements.
4 The grounds mentioned in subsection (1)(b) are that—
a the provider of the Part 3 service has failed to comply with a notice under section 121(1) that relates to the service (notices to deal with terrorism content and CSEA content), and
b the failure is continuing.
5 An application by OFCOM for a service restriction order must—
a specify the regulated service in relation to which the application is made (“the relevant service”),
b specify the provider of that service (“the non-compliant provider”),
c specify the grounds on which the application is based, and contain evidence about those grounds,
d specify the persons on whom (in OFCOM’s opinion) the requirements of the order should be imposed,
e contain evidence as to why OFCOM consider that the persons mentioned in paragraph (d) provide an ancillary service in relation to the relevant service, and specify any such ancillary service provided,
f specify the requirements which OFCOM consider that the order should impose on such persons, and
g in the case of an application made without notice having been given to the non-compliant provider, or to the persons mentioned in paragraph (d), state why no notice has been given.
6 The court may make a service restriction order imposing requirements on a person in relation to the relevant service if the court is satisfied—
a as to the grounds in subsection (3) or the grounds in subsection (4) (as the case may be),
b that the person provides an ancillary service in relation to the relevant service,
c that it is appropriate to make the order for the purpose of preventing harm to individuals in the United Kingdom, and the order is proportionate to the risk of such harm,
d in the case of an application made on the ground in subsection (3)(c)(iii) or (iv), that it is appropriate to make the order before a provisional notice of contravention or confirmation decision has been given, or before compliance with requirements imposed by a confirmation decision has been ascertained (as the case may be), and
e if no notice of the application has been given to the non-compliant provider, or to the persons on whom requirements are being imposed, that it is appropriate to make the order without notice.
7 When considering whether to make a service restriction order in relation to the relevant service, and when considering what provision it should contain, the court must take into account (among other things) the rights and obligations of all relevant parties, including those of—
a the non-compliant provider,
b the person or persons on whom the court is considering imposing the requirements, and
c United Kingdom users of the relevant service.
8 A service restriction order made in relation to the relevant service must—
a identify the non-compliant provider,
b identify the persons on whom the requirements are imposed, and any ancillary service to which the requirements relate,
c require such persons to take the steps specified in the order, or to put in place arrangements, that have the effect of withdrawing the ancillary service to the extent that it relates to the relevant service (or part of it), or preventing the ancillary service from promoting or displaying content that relates to the relevant service (or part of it) in any way,
d specify the date by which the requirements in the order must be complied with, and
e specify the date on which the order expires, or the period for which the order has effect.
9 The steps that may be specified or arrangements that may be required to be put in place—
a include steps or arrangements that will or may require the termination of an agreement (whether or not made before the coming into force of this section), or the prohibition of the performance of such an agreement, and
b are limited, so far as that is possible, to steps or arrangements relating to the operation of the relevant service as it affects United Kingdom users.
10 OFCOM must inform the Secretary of State as soon as reasonably practicable after a service restriction order has been made.
11 For the purposes of this section, a service is an “ancillary service” in relation to a regulated service if the service facilitates the provision of the regulated service (or part of it), whether directly or indirectly, or displays or promotes content relating to the regulated service (or to part of it).
12 Examples of ancillary services include—
a services, provided (directly or indirectly) in the course of a business, which enable funds to be transferred in relation to a regulated service,
b search engines which generate search results displaying or promoting content relating to a regulated service,
c user-to-user services which make content relating to a regulated service available to users, and
d services which use technology to facilitate the display of advertising on a regulated service (for example, an ad server or an ad network).
13 In this section “the court” means—
a in England and Wales, the High Court or the county court,
b in Scotland, the Court of Session or a sheriff, and
c in Northern Ireland, the High Court or a county court.

I452I55145 Interim service restriction orders

1 OFCOM may apply to the court for an interim order under this section (an “interim service restriction order”) in relation to a regulated service where they consider that—
a the grounds in subsection (3) apply in relation to the service, or
b in the case of a Part 3 service, the grounds in subsection (4) apply in relation to the service.
2 An interim service restriction order is an interim order imposing requirements on one or more persons who provide an ancillary service (whether from within or outside the United Kingdom) in relation to a regulated service (see subsection (9)).
3 The grounds mentioned in subsection (1)(a) are that—
a it is likely that the provider of the regulated service is failing to comply with an enforceable requirement that applies in relation to the regulated service, and
b the level of risk of harm to individuals in the United Kingdom relating to the likely failure, and the nature and severity of that harm, are such that it would not be appropriate to wait to establish the failure before applying for the order.
4 The grounds mentioned in subsection (1)(b) are that—
a it is likely that the provider of the Part 3 service is failing to comply with a notice under section 121(1) that relates to the service (notices to deal with terrorism content and CSEA content), and
b the level of risk of harm to individuals in the United Kingdom relating to the likely failure, and the nature and severity of that harm, are such that it would not be appropriate to wait to establish the failure before applying for the order.
5 An application by OFCOM for an interim service restriction order must—
a specify the regulated service in relation to which the application is made (“the relevant service”),
b specify the provider of that service (“the non-compliant provider”),
c specify the grounds on which the application is based, and contain evidence about those grounds,
d specify the persons on whom (in OFCOM’s opinion) the requirements of the order should be imposed,
e contain evidence as to why OFCOM consider that the persons mentioned in paragraph (d) provide an ancillary service in relation to the relevant service, and specify any such ancillary service provided,
f specify the requirements which OFCOM consider that the order should impose on such persons, and
g in the case of an application made without notice having been given to the non-compliant provider, or to the persons mentioned in paragraph (d), state why no notice has been given.
6 The court may make an interim service restriction order imposing requirements on a person in relation to the relevant service if the court is satisfied—
a as to the ground in subsection (3)(a) or the ground in subsection (4)(a) (as the case may be),
b that the person provides an ancillary service in relation to the relevant service,
c that there are prima facie grounds to suggest that an application for a service restriction order under section 144 would be successful,
d that the level of risk of harm to individuals in the United Kingdom relating to the likely failure mentioned in subsection (3)(a) or (4)(a) (whichever applies), and the nature and severity of that harm, are such that it is not appropriate to wait for the failure to be established before making the order, and
e if no notice of the application has been given to the non-compliant provider, or to the persons on whom requirements are being imposed, that it is appropriate to make the order without notice.
7 An interim service restriction order ceases to have effect on the earlier of—
a the date specified in the order, or the date on which the period specified in the order expires (as the case may be), and
b the date on which the court makes a service restriction order under section 144 in relation to the relevant service that imposes requirements on the same persons on whom requirements are imposed by the interim order, or dismisses the application for such an order.
8 Subsections (7) to (10) of section 144 apply in relation to an interim service restriction order under this section as they apply in relation to a service restriction order under that section.
9 In this section, “ancillary service” and “the court” have the same meaning as in section 144 (see subsections (11), (12) and (13) of that section).

I506I42146 Access restriction orders

1 OFCOM may apply to the court for an order under this section (an “access restriction order”) in relation to a regulated service where they consider that—
a the grounds in section 144(3) or (4) apply in relation to the service, and
b either—
i a service restriction order under section 144 or an interim service restriction order under section 145 has been made in relation to the failure, and it was not sufficient to prevent significant harm arising to individuals in the United Kingdom as a result of the failure, or
ii the likely consequences of the failure are such that if a service restriction order or an interim service restriction order were to be made, it would be unlikely to be sufficient to prevent significant harm arising to individuals in the United Kingdom as a result of the failure,
and in this paragraph, “the failure” means the failure mentioned in section 144(3)(a) or (4)(a) (as the case may be).
2 An access restriction order is an order imposing requirements on one or more persons who provide an access facility (whether from within or outside the United Kingdom) in relation to a regulated service (see subsection (10)).
3 An application by OFCOM for an access restriction order must—
a specify the regulated service in relation to which the application is made (“the relevant service”),
b specify the provider of that service (“the non-compliant provider”),
c specify the grounds on which the application is based, and contain evidence about those grounds,
d specify the persons on whom (in OFCOM’s opinion) the requirements of the order should be imposed,
e contain evidence as to why OFCOM consider that the persons mentioned in paragraph (d) provide an access facility in relation to the relevant service, and specify any such access facility provided,
f specify the requirements which OFCOM consider that the order should impose on such persons, and
g in the case of an application made without notice having been given to the non-compliant provider, or to the persons mentioned in paragraph (d), state why no notice has been given.
4 The court may make an access restriction order imposing requirements on a person in relation to the relevant service if the court is satisfied—
a as to the grounds in subsection (1),
b that the person provides an access facility in relation to the relevant service,
c that it is appropriate to make the order for the purpose of preventing significant harm to individuals in the United Kingdom, and the order is proportionate to the risk of such harm,
d in the case of an application made on the ground in subsection (3)(c)(iii) or (iv) of section 144 (by virtue of subsection (1)(a)), that it is appropriate to make the order before a provisional notice of contravention or confirmation decision has been given, or before compliance with requirements imposed by a confirmation decision has been ascertained (as the case may be), and
e if no notice of the application has been given to the non-compliant provider, or to the persons on whom requirements are being imposed, that it is appropriate to make the order without notice.
5 When considering whether to make an access restriction order in relation to the relevant service, and when considering what provision it should contain, the court must take into account (among other things) the rights and obligations of all relevant parties, including those of—
a the non-compliant provider,
b the person or persons on whom the court is considering imposing the requirements, and
c United Kingdom users of the relevant service.
6 An access restriction order made in relation to the relevant service must—
a identify the non-compliant provider,
b identify the persons on whom the requirements are imposed, and any access facility to which the requirements relate,
c require such persons to take the steps specified in the order, or to put in place arrangements, to withdraw, adapt or manipulate the access facility in order to impede users’ access (by means of that facility) to the relevant service (or to part of it),
d specify the date by which the requirements in the order must be complied with, and
e specify the date on which the order expires, or the period for which the order has effect.
7 The steps that may be specified or arrangements that may be required to be put in place—
a include steps or arrangements that will or may require the termination of an agreement (whether or not made before the coming into force of this section), or the prohibition of the performance of such an agreement,
b are limited, so far as that is possible, to steps or arrangements that impede the access of United Kingdom users, and
c are limited, so far as that is possible, to steps or arrangements that do not affect such users’ ability to access any other internet services.
8 OFCOM must inform the Secretary of State as soon as reasonably practicable after an access restriction order has been made.
9 Where a person who provides an access facility takes steps or puts in place arrangements required by an access restriction order, OFCOM may, by notice, require that person to (where possible) notify persons in the United Kingdom who attempt to access the relevant service via that facility of the access restriction order (and where a confirmation decision has been given to the non-compliant provider, the notification must refer to that decision).
10 For the purposes of this section, a facility is an “access facility” in relation to a regulated service if the person who provides the facility is able to withdraw, adapt or manipulate it in such a way as to impede access (by means of that facility) to the regulated service (or to part of it) by United Kingdom users of that service.
11 Examples of access facilities include—
a internet access services by means of which a regulated service is made available, and
b app stores through which a mobile app for a regulated service may be downloaded or otherwise accessed.
12 In this section—
  • “the court” means—
    1. in England and Wales, the High Court or the county court,
    2. in Scotland, the Court of Session or a sheriff, and
    3. in Northern Ireland, the High Court or a county court;
  • “facility” means any kind of service, infrastructure or apparatus enabling users of a regulated service to access the regulated service;
  • “internet access service” means a service that provides access to virtually all (or just some) of the end points of the internet.

I865I526147 Interim access restriction orders

1 OFCOM may apply to the court for an interim order under this section (an “interim access restriction order”) in relation to a regulated service where they consider that—
a the grounds in section 145(3) or (4) apply in relation to the service, and
b either—
i a service restriction order under section 144 or an interim service restriction order under section 145 has been made in relation to the likely failure, and it was not sufficient to prevent significant harm arising to individuals in the United Kingdom as a result of the failure, or
ii the likely consequences of such a failure would be such that if a service restriction order or an interim service restriction order were to be made, it would be unlikely to be sufficient to prevent significant harm arising to individuals in the United Kingdom as a result of the failure,
and in this section, “the likely failure” means the likely failure mentioned in section 145(3)(a) or (4)(a) (as the case may be).
2 An interim access restriction order is an interim order imposing requirements on one or more persons who provide an access facility (whether from within or outside the United Kingdom) in relation to a regulated service (see subsection (8)).
3 An application by OFCOM for an interim access restriction order must—
a specify the regulated service in relation to which the application is made (“the relevant service”),
b specify the provider of that service (“the non-compliant provider”),
c specify the grounds on which the application is based, and contain evidence about those grounds,
d specify the persons on whom (in OFCOM’s opinion) the requirements of the order should be imposed,
e contain evidence as to why OFCOM consider that the persons mentioned in paragraph (d) provide an access facility in relation to the relevant service, and specify any such access facility provided,
f specify the requirements which OFCOM consider that the order should impose on such persons, and
g in the case of an application made without notice having been given to the non-compliant provider, or to the persons mentioned in paragraph (d), state why no notice has been given.
4 The court may make an interim access restriction order imposing requirements on a person in relation to the relevant service if the court is satisfied—
a that the ground in section 145(3)(a) or (4)(a) (as the case may be) applies in relation to the service,
b as to the ground in subsection (1)(b)(i) or (ii),
c that the person provides an access facility in relation to the relevant service,
d that there are prima facie grounds to suggest that an application for an access restriction order under section 146 would be successful,
e that the level of risk of harm to individuals in the United Kingdom relating to the likely failure, and the nature and severity of that harm, are such that it is not appropriate to wait for the failure to be established before making the order, and
f if no notice of the application has been given to the non-compliant provider, or to the persons on whom requirements are being imposed, that it is appropriate to make the order without notice.
5 An interim access restriction order ceases to have effect on the earlier of—
a the date specified in the order, or the date on which the period specified in the order expires (as the case may be), and
b the date on which the court makes an access restriction order under section 146 in relation to the relevant service that imposes requirements on the same persons on whom requirements are imposed by the interim order, or dismisses an application for such an order.
6 Subsections (5) to (8) of section 146 apply in relation to an interim access restriction order under this section as they apply in relation to an access restriction order under that section.
7 Where a person who provides an access facility takes steps or puts in place arrangements required by an interim access restriction order, OFCOM may, by notice, require that person to (where possible) notify persons in the United Kingdom who attempt to access the relevant service via that facility of the interim access restriction order.
8 In this section, “access facility” and “the court” have the same meaning as in section 146 (see subsections (10), (11) and (12) of that section).

I110I379148 Interaction with other action by OFCOM

1 Where OFCOM apply for a business disruption order in respect of a failure by a provider of a regulated service to comply with an enforceable requirement, nothing in sections 144 to 147 is to be taken to prevent OFCOM also giving the provider—
a a confirmation decision in respect of the failure, or
b a penalty notice under section 139 in relation to a confirmation decision in respect of the failure.
2 Where OFCOM apply for a business disruption order in respect of a failure by a provider of a Part 3 service to comply with a notice under section 121(1) (notices to deal with terrorism content and CSEA content), nothing in sections 144 to 147 is to be taken to prevent OFCOM also giving the provider either or both of the following—
a a further notice under section 121(1) (see section 126);
b a penalty notice under section 140(5).
3 In this section, a “business disruption order” means—
a a service restriction order under section 144,
b an interim service restriction order under section 145,
c an access restriction order under section 146, or
d an interim access restriction order under section 147.

Publication of enforcement action

I345I425149 Publication by OFCOM of details of enforcement action

1 Subsections (2) and (3) apply where OFCOM have given a person (and not withdrawn) any of the following—
a a confirmation decision;
b a penalty notice under section 139;
c a penalty notice under section 140(5);
d a penalty notice under section 141(6).
2 OFCOM must publish details identifying the person and describing—
a the failure (or failures) to which the decision or notice relates, and
b OFCOM’s response.
3 But OFCOM may not publish anything that, in OFCOM’s opinion—
a is confidential in accordance with subsections (4) and (5), or
b is otherwise not appropriate for publication.
4 A matter is confidential under this subsection if—
a it relates specifically to the affairs of a particular body, and
b publication of that matter would or might, in OFCOM’s opinion, seriously and prejudicially affect the interests of that body.
5 A matter is confidential under this subsection if—
a it relates to the private affairs of an individual, and
b publication of that matter would or might, in OFCOM’s opinion, seriously and prejudicially affect the interests of that individual.
6 Where OFCOM have given a person a provisional notice of contravention but have not given the person a confirmation decision, OFCOM may publish details identifying the person and describing the reasons for the provisional notice.
7 OFCOM must notify the person concerned that information has been published under this section.

I801I39150 Publication by providers of details of enforcement action

1 This section applies where—
a OFCOM have given a person (and not withdrawn) any of the following—
i a confirmation decision;
ii a penalty notice under section 139;
iii a penalty notice under section 140(5);
iv a penalty notice under section 141(6), and
b the appeal period in relation to the decision or notice has ended.
2 OFCOM may give to the person a notice (a “publication notice”) requiring the person to—
a publish details describing—
i the failure (or failures) to which the decision or notice mentioned in subsection (1)(a) relates, and
ii OFCOM’s response, or
b otherwise notify users of the service to which the decision or notice mentioned in subsection (1)(a) relates of those details.
3 A publication notice may require a person to publish details under subsection (2)(a) or give notification of details under subsection (2)(b) or both.
4 A publication notice must—
a specify the decision or notice mentioned in subsection (1)(a) to which it relates,
b specify or describe the details that must be published or notified,
c specify the form and manner in which the details must be published or notified,
d specify a date by which the details must be published or notified, and
e contain information about the consequences of not complying with the notice.
5 Where a publication notice requires a person to publish details under subsection (2)(a) the notice may also specify a period during which publication in the specified form and manner must continue.
6 Where a publication notice requires a person to give notification of details under subsection (2)(b) the notice may only require that notification to be given to United Kingdom users of the service (see section 227).
7 A publication notice may not require a person to publish or give notification of anything that, in OFCOM’s opinion—
a is confidential in accordance with subsections (8) and (9), or
b is otherwise not appropriate for publication or notification.
8 A matter is confidential under this subsection if—
a it relates specifically to the affairs of a particular body, and
b publication or notification of that matter would or might, in OFCOM’s opinion, seriously and prejudicially affect the interests of that body.
9 A matter is confidential under this subsection if—
a it relates to the private affairs of an individual, and
b publication or notification of that matter would or might, in OFCOM’s opinion, seriously and prejudicially affect the interests of that individual.
10 A person to whom a publication notice is given has a duty to comply with it.
11 The duty under subsection (10) is enforceable in civil proceedings by OFCOM—
a for an injunction,
b for specific performance of a statutory duty under section 45 of the Court of Session Act 1988, or
c for any other appropriate remedy or relief.
12 For the purposes of subsection (1)(b) “the appeal period”, in relation to a decision or notice mentioned in subsection (1)(a), means—
a the period during which any appeal relating to the decision or notice may be made, or
b where such an appeal has been made, the period ending with the determination or withdrawal of that appeal.

Guidance

I823151 OFCOM’s guidance about enforcement action

1 OFCOM must produce guidance for providers of regulated services about how OFCOM propose to exercise their functions under this Chapter.
2 The guidance must, in particular, give information about the factors that OFCOM would consider it appropriate to take into account when taking, or considering taking, enforcement action relating to a person’s failure to comply with different kinds of enforceable requirements.
3 In relation to any enforcement action by OFCOM which relates to a failure by a provider of a regulated service to comply with a relevant duty, the guidance must include provision explaining how OFCOM will take into account the impact (or possible impact) of such a failure on children.
4 Before producing the guidance (including revised or replacement guidance), OFCOM must consult—
a the Secretary of State,
b the Information Commissioner, and
c such other persons as OFCOM consider appropriate.
5 OFCOM must publish the guidance (and any revised or replacement guidance).
6 Guidelines prepared by OFCOM under section 392 of the Communications Act (amount of penalties) may, so far as relating to penalties imposed under this Chapter, be included in the same document as guidance under this section.
7 In exercising their functions under this Chapter, or deciding whether to exercise them, OFCOM must have regard to the guidance for the time being published under this section.
8 In this section, a “relevant duty” means—
a a duty set out in section 10 or 27 (illegal content),
b a duty set out in section 12 or 29 (children’s online safety), or
c a duty set out in section 81(2) (children’s access to provider pornographic content).

CHAPTER 7 Committees, research and reports

I363I143152 Advisory committee on disinformation and misinformation

1 OFCOM must, in accordance with the following provisions of this section, exercise their powers under paragraph 14 of the Schedule to the Office of Communications Act 2002 (committees of OFCOM) to establish and maintain a committee to provide the advice specified in this section.
2 The committee is to consist of—
a a chairman appointed by OFCOM, and
b such number of other members appointed by OFCOM as OFCOM consider appropriate.
3 In appointing persons to be members of the committee, OFCOM must have regard to the desirability of ensuring that the members of the committee include—
a persons representing the interests of United Kingdom users of regulated services,
b persons representing providers of regulated services, and
c persons with expertise in the prevention and handling of disinformation and misinformation online.
4 The function of the committee is to provide advice to OFCOM (including other committees established by OFCOM) about—
a how providers of regulated services should deal with disinformation and misinformation on such services,
b OFCOM’s exercise of the power conferred by section 77 to require information about a matter listed in Part 1 or 2 of Schedule 8, so far as relating to disinformation and misinformation, and
c OFCOM’s exercise of their functions under section 11 of the Communications Act (duties to promote media literacy) in relation to countering disinformation and misinformation on regulated services.
5 The committee must publish a report within the period of 18 months after being established, and after that must publish periodic reports.

I313I614153 Functions of the Content Board

1 Section 13 of the Communications Act (functions of the Content Board) is amended as follows.
2 At the beginning of subsection (2), insert “Subject to subsection (3A),”.
3 After subsection (3) insert—
4 After subsection (7) insert—

I716I5154 Research about users’ experiences of regulated services

1 Section 14 of the Communications Act (consumer research) is amended as follows.
2 After subsection (6A) insert—
3 After subsection (8) insert—

154A Information for research about online safety matters

1 The Secretary of State may by regulations require providers of regulated services to provide information for purposes related to the carrying out of independent research into online safety matters.
2 Regulations under this section may (for example) provide for—
a the making of applications by persons seeking information;
b the procedure to be followed in the making and determination of applications;
c the grounds on which applications are to be determined;
d the imposition of requirements described in subsection (1) to be effected by means of notices given to providers of regulated services (“researcher access notices”);
e the contents of researcher access notices;
f the procedure to be followed in the giving of researcher access notices;
g the form in which, and the means by which, information is to be provided;
h the safeguards to be applied in respect of the handling of information;
i the charging of fees payable by applicants for information under the regulations and by providers of regulated services;
j the enforcement of requirements imposed by the regulations;
k appeals in respect of decisions taken under the regulations.
3 Provision about enforcement under subsection (2)(j) may include provision—
a about investigations (including the making of reports);
b conferring powers of entry, inspection and audit;
c imposing monetary penalties;
d creating offences, but such provision may not impose a penalty for an offence that is greater than a penalty of any of the descriptions mentioned in section 113.
4 Regulations under this section—
a may authorise or require anything that is to be done under, or for the purposes of, the regulations to be done by an appropriate person;
b may confer a discretion on an appropriate person for the purposes of provision under paragraph (a);
c may apply (with or without modifications) other provisions of this Act.
5 Regulations under this section may apply generally or only in relation to specified descriptions of—
a regulated services;
b persons carrying out independent research;
c research into online safety matters or the purposes of such research;
d information,
and provision made by virtue of section 224(1) in connection with this section may, in particular, make different provision for different descriptions of services, researchers, research or information.
6 Regulations under this section may not require—
a processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, the duty imposed under the regulations to provide information is to be taken into account);
b provision of information in respect of which a claim to legal professional privilege, or (in Scotland) to confidentiality of communications, could be maintained in legal proceedings.
7 Before making regulations under this section the Secretary of State must consult—
a OFCOM,
b the Information Commissioner,
c persons who appear to the Secretary of State to represent providers of regulated services,
d persons who appear to the Secretary of State to represent the interests of persons carrying out independent research into online safety matters, and
e such other persons as the Secretary of State considers appropriate.
8 For the purposes of this section—
a “independent research” is research carried out other than on behalf of a provider of a regulated service;
b references to an “appropriate person” are references to—
i OFCOM, or
ii such other person as the Secretary of State considers appropriate to carry out functions under regulations made under this section (and the regulations may include provision establishing a body for this purpose).

I454I90155 Consumer consultation

1 Section 16 of the Communications Act (consumer consultation) is amended as follows.
2 In subsection (4), after paragraph (d) insert—
.
3 After subsection (5) insert—
4 After subsection (12) insert—
5 In subsection (13), in the definition of “domestic and small business consumer”, in paragraph (b)(i), after “available” insert “or a provider of a regulated service”.
6 After subsection (13) insert—

I765I585156 OFCOM’s statement about freedom of expression and privacy

OFCOM’s report under paragraph 12 of the Schedule to the Office of Communications Act 2002 for each financial year must contain a statement by OFCOM about the steps they have taken, and the processes they operate, to ensure that their online safety functions have been exercised in that year compatibly with Articles 8 and 10 of the Convention (so far as relevant).

I226I521157 OFCOM’s reports about use of age assurance

1 OFCOM must produce and publish a report assessing—
a how providers of regulated services have used age assurance for the purpose of compliance with their duties set out in this Act,
b how effective the use of age assurance has been for that purpose, and
c whether there are factors that have prevented or hindered the effective use of age assurance, or a particular kind of age assurance, for that purpose,
(and in this section, references to a report are to a report described in this subsection).
2 A report must, in particular, consider whether the following have prevented or hindered the effective use of age assurance—
a the costs to providers of using it, and
b the need to protect users from a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of a regulated service (including, but not limited to, any such provision or rule concerning the processing of personal data).
3 Unless the Secretary of State requires the production of a further report (see subsection (6)), the requirement in subsection (1) is met by producing and publishing one report within the period of 18 months beginning with the day on which sections 12 and 81(2) come into force (or if those provisions come into force on different days, the period of 18 months beginning with the later of those days).
4 In preparing a report, OFCOM must consult—
a the Information Commissioner, and
b such other persons as OFCOM consider appropriate.
5 OFCOM must send a copy of a report to the Secretary of State, and the Secretary of State must lay it before Parliament.
6 The Secretary of State may require OFCOM to produce and publish a further report in response to—
a the development of age assurance technology, or
b evidence of the reduced effectiveness of such technology.
7 But such a requirement may not be imposed—
a within the period of three years beginning with the date on which the first report is published, or
b more frequently than once every three years.
8 For further provision about reports under this section, see section 164.
9 In this section “age assurance” means age verification or age estimation.

I625I167158 OFCOM’s reports about news publisher content and journalistic content

1 OFCOM must produce and publish a report assessing the impact of the regulatory framework provided for in this Act on the availability and treatment of news publisher content and journalistic content on Category 1 services (and in this section, references to a report are to a report described in this subsection).
2 Unless the Secretary of State requires the production of a further report (see subsection (6)), the requirement in subsection (1) is met by producing and publishing one report within the period of two years beginning with the day on which sections 18 and 19 come into force (or if those sections come into force on different days, the period of two years beginning with the later of those days).
3 A report must, in particular, consider how effective the duties to protect such content set out in sections 18 and 19 are at protecting it.
4 In preparing a report, OFCOM must consult—
a persons who represent recognised news publishers,
b persons who appear to OFCOM to represent creators of journalistic content,
c persons who appear to OFCOM to represent providers of Category 1 services, and
d such other persons as OFCOM consider appropriate.
5 OFCOM must send a copy of a report to the Secretary of State, and the Secretary of State must lay it before Parliament.
6 The Secretary of State may require OFCOM to produce and publish a further report if the Secretary of State considers that the regulatory framework provided for in this Act is, or may be, having a detrimental effect on the availability and treatment of news publisher content or journalistic content on Category 1 services.
7 But such a requirement may not be imposed—
a within the period of three years beginning with the date on which the first report is published, or
b more frequently than once every three years.
8 For further provision about reports under this section, see section 164.
9 In this section—
  • “journalistic content” has the meaning given by section 19;
  • “news publisher content” has the meaning given by section 55;
  • “recognised news publisher” has the meaning given by section 56.
10 For the meaning of “Category 1 service”, see section 95 (register of categories of services).

I694I127159 OFCOM’s transparency reports

1 OFCOM must produce transparency reports based on information contained in the transparency reports produced by providers of Part 3 services under section 77.
2 OFCOM’s transparency reports must contain—
a a summary of conclusions drawn from the transparency reports produced under section 77 regarding patterns or trends which OFCOM have identified in such reports,
b a summary of measures mentioned in such transparency reports which OFCOM consider to be good industry practice, and
c any other information from such transparency reports which OFCOM consider it appropriate to include.
3 OFCOM’s first transparency report must be published by the end of the period of one year beginning with—
a the day on which the first report under section 77 is published by a provider of a Part 3 service (see subsection (3)(d) of that section), or
b if later, the earliest date specified by OFCOM for submission of a report under section 77 in a notice given to a provider (see subsection (3)(c) of that section).
4 OFCOM must publish a transparency report at least once a year after the publication of their first transparency report.
5 For further provision about reports under this section, see section 164.

I704160 OFCOM’s report about reporting and complaints procedures

1 OFCOM must produce a report assessing the measures taken or in use by providers of Part 3 services to enable users and others to—
a report particular kinds of content present on such services, and
b make complaints to providers of such services.
2 OFCOM’s report must take into account the experiences of users and others in reporting content and making complaints to providers of Part 3 services, including—
a how clear the procedures are for reporting content and making complaints,
b how easy it is to do those things, and
c whether providers are taking appropriate and timely action in response to reports and complaints that are made.
3 The report must include advice from OFCOM about whether they consider that the Secretary of State should make regulations under section 217 (duty about alternative dispute resolution procedure).
4 In the report, OFCOM may make recommendations that they consider would improve the experiences of users and others in reporting content or making complaints to providers of Part 3 services, or would deliver better outcomes in relation to reports or complaints that are made.
5 In preparing the report under this section, OFCOM must consult—
a the Secretary of State,
b persons who appear to OFCOM to represent the interests of United Kingdom users of Part 3 services,
c persons who appear to OFCOM to represent the interests of children (generally or with particular reference to online safety matters),
d the Information Commissioner, and
e such other persons as OFCOM consider appropriate.
6 The report may draw on OFCOM’s research under section 14 of the Communications Act (see subsection (6B) of that section).
7 The report is not required to address any matters which are the subject of a report by OFCOM under section 158 (report about the availability and treatment of news publisher content and journalistic content).
8 OFCOM must publish the report within the period of two years beginning with the day on which this section comes into force.
9 OFCOM must send a copy of the report to the Secretary of State, and the Secretary of State must lay it before Parliament.
10 The Secretary of State must publish a statement responding to the report within the period of three months beginning with the day on which the report is published, and the statement must include a response to OFCOM’s advice about whether to make regulations under section 217.
11 The statement must be published in such manner as the Secretary of State considers appropriate for bringing it to the attention of persons who may be affected by it.
12 For further provision about the report under this section, see section 164.
13 References in this section to “users and others” are to United Kingdom users and individuals in the United Kingdom.

I435I88161 OFCOM’s report about use of app stores by children

1 OFCOM must produce a report about the use of app stores by children.
2 In particular, the report must—
a assess what role app stores play in children encountering content that is harmful to children, search content that is harmful to children or regulated provider pornographic content by means of regulated apps which the app stores make available,
b assess the extent to which age assurance is currently used by providers of app stores, and how effective it is, and
c explore whether children’s online safety would be better protected by the greater use of age assurance or particular kinds of age assurance by such providers, or by other measures.
3 OFCOM must publish the report during the period beginning two years, and ending three years, after the day on which sections 12 and 29 come into force (or if those sections come into force on different days, the later of those days).
4 For further provision about the report under this section, see section 164.
5 In this section—
  • “age assurance” means age verification or age estimation;
  • “app” includes an app for use on any kind of device, and “app store” is to be read accordingly;
  • “content that is harmful to children” has the same meaning as in Part 3 (see section 60);
  • “regulated app” means an app for a regulated service;
  • “regulated provider pornographic content” has the same meaning as in Part 5 (see section 79);
  • “search content” has the same meaning as in Part 3 (see section 57).
6 In this section references to children are to children in the United Kingdom.

I699162 OFCOM’s report about researchers’ access to information

I2561 OFCOM must produce a report—
a describing how, and to what extent, persons carrying out independent research into online safety matters are currently able to obtain information from providers of regulated services to inform their research,
b exploring the legal and other issues which currently constrain the sharing of information for such purposes, and
c assessing the extent to which greater access to information for such purposes might be achieved.
I2562 For the purposes of this section a person carries out “independent research” if the person carries out research on behalf of a person other than a provider of a regulated service.
I2563 In preparing the report, OFCOM must consult—
a the Information Commissioner,
b the Centre for Data Ethics and Innovation,
c United Kingdom Research and Innovation,
d persons who appear to OFCOM to represent providers of regulated services, and
e such other persons as OFCOM consider appropriate.
I2564 OFCOM must publish the report within the period of 18 months beginning with the day on which this section comes into force.
I2565 OFCOM must send a copy of the report to the Secretary of State, and the Secretary of State must lay it before Parliament.
I2566 For further provision about the report under this section, see section 164.
F307 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
F308 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
F309 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
F3010 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

I116I839163 OFCOM’s report in connection with investigation into a death

1 Subsection (2) applies if OFCOM receive—
a a notice from a senior coroner under paragraph 1(2) of Schedule 5 to the Coroners and Justice Act 2009 in connection with an investigation into the death of a person;
b a request for information in connection with the investigation of a procurator fiscal into, or an inquiry held or to be held in relation to, the death of a person;
c a notice from a coroner under section 17A(2) of the Coroners Act (Northern Ireland) 1959 (c. 15 (N.I.)) in connection with—
i an investigation to determine whether an inquest into the death of a person is necessary, or
ii an inquest in relation to the death of a person.
2 OFCOM may produce a report for use by the coroner or procurator fiscal, dealing with any matters that they consider may be relevant.
3 In subsection (1)(b) “inquiry” means an inquiry held, or to be held, under the Inquiries into Fatal Accidents and Sudden Deaths etc. (Scotland) Act 2016 (asp 2).

I287I732164 OFCOM’s reports

1 OFCOM may from time to time produce and publish reports about online safety matters.
2 In publishing a report mentioned in subsection (5), OFCOM must have regard to the need to exclude from publication, so far as that is practicable, the matters which are confidential in accordance with subsections (3) and (4).
3 A matter is confidential under this subsection if—
a it relates specifically to the affairs of a particular body, and
b publication of that matter would or might, in OFCOM’s opinion, seriously and prejudicially affect the interests of that body.
4 A matter is confidential under this subsection if—
a it relates to the private affairs of an individual, and
b publication of that matter would or might, in OFCOM’s opinion, seriously and prejudicially affect the interests of that individual.
5 The reports referred to in subsection (2) are—
a a report under section 128 (report in connection with notices to deal with terrorism content and CSEA content),
b a report under section 157 (report about use of age assurance),
c a report under section 158 (report about news publisher content and journalistic content),
d a report under section 159 (transparency report),
e a report under section 160 (report about reporting and complaints procedures),
f a report under section 161 (report about use of app stores by children),
g a report under section 162 (report about researchers’ access to information), and
h a report produced under this section.
6 See also section 116(3) (restriction on publishing intelligence service information).

CHAPTER 8 Media literacy

I787I136165 Media literacy

1 Section 11 of the Communications Act is amended in accordance with subsections (2) to (5).
2 Before subsection (1) insert—
3 After subsection (1) insert—
4 After subsection (2) insert—
5 In the heading, for “Duty” substitute “Duties”.
6 In section 14 of the Communications Act (consumer research), in subsection (6)(a), after “11(1)” insert “, (1A) and (1B)”.

I99I900166 Media literacy strategy and media literacy statement

After section 11 of the Communications Act insert—

PART 8 Appeals and super-complaints

CHAPTER 1 Appeals

I617I192167 Appeals against OFCOM decisions relating to the register under section 95

1 This section applies to the following decisions of OFCOM—
a a decision to include a regulated user-to-user service in the part of the register referred to in section 95(2)(a) (Category 1 services);
b a decision not to remove a regulated user-to-user service from that part of the register;
c a decision to include a regulated search service or a combined service in the part of the register referred to in section 95(2)(b) (Category 2A services);
d a decision not to remove a regulated search service or a combined service from that part of the register;
e a decision to include a regulated user-to-user service in the part of the register referred to in section 95(2)(c) (Category 2B services);
f a decision not to remove a regulated user-to-user service from that part of the register.
2 The provider of the service to which the decision relates may appeal to the Upper Tribunal against the decision.
3 Where an appeal is made under subsection (1)(a), (c) or (e), any special requirements need not be complied with until the determination or withdrawal of the appeal.
4 “Special requirement” means—
a in the case of an appeal against a decision mentioned in subsection (1)(a)—
i any duty or requirement of this Act that applies in relation to Category 1 services but not in relation to any other regulated services, or
ii any duty or requirement of this Act that applies in relation to Category 1 services, Category 2A services and Category 2B services but not in relation to any other regulated services;
b in the case of an appeal against a decision mentioned in subsection (1)(c)—
i any duty or requirement of this Act that applies in relation to Category 2A services but not in relation to any other regulated services, or
ii any duty or requirement of this Act that applies in relation to Category 1 services, Category 2A services and Category 2B services but not in relation to any other regulated services;
c in the case of an appeal against a decision mentioned in subsection (1)(e), any duty or requirement of this Act that applies in relation to Category 1 services, Category 2A services and Category 2B services but not in relation to any other regulated services.
5 The Upper Tribunal must decide the appeal by applying the same principles as would be applied—
a by the High Court on an application for judicial review, or
b in Scotland, on an application to the supervisory jurisdiction of the Court of Session.
6 On an appeal under this section, the Upper Tribunal may—
a dismiss the appeal, or
b quash the decision being challenged.
7 Where a decision is quashed, the Upper Tribunal must remit the decision to OFCOM for reconsideration with such directions (if any) as the Tribunal considers appropriate.

I529I418168 Appeals against OFCOM notices

1 An appeal to the Upper Tribunal against OFCOM’s decision to give to a person—
a a notice under section 121(1) (notices to deal with terrorism content and CSEA content),
b a confirmation decision, or
c a penalty notice,
may be brought by any person with a sufficient interest in the decision.
2 An appeal under subsection (1) by a person other than the person given the notice or decision in question may be brought only with the permission (or leave) of the Upper Tribunal.
3 The Upper Tribunal must decide the appeal by applying the same principles as would be applied—
a by the High Court on an application for judicial review, or
b in Scotland, on an application to the supervisory jurisdiction of the Court of Session.
4 On an appeal under this section, the Upper Tribunal may—
a dismiss the appeal, or
b quash the decision being challenged.
5 Where a decision is quashed, the Upper Tribunal must remit the decision to OFCOM for reconsideration with such directions (if any) as the Tribunal considers appropriate.
6 In this section “penalty notice” means a penalty notice under section 139, 140(5) or 141(6).

CHAPTER 2 Super-complaints

I389169 Power to make super-complaints

1 An eligible entity may make a complaint to OFCOM that any feature of one or more regulated services, or any conduct of one or more providers of such services, or any combination of such features and such conduct is, appears to be, or presents a material risk of—
a causing significant harm to users of the services or members of the public, or a particular group of such users or members of the public;
b significantly adversely affecting the right to freedom of expression within the law of users of the services or members of the public, or of a particular group of such users or members of the public; or
c otherwise having a significant adverse impact on users of the services or members of the public, or on a particular group of such users or members of the public.
2 But a complaint under subsection (1) that relates to a single regulated service or that relates to a single provider of one or more regulated services is only admissible if OFCOM consider that—
a the complaint is of particular importance, or
b the complaint relates to the impacts on a particularly large number of users of the service or members of the public.
3 An entity is an “eligible entity” if the entity meets criteria specified in regulations made by the Secretary of State.
4 Regulations under subsection (3) must specify as one of the criteria that the entity must be a body representing the interests of users of regulated services, or members of the public, or a particular group of such users or members of the public.
5 Before making regulations under subsection (3), the Secretary of State must consult—
a OFCOM, and
b such other persons as the Secretary of State considers appropriate.
6 In this section—
  • “conduct” includes acts and omissions;
  • “users” means United Kingdom users (see section 227), except in subsection (1)(a) where “users” means individuals in the United Kingdom who are users of a service.

I134170 Procedure for super-complaints

1 The Secretary of State must make regulations containing provision about procedural matters relating to complaints under section 169.
2 Such regulations may, in particular, include provision about the following matters—
a notification to OFCOM of an intention to make a complaint under section 169;
b the form and manner of such a complaint, including requirements for supporting evidence in relation to—
i matters mentioned in subsections (1) and (2) of section 169, and
ii criteria specified in regulations under subsection (3) of that section;
c steps that OFCOM must take in relation to such a complaint, including requirements for publication of responses;
d time limits for taking steps in relation to such a complaint (or provision about how such time limits are to be determined) including time limits in relation to the determination of—
i whether a complaint is a complaint that is within section 169(1),
ii where applicable, whether a complaint is admissible under section 169(2), and
iii whether an entity is an eligible entity (see section 169(3)).
3 Before making regulations under subsection (1), the Secretary of State must consult—
a OFCOM, and
b such other persons as the Secretary of State considers appropriate.

I556I58171 OFCOM’s guidance about super-complaints

1 OFCOM must produce guidance about complaints under section 169, which must include guidance about—
a the criteria specified in regulations under section 169(3),
b procedural matters relating to such complaints, and
c any other aspect of such complaints that OFCOM consider it appropriate to include.
2 OFCOM must publish the guidance (and any revised or replacement guidance).

PART 9 Secretary of State's functions in relation to regulated services

Strategic priorities

I396I209172 Statement of strategic priorities

1 The Secretary of State may designate a statement for the purposes of this section if the requirements set out in section 173 (consultation and parliamentary procedure) are satisfied.
2 The statement is a statement prepared by the Secretary of State that sets out strategic priorities of His Majesty’s Government in the United Kingdom relating to online safety matters.
3 The statement may, among other things, set out particular outcomes identified with a view to achieving the strategic priorities.
4 This section does not restrict the Secretary of State’s powers under any other provision of this Act or any other enactment.
5 A statement designated under subsection (1) must be published in such manner as the Secretary of State considers appropriate.
6 A statement designated under subsection (1) may be amended (including by replacing the whole or a part of the statement with new material) by a subsequent statement designated under that subsection, and this section and sections 92 and 173 apply in relation to any such subsequent statement as they apply in relation to the original statement.
7 Except as provided by subsection (8), no amendment may be made under subsection (6) within the period of five years beginning with the day on which a statement was most recently designated under subsection (1).
8 An earlier amendment may be made under subsection (6) if—
a since that day—
i a Parliamentary general election has taken place, or
ii there has been a significant change in the policy of His Majesty’s Government affecting online safety matters, or
b the Secretary of State considers that the statement, or any part of it, conflicts with any of OFCOM’s general duties (within the meaning of section 3 of the Communications Act).

I644I18173 Consultation and parliamentary procedure

1 This section sets out the requirements that must be satisfied in relation to a statement before the Secretary of State may designate it under section 172.
2 The Secretary of State must consult—
a OFCOM, and
b such other persons as the Secretary of State considers appropriate,
on a draft of the statement.
3 The Secretary of State must allow OFCOM a period of at least 40 days to respond to any consultation under subsection (2)(a).
4 After that period has ended the Secretary of State—
a must make any changes to the draft that appear to the Secretary of State to be necessary in view of responses to the consultation, and
b must then lay the draft before Parliament.
5 The Secretary of State must then wait until the end of the 40-day period and may not designate the statement if, within that period, either House of Parliament resolves not to approve it.
6 “The 40-day period” is the period of 40 days beginning with the day on which the draft is laid before Parliament (or, if it is not laid before each House on the same day, the later of the days on which it is laid).
7 In calculating the 40-day period, no account is to be taken of any period during which Parliament is dissolved or prorogued or during which both Houses are adjourned for more than 4 days.

Directions to OFCOM

I52I733174 Directions about advisory committees

1 The Secretary of State may give OFCOM a direction requiring OFCOM to establish a committee to provide them with advice about online safety matters of a kind specified in the direction.
2 The Secretary of State must consult OFCOM before giving or varying such a direction.
3 A committee required to be established by a direction is to consist of the following members, unless the direction specifies otherwise—
a a chairman appointed by OFCOM, and
b such number of other members appointed by OFCOM as OFCOM consider appropriate.
4 A committee required to be established by a direction must, unless the direction specifies otherwise, publish a report within the period of 18 months after being established, and after that must publish periodic reports.
5 The Secretary of State may vary or revoke a direction given under this section.

I394I660175 Directions in special circumstances

1 The Secretary of State may give a direction to OFCOM under subsection (2) or (3) if the Secretary of State has reasonable grounds for believing that circumstances exist that present a threat—
a to the health or safety of the public, or
b to national security.
2 A direction under this subsection is a direction requiring OFCOM, in exercising their media literacy functions, to give priority for a specified period to specified objectives designed to address the threat presented by the circumstances mentioned in subsection (1).
3 A direction under this subsection is a direction requiring OFCOM to give a public statement notice to—
a a specified provider of a regulated service, or
b providers of regulated services generally.
4 A “public statement notice” is a notice requiring a provider of a regulated service to make a publicly available statement, by a date specified in the notice, about steps the provider is taking in response to the threat presented by the circumstances mentioned in subsection (1).
5 OFCOM may, by a public statement notice or a subsequent notice, require a provider of a regulated service to provide OFCOM with such information as they may require for the purpose of responding to that threat.
6 If a direction under subsection (2) or (3) is given on the ground mentioned in subsection (1)(a), the Secretary of State must publish the reasons for giving the direction.
7 The Secretary of State may vary or revoke a direction given under subsection (2) or (3).
8 If the Secretary of State varies or revokes a direction given under subsection (3), OFCOM may, in consequence, vary or revoke a public statement notice that they have given by virtue of the direction.
9 In subsection (2) “media literacy functions” means OFCOM’s functions under section 11 of the Communications Act (duties to promote media literacy), so far as functions under that section relate to regulated services.
10 In subsections (2) and (3) “specified” means specified in a direction under this section.

Guidance

I741I65176 Secretary of State’s guidance

1 The Secretary of State may issue guidance to OFCOM about—
a OFCOM’s exercise of their functions under this Act,
b OFCOM’s exercise of their powers under section 1(3) of the Communications Act (functions and general powers of OFCOM) to carry out research in connection with online safety matters or to arrange for others to carry out research in connection with such matters, and
c OFCOM’s exercise of their functions under section 11 of the Communications Act (media literacy) in relation to regulated services.
2 In the rest of this section, “the guidance” means any such guidance as is mentioned in subsection (1), except that it does not include guidance under section 87 (guidance to OFCOM about fees).
3 The Secretary of State must consult OFCOM before issuing, revising or replacing the guidance.
4 The guidance may not be revised or replaced more frequently than once every three years unless—
a the guidance needs to be corrected because of an amendment, repeal or modification of any provision of this Act or of section 11 of the Communications Act, or
b the revision or replacement is by agreement between the Secretary of State and OFCOM.
5 The guidance must be issued as one document.
6 The Secretary of State must lay the guidance (including revised or replacement guidance) before Parliament.
7 The Secretary of State must publish the guidance (and any revised or replacement guidance).
8 In exercising any functions to which the guidance relates, or deciding whether to exercise them, OFCOM must have regard to the guidance for the time being published under this section.

Annual report

I351I64177 Annual report on the Secretary of State’s functions

In section 390 of the Communications Act (annual report on the Secretary of State’s functions), in subsection (2), after paragraph (e) insert—

Review

I784I150178 Review

1 The Secretary of State must review the operation of—
a the regulatory framework provided for in this Act, and
b section 11 of the Communications Act, to the extent that that section relates to regulated services.
2 The review—
a must not be carried out before the end of the period of two years beginning with the day on which the last of the provisions of Part 3 comes into force, but
b must be carried out before the end of the period of five years beginning with that day.
3 The review must, in particular, consider how effective the regulatory framework provided for in this Act is at—
a securing that regulated services are operated using systems and processes that, so far as relevant—
i minimise the risk of harm to individuals in the United Kingdom presented by content on regulated services,
ii provide higher levels of protection for children than for adults,
iii provide transparency and accountability to users in relation to actions taken to comply with duties set out in Chapter 2, 3, 4 or 5 of Part 3, Chapter 1, 3 or 4 of Part 4, or Part 5,
iv protect the right of users and (in the case of search services or combined services) interested persons to freedom of expression within the law, and
v protect users from a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of a regulated service (including, but not limited to, any such provision or rule concerning the processing of personal data); and
b ensuring that regulation of services is proportionate, having regard to the level of risk of harm presented by regulated services of different kinds and to the size and capacity of providers.
4 The review must also, in particular, consider—
a the effectiveness of—
i the information gathering and information sharing powers available to OFCOM, and
ii the enforcement powers available to OFCOM; and
b the extent to which OFCOM have had regard to the desirability of encouraging innovation by providers of regulated services.
5 In carrying out the review, the Secretary of State must consult—
a OFCOM, and
b such other persons as the Secretary of State considers appropriate.
6 In carrying out the review, the Secretary of State must take into account any report published by OFCOM under section 158 (reports about news publisher content and journalistic content).
7 The Secretary of State must produce and publish a report on the outcome of the review.
8 The report must be laid before Parliament.
9 In subsection (3) “content on regulated services” means—
a regulated user-generated content present on regulated services,
b search content of regulated services,
c fraudulent advertisements present on regulated services, and
d regulated provider pornographic content published or displayed on regulated services.
10 In subsection (9)—
  • “fraudulent advertisement” has the meaning given by section 38 or 39 (depending on the kind of service in question);
  • “regulated user-generated content” has the same meaning as in Part 3 (see section 55);
  • “regulated provider pornographic content” and “published or displayed” have the same meaning as in Part 5 (see section 79);
  • “search content” has the same meaning as in Part 3 (see section 57).

PART 10 Communications offences

False and threatening communications offences

I689I30179 False communications offence

1 A person commits an offence if—
a the person sends a message (see section 182),
b the message conveys information that the person knows to be false,
c at the time of sending it, the person intended the message, or the information in it, to cause non-trivial psychological or physical harm to a likely audience, and
d the person has no reasonable excuse for sending the message.
2 For the purposes of this offence an individual is a “likely audience” of a message if, at the time the message is sent, it is reasonably foreseeable that the individual—
a would encounter the message, or
b in the online context, would encounter a subsequent message forwarding or sharing the content of the message.
3 In a case where several or many individuals are a likely audience, it is not necessary for the purposes of subsection (1)(c) that the person intended to cause harm to any one of them in particular (or to all of them).
4 See section 180 for exemptions from the offence under this section.
5 A person who commits an offence under this section is liable—
a on summary conviction in England and Wales, to imprisonment for a term not exceeding the maximum term for summary offences or a fine (or both);
b on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding level 5 on the standard scale (or both).
6 In subsection (5)(a) “the maximum term for summary offences” means—
a if the offence is committed before the time when section 281(5) of the Criminal Justice Act 2003 comes into force, 6 months;
b if the offence is committed after that time, 51 weeks.
7 Proceedings for an offence under this section may be brought within the period of 6 months beginning with the date on which evidence sufficient in the opinion of the prosecutor to justify the proceedings comes to the prosecutor’s knowledge.
8 But such proceedings may not be brought by virtue of subsection (7) more than 3 years after the commission of the offence.
9 A certificate signed by the prosecutor as to the date on which the evidence in question came to the prosecutor’s knowledge is conclusive evidence of the date on which it did so; and a certificate to that effect and purporting to be so signed is to be treated as being so signed unless the contrary is proved.

I729I722180 Exemptions from offence under section 179

1 A recognised news publisher cannot commit an offence under section 179.
2 An offence under section 179 cannot be committed by the holder of a licence under the Broadcasting Act 1990 or 1996 in connection with anything done under the authority of the licence.
3 An offence under section 179 cannot be committed by the holder of a multiplex licence in connection with anything done under the authority of the licence.
4 An offence under section 179 cannot be committed by the provider of an on-demand programme service in connection with anything done in the course of providing such a service.
5 An offence under section 179 cannot be committed in connection with the showing of a film made for cinema to members of the public.

I635I846181 Threatening communications offence

1 A person commits an offence if—
a the person sends a message (see section 182),
b the message conveys a threat of death or serious harm, and
c at the time of sending it, the person—
i intended an individual encountering the message to fear that the threat would be carried out (whether or not by the person sending the message), or
ii was reckless as to whether an individual encountering the message would fear that the threat would be carried out (whether or not by the person sending the message).
2 “Serious harm” means—
a serious injury amounting to grievous bodily harm within the meaning of the Offences against the Person Act 1861,
b rape,
c assault by penetration within the meaning of section 2 of the Sexual Offences Act 2003, or
d serious financial loss.
3 In proceedings for an offence under this section relating to a threat of serious financial loss, it is a defence for the person to show that—
a the threat was used to reinforce a reasonable demand, and
b the person reasonably believed that the use of the threat was a proper means of reinforcing the demand.
4 If evidence is adduced which is sufficient to raise an issue with respect to the defence under subsection (3), the court must assume that the defence is satisfied unless the prosecution proves beyond reasonable doubt that it is not.
5 A person who commits an offence under this section is liable—
a on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);
b on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);
c on conviction on indictment, to imprisonment for a term not exceeding 5 years or a fine (or both).

I211I26182 Interpretation of sections 179 to 181

1 This section applies for the purposes of sections 179 to 181, and references in this section to an offence are to an offence under section 179 or 181.
2 A person “sends a message” if the person—
a sends, transmits or publishes a communication (including an oral communication) by electronic means, or
b sends, or gives to an individual, a letter or a thing of any other description,
and references to a message are to be read accordingly.
3 A person also “sends a message” if the person—
a causes a communication (including an oral communication) to be sent, transmitted or published by electronic means, or
b causes a letter or a thing of any other description to be—
i sent, or
ii given to an individual.
4 But a provider of an internet service by means of which a communication is sent, transmitted or published is not to be regarded as a person who sends a message.
5 “Encounter”, in relation to a message, means read, view, hear or otherwise experience the message.
6 It does not matter whether the content of a message is created by the person who sends it (so for example, in the online context, an offence may be committed by a person who forwards another person’s direct message or shares another person’s post).
7 In the application of sections 179 to 181 to the sending by electronic means of a message consisting of or including a hyperlink to other content—
a references to the message are to be read as including references to content accessed directly via the hyperlink, and
b an individual who is a likely audience in relation to the hyperlink for the purposes of section 179 is to be assumed to be a likely audience in relation to the linked content.
8 In the application of sections 179 to 181 to the sending of an item on which data is stored electronically, references to the message are to be read as including content accessed by means of the item to which the recipient is specifically directed by the sender (and in this subsection “sending” includes “giving”, and “sender” is to be read accordingly).
9 In the online context, the date on which a person commits an offence in relation to a message is the date on which the message is first sent by the person.
10 “Recognised news publisher” has the meaning given by section 56.
11 “Multiplex licence” means a licence under section 8 of the Wireless Telegraphy Act 2006 which authorises the provision of a multiplex service within the meaning of section 42(6) of that Act.
12 “On-demand programme service” has the same meaning as in the Communications Act (see section 368A of that Act), and a person is the “provider” of an on-demand programme service if the person has given notification of the person’s intention to provide that service in accordance with section 368BA of that Act.

Offences of sending or showing flashing images

I442I2183 Offences of sending or showing flashing images electronically

1 A person (A) commits an offence if—
a A sends a communication by electronic means which consists of or includes flashing images (see subsection (13)),
b either condition 1 or condition 2 is met, and
c A has no reasonable excuse for sending the communication.
2 Condition 1 is that—
a at the time the communication is sent, it is reasonably foreseeable that an individual with epilepsy would be among the individuals who would view it, and
b A sends the communication with the intention that such an individual will suffer harm as a result of viewing the flashing images.
3 Condition 2 is that, when sending the communication—
a A believes that an individual (B)—
i whom A knows to be an individual with epilepsy, or
ii whom A suspects to be an individual with epilepsy,
will, or might, view it, and
b A intends that B will suffer harm as a result of viewing the flashing images.
4 In subsections (2)(a) and (3)(a), references to viewing the communication are to be read as including references to viewing a subsequent communication forwarding or sharing the content of the communication.
5 The exemptions contained in section 180 apply to an offence under subsection (1) as they apply to an offence under section 179.
6 For the purposes of subsection (1), a provider of an internet service by means of which a communication is sent is not to be regarded as a person who sends a communication.
7 In the application of subsection (1) to a communication consisting of or including a hyperlink to other content, references to the communication are to be read as including references to content accessed directly via the hyperlink.
8 A person (A) commits an offence if—
a A shows an individual (B) flashing images by means of an electronic communications device,
b when showing the images—
i A knows that B is an individual with epilepsy, or
ii A suspects that B is an individual with epilepsy,
c when showing the images, A intends that B will suffer harm as a result of viewing them, and
d A has no reasonable excuse for showing the images.
9 An offence under subsection (1) or (8) cannot be committed by a healthcare professional acting in that capacity.
10 A person who commits an offence under subsection (1) or (8) is liable—
a on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);
b on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);
c on conviction on indictment, to imprisonment for a term not exceeding 5 years or a fine (or both).
11 It does not matter for the purposes of this section whether flashing images may be viewed at once (for example, a GIF that plays automatically) or only after some action is performed (for example, pressing play).
12 In this section—
a references to sending a communication include references to causing a communication to be sent;
b references to showing flashing images include references to causing flashing images to be shown.
13 In this section—
  • “electronic communications device” means equipment or a device that is capable of transmitting images by electronic means;
  • “flashing images” means images which carry a risk that an individual with photosensitive epilepsy who viewed them would suffer a seizure as a result;
  • “harm” means—
    1. a seizure, or
    2. alarm or distress;
  • “individual with epilepsy” includes, but is not limited to, an individual with photosensitive epilepsy;
  • “send” includes transmit and publish (and related expressions are to be read accordingly).

Offence of encouraging or assisting serious self-harm

I612I681184 Offence of encouraging or assisting serious self-harm

1 A person (D) commits an offence if—
a D does a relevant act capable of encouraging or assisting the serious self-harm of another person, and
b D’s act was intended to encourage or assist the serious self-harm of another person.
2 D “does a relevant act” if D—
a communicates in person,
b sends, transmits or publishes a communication by electronic means,
c shows a person such a communication,
d publishes material by any means other than electronic means,
e sends, gives, shows or makes available to a person—
i material published as mentioned in paragraph (d), or
ii any form of correspondence, or
f sends, gives or makes available to a person an item on which data is stored electronically.
3 “Serious self-harm” means self-harm amounting to—
a in England and Wales and Northern Ireland, grievous bodily harm within the meaning of the Offences Against the Person Act 1861, and
b in Scotland, severe injury,
and includes successive acts of self-harm which cumulatively reach that threshold.
4 The person referred to in subsection (1)(a) and (b) need not be a specific person (or class of persons) known to, or identified by, D.
5 D may commit an offence under this section whether or not serious self-harm occurs.
6 If a person (D1) arranges for a person (D2) to do an act that is capable of encouraging or assisting the serious self-harm of another person and D2 does that act, D1 is to be treated as also having done it.
7 In the application of subsection (1) to an act by D involving an electronic communication or a publication in physical form, it does not matter whether the content of the communication or publication is created by D (so for example, in the online context, the offence under this section may be committed by forwarding another person’s direct message or sharing another person’s post).
8 In the application of subsection (1) to the sending, transmission or publication by electronic means of a communication consisting of or including a hyperlink to other content, the reference in subsection (2)(b) to the communication is to be read as including a reference to content accessed directly via the hyperlink.
9 In the application of subsection (1) to an act by D involving an item on which data is stored electronically, the reference in subsection (2)(f) to the item is to be read as including a reference to content accessed by means of the item to which the person in receipt of the item is specifically directed by D.
10 A provider of an internet service by means of which a communication is sent, transmitted or published is not to be regarded as a person who sends, transmits or publishes it.
11 Any reference in this section to doing an act that is capable of encouraging the serious self-harm of another person includes a reference to doing so by threatening another person or otherwise putting pressure on another person to seriously self-harm. “Seriously self-harm” is to be interpreted consistently with subsection (3).
12 Any reference to an act in this section, except in subsection (3), includes a reference to a course of conduct, and references to doing an act are to be read accordingly.
13 In subsection (3) “act” includes omission.
14 A person who commits an offence under this section is liable—
a on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);
b on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum (or both);
c on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);
d on conviction on indictment, to imprisonment for a term not exceeding 5 years or a fine (or both).

Further provision

I273I593185 Extra-territorial application and jurisdiction

1 Sections 179(1), 181(1) and 183(1) apply to an act done outside the United Kingdom, but only if the act is done by a person within subsection (2).
2 A person is within this subsection if the person is—
a an individual who is habitually resident in England and Wales or Northern Ireland, or
b a body incorporated or constituted under the law of England and Wales or Northern Ireland.
3 Section 184(1) applies to an act done outside the United Kingdom, but only if the act is done by a person within subsection (4).
4 A person is within this subsection if the person is—
a an individual who is habitually resident in the United Kingdom, or
b a body incorporated or constituted under the law of any part of the United Kingdom.
5 Proceedings for an offence committed under section 179, 181 or 183(1) outside the United Kingdom may be taken, and the offence may for incidental purposes be treated as having been committed, at any place in England and Wales or Northern Ireland.
6 Proceedings for an offence committed under section 184 outside the United Kingdom may be taken, and the offence may for incidental purposes be treated as having been committed, at any place in the United Kingdom.
7 In the application of subsection (6) to Scotland, any such proceedings against a person may be taken, and the offence may for incidental purposes be treated as having been committed—
a in any sheriff court district in which the person is apprehended or is in custody, or
b in such sheriff court district as the Lord Advocate may determine.
8 In subsection (7) “sheriff court district” is to be construed in accordance with the Criminal Procedure (Scotland) Act 1995 (see section 307(1) of that Act).

I89I191186 Liability of corporate officers

1 If an offence under section 179, 181, 183 or 184 is committed by a body corporate and it is proved that the offence—
a has been committed with the consent or connivance of an officer of the body corporate, or
b is attributable to any neglect on the part of an officer of the body corporate,
the officer (as well as the body corporate) commits the offence and is liable to be proceeded against and punished accordingly.
2 “Officer”, in relation to a body corporate, means—
a a director, manager, associate, secretary or other similar officer, or
b a person purporting to act in any such capacity.
In paragraph (a) “director”, in relation to a body corporate whose affairs are managed by its members, means a member of the body corporate.
3 If an offence under section 184 is committed by a Scottish partnership and it is proved that the offence—
a has been committed with the consent or connivance of a partner of the partnership, or
b is attributable to any neglect on the part of a partner of the partnership,
the partner (as well as the partnership) commits the offence and is liable to be proceeded against and punished accordingly.
4 “Partner”, in relation to a Scottish partnership, includes any person who was purporting to act as a partner.

Offences to be inserted into Sexual Offences Act 2003

I639I793187 Sending etc photograph or film of genitals

In the Sexual Offences Act 2003, after section 66 insert—

I299I445188 Sharing or threatening to share intimate photograph or film

In the Sexual Offences Act 2003, after section 66A (inserted by section 187), insert—

Repeals and amendments in connection with offences

I835I894189 Repeals in connection with offences under sections 179 and 181

1 Section 127(2)(a) and (b) of the Communications Act (false messages) is repealed so far as it extends to England and Wales and Northern Ireland.
2 The following provisions of the Malicious Communications Act 1988 are repealed—
a section 1(1)(a)(ii),
b section 1(1)(a)(iii), and
c section 1(2).
3 The following provisions of the Malicious Communications (Northern Ireland) Order 1988 (S.I. 1988/1849 (N.I. 18)) are repealed—
a Article 3(1)(a)(ii),
b Article 3(1)(a)(iii), and
c Article 3(2).

I810I488190 Repeals in connection with offences under section 188

Sections 33 to 35 of the Criminal Justice and Courts Act 2015 (disclosing or threatening to disclose private sexual photographs and films with intent to cause distress) are repealed.

I738I611191 Consequential amendments

1 Part 1 of Schedule 14 contains amendments consequential on sections 179, 181 and 183.
2 Part 2 of Schedule 14 contains amendments consequential on section 184.
3 Part 3 of Schedule 14 contains amendments consequential on sections 187 and 188.
4 Part 4 of Schedule 14 contains amendments consequential on section 190.

PART 11 Supplementary and general

Providers' judgements about the status of content

I811I537192 Providers’ judgements about the status of content

1 This section sets out the approach to be taken where—
a a system or process operated or used by a provider of a Part 3 service for the purpose of compliance with relevant requirements,
b a risk assessment required to be carried out by Part 3, or
c an assessment required to be carried out by section 14,
involves a judgement by a provider about whether content is content of a particular kind.
2 Such judgements are to be made on the basis of all relevant information that is reasonably available to a provider.
3 In construing the reference to information that is reasonably available to a provider, the following factors, in particular, are relevant—
a the size and capacity of the provider, and
b whether a judgement is made by human moderators, by means of automated systems or processes or by means of automated systems or processes together with human moderators.
4 Subsections (5) to (7) apply (as well as subsection (2)) in relation to judgements by providers about whether content is—
a illegal content, or illegal content of a particular kind, or
b a fraudulent advertisement.
5 In making such judgements, the approach to be followed is whether a provider has reasonable grounds to infer that content is content of the kind in question (and a provider must treat content as content of the kind in question if reasonable grounds for that inference exist).
6 Reasonable grounds for that inference exist in relation to content and an offence if, following the approach in subsection (2), a provider—
a has reasonable grounds to infer that all elements necessary for the commission of the offence, including mental elements, are present or satisfied, and
b does not have reasonable grounds to infer that a defence to the offence may be successfully relied upon.
7 In the case of content generated by a bot or other automated tool, the tests mentioned in subsection (6)(a) and (b) are to be applied in relation to the conduct or mental state of a person who may be assumed to control the bot or tool (or, depending what a provider knows in a particular case, the actual person who controls the bot or tool).
8 In considering a provider’s compliance with relevant requirements to which this section is relevant, OFCOM may take into account whether providers’ judgements follow the approaches set out in this section (including judgements made by means of automated systems or processes, alone or together with human moderators).
9 In this section—
  • “fraudulent advertisement” has the meaning given by section 38 or 39 (depending on the kind of service in question);
  • “illegal content” has the same meaning as in Part 3 (see section 59);
  • “relevant requirements” means—
    1. duties and requirements under this Act, and
    2. requirements of a notice given by OFCOM under this Act.

I677193 OFCOM’s guidance about illegal content judgements

I6771 OFCOM must produce guidance for providers of Part 3 services about the matters dealt with in section 192 so far as relating to illegal content judgements.
2 “Illegal content judgements” means—
I677a judgements of a kind mentioned in subsection (4) of that section, and
b judgements by providers about whether news publisher content amounts to a relevant offence (see section 18(5) and (10)).
I6773 Before producing the guidance (including revised or replacement guidance), OFCOM must consult such persons as they consider appropriate.
I6774 OFCOM must publish the guidance (and any revised or replacement guidance).

Time-limits for first guidance

I641194 Time for publishing first guidance under certain provisions of this Act

1 OFCOM must publish guidance to which this section applies within the period of 18 months beginning with the day on which this Act is passed.
2 This section applies to—
a the first guidance under section 52(3)(a) (record-keeping and review);
b the first guidance under section 52(3)(b) (children’s access assessments);
c the first guidance under section 53(1) (content harmful to children);
d the first guidance under section 82 (provider pornographic content);
e the first guidance under section 99(1) (illegal content risk assessments under section 9);
f the first guidance under section 99(2) (illegal content risk assessments under section 26);
g the first guidance under section 99(3) (children’s risk assessments);
h the first guidance under section 151 (enforcement);
i the first guidance under section 193 relating to illegal content judgements within the meaning of subsection (2)(a) of that section (illegal content and fraudulent advertisements).
3 If OFCOM consider that it is necessary to extend the period mentioned in subsection (1) in relation to guidance mentioned in any of paragraphs (a) to (i) of subsection (2), OFCOM may extend the period in relation to that guidance by up to 12 months by making and publishing a statement.But this is subject to subsection (6).
4 A statement under subsection (3) must set out—
a the reasons why OFCOM consider that it is necessary to extend the period mentioned in subsection (1) in relation to the guidance concerned, and
b the period of extension.
5 A statement under subsection (3) may be published at the same time as (or incorporate) a statement under section 43(12) (extension of time to prepare certain codes of practice).
6 But a statement under subsection (3) may not be made in relation to guidance mentioned in a particular paragraph of subsection (2) if—
a a statement has previously been made under subsection (3) (whether in relation to guidance mentioned in the same or a different paragraph of subsection (2)), or
b a statement has previously been made under section 43(12).

Liability of providers etc

I257I874195 Providers that are not legal persons

1 In this section a “relevant entity” means an entity that—
a is the provider of a regulated service, and
b is not a legal person under the law under which it is formed.
2 If a penalty notice is given to a relevant entity (in the name of the entity), the penalty must be paid out of the entity’s funds.
3 If a notice is given by OFCOM to a relevant entity (in the name of the entity) under any provision of this Act, the notice continues to have effect despite a change in the membership of the entity.
4 If a penalty notice is given jointly to two or more officers or members of a relevant entity, those individuals are jointly and severally liable to pay the penalty under it.
5 In subsection (4) the reference to officers or members of a relevant entity includes a reference to employees of such an entity or any other individuals associated with such an entity.
6 In this section a “penalty notice” means—
a a confirmation decision that imposes a penalty (see sections 132(5)(b) and 137),
b a penalty notice under section 139,
c a penalty notice under section 140(5), or
d a penalty notice under section 141(6).

I406I439196 Individuals providing regulated services: liability

1 This section applies in relation to two or more individuals who together are the provider of a regulated service (see section 226(3), (5), (7), (9) and (11)).
2 Any duty or requirement imposed on such a provider under any of the provisions specified in subsection (3), or any liability of such a provider to pay a fee under section 84 or Schedule 10, is to be taken to be imposed on, or to be a liability of, all the individuals jointly and severally.
3 The provisions are—
a Chapter 2 of Part 3 (providers of user-to-user services: duties of care);
b Chapter 3 of Part 3 (providers of search services: duties of care);
c Chapter 4 of Part 3 (children’s access assessments);
d Chapter 5 of Part 3 (duties about fraudulent advertising);
e Chapter 1 of Part 4 (user identity verification);
f Chapter 2 of Part 4 (reporting CSEA content);
g Chapter 3 of Part 4 (terms of service: transparency, accountability and freedom of expression);
h Chapter 4 of Part 4 (deceased child users);
i Chapter 5 of Part 4 (transparency reporting);
j section 81 (provider pornographic content);
k section 83 (duty to notify OFCOM).
4 A notice in respect of a matter that may or must be given by OFCOM under any provision of this Act may be given—
a to only one of the individuals,
b jointly to two or more of them, or
c jointly to all of them,
but a separate notice may not be given to each of the individuals in respect of the matter.
5 If a penalty notice is given jointly to two or more individuals, those individuals are jointly and severally liable to pay the penalty under it.
6 In subsection (5) a “penalty notice” means—
a a confirmation decision that imposes a penalty (see sections 132(5)(b) and 137),
b a penalty notice under section 139,
c a penalty notice under section 140(5), or
d a penalty notice under section 141(6).

I336I168197 Liability of parent entities etc

Schedule 15 contains provision about—
a the giving of joint provisional notices of contravention to parent entities etc,
b the liability of parent entities for failures by subsidiary entities,
c the liability of subsidiary entities for failures by parent entities,
d the liability of fellow subsidiary entities for failures by subsidiary entities, and
e the liability of controlling individuals for failures by entities.

I464I756198 Former providers of regulated services

1 A power conferred by Chapter 6 of Part 7 (enforcement powers) to give a notice to a provider of a regulated service is to be read as including power to give a notice to a person who was, at the relevant time, a provider of such a service but who has ceased to be a provider of such a service (and that Chapter and Schedules 13 and 15 are to be read accordingly).
2 “The relevant time” means—
a the time of the failure to which the notice relates, or
b in the case of a notice which relates to the requirement in section 105(1) to co-operate with an investigation, the time of the failure or possible failure to which the investigation relates.

Offences

I357I285I921199 Information offences: supplementary

1 Proceedings against a person for an offence under section 109(1) or paragraph 18(1)(b) of Schedule 12 may be brought only if—
a OFCOM have given the person a provisional notice of contravention in respect of the failure to comply with the requirements of an information notice or the requirements imposed by a person acting under Schedule 12 (as the case may be),
b OFCOM have given the person a confirmation decision in respect of that failure imposing requirements of a kind described in section 133(1) and the time allowed for compliance with the decision has expired without those requirements having been complied with,
c OFCOM have not imposed a penalty on the person in respect of that failure,
d a service restriction order under section 144 has not been made in relation to a regulated service provided by the person in respect of that failure, and
e an access restriction order under section 146 has not been made in relation to a regulated service provided by the person in respect of that failure.
2 Proceedings for an offence under section 110(2) (failure by named senior manager to prevent offence under section 109(1)) may be brought only if the conditions in subsection (1) are met in respect of the offence under section 109(1).
3 Where a penalty has been imposed on a person in respect of an act or omission constituting an offence under section 69 or 109 or paragraph 18 of Schedule 12, no proceedings may be brought against the person for that offence.
4 Where a penalty has been imposed on an entity in respect of an act or omission constituting an offence under section 109, no proceedings for an offence under section 110 may be brought against an individual in respect of a failure to prevent that offence.
5 A penalty may not be imposed on a person in respect of an act or omission constituting an offence under section 69 or 109 or paragraph 18 of Schedule 12 if—
a proceedings for the offence have been brought against the person but have not been concluded, or
b the person has been convicted of the offence.
6 In this section “penalty” means a penalty imposed by—
a a confirmation decision (see sections 132(5)(b) and 137), or
b a penalty notice under section 139.

I69I815I922200 Offence of failure to comply with confirmation decision: supplementary

1 Where a penalty has been imposed on a person by a penalty notice under section 139 in respect of a failure constituting an offence under section 138 (failure to comply with certain requirements of a confirmation decision), no proceedings may be brought against the person for that offence.
2 A penalty may not be imposed on a person by a penalty notice under section 139 in respect of a failure constituting an offence under section 138 if—
a proceedings for the offence have been brought against the person but have not been concluded, or
b the person has been convicted of the offence.
3 Where a service restriction order under section 144 or an access restriction order under section 146 has been made in relation to a regulated service provided by a person in respect of a failure constituting an offence under section 138, no proceedings may be brought against the person for that offence.

I487I87I923201 Defences

1 Subsection (2) applies where a person relies on a defence under section 109 or 110.
2 If evidence is adduced which is sufficient to raise an issue with respect to the defence, the court must assume that the defence is satisfied unless the prosecution proves beyond reasonable doubt that it is not.

I279I255I924202 Liability of corporate officers for offences

1 In this section a “relevant entity” means an entity that is—
a the provider of a regulated service, and
b a legal person under the law under which it is formed.
2 If an offence is committed by a relevant entity and it is proved that the offence—
a has been committed with the consent or connivance of an officer of the entity, or
b is attributable to any neglect on the part of an officer of the entity,
the officer (as well as the entity) commits the offence and (subject to section 199(1)) is liable to be proceeded against and punished accordingly.
3 In relation to an entity which is a body corporate, “officer” means—
a a director, manager, associate, secretary or other similar officer, or
b a person purporting to act in any such capacity.
In paragraph (a) “director”, in relation to a body corporate whose affairs are managed by its members, means a member of the body corporate.
4 In relation to a partnership which is not regarded as a body corporate under the law under which it is formed, “officer” means—
a a partner, or
b a person purporting to act as a partner.
5 In this section—
  • “body corporate” includes an entity incorporated outside the United Kingdom;
  • “offence” means an offence under this Act, except under Part 10.

I356I339I925203 Application of offences to providers that are not legal persons

1 In this section a “relevant entity” means an entity that—
a is the provider of a regulated service, and
b is not a legal person under the law under which it is formed.
2 Proceedings for an offence alleged to have been committed by a relevant entity must be brought against the entity in its own name (and not in that of any of its officers or members).
3 For the purposes of such proceedings—
a rules of court relating to the service of documents have effect as if the entity were a body corporate; and
b the following provisions apply as they apply in relation to a body corporate—
i section 33 of the Criminal Justice Act 1925 and Schedule 3 to the Magistrates’ Courts Act 1980;
ii section 18 of the Criminal Justice Act (Northern Ireland) 1945 (c. 15 (N.I.)) and Article 166 of, and Schedule 4 to, the Magistrates’ Courts (Northern Ireland) Order 1981 (S.I. 1981/1675 (N.I. 26)).
4 A fine imposed on a relevant entity on its conviction of an offence must be paid out of the entity’s funds.
5 If an offence is committed by a relevant entity and it is proved that the offence—
a has been committed with the consent or connivance of an officer of the entity, or
b is attributable to any neglect on the part of an officer of the entity,
the officer (as well as the entity) commits the offence and (subject to section 199(1)) is liable to be proceeded against and punished accordingly.
6 In relation to a partnership, “officer” means—
a a partner, or
b a person purporting to act as a partner.
7 In relation to a relevant entity other than a partnership, “officer” means—
a an officer of the entity or a person concerned in the management or control of the entity, or
b a person purporting to act in such a capacity.
8 Subsection (2) is not to be read as prejudicing any liability of an officer under subsection (5).
9 In this section “offence” means an offence under this Act, except under Part 10.

Extra-territorial application

I264204 Extra-territorial application

I2641 References in this Act to an internet service, a user-to-user service or a search service include such a service provided from outside the United Kingdom (as well as such a service provided from within the United Kingdom).
I82I9152 The power to require the production of documents by an information notice includes power to require the production of documents held outside the United Kingdom.
I82I9153 The power conferred by section 106 includes power to require the attendance for interview of an individual who is outside the United Kingdom.
I82I9154 Sections 133(9) and 150(11) (requirements enforceable in civil proceedings against a person) apply whether or not the person is in the United Kingdom.

I531I403I926205 Offences: extra-territorial application and jurisdiction

1 Sections 69, 109 and 112 apply to acts done by a person in the United Kingdom or elsewhere (information offences).
2 Section 110 applies to acts done by an individual in the United Kingdom or elsewhere (offences by senior managers of providers of regulated services).
3 Section 138 applies to acts done by a person in the United Kingdom or elsewhere (offence of failure to comply with confirmation decision).
4 Sections 202(2) and 203(5), so far as relating to an offence under a section specified in subsection (1) or (3) of this section, apply to acts done by an individual in the United Kingdom or elsewhere (liability of directors etc of providers of regulated services).
5 In the case of an offence under section 69, 109, 110, 112 or 138 which is committed outside the United Kingdom—
a proceedings for the offence may be taken at any place in the United Kingdom, and
b the offence may for all incidental purposes be treated as having been committed at any such place.
6 In the application of subsection (5) to Scotland, any such proceedings against a person may be taken—
a in any sheriff court district in which the person is apprehended or is in custody, or
b in such sheriff court district as the Lord Advocate may determine.
7 In this section—
  • “act” includes a failure to act;
  • “sheriff court district” is to be construed in accordance with the Criminal Procedure (Scotland) Act 1995 (see section 307(1) of that Act).

Payment of sums into Consolidated Fund

I653I751206 Payment of sums into the Consolidated Fund

1 Section 400 of the Communications Act (destination of penalties etc) is amended as follows.
2 In subsection (1), after paragraph (i) insert—
3 In subsection (2), after “applies” insert “(except an amount mentioned in subsection (1)(j) or (k))”.
4 After subsection (3) insert—
5 In the heading, omit “licence”.

Publication by OFCOM

I913207 Publication by OFCOM

Anything required by this Act to be published by OFCOM must be published in such manner as OFCOM consider appropriate for bringing it to the attention of the persons who, in their opinion, are likely to be affected by it.

Service of notices

I656I164208 Service of notices

1 This section applies in relation to a notice that may or must be given by OFCOM to a person under any provision of this Act.
2 OFCOM may give a notice to a person by—
a delivering it by hand to the person,
b leaving it at the person’s proper address,
c sending it by post to the person at that address, or
d sending it by email to the person’s email address.
3 A notice to a body corporate may be given to any officer of that body.
4 A notice to a partnership may be given to any partner or to a person who has the control or management of the partnership business.
5 A notice to an entity that is not a legal person under the law under which it is formed (other than a partnership) may be given to any member of the governing body of the entity.
6 In the case of a notice given to a person who is a provider of a regulated service, the person’s proper address for the purposes of paragraphs (b) and (c) of subsection (2), and section 7 of the Interpretation Act 1978 in its application to those paragraphs, is any address (within or outside the United Kingdom) at which OFCOM believe, on reasonable grounds, that the notice will come to the attention of the person or (where the person is an entity) any director or other officer of that entity.
7 In the case of a notice given to a person other than a provider of a regulated service, a person’s proper address for the purposes of paragraphs (b) and (c) of subsection (2), and section 7 of the Interpretation Act 1978 in its application to those paragraphs, is—
a in the case of an entity, the address of the entity’s registered or principal office;
b in any other case, the person’s last known address.
8 In the case of an entity registered or carrying on business outside the United Kingdom, or with offices outside the United Kingdom, the reference in subsection (7) to its principal office includes its principal office in the United Kingdom or, if the entity has no office in the United Kingdom, any place in the United Kingdom at which OFCOM believe, on reasonable grounds, that the notice will come to the attention of any director or other officer of that entity.
9 In the case of a notice given to an individual under section 106 (interviews), the reference in subsection (7) to the person’s last known address is to the individual’s home address or, if the individual is currently connected with a provider of a regulated service, the address of the provider’s registered or principal office.
10 For the purposes of subsection (2)(d), a person’s email address is—
a any email address published for the time being by that person as an address for contacting that person, or
b if there is no such published address, any email address by means of which OFCOM believe, on reasonable grounds, that the notice will come to the attention of that person or (where that person is an entity) any director or other officer of that entity.
11 A notice sent by email is treated as given 48 hours after it was sent, unless the contrary is proved.
12 In this section—
  • “director” includes any person occupying the position of a director, by whatever name called;
  • “officer”, in relation to an entity, includes a director, a manager, a partner, an associate, a secretary or, where the affairs of the entity are managed by its members, a member.

Repeals and amendments

F31209 Amendments of Part 4B of the Communications Act

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

I365I561210 Repeal of Part 4B of the Communications Act

1 In the Communications Act, omit Part 4B (video-sharing platform services).
2 In the Audiovisual Media Services Regulations 2020 (S.I. 2020/1062), omit Part 4 (which inserts Part 4B into the Communications Act).
3 In this Act, omit—
a section 209, and
b Schedule 16.
4 In the Audiovisual Media Services (Amendment) (EU Exit) Regulations 2020 (S.I. 2020/1536), omit regulation 4.

I131I541211 Repeal of Part 4B of the Communications Act: transitional provision etc

1 Schedule 17 contains transitional, transitory and saving provision—
a about the application of this Act and Part 4B of the Communications Act during a period before the repeal of Part 4B of the Communications Act (or, in the case of Part 3 of Schedule 17, in respect of charging years as mentioned in that Part);
b in connection with the repeal of Part 4B of the Communications Act.
2 The Secretary of State may by regulations make transitional, transitory or saving provision of the kind mentioned in subsection (1)(a) and (b).
3 Regulations under subsection (2) may amend or repeal—
a Part 3 of Schedule 3;
b Schedule 17.
4 Regulations under subsection (2) may, in particular, make provision about—
a the application of Schedule 17 in relation to a service if the transitional period in relation to that service ends on a date before the date when section 210 comes into force;
b the application of Part 3 of Schedule 17, including further provision about the calculation of a provider’s non-Part 4B qualifying worldwide revenue for the purposes of paragraph 19 of that Schedule;
c the application of Schedule 10 (recovery of OFCOM’s initial costs), and in particular how fees chargeable under that Schedule may be calculated, in respect of charging years to which Part 3 of Schedule 17 relates.

I728212 Repeals: Digital Economy Act 2017

1 The Digital Economy Act 2017 is amended as follows.
2 Omit—
a Part 3 (online pornography), and
b section 119(10) and (11) (power to extend that Part to the Channel Islands or the Isle of Man).
3 Omit section 103 (code of practice for providers of online social media platforms).

I673I237213 Offence under the Obscene Publications Act 1959: OFCOM defence

1 Section 2 of the Obscene Publications Act 1959 (prohibition of publication of obscene matter) is amended in accordance with subsections (2) and (3).
2 After subsection (5) insert—
3 In subsection (7)—
a the words after “In this section” become paragraph (a), and
b at the end of that paragraph, insert

I119214 Offences regarding indecent photographs of children: OFCOM defence

England and Wales

1 Section 1B of the Protection of Children Act 1978 (defence to offence relating to indecent photographs of children) is amended in accordance with subsections (2) and (3).
2 In subsection (1)—
a for “he”, in each place, substitute “the defendant”;
b for “him”, in each place, substitute “the defendant”;
c omit “or” at the end of paragraph (b);
d at the end of paragraph (c) insert
3 After subsection (2) insert—

Scotland

4 Section 52 of the Civic Government (Scotland) Act 1982 (indecent photographs of children) is amended in accordance with subsections (5) and (6).
5 After subsection (4) insert—
6 In subsection (8), after paragraph (d) insert—

Northern Ireland

7 Article 3A of the Protection of Children (Northern Ireland) Order 1978 (S.I. 1978/1047 (N.I. 17)) (defence to offence relating to indecent photographs of children) is amended in accordance with subsections (8) and (9).
8 In paragraph (1)—
a for “he”, in each place, substitute “the defendant”;
b for “him”, in each place, substitute “the defendant”;
c omit “or” at the end of sub-paragraph (b);
d at the end of sub-paragraph (c) insert
9 After paragraph (2) insert—

Power to require providers of internet services to prevent or restrict access by children to internet services

214A Power to require providers of internet services to prevent or restrict access by children to internet services

1 The Secretary of State may, for the purpose of protecting relevant children from a risk of harm (including harm presented by content), make provision by regulations requiring providers of specified internet services—
a to prevent access by relevant children to specified internet services which they provide, or to specified functionalities or other features of such services;
b to restrict access by relevant children to specified internet services which they provide, or to specified functionalities or other features of such services.
2 “Relevant child” means a child who is of, or under, a specified age (and different ages may be specified for the purposes of paragraphs (a) and (b) of subsection (1)).
3 The provision that may be made by regulations under this section includes provision—
a about the steps that must or may be taken by a provider for the purposes of complying with a requirement imposed by the regulations;
b about the monitoring of compliance with a requirement imposed by the regulations;
c about the enforcement of a requirement imposed by the regulations.
4 The provision that may be made by virtue of subsection (1)(b) includes, for example, provision requiring a provider of an internet service to—
a limit the amount of time per day, or over the course of a specified period, for which relevant children may access the service or a specified functionality or other feature of the service;
b limit the times of day at which relevant children may access the service or a specified functionality or other feature of the service;
c restrict access by relevant children to a service or to a functionality or other feature of a service by virtue of which—
i a user of the service could receive unsolicited contact from a person who is not known to the user;
ii a user of the service could encounter live oral communications or live video generated directly on the service, or uploaded to or shared on the service, by a person who is not known to the user;
iii a person who is not known to a user of the service could encounter live oral communications or live video generated directly on the service, or uploaded to or shared on the service, by the user;
iv a person who is not known to a user of the service could identify the actual or approximate location of the user.
5 The provision that may be made by virtue of subsection (3)(c) includes provision for a requirement to be an enforceable requirement for the purposes of Chapter 6 of Part 7.
6 In making regulations under this section, the Secretary of State must have regard to—
a the different ways in which an internet service of a particular kind is used, including functionalities or other features of the service that affect how much children use the service, and the impact of such use on the level of risk of harm that might be suffered by children, and
b the fact that children of different ages may be affected by an internet service, or a functionality or other feature of an internet service, in different ways.
7 Regulations under this section may—
a make provision applying any provision of this Act (with or without modifications);
b make provision for exceptions to requirements imposed by the regulations;
c make provision about the time by which, or period within which, a thing must be done;
d make provision by reference to standards, arrangements, specifications or technical requirements as published from time to time;
e confer functions on a person, including functions involving the exercise of a discretion, and make provision in connection with the procedure for exercising the functions;
f make consequential provision.
8 Regulations made by virtue of subsection (7)(f) may amend or repeal primary legislation.
9 The Secretary of State—
a must exercise the power under subsection (1) so as to make such provision as the Secretary of State considers appropriate following the conclusion of the consultation entitled “Growing up in the online world: a national consultation” launched on 2 March 2026 (command paper numbered CP 1528), and
b must, in exercising that power, have regard to the responses to the consultation.
10 OFCOM must, so far as reasonably practicable—
a carry out such research or provide such advice as the Secretary of State may request for the purposes of making regulations under this section, and
b do so by such time, or within such period, as the Secretary of State may specify in the request.
11 As soon as reasonably practicable after providing advice under subsection (10), OFCOM must publish the advice.
12 In this section—
  • “primary legislation” means—
    1. an Act of Parliament,
    2. an Act of the Scottish Parliament,
    3. an Act or Measure of Senedd Cymru, or
    4. Northern Ireland legislation;
  • “specified” means specified, or of a description specified, in regulations under this section.

Power to amend Act to regulate app stores

I507I478215 Power to regulate app stores

1 Subject to the following provisions of this section and section 216, the Secretary of State may by regulations amend any provision of this Act to make provision for or in connection with the regulation of internet services that are app stores.
2 Regulations under this section may not be made before OFCOM have published a report under section 161 (report about use of app stores by children).
3 Regulations under this section may be made only if the Secretary of State, having considered that report, considers that there is a material risk of significant harm to an appreciable number of children presented by either of the following, or by both taken together—
a harmful content present on app stores, or
b harmful content encountered by means of regulated apps available in app stores.
4 Before making regulations under this section the Secretary of State must consult—
a persons who appear to the Secretary of State to represent providers of app stores,
b persons who appear to the Secretary of State to represent the interests of children (generally or with particular reference to online safety matters),
c OFCOM,
d the Information Commissioner,
e the Children’s Commissioner, and
f such other persons as the Secretary of State considers appropriate.
5 In this section and in section 216—
  • “amend” includes repeal and apply (with or without modifications);
  • “app” includes an app for use on any kind of device, and “app store” is to be read accordingly;
  • “content that is harmful to children” has the same meaning as in Part 3 (see section 60);
  • “harmful content” means—
    1. content that is harmful to children,
    2. search content that is harmful to children, and
    3. regulated provider pornographic content;
  • “regulated app” means an app for a regulated service;
  • “regulated provider pornographic content” has the same meaning as in Part 5 (see section 79);
  • “search content” has the same meaning as in Part 3 (see section 57).
6 In this section and in section 216 references to children are to children in the United Kingdom.

I210I838216 Power to regulate app stores: supplementary

1 In this section (except in subsection (4)(c)) “regulations” means regulations under section 215(1).
2 Provision may be made by regulations only for or in connection with the purposes of minimising or mitigating the risks of harm to children presented by harmful content as mentioned in section 215(3)(a) and (b).
3 Regulations may not have the effect that any body other than OFCOM is the regulator in relation to app stores.
4 Regulations may—
a make provision exempting specified descriptions of app stores from regulation under this Act;
b make provision amending Part 2, section 55 or Schedule 1 in connection with provision mentioned in paragraph (a);
c make provision corresponding or similar to provision which may be made by regulations under paragraph 1 of Schedule 11 (“threshold conditions”), with the effect that only app stores which meet specified conditions are regulated by this Act.
5 Regulations may make provision having the effect that app stores provided from outside the United Kingdom are regulated by this Act (as well as app stores provided from within the United Kingdom), but, if they do so, must contain provision corresponding or similar to section 4(5) and (6) (UK links).
6 The provision that may be made by regulations includes provision—
a imposing on providers of app stores duties corresponding or similar to duties imposed on providers of Part 3 services by—
i section 11 or 12 (children’s online safety: user-to-user services) or any of sections 20 to 23 so far as relating to section 11 or 12;
ii section 28 or 29 (children’s online safety: search services) or any of sections 31 to 34 so far as relating to section 28 or 29;
b imposing on providers of app stores duties corresponding or similar to duties imposed on providers of internet services within section 80(2) by section 81 (duties about regulated provider pornographic content);
c imposing on providers of app stores requirements corresponding or similar to requirements imposed on providers of regulated services by, or by OFCOM under, Part 6 (fees);
d imposing on OFCOM duties in relation to app stores corresponding or similar to duties imposed in relation to Part 3 services by Chapter 3 of Part 7 (OFCOM’s register of risks, and risk profiles);
e conferring on OFCOM functions in relation to app stores corresponding or similar to the functions that OFCOM have in relation to regulated services under—
i Chapter 4 of Part 7 (information), or
ii Chapter 6 of Part 7 (enforcement), including provisions of that Chapter conferring power for OFCOM to impose monetary penalties;
f about OFCOM’s production of guidance or a code of practice relating to any aspect of the regulation of app stores that is included in the regulations.
7 The provision that may be made by regulations includes provision having the effect that app stores fall within the definition of “Part 3 service” or “regulated service” for the purposes of specified provisions of this Act (with the effect that specified provisions of this Act which apply in relation to Part 3 services or regulated services, or to providers of Part 3 services or regulated services, also apply in relation to app stores or to providers of app stores).
8 Regulations may not amend or make provision corresponding or similar to—
a Chapter 2 of Part 4 (reporting CSEA content),
b Chapter 5 of Part 7 (notices to deal with terrorism content and CSEA content), or
c Part 10 (communications offences).
9 Regulations may make different provision with regard to app stores of different kinds.
10 In this section “specified” means specified in regulations.

Power to amend Act: illegal AI-generated content etc

216A Power to amend Act in relation to illegal AI-generated content etc

1 Subject to subsection (14)(b), the Secretary of State may by regulations amend any provision of this Act for or in connection with the purposes of minimising or mitigating the risks of harm to individuals in the United Kingdom presented by—
a illegal AI-generated content;
b the use of AI services for the commission or facilitation of priority offences.
2 In this section, “AI service” means an internet service that is capable (or part of which is capable) of generating AI-generated content (no matter what proportion of content on the service is AI-generated).
3 The provision that may be made by regulations includes provision securing that any or all of the duties set out in subsection (4) are imposed on providers of AI services in relation to—
a illegal AI-generated content;
b the design, operation or use of AI services so far as relating to illegal AI-generated content;
c the use of AI services for the commission or facilitation of priority offences.
4 The duties referred to in subsection (3) are—
a duties imposed on providers of regulated user-to-user services by section 9 or 10 (illegal content and activity) or any of sections 20 to 23 so far as relating to section 9 or 10;
b duties imposed on providers of regulated search services or combined services by section 26 or 27 (search content that is illegal content) or any of sections 31 to 34 so far as relating to section 26 or 27;
c duties corresponding or similar to the duties in paragraph (a) or (b).
5 The provision that may be made by regulations by virtue of subsection (3) includes provision imposing duties on providers of AI services in relation to illegal AI-generated content of all kinds even where a corresponding or similar duty imposed on providers of regulated user-to-user or search services relates only to priority illegal content.
6 The provision that may be made by regulations includes provision securing that the duties imposed on providers of Category 1 services and Category 2A services by section 38 or 39 (fraudulent advertising), or duties corresponding or similar to those duties, are imposed on providers of AI services in relation to fraudulent advertisements (whether or not AI-generated).
7 The provision that may be made by regulations includes provision securing that the requirements imposed on providers of Part 3 services by section 66 (reporting CSEA content), or requirements corresponding or similar to those requirements, are imposed on providers of AI services in relation to AI-generated CSEA content (and if such corresponding or similar requirements are imposed, regulations may amend section 67(1) so as to refer to the provision imposing them, as well as to section 66).
8 The provision that may be made by regulations includes provision securing any of the following—
a that providers of AI services are subject to the requirements imposed on providers of regulated services by, or by OFCOM under, Part 6 (fees), or are subject to requirements corresponding or similar to those requirements;
b that duties imposed on OFCOM in relation to Part 3 services by Chapter 3 of Part 7 (OFCOM’s register of risks, and risk profiles), or duties corresponding or similar to those duties, are imposed on OFCOM in relation to AI services, so far as relating to illegal AI-generated content generated by such services or their use for the commission or facilitation of priority offences;
c that functions conferred on OFCOM in relation to regulated services under the following provisions, or functions corresponding or similar to those functions, are conferred on OFCOM in relation to AI services, so far as relating to provision made by the regulations—
i Chapter 4 of Part 7 (information);
ii Chapter 6 of Part 7 (enforcement), including provisions of that Chapter conferring power for OFCOM to impose monetary penalties;
d that powers conferred on OFCOM in relation to Part 3 services under Chapter 5 of Part 7 (notices to deal with terrorism content and CSEA content), or powers corresponding or similar to those powers, are conferred on OFCOM in relation to AI services, so far as relating to AI-generated terrorism content or AI-generated CSEA content;
e that OFCOM have power to make provision in guidance or a code of practice relating to provision made by the regulations.
9 The provision that may be made by regulations includes provision securing that any provision of this Act that applies in relation to illegal content or illegal content of a particular kind applies (with or without modifications), or does not apply, in relation to illegal AI-generated content or illegal AI-generated content of a particular kind.
10 The provision that may be made by regulations includes provision amending any definition in this Act, including (but not limited to)—
a provision securing that AI services fall within the definition of “regulated user-to-user service”, “regulated search service”, “combined service”, “Part 3 service” or “regulated service” (so far as that is not already the case) or are excluded from any of those definitions;
b provision giving the meaning of any defined term in relation to AI services, AI-generated content or AI-generated content of a particular kind.
11 Regulations may make provision securing that providers of specified kinds of AI services are exempt from the requirement to comply with specified duties or requirements imposed by the regulations.
12 The provision that may be made by regulations includes—
a provision in relation to AI services that corresponds or is similar to provision in Chapter 2 of Part 7 (register of categories of services);
b provision conferring power on the Secretary of State to make regulations containing provision in relation to AI services that corresponds or is similar to provision that may be made by regulations under paragraph 1 of Schedule 11 (“threshold conditions”).
13 Regulations may make provision having the effect that AI services provided from outside the United Kingdom are regulated by this Act (as well as AI services provided from within the United Kingdom), but, if they do so, must contain equivalent provision to that made in relation to user-to-user services and search services by section 4(5) and (6) (UK links).
14 Regulations—
a may (among other things) amend any provision of this Act that mentions an automated tool or a bot (including section 59(12));
b may not amend section 234 (“harm” etc).
15 Regulations—
a may make different provision with regard to AI services of different kinds;
b may make provision with regard to AI services generally or any one or more specified kinds of AI service;
c may make different provision with regard to AI-generated content generated by different kinds of automated tools or functionalities available on AI services;
d may make provision with regard only to AI-generated content generated by specified kinds of automated tools or functionalities available on AI services.
16 Regulations may make provision as to the meaning of any reference to “AI-generated”, or “AI-generated content”, inserted by the regulations into this Act.
17 In this section—
  • “AI” is short for artificial intelligence;
  • “AI-generated CSEA content” means CSEA content that is AI-generated, and “CSEA content” here has the same meaning as in Part 3 (see section 59) except that section 59(14)(a) is to be disregarded;
  • “AI-generated terrorism content” means terrorism content that is AI-generated, and “terrorism content” here has the same meaning as in Part 3 (see section 59) except that section 59(14)(a) is to be disregarded;
  • “amend” includes repeal and apply (with or without modifications);
  • “fraudulent advertisement” has the meaning given by section 38 or 39 (depending on the kind of AI service in question), disregarding the fact that the definition in those sections applies in relation only to a Category 1 service or a Category 2A service;
  • “illegal AI-generated content” means illegal content that is AI-generated;
  • “illegal content” has the same meaning as in Part 3 (see section 59), except that where that term is used in the definition of “illegal AI-generated content”, section 59(14)(a) is to be disregarded;
  • “priority illegal content” has the same meaning as in Part 3 (see section 59);
  • “priority offence” has the same meaning as in Part 3 (see section 59);
  • “regulations”, except in subsection (12)(b), means regulations under subsection (1);
  • “specified” means specified in regulations.

Power to amend Act: alternative dispute resolution

I373I489217 Power to impose duty about alternative dispute resolution procedure

1 The Secretary of State may by regulations amend this Act for or in connection with the imposition on providers of Category 1 services of an ADR duty.
2 An “ADR duty”—
a is a duty requiring providers of Category 1 services to arrange for and engage in an alternative dispute resolution procedure in specified circumstances for the resolution of disputes about their handling of relevant complaints, and
b may include a duty requiring such providers to meet the costs incurred by any other person in using a dispute resolution procedure which is so arranged.
3 Complaints are “relevant” for the purposes of subsection (2)(a) if they—
a relate to a Category 1 service,
b are of a specified kind, and
c are made by persons of a specified kind.
4 Regulations under this section may not be made before the publication of a statement by the Secretary of State responding to OFCOM’s report under section 160 (report about reporting and complaints procedures in use by providers of Part 3 services: see subsection (10) of that section).
5 Before making regulations under this section the Secretary of State must consult—
a OFCOM,
b the Information Commissioner, and
c such other persons as the Secretary of State considers appropriate.
6 If the power conferred by subsection (1) is exercised, the first regulations made under the power must—
a require the use of a dispute resolution procedure which is impartial, and
b prohibit the use of a dispute resolution procedure which restricts or excludes the availability of civil proceedings.
7 Provision made by regulations under this section may have the effect that the duties set out in any or all of sections 21, 22 and 23 which apply in relation to duties imposed by other provisions of Chapter 2 of Part 3 are also to apply in relation to the ADR duty, and accordingly the regulations may amend—
a section 21(6),
b the definition of “safety measures and policies” in section 22(8), or
c the definition of “relevant duties” in section 23(11).
8 The provisions of this Act that may be amended by the regulations in connection with the imposition of the ADR duty include, but are not limited to, the following provisions (in addition to those mentioned in subsection (7))—
a section 7(5),
b section 104(13)(a), and
c section 131(2).
9 If the power conferred by subsection (1) is exercised, the first regulations made under the power must require OFCOM to—
a produce and publish guidance for providers of Category 1 services to assist them in complying with the ADR duty, and
b consult the Secretary of State, the Information Commissioner and such other persons as OFCOM consider appropriate before producing the guidance.
10 Section 204(1) applies for the purposes of the references to Category 1 services in this section.
11 In this section “specified” means specified in regulations under this section.
12 For the meaning of “Category 1 service”, see section 95 (register of categories of services).

Other powers to amend Act

I250I782218 Power to amend section 40

1 The Secretary of State may by regulations amend section 40 (fraud etc offences).But the power to add an offence to that section is limited by subsections (2) and (3).
2 An offence may be added to section 40 only if the Secretary of State considers it appropriate to do so because of—
a the prevalence on Category 1 services of content (other than regulated user-generated content) consisting of paid-for advertisements that amount to that offence, or the prevalence in or via search results of Category 2A services of paid-for advertisements that amount to that offence,
b the risk of harm to individuals in the United Kingdom presented by such advertisements, and
c the severity of that harm.
3 An offence may not be added to section 40 if—
a the offence concerns—
i the infringement of intellectual property rights,
ii the safety or quality of goods (as opposed to what kind of goods they are), or
iii the performance of a service by a person not qualified to perform it; or
b it is an offence under Chapter 1 of Part 4 of the Digital Markets, Competition and Consumers Act 2024.
4 In this section—
a “regulated user-generated content” has the same meaning as in Part 3 (see section 55);
b the words “in or via search results” are to be construed in accordance with section 39;
c references to advertisements that amount to an offence are to be construed in accordance with section 59 (see subsections (3), (11) and (12) of that section).

I816219 Powers to amend sections 61 and 62

1 The Secretary of State may by regulations amend—
a section 61 (primary priority content that is harmful to children);
b section 62 (priority content that is harmful to children).
But the power to add a kind of content is limited by subsections (2) to (4).
2 A kind of content may be added to section 61 only if the Secretary of State considers that, in relation to Part 3 services—
a there is a material risk of significant harm to an appreciable number of children presented by content of that kind that is regulated user-generated content or search content, and
b it is appropriate for the duties set out in sections 12(3)(a) and 29(3)(a) (duty in relation to children of all ages) to apply in relation to content of that kind.
3 A kind of content may be added to section 62 only if the Secretary of State considers that, in relation to Part 3 services, there is a material risk of significant harm to an appreciable number of children presented by content of that kind that is regulated user-generated content or search content.
4 A kind of content may not be added to section 61 or 62 if the risk of harm presented by content of that kind flows from—
a the content’s potential financial impact,
b the safety or quality of goods featured in the content, or
c the way in which a service featured in the content may be performed (for example, in the case of the performance of a service by a person not qualified to perform it).
5 The Secretary of State must consult OFCOM before making regulations under this section.
6 In this section references to children are to children in the United Kingdom.
7 In this section—
  • “regulated user-generated content” has the same meaning as in Part 3 (see section 55);
  • “search content” has the same meaning as in Part 3 (see section 57).

I760I586220 Powers to amend or repeal provisions relating to exempt content or services

1 The Secretary of State may by regulations—
a amend section 55(5), or
b repeal section 55(2)(d) and (5), and make a consequential amendment of sections 3(6), 5(2)(a) and 55(2)(f),
if the Secretary of State considers that it is appropriate to do so because of the risk of harm to individuals in the United Kingdom presented by one-to-one live aural communications.
2 Subject to subsection (3), the Secretary of State may by regulations amend section 55(2)(e), (6) or (7) if the Secretary of State considers that it is appropriate to do so because of the risk of harm to individuals in the United Kingdom presented by comments and reviews on provider content.
3 Regulations under subsection (2) may not have the effect that comments and reviews on provider content present on a service of which the provider is a recognised news publisher become regulated user-generated content within the meaning of Part 3.
4 The Secretary of State may by regulations amend Part 1 of Schedule 1 to provide for a further description of user-to-user service or search service to be exempt, if the Secretary of State considers that the risk of harm to individuals in the United Kingdom presented by a service of that description is low.
5 Regulations under subsection (4) may amend sections 3, 5 and 55 and Schedule 2 in connection with the amendment of Part 1 of Schedule 1.
6 The Secretary of State may by regulations amend Schedule 9 to provide for a further description of internet service to be included, if the Secretary of State considers that the risk of harm to children in the United Kingdom presented by regulated provider pornographic content published or displayed on a service of that description is low.
7 If the condition in subsection (8) is met, the Secretary of State may by regulations amend or repeal either of the following—
a paragraph 3 of Schedule 1 (services offering only one-to-one live aural communications);
b any provision of that Schedule added in exercise of the power conferred by subsection (4).
8 The condition is that the Secretary of State considers that it is appropriate to amend or repeal the provision in question (as the case may be) because of the risk of harm to individuals in the United Kingdom presented by a service of the description in question.
9 Subject to subsection (10), the Secretary of State may by regulations amend paragraph 4 of Schedule 1 (limited functionality services) if the Secretary of State considers that it is appropriate because of the risk of harm to individuals in the United Kingdom presented by a service described in that paragraph.
10 Regulations under subsection (9) may not have the effect that a service described in paragraph 4 of Schedule 1 of which the provider is a recognised news publisher is no longer exempt under that paragraph.
11 Regulations under subsection (7) may amend or repeal a provision of Schedule 2 in connection with the amendment or repeal of a provision of Part 1 of Schedule 1.
12 Regulations under subsection (7)(b) may amend or repeal a provision of sections 3, 5 and 55 in connection with the amendment or repeal of a provision of Part 1 of Schedule 1.
13 The Secretary of State may by regulations amend or repeal any provision of Schedule 9 added in exercise of the power conferred by subsection (6), if the Secretary of State considers that it is appropriate to do so because of the risk of harm to children in the United Kingdom presented by regulated provider pornographic content published or displayed on a service of that description.
14 In this section—
  • “comments and reviews on provider content” and “one-to-one live aural communications” have the meaning given by section 55;
  • “recognised news publisher” has the meaning given by section 56;
  • “regulated provider pornographic content” and “published or displayed” have the same meaning as in Part 5 (see section 79).

I78221 Powers to amend Part 2 of Schedule 1

England

1 The Secretary of State may by regulations amend the part of the list in Part 2 of Schedule 1 which relates to England—
a if there has been an amendment or repeal of legislation, or of a provision of legislation, by reference to which a description of education or childcare is framed;
b to add a further description of education or childcare, if the Secretary of State considers that it is appropriate to do so because of the application of enactments other than this Act, or guidance or requirements (however referred to) produced under enactments other than this Act, to persons providing education or childcare of that description;
c to omit a description of education or childcare, if the Secretary of State considers that it is appropriate to do so because of the risk of harm to individuals in England presented by services provided by persons providing education or childcare of that description which are provided for the purposes of such education or childcare (other than a service described in paragraph 7 of Schedule 1).
2 In subsection (1)(b), “enactment” includes an enactment contained in subordinate legislation (within the meaning of the Interpretation Act 1978).

Scotland

3 The Scottish Ministers may by regulations amend the part of the list in Part 2 of Schedule 1 which relates to Scotland—
a if there has been an amendment or repeal of legislation, or of a provision of legislation, by reference to which a description of education or childcare is framed;
b to add a further description of education or childcare, if the Scottish Ministers consider that it is appropriate to do so because of the application of enactments other than this Act, or guidance or requirements (however referred to) produced under enactments other than this Act, to persons providing education or childcare of that description;
c to omit a description of education or childcare, if the Scottish Ministers consider that it is appropriate to do so because of the risk of harm to individuals in Scotland presented by services provided by persons providing education or childcare of that description which are provided for the purposes of such education or childcare (other than a service described in paragraph 7 of Schedule 1).
4 In subsection (3)(b), “enactment” includes an enactment contained in, or in an instrument made under, an Act of the Scottish Parliament.

Wales

5 The Welsh Ministers may by regulations made by statutory instrument amend the part of the list in Part 2 of Schedule 1 which relates to Wales—
a if there has been an amendment or repeal of legislation, or of a provision of legislation, by reference to which a description of education or childcare is framed;
b to add a further description of education or childcare, if the Welsh Ministers consider that it is appropriate to do so because of the application of enactments other than this Act, or guidance or requirements (however referred to) produced under enactments other than this Act, to persons providing education or childcare of that description;
c to omit a description of education or childcare, if the Welsh Ministers consider that it is appropriate to do so because of the risk of harm to individuals in Wales presented by services provided by persons providing education or childcare of that description which are provided for the purposes of such education or childcare (other than a service described in paragraph 7 of Schedule 1).
6 In subsection (5)(b), “enactment” includes an enactment contained in, or in an instrument made under, a Measure or Act of Senedd Cymru.

Northern Ireland

7 The relevant Department may by regulations amend the part of the list in Part 2 of Schedule 1 which relates to Northern Ireland—
a if there has been an amendment or repeal of legislation, or of a provision of legislation, by reference to which a description of education or childcare is framed;
b to add a further description of education or childcare, if the relevant Department considers that it is appropriate to do so because of the application of enactments other than this Act, or guidance or requirements (however referred to) produced under enactments other than this Act, to persons providing education or childcare of that description;
c to omit a description of education or childcare, if the relevant Department considers that it is appropriate to do so because of the risk of harm to individuals in Northern Ireland presented by services provided by persons providing education or childcare of that description which are provided for the purposes of such education or childcare (other than a service described in paragraph 7 of Schedule 1).
8 In subsection (7), “the relevant Department” means—
a where the amendment relates to childcare, primary education or secondary education, the Department of Education in Northern Ireland;
b where the amendment relates to further education or higher education, the Department for the Economy in Northern Ireland with the concurrence of the Department of Agriculture, Environment and Rural Affairs in Northern Ireland, or the Department of Agriculture, Environment and Rural Affairs in Northern Ireland with the concurrence of the Department for the Economy in Northern Ireland;
c where the amendment relates to education in agriculture and related subjects, the Department of Agriculture, Environment and Rural Affairs in Northern Ireland.
9 In subsection (7)(b), “enactment” includes an enactment contained in, or in an instrument made under, Northern Ireland legislation.

Interpretation

10 In this section, the following terms have the same meaning as in Schedule 1—
  • “childcare”;
  • “education”;
  • “education in agriculture and related subjects”;
  • “further education”;
  • “higher education”;
  • “primary education”;
  • “secondary education”.

I742222 Powers to amend Schedules 5, 6 and 7

1 The Secretary of State may by regulations amend—
a Schedule 5 (terrorism offences);
b Part 1 of Schedule 6 (child sexual exploitation and abuse offences).
2 The Scottish Ministers may by regulations amend Part 2 of Schedule 6.
3 The Secretary of State may by regulations amend Schedule 7 (priority offences).But an offence may be added to that Schedule only on the grounds in subsection (4) or (5), and subsection (6) limits the power to add an offence.
4 The first ground for adding an offence to Schedule 7 is that the Secretary of State considers it appropriate to do so because of—
a the prevalence on regulated user-to-user services of regulated user-generated content that amounts to that offence, or the prevalence on regulated search services and combined services of search content that amounts to that offence,
b the risk of harm to individuals in the United Kingdom presented by regulated user-generated content or search content that amounts to that offence, and
c the severity of that harm.
5 The second ground for adding an offence to Schedule 7 is that the Secretary of State considers it appropriate to do so because of—
a the prevalence of the use of regulated user-to-user services for the commission or facilitation of that offence,
b the risk of harm to individuals in the United Kingdom presented by the use of such services for the commission or facilitation of that offence, and
c the severity of that harm.
6 An offence may not be added to Schedule 7 if—
a the offence concerns—
i the infringement of intellectual property rights,
ii the safety or quality of goods (as opposed to what kind of goods they are), or
iii the performance of a service by a person not qualified to perform it; or
b it is an offence under Chapter 1 of Part 4 of the Digital Markets, Competition and Consumers Act 2024.
7 The Secretary of State must consult the Scottish Ministers before making regulations under subsection (3) which—
a add an offence that extends only to Scotland, or
b amend or remove an entry specifying an offence that extends only to Scotland.
8 The Secretary of State must consult the Department of Justice in Northern Ireland before making regulations under subsection (3) which—
a add an offence that extends only to Northern Ireland, or
b amend or remove an entry specifying an offence that extends only to Northern Ireland.
9 In this section—
a “regulated user-generated content” has the same meaning as in Part 3 (see section 55);
b “search content” has the same meaning as in Part 3 (see section 57);
c references to content that amounts to an offence are to be construed in accordance with section 59 (see subsections (3), (11) and (12) of that section).

Regulations

I400223 Power to make consequential provision

1 The Secretary of State may by regulations make provision that is consequential on this Act or regulations under this Act.
2 The regulations may—
a amend or repeal provision made by the Communications Act;
b amend or revoke provision made under that Act.
3 The regulations may make transitional, transitory or saving provision.

I358224 Regulations: general

1 Regulations under this Act may make different provision for different purposes and may, in particular—
a make different provision with regard to—
i user-to-user services,
ii search services, and
iii internet services, other than regulated user-to-user services or regulated search services, that are within section 80(2);
b make different provision with regard to user-to-user services of different kinds;
c make different provision with regard to search services of different kinds;
d make different provision with regard to different kinds of services mentioned in paragraph (a)(iii);
e make different provision with regard to different kinds of internet services within section 80(2).
2 A power to make regulations under this Act includes power to make supplementary, incidental, transitional, transitory or saving provision.This subsection does not apply to regulations under section 223 (consequential provision).
3 Any power of the Secretary of State or OFCOM under this Act to make regulations is exercisable by statutory instrument.
4 The Statutory Instruments Act 1946 applies in relation to OFCOM’s powers to make regulations under this Act as if OFCOM were a Minister of the Crown.
5 The Documentary Evidence Act 1868 (proof of orders and regulations etc) has effect as if—
a OFCOM were included in the first column of the Schedule to that Act;
b OFCOM and persons authorised to act on their behalf were mentioned in the second column of that Schedule.
6 This section does not apply to regulations under section 240 (commencement and transitional provision).

I111225 Parliamentary procedure for regulations

1 A statutory instrument containing (whether alone or with other provision)—
a regulations under section 77(12),
b regulations under section 85(1),
c regulations under section 114(2),
d regulations under section 169(3),
e regulations under section 211(2),
ea regulations under section 214A(1),
f regulations under section 215(1),
fa regulations under section 216A(1),
g regulations under section 217(1),
h regulations under section 218(1),
i regulations under section 220(1), (2), (4), (6), (7), (9) or (13),
j regulations under section 221(1),
k regulations under section 222(1) or (3),
l regulations under section 223 that amend or repeal provision made by the Communications Act,
m regulations under paragraph 7 of Schedule 4,
n regulations under paragraph 38 of Schedule 8,
o regulations under paragraph 7 of Schedule 10, or
p regulations under paragraph 5(9) of Schedule 13,
may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament.
2 A statutory instrument containing regulations under section 219(1) may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament.
3 But a statutory instrument mentioned in subsection (2) may be made without a draft of the instrument being laid before, and approved by a resolution of, each House of Parliament if it contains a declaration that the Secretary of State is of the opinion that, because of urgency, it is necessary to make the regulations without a draft being so laid and approved.
4 After an instrument is made in accordance with subsection (3), it must be laid before Parliament.
5 Regulations contained in an instrument made in accordance with subsection (3) cease to have effect at the end of the period of 28 days beginning with the day on which the instrument is made unless, during that period, the instrument is approved by a resolution of each House of Parliament.
6 In calculating the period of 28 days, no account is to be taken of any whole days that fall within a period during which—
a Parliament is dissolved or prorogued, or
b either House of Parliament is adjourned for more than 4 days.
7 If regulations cease to have effect as a result of subsection (5), that does not—
a affect the validity of anything previously done under or by virtue of the regulations, or
b prevent the making of new regulations.
8 A statutory instrument containing (whether alone or with other provision) the first regulations under the following provisions may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament—
a section 154A(1);
b paragraph 1(1) of Schedule 11.
9 Any other statutory instrument containing regulations under a provision mentioned in subsection (8) is subject to annulment in pursuance of a resolution of either House of Parliament.
10 A statutory instrument containing—
a regulations under section 67(1),
b regulations under section 85(2),
c regulations under section 86,
ca regulations under section 101(E1)(a),
d regulations under section 170(1),
e regulations under section 223 that do not amend or repeal provision made by the Communications Act,
f regulations under paragraph 8(1) of Schedule 3, or
g regulations under paragraph 1(2) or (3) of Schedule 11,
is subject to annulment in pursuance of a resolution of either House of Parliament.
11 As soon as a draft of a statutory instrument containing regulations under section 85(1) or paragraph 5(9) of Schedule 13 (whether alone or with provision under section 85(2)) is ready for laying before Parliament, OFCOM must send the draft to the Secretary of State, and the Secretary of State must lay the draft before Parliament.
12 Immediately after making a statutory instrument containing only regulations under section 85(2), OFCOM must send the instrument to the Secretary of State, and the Secretary of State must lay it before Parliament.
13 Regulations made by the Scottish Ministers under—
a section 221(3), and
b section 222(2),
are subject to the affirmative procedure (see section 29 of the Interpretation and Legislative Reform (Scotland) Act 2010 (asp 10)).
14 A statutory instrument containing regulations under section 221(5) may not be made by the Welsh Ministers unless a draft of the instrument has been laid before and approved by a resolution of Senedd Cymru.
15 The power of the relevant Department to make regulations under section 221(7) is exercisable by statutory rule for the purposes of the Statutory Rules (Northern Ireland) Order 1979 (S.I. 1979/1573 (N.I. 12)).
16 Regulations may not be made by the relevant Department under section 221(7) unless a draft of the regulations has been laid before and approved by a resolution of the Northern Ireland Assembly.
17 In subsections (15) and (16), “the relevant Department” has the same meaning as in section 221(7) (see subsection (8) of that section).

PART 12 Interpretation and final provisions

Interpretation

I763226 “Provider” of internet service

1 This section applies to determine who is the “provider” of an internet service for the purposes of this Act.

User-to-user services (other than combined services)

2 The provider of a user-to-user service is to be treated as being the entity that has control over who can use the user-to-user part of the service (and that entity alone).
3 If no entity has control over who can use the user-to-user part of a user-to-user service, but an individual or individuals have control over who can use that part, the provider of the service is to be treated as being that individual or those individuals.

Search services

4 The provider of a search service is to be treated as being the entity that has control over the operations of the search engine (and that entity alone).
5 If no entity has control over the operations of the search engine, but an individual or individuals have control over those operations, the provider of the search service is to be treated as being that individual or those individuals.

Combined services

6 The provider of a combined service is to be treated as being the entity that has control over both—
a who can use the user-to-user part of the service, and
b the operations of the search engine,
(and that entity alone).
7 If no entity has control over the matters mentioned in paragraphs (a) and (b) of subsection (6), but an individual or individuals have control over both those matters, the provider of the combined service is to be treated as being that individual or those individuals.

Internet services other than user-to-user services or search services

8 The provider of an internet service, other than a user-to-user service or a search service, is to be treated as being the entity that has control over which content is published or displayed on the service.
9 If no entity has control over which content is published or displayed on such an internet service, but an individual or individuals have control over which content is published or displayed, the provider of the service is to be treated as being that individual or those individuals.

Machine-generated services

10 The provider of an internet service that is generated by a machine is to be treated as being the entity that controls the machine (and that entity alone).
11 If no entity controls the machine, but an individual or individuals control it, the provider of the internet service is to be treated as being that individual or those individuals.

Interpretation

12 A person who provides an access facility in relation to a user-to-user service, within the meaning of section 146, is not to be regarded as a person who has control over who can use the user-to-user part of the service for the purposes of this section.
13 In this section “operations of the search engine” means operations which—
a enable users of a search service or a combined service to make search requests, and
b generate responses to those requests.
14 In this section “published or displayed” is to be construed in accordance with section 79(6).
15 For the purposes of subsections (8) and (9), a person who makes available on a service an automated tool or algorithm by means of which content is generated is to be regarded as having control over content so generated.

I104227 “User”, “United Kingdom user” and “interested person”

1 For the purposes of this Act a user is a “United Kingdom user” of a service if—
a where the user is an individual, the individual is in the United Kingdom;
b where the user is an entity, the entity is incorporated or formed under the law of any part of the United Kingdom.
2 For the purposes of references in this Act to a user of a service it does not matter whether a person is registered to use a service.
3 References in this Act to a user of a service do not include references to any of the following when acting in the course of the provider’s business—
a where the provider of the service is an individual or individuals, that individual or those individuals;
b where the provider is an entity, officers of the entity;
c persons who work for the provider (including as employees or volunteers);
d any other person providing a business service to the provider such as a contractor, consultant or auditor.
4 In subsection (3) “acting in the course of the provider’s business” means (as the case may be)—
a acting in the course of the provider’s business of providing the service, or
b acting in the course of a business, trade, profession or other concern—
i carried on (whether or not for profit) by the provider of the service, and
ii for the purposes of which the service is provided.
5 In subsections (1) to (4) “service” (except in the term “business service”) means internet service, user-to-user service or search service.
6 In subsection (3) “officer” includes a director, manager, partner, associate, secretary or other similar officer.
7 In this Act “interested person”, in relation to a search service or a combined service, means a person that is responsible for a website or database capable of being searched by the search engine, provided that—
a in the case of an individual, the individual is in the United Kingdom;
b in the case of an entity, the entity is incorporated or formed under the law of any part of the United Kingdom.

I774228 “Internet service”

1 In this Act “internet service” means a service that is made available by means of the internet.
2 For the purposes of subsection (1) a service is “made available by means of the internet” even where it is made available by means of a combination of—
a the internet, and
b an electronic communications service.
3 “Electronic communications service” has the same meaning as in the Communications Act (see section 32(2) of that Act).

I645229 “Search engine”

1 In this Act “search engine”—
a includes a service or functionality which enables a person to search some websites or databases (as well as a service or functionality which enables a person to search (in principle) all websites or databases);
b does not include a service which enables a person to search just one website or database.
2 For the purposes of this Act, a search engine is not to be taken to be “included” in an internet service or a user-to-user service if the search engine is controlled by a person who does not control other parts of the service.

I599230 “Age verification” and “age estimation”

1 This section applies for the purposes of this Act.
2 “Age verification” means any measure designed to verify the exact age of users of a regulated service.
3 “Age estimation” means any measure designed to estimate the age or age-range of users of a regulated service.
4 A measure which requires a user to self-declare their age (without more) is not to be regarded as age verification or age estimation.

I382231 “Proactive technology”

1 In this Act “proactive technology” means—
a content identification technology,
b user profiling technology, or
c behaviour identification technology,
but this is subject to subsections (3) and (7).
2 “Content identification technology” means technology, such as algorithms, keyword matching, image matching or image classification, which analyses content to assess whether it is content of a particular kind (for example, illegal content).
3 But content identification technology is not to be regarded as proactive technology if it is used in response to a report from a user or other person about particular content.
4 “User profiling technology” means technology which analyses (any or all of)—
a relevant content,
b user data, or
c metadata relating to relevant content or user data,
for the purposes of building a profile of a user to assess characteristics such as age.
5 Technology which—
a analyses data specifically provided by a user for the purposes of the provider verifying or estimating the user’s age in order to decide whether to allow the user to access a service (or part of a service) or particular content, and
b does not analyse any other data or content,
is not to be regarded as user profiling technology.
6 “Behaviour identification technology” means technology which analyses (any or all of)—
a relevant content,
b user data, or
c metadata relating to relevant content or user data,
to assess a user’s online behaviour or patterns of online behaviour (for example, to assess whether a user may be involved in, or be the victim of, illegal activity).
7 But behaviour identification technology is not to be regarded as proactive technology if it is used in response to concerns identified by another person or an automated tool about a particular user.
8 “Relevant content” means—
a in relation to a user-to-user service, content that is user-generated content in relation to the service;
b in relation to a search service, the content of websites and databases capable of being searched by the search engine;
c in relation to an internet service within section 80(2), content that is provider pornographic content in relation to the service.
9 “User data” means—
a data provided by users, including personal data (for example, data provided when a user sets up an account), and
b data created, compiled or obtained by providers of regulated services and relating to users (for example, data relating to when or where users access a service or how they use it).
10 References in this Act to proactive technology include content identification technology, user profiling technology or behaviour identification technology which utilises artificial intelligence or machine learning.
11 Accredited technology that may be required to be used in relation to the detection of terrorism content or CSEA content (or both) by a notice under section 121(1) is an example of content identification technology.
12 The reference in subsection (8)(b) to a search service includes a reference to the search engine of a combined service.
13 In this section—
  • “accredited” technology has the same meaning as in Chapter 5 of Part 7 (see section 125(12));
  • “illegal content”, “terrorism content” and “CSEA content” have the same meaning as in Part 3 (see section 59);
  • “user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

I538232 Content communicated “publicly” or “privately”

1 This section specifies factors which OFCOM must, in particular, consider when deciding whether content is communicated “publicly” or “privately” by means of a user-to-user service for the purposes of—
a section 121 (notice to deal with terrorism content),
b section 136 (requirement to use proactive technology), or
c paragraph 13(4) of Schedule 4 (recommendation of proactive technology in codes of practice).
2 The factors are—
a the number of individuals in the United Kingdom who are able to access the content by means of the service;
b any restrictions on who may access the content by means of the service (for example, a requirement for approval or permission from a user, or the provider, of the service);
c the ease with which the content may be forwarded to or shared with—
i users of the service other than those who originally encounter it, or
ii users of another internet service.
3 The following factors do not count as restrictions on access—
a a requirement to log in to or register with a service (or part of a service);
b a requirement to make a payment or take out a subscription in order to access a service (or part of a service) or to access particular content;
c inability to access a service (or part of a service) or to access particular content except by using particular technology or a particular kind of device (as long as that technology or device is generally available to the public).

I411233 “Functionality”

1 In this Act “functionality”, in relation to a user-to-user service, includes any feature that enables interactions of any description between users of the service by means of the service, and includes any feature enabling a user to do anything listed in subsection (2).
2 The things are—
a creating a user profile, including an anonymous or pseudonymous profile;
b searching within the service for user-generated content or other users of the service;
c forwarding content to, or sharing content with, other users of the service;
d sharing content on other internet services;
e sending direct messages to or speaking to other users of the service, or interacting with them in another way (for example by playing a game);
f expressing a view on content, including, for example, by—
i applying a “like” or “dislike” button or other button of that nature,
ii applying an emoji or symbol of any kind,
iii engaging in yes/no voting, or
iv rating or scoring content in any way (including giving star or numerical ratings);
g sharing current or historic location information with other users of the service, recording a user’s movements, or identifying which other users of the service are nearby;
h following or subscribing to particular kinds of content or particular users of the service;
i creating lists, collections, archives or directories of content or users of the service;
j tagging or labelling content present on the service;
k uploading content relating to goods or services;
l applying or changing settings on the service which affect the presentation of user-generated content on the service;
m accessing other internet services through content present on the service (for example through hyperlinks).
3 In this Act “functionality”, in relation to a search service, includes (in particular)—
a a feature that enables users to search websites or databases;
b a feature that makes suggestions relating to users’ search requests (predictive search functionality).
4 In this section “user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

I91234 “Harm” etc

1 This section applies for the purposes of this Act, apart from Part 10 (communications offences).
2 “Harm” means physical or psychological harm.
3 References to harm presented by content, and any other references to harm in relation to content, include references to harm arising or that may arise from any one or combination of the following—
a the nature of the content;
b the fact of its dissemination;
c the manner of its dissemination.
4 References to harm presented by content, and any other references to harm in relation to content, include references to cumulative harm arising or that may arise in the following circumstances—
a where content, or content of a particular kind, is repeatedly encountered by an individual (including, but not limited to, where content, or a kind of content, is sent to an individual by one user or by different users or encountered as a result of algorithms used by, or functionalities of, a service);
b where content of a particular kind is encountered by an individual in combination with content of a different kind (including, but not limited to, where a kind of content is sent to an individual by one user or by different users or encountered as a result of algorithms used by, or functionalities of, a service).
5 References to harm presented by content, and any other references to harm in relation to content, include references to harm arising or that may arise in the following circumstances—
a where, as a result of the content, individuals act in a way that results in harm to themselves or that increases the likelihood of harm to themselves;
b where, as a result of the content, individuals do or say something to another individual that results in harm to that other individual or that increases the likelihood of such harm (including, but not limited to, where individuals act in such a way as a result of content that is related to that other individual’s characteristics or membership of a group).
6 References to a risk of harm in relation to functionalities, and references to the risk of functionalities facilitating users encountering particular kinds of content (however expressed), include references to risks arising or that may arise due to multiple functionalities which, used in combination, increase the likelihood of harm arising (for example, as mentioned in subsection (4)).
7 References to a risk of harm, or to potential harm, are to be read in the same way as references to harm.
8 In contexts where harm (or a risk of harm or potential harm) relates to children, subsections (4) to (5) are to be read as if they referred to children instead of individuals.

I268235 “Online safety functions” and “online safety matters”

1 In this Act references to OFCOM’s “online safety functions”—
a are references to—
i the functions that OFCOM have under this Act,
ii the functions that OFCOM have under the provisions of the Communications Act listed in subsection (2), so far as those functions relate to regulated services or Part 3 services (as the case may be), and
iii the functions that OFCOM have under section 3 of the Communications Act (general duties), so far as duties under that section relate to a function which is an online safety function by reason of sub-paragraph (i) or (ii);
b include references to OFCOM’s power to do anything appearing to them to be incidental or conducive to the carrying out of any of their functions within paragraph (a)(i) or (ii) (see section 1(3) of the Communications Act).
2 These are the provisions of the Communications Act referred to in subsection (1)(a)(ii)—
a section 6 (duties to review regulatory burdens);
b section 7 (duty to carry out impact assessments);
c section 8 (duty to publish and meet promptness standards);
d sections 11 and 11A (duties to promote media literacy);
e sections 12 and 13 (Content Board);
f section 14(6)(a) (research about media literacy);
g section 14(6B) (research about users’ experience of regulated services);
h section 16 (consumer consultation);
i section 20 (advisory committees for different parts of the United Kingdom);
j section 21 (advisory committee on elderly and disabled persons);
k section 22 (representation on international and other bodies);
l section 26 (publication of information and advice for consumers etc).
3 References to OFCOM’s “online safety functions” also include references to OFCOM’s duty to comply with any of the following, so far as relating to the use of a regulated service by a person who has died—
a a notice from a senior coroner under paragraph 1(2) of Schedule 5 to the Coroners and Justice Act 2009 in connection with an investigation into a person’s death;
b a request for information in connection with the investigation of a procurator fiscal into, or an inquiry held or to be held in relation to, a person’s death;
c a notice from a coroner under section 17A(2) of the Coroners Act (Northern Ireland) 1959 (c. 15 (N.I.)) in connection with—
i an investigation to determine whether an inquest into a person’s death is necessary, or
ii an inquest in relation to a person’s death.
4 In this Act “online safety matters” means the matters to which OFCOM’s online safety functions relate.
5 In subsection (3)(b) “inquiry” means an inquiry held, or to be held, under the Inquiries into Fatal Accidents and Sudden Deaths etc. (Scotland) Act 2016 (asp 2).

I68236 Interpretation: general

1 In this Act—
  • “adult” means a person aged 18 or over;
  • “audit notice” means a notice given under paragraph 4 of Schedule 12;
  • “automated tool” includes bot;
  • “capacity”: any reference to the capacity of a provider of a regulated service is to—
    1. the financial resources of the provider, and
    2. the level of technical expertise which is available to the provider, or which it is reasonable to expect would be available to the provider given its size and financial resources;
  • “child” means a person under the age of 18;
  • “the Communications Act” means the Communications Act 2003;
  • “confirmation decision” means a notice given under section 132;
  • “content” means anything communicated by means of an internet service, whether publicly or privately, including written material or messages, oral communications, photographs, videos, visual images, music and data of any description;
  • “the Convention” has the meaning given by section 21(1) of the Human Rights Act 1998;
  • “country” includes territory;
  • “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3(9) of that Act);
  • “document” means anything in which information (in whatever form) is recorded;
  • “encounter”, in relation to content, means read, view, hear or otherwise experience content;
  • “entity” means a body or association of persons or an organisation, regardless of whether the body, association or organisation is—
    1. formed under the law of any part of the United Kingdom or of a country outside the United Kingdom, or
    2. a legal person under the law under which it is formed;
  • “freedom of expression”: any reference to freedom of expression (except in sections 41(6)(f) and 78(2)(d)) is to the freedom to receive and impart ideas, opinions or information (referred to in Article 10(1) of the Convention) by means of speech, writing or images;
  • “identifying content” means content the function of which is to identify a user of an internet service (for example, a user name or profile picture);
  • “information notice” means a notice given under section 101(C1) or (1) or 101(1);
  • “measure”: any reference to a measure includes a reference to any system or process relevant to the operation of an internet service or any step or action which may be taken by a provider of an internet service to comply with duties or requirements under this Act;
  • “notice” means notice in writing;
  • “notify” means notify in writing, and “notification” is to be construed accordingly;
  • “OFCOM” means the Office of Communications;
  • “paid-for advertisement”: an advertisement is a “paid-for advertisement” in relation to an internet service if—
    1. the provider of the service receives any consideration (monetary or non-monetary) for the advertisement (whether directly from the advertiser or indirectly from another person), and
    2. the placement of the advertisement is determined by systems or processes that are agreed between the parties entering into the contract relating to the advertisement;
  • “person” includes (in addition to an individual and a body of persons corporate or unincorporate) any organisation or association of persons;
  • “personal data” has the meaning given by section 3(2) of the Data Protection Act 2018;
  • “pornographic content” means content of such a nature that it is reasonable to assume that it was produced solely or principally for the purpose of sexual arousal;
  • “processing” has the meaning given by section 3(4) of the Data Protection Act 2018;
  • “provisional notice of contravention” means a notice given under section 130;
  • “publicly available” means available to members of the public in the United Kingdom;
  • “systems and/or processes”: any reference to systems and/or processes is to human or automated systems and/or processes, and accordingly includes technologies;
  • “taking down” (content): any reference to taking down content is to any action that results in content being removed from a user-to-user service or being permanently hidden so users of the service cannot encounter it (and related expressions are to be read accordingly);
  • “terms of service”, in relation to a user-to-user service, means all documents (whatever they are called) comprising the contract for use of the service (or of part of it) by United Kingdom users;
  • “user-to-user part”, in relation to a user-to-user service, means the part of the service on which content that is user-generated content in relation to the service is present.
2 The definitions of “encounter” and “person” in subsection (1) do not apply for the purposes of Part 10 (for the definition of “encounter” in that Part, see section 182(5)).
3 References in this Act to an individual with a certain characteristic include references to an individual with a combination of characteristics.
4 References in this Act to a kind of user-to-user service or search service (or Part 3 service) include references to user-to-user services or search services grouped together for the purposes of a risk profile prepared by OFCOM under section 98 (and references to different kinds of user-to-user services or search services (or Part 3 services) are to be read accordingly).
5 References in this Act to content (or content of a particular kind) present or prevalent on a user-to-user service (or on a part of it), or to the presence, incidence or prevalence of content (or content of a particular kind) on a user-to-user service (or on a part of it), do not include, in the case of a user-to-user service that includes a search engine—
a search content, or
b any other content that, following a search request, may be encountered as a result of subsequent interactions with internet services.
In this subsection “search content” and “search request” have the same meaning as in Part 3 (see section 57).
6 For the purposes of this Act—
a any reference to the use of or access to a service, or to content present, published or displayed on a service, is to be taken to include use of or access to the service or content on registering or on the making of a payment or on subscription;
b any reference to content that is made available or that may be accessed, encountered or shared, is to be taken to include content that is made available or that may be accessed, encountered or shared for a limited period of time only;
and references to restrictions on access to a service or to content are to be read accordingly.
7 For the purposes of this Act, content that is user-generated content in relation to an internet service does not cease to be such content in relation to the service when published or displayed on the service by means of—
a software or an automated tool or algorithm applied by the provider of the service or by a person acting on behalf of the provider, or
b an automated tool or algorithm made available on the service by the provider or by a person acting on behalf of the provider.
8 Nothing in this Act (other than section 212) affects any prohibition or restriction in relation to pornographic content, or powers in relation to such content, under another enactment or rule of law.
9 In this section, “user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

I568237 Index of defined terms

The following table sets out terms defined or explained for this Act or for a Part of this Act.
TermProvision
adultsection 236
age estimationsection 230
age verificationsection 230
audit noticesection 236
automated toolsection 236
capacity (of a provider)section 236
Category 1 servicesection 95(10)(a)
Category 2A servicesection 95(10)(b)
Category 2B servicesection 95(10)(c)
charging year (in Part 6)section 90
childsection 236
children’s access assessment (in Part 3)section 35
combined servicesection 4(7)
the Communications Act section 236
confirmation decisionsection 236
contentsection 236
content that is harmful to children (in Part 3)section 60
the Conventionsection 236
countrysection 236
CSEA content (in Part 3)section 59
the data protection legislation section 236
documentsection 236
encounter (content) (except in Part 10)section 236
entitysection 236
freedom of expressionsection 236
functionalitysection 233
harm (except in Part 10)section 234
identifying contentsection 236
illegal content (in Part 3)section 59
information noticesection 236
initial charging year (in Part 6)section 90
interested personsection 227
internet servicesection 228 (see also section 204(1))
journalistic content (in Part 3)section 19
likely to be accessed by children (in Part 3)section 37
measuresection 236
news publisher content (in Part 3)section 55(8) to (10)
non-designated content that is harmful to children (in Part 3)section 60
noticesection 236
notify, notificationsection 236
OFCOMsection 236
online safety functionssection 235
online safety matterssection 235
paid-for advertisementsection 236
Part 3 servicesection 4(3)
person (except in Part 10)section 236
personal datasection 236
pornographic content section 236
primary priority content that is harmful to children (in Part 3)section 61
priority content that is harmful to children (in Part 3)section 62
priority illegal content (in Part 3)section 59
priority offence (in Part 3)section 59
proactive technologysection 231
processing (of data)section 236
providersection 226
provider pornographic content (in Part 5)section 79
provisional notice of contraventionsection 236
publicly availablesection 236
publicly/privately (in relation to communication of content)section 232
published or displayed (in relation to pornographic content) (in Part 5)section 79
recognised news publisher (in Part 3)section 56
regulated provider pornographic content (in Part 5)section 79
regulated search servicesection 4(2)
regulated servicesection 4(4)
regulated user-generated content (in Part 3)section 55
regulated user-to-user servicesection 4(2)
restricting users’ access to content (in Part 3)section 58
searchsection 57
search contentsection 57
search enginesection 229
search requestsection 57
search resultssection 57
search servicesection 3 (see also section 204(1))
systems and/or processessection 236
taking down (content)section 236
terms of servicesection 236
terrorism content (in Part 3)section 59
United Kingdom usersection 227
usersection 227
user-generated content (in Part 3)section 55(3) and (4)
user-to-user part (of a service)section 236
user-to-user servicesection 3 (see also section 204(1))

Final provisions

I387238 Financial provisions

There is to be paid out of money provided by Parliament—
a any expenditure incurred under or by virtue of this Act by the Secretary of State, and
b any increase attributable to this Act in the sums payable under any other Act out of money so provided.

I543239 Extent

1 Subject to the following provisions of this section, this Act extends to England and Wales, Scotland and Northern Ireland.
2 The following provisions extend to England and Wales and Northern Ireland—
a sections 179 to 183;
b section 189(1).
3 The following provisions extend to England and Wales only—
a section 187;
b section 188;
c section 189(2);
d section 190;
e section 213;
f section 214(1) to (3).
4 Section 214(4) to (6) extends to Scotland only.
5 The following provisions extend to Northern Ireland only—
a section 189(3);
b section 214(7) to (9).
6 An amendment or repeal made by Schedule 14 has the same extent within the United Kingdom as the provision amended or repealed.
C17 His Majesty may by Order in Council provide for any of the provisions of this Act to extend, with or without modifications, to the Bailiwick of Guernsey or to the Isle of Man.
8 Subsections (1) and (2) of section 224 apply to an Order in Council under subsection (7) as they apply to regulations under this Act.
9 The power conferred by section 411(6) of the Communications Act may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment or repeal made by or under this Act of any part of that Act (with or without modifications).
10 The power conferred by section 338 of the Criminal Justice Act 2003 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man the amendments of provisions of that Act made by paragraph 17 of Schedule 14.
11 The power conferred by section 60(6) of the Modern Slavery Act 2015 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man the amendments of Schedule 4 to that Act made by paragraph 19 of Schedule 14.
12 The power conferred by section 415(1) of the Sentencing Act 2020 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man the amendments of Schedule 18 to that Act made by paragraph 20 of Schedule 14.

I723240 Commencement and transitional provision

1 Except as provided by subsection (4), this Act comes into force on such day as the Secretary of State may by regulations appoint.
2 The power to make regulations under subsection (1) includes power to appoint different days for different purposes.
3 Regulations under subsection (1) may not bring section 210 into force before the end of the period of six months beginning with the date specified in regulations under paragraph 8(1) of Schedule 3.
4 The following provisions come into force on the day on which this Act is passed—
a Parts 1 and 2;
b Chapter 1 of Part 3;
c section 41, except subsection (4) of that section;
d section 42 and Schedule 4;
e sections 43 to 48;
f section 52(3), (4) and (5);
g section 53, except subsection (2) of that section;
h Chapter 7 of Part 3 and Schedules 5, 6 and 7;
i section 70;
j section 74;
k section 79;
l section 80(4);
m section 82;
n sections 90 and 91;
o section 93;
p section 94 and Schedule 11;
q Chapter 3 of Part 7;
r sections 115 to 117;
s section 129;
t section 151;
u section 154 so far as relating to a duty imposed on OFCOM under Schedule 11;
v sections 169 and 170;
w section 193, except subsection (2)(b) of that section;
x section 194;
y section 204(1);
z section 207;
z1 section 212;
z2 section 214;
z3 section 219;
z4 sections 221 to 225;
z5 this Part.
5 The Secretary of State may by regulations make transitional, transitory or saving provision in connection with the coming into force of any provision of this Act.
6 The power to make regulations under subsection (5) includes power to make different provision for different purposes.
7 Regulations under this section are to be made by statutory instrument.

I290241 Short title

This Act may be cited as the Online Safety Act 2023.

SCHEDULES

SCHEDULE 1 

Exempt user-to-user and search services

Sections 3 and 4

PART 1 Descriptions of services which are exempt

I3031 Email services

A user-to-user service is exempt if emails are the only user-generated content (other than identifying content) enabled by the service.

I7152 SMS and MMS services

1 A user-to-user service is exempt if SMS messages are the only user-generated content (other than identifying content) enabled by the service.
2 A user-to-user service is exempt if MMS messages are the only user-generated content (other than identifying content) enabled by the service.
3 A user-to-user service is exempt if SMS messages and MMS messages are the only user-generated content (other than identifying content) enabled by the service.
4 “SMS message” and “MMS message” have the meaning given by section 55(12).

I8623 Services offering only one-to-one live aural communications

1 A user-to-user service is exempt if one-to-one live aural communications are the only user-generated content (other than identifying content) enabled by the service.
2 “One-to-one live aural communications” has the meaning given by section 55(5).

I454 Limited functionality services

1 A user-to-user service is exempt if the functionalities of the service are limited, such that users are able to communicate by means of the service only in the following ways—
a posting comments or reviews relating to provider content;
b sharing such comments or reviews on a different internet service;
c expressing a view on such comments or reviews, or on provider content, by means of—
i applying a “like” or “dislike” button or other button of that nature,
ii applying an emoji or symbol of any kind,
iii engaging in yes/no voting, or
iv rating or scoring the content (or the comments or reviews) in any way (including giving star or numerical ratings);
d producing or displaying identifying content in connection with any of the activities described in paragraphs (a) to (c).
2 In sub-paragraph (1), “provider content” means content published on a service by the provider of the service or by a person acting on behalf of the provider, including where the publication of the content is effected or controlled by means of—
a software or an automated tool or algorithm applied by the provider or by a person acting on behalf of the provider, or
b an automated tool or algorithm made available on the service by the provider or by a person acting on behalf of the provider.
3 For the purposes of this paragraph, content that is user-generated content in relation to a service is not to be regarded as provider content in relation to that service.

I3715 Services which enable combinations of user-generated content

A user-to-user service is exempt if the only user-generated content enabled by the service is content of the following kinds—
a content mentioned in paragraph 1, 2 or 3 and related identifying content;
b content arising in connection with any of the activities described in paragraph 4(1).

I1586 Exception to exemptions in paragraphs 1 to 5

But a a user-to-user service described in any of paragraphs 1 to 5 is not exempt if—
a regulated provider pornographic content is published or displayed on the service, and
b the service has links with the United Kingdom within the meaning of section 80(4).

I8767 Internal business services (entire user-to-user service or search service)

1 A user-to-user service or a search service is exempt if the conditions in sub-paragraph (2) are met in relation to the service.
2 The conditions are—
a the user-to-user service or search service is an internal resource or tool for a business, or for more than one business carried on by the same person,
b the person carrying on the business (or businesses) (“P”) is the provider of the user-to-user service or search service, and
c the user-to-user service or search service is available only to a closed group of people comprising some or all of the following—
i where P is an individual or individuals, that individual or those individuals,
ii where P is an entity, officers of P,
iii persons who work for P (including as employees or volunteers) for the purposes of any activities of the business (or any of the businesses) in question, and
iv any other persons authorised by a person within sub-paragraph (i), (ii) or (iii) to use the service for the purposes of any activities of the business (or any of the businesses) in question (for example, a contractor, consultant or auditor, or in the case of an educational institution, pupils or students).
3 In this paragraph—
  • “business” includes trade, profession, educational institution or other concern (whether or not carried on for profit);
  • “officer” includes a director, manager, partner, associate, secretary, governor, trustee or other similar officer.

I3708 Internal business services (part of user-to-user service or search service)

1 A user-to-user service is exempt if—
a the conditions in paragraph 7(2) are met in relation to a part of the service,
b no user-generated content is enabled by the rest of the service, and
c no regulated provider pornographic content is published or displayed on the rest of the service.
2 A user-to-user service is also exempt if—
a the conditions in paragraph 7(2) are met in relation to a part of the service,
b the only user-generated content enabled by the rest of the service is—
i content mentioned in paragraph 1, 2 or 3 and related identifying content, or
ii content arising in connection with any of the activities described in paragraph 4(1), and
c no regulated provider pornographic content is published or displayed on the rest of the service.
3 A search service is exempt if—
a the conditions in paragraph 7(2) are met in relation to a part of the service that is a search engine,
b the service does not include a public search engine, and
c no regulated provider pornographic content is published or displayed on the rest of the service.
4 In this paragraph—
  • “public search engine” means a search engine other than one in relation to which the conditions in paragraph 7(2) are met;
  • “the rest of the service” means all parts of the user-to-user service or search service other than the part in relation to which the conditions in paragraph 7(2) are met.

I219 Services provided by public bodies

1 A user-to-user service or a search service is exempt if—
a both of the following conditions are met in relation to the service—
i the provider of the service is a public authority within the meaning of section 6 of the Human Rights Act 1998, and
ii the service is provided in the exercise of public functions only,
b the provider of the service is Parliament, either House of Parliament, the Scottish Parliament, Senedd Cymru, the Northern Ireland Assembly or a person acting on behalf of any of those institutions,
c the provider of the service is a foreign sovereign power, or
d both of the following conditions are met in relation to the service—
i the provider of the service is an entity formed under the law of a country outside the United Kingdom, which exercises functions of a public nature, and
ii the service is provided in the exercise of such functions only.
2 But a user-to-user service or a search service is not exempt under this paragraph if—
a the provider of the service is a person providing education or childcare, and
b the service is provided for the purposes of that education or childcare.
See paragraph 10 for an exemption for services provided by persons providing education or childcare of particular descriptions.
3 This paragraph is without prejudice to the fact that this Act does not apply in relation to a user-to-user or search service provided by the Crown.
4 In this paragraph, “public function” means a function that is a function of a public nature for the purposes of the Human Rights Act 1998.

I66810 Services provided by persons providing education or childcare

1 A user-to-user service or a search service is exempt if—
a the provider of the service is—
i the person with legal responsibility for education or childcare of a description listed in Part 2 of this Schedule (“the responsible person”), or where the responsible person is a body, a member of that body, or
ii a person who is employed or engaged to provide education or childcare of a description listed in Part 2 of this Schedule, and who is subject to safeguarding duties which relate to the provision of that education or childcare, and
b the service is provided for the purposes of that education or childcare.
2 In sub-paragraph (1)(a)(ii), “safeguarding duties” means duties or requirements which are related to the safeguarding of children arising under enactments other than this Act, under guidance or requirements (however referred to) produced under enactments other than this Act, or as a result of contractual arrangements made by the responsible person.
3 For the purposes of this paragraph, the person with legal responsibility for education or childcare of a particular description is the person with legal responsibility for its day-to-day provision (for example, the person with legal responsibility for a particular school), rather than any other person who has a duty to ensure that, in general, education or childcare of that description (or education or childcare which includes education or childcare of that description) is provided.

I80511 Interpretation

In Part 1 of this Schedule—
  • “enactment” includes—
    1. an enactment contained in subordinate legislation (within the meaning of the Interpretation Act 1978),
    2. an enactment contained in, or in an instrument made under, an Act of the Scottish Parliament,
    3. an enactment contained in, or in an instrument made under, a Measure or Act of Senedd Cymru, and
    4. an enactment contained in, or in an instrument made under, Northern Ireland legislation;
  • “regulated provider pornographic content” and “published or displayed” have the same meaning as in Part 5 (see section 79);
  • “user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

PART 2 Paragraph 10 exemption: descriptions of education and childcare

England

I69712Early years childminding by an early years childminder registered under Chapter 2 of Part 3 of the Childcare Act 2006.
I77013Early years provision by a person registered under Chapter 2 of Part 3 of that Act.
I37714Later years childminding by a later years childminder registered under Chapter 3 of Part 3 of that Act.
I35515Later years provision by a person registered under Chapter 3 of Part 3 of that Act.
I20216Education or childcare in a maintained nursery school within the meaning of section 22 of the School Standards and Framework Act 1998.
I10617Education or childcare in—
a an Academy school, within the meaning of section 1A of the Academies Act 2010;
b an alternate provision Academy, within the meaning of section 1C of that Act;
c a maintained school, within the meaning of the School Standards and Framework Act 1998 (see section 20(7) of that Act);
d a non-maintained special school, being a school that is approved under section 342 of the Education Act 1996;
e an independent educational institution registered on the register maintained under section 95 of the Education and Skills Act 2008;
f a pupil referral unit, within the meaning of section 19 of the Education Act 1996.
I26718Education in—
a an institution in England within the further education sector, within the meaning of the Further and Higher Education Act 1992 (see section 91(3) of that Act);
b a 16 to 19 Academy, within the meaning of section 1B of the Academies Act 2010;
c a special post-16 institution, within the meaning of Part 3 of the Children and Families Act 2014 (see section 83(2) of that Act).
I81819Education provided by an independent training provider.
I15320Further education for persons under 19 provided by a local authority in England.
I80221In paragraphs 12 to 15, “early years childminding”, “early years provision”, “later years childminding” and “later years provision” have the same meaning as in Part 3 of the Childcare Act 2006 (see section 98 of that Act).
I23522In paragraph 19, “independent training provider” means a provider—
a that is a provider of post-16 education or training carried on, or partly carried on, in England—
i to which Chapter 3 of Part 8 of the Education and Inspections Act 2006 (inspection of further education and training etc) applies, and
ii which is funded, wholly or partly, by the Secretary of State, a local authority in England or a combined authority, but
b that is not—
i an employer who only provides such education or training to its employees,
ii a 16 to 19 Academy (within the meaning of section 1B of the Academies Act 2010),
iii a school,
iv a local authority in England,
v an institution within the further education sector (within the meaning given by section 91(3) of the Further and Higher Education Act 1992), or
vi a higher education provider (within the meaning given by section 83(1) of the Higher Education and Research Act 2017).
I14723In paragraphs 20 and 22, “local authority in England” has the same meaning as in the Education Act 1996 (see sections 579(1) and 581 of that Act).
I33224In paragraph 22—
  • “combined authority” means a combined authority established under section 103 of the Local Democracy, Economic Development and Construction Act 2009;
  • “school” has the meaning given by section 4(1) of the Education Act 1996.

Scotland

I24825Early learning and childcare, within the meaning of Part 6 of the Children and Young People (Scotland) Act 2014 (asp 8) (see section 46 of that Act).
I57926Child minding, within the meaning of Part 5 of the Public Services Reform (Scotland) Act 2010 (asp 8) (see paragraph 12 of Schedule 12 to that Act).
I36827Day care of children, within the meaning of Part 5 of that Act (see paragraph 13 of Schedule 12 to that Act).
I88428Primary education, secondary education or childcare in—
a a school, or
b a hostel used mainly by pupils attending a school;
and in this paragraph “school” has the same meaning as in the Education (Scotland) Act 1980 (see section 135(1) of that Act).
I929Further education provided by a body listed under the heading “Institutions formerly eligible for funding by the Scottish Further Education Funding Council” or under the heading “Other institutions” in Schedule 2 to the Further and Higher Education (Scotland) Act 2005 (asp 6).
I22530Further education provided by a college of further education which is assigned to a regional strategic body by an order made under section 7C(1) of that Act.

Wales

I18331Child minding by a person who is registered as a child minder under Part 2 of the Children and Families (Wales) Measure 2010 (nawm 1).
I46732Day care for children by a person who is registered to provide day care for children under Part 2 of that Measure.
I67133Primary education, secondary education or childcare in a school in Wales, within the meaning of the Education Act 1996 as it applies in relation to Wales (see section 4 of that Act).
I77234Education provided in accordance with section 19A of the Education Act 1996.
I24435Further education in an institution in Wales within the further education sector, within the meaning of the Further and Higher Education Act 1992 (see section 91(3) of that Act).
I57536
1 Any further education or training in Wales that is—
a funded or otherwise secured by the Commission for Tertiary Education and Research,
b funded or otherwise secured by the Welsh Ministers, or
c funded by a local authority in Wales (within the meaning of section 579(1) of the Education Act 1996).
2 Sub-paragraph (1) does not include further education or training in Wales provided by—
a an institution in Wales within the higher education sector, within the meaning of the Further and Higher Education Act 1992 (see section 91(5) of that Act), or
b a person who is a provider of such education or training only by reason of providing it to the person’s employees.
3 In this paragraph, the references to “further education” and “training” have the meanings given by section 144(2), (4) and (5) of the Tertiary Education and Research (Wales) Act 2022.
I9337In paragraphs 31 and 32, “child minding” and “day care for children” have the same meaning as in Part 2 of the Children and Families (Wales) Measure 2010 (see section 19 of that Measure).

Northern Ireland

I3838Childcare by persons who act as child minders or provide day care for children within the meaning of the Children (Northern Ireland) Order 1995 (S.I. 1995/755 (N.I. 2)), and who are registered under Article 118 of that Order.
I30139Pre-school education, within the meaning of Part 5 of the Education (Northern Ireland) Order 1998 (S.I. 1998/1759 (N.I. 13)) (see Article 17(8) of that Order).
I3640Education in a nursery school, within the meaning of the Education and Libraries (Northern Ireland) Order 1986 (S.I. 1986/594 (N.I. 3)) (see Article 2(2) of that Order).
I4641Education or childcare in a school, within the meaning of the Education and Libraries (Northern Ireland) Order 1986 (see Article 2(2) of that Order).
I71742Education which is suitable education otherwise than at school provided in accordance with Article 86 of the Education (Northern Ireland) Order 1998.
I67643Education in an institution of further education, within the meaning of the Further Education (Northern Ireland) Order 1997 (S.I. 1997/1772 (N.I. 15)) (see Article 2(2) of that Order).
I43244Education in agriculture and related subjects.

PART 3 Interpretation

I15245The following definitions apply for the purposes of this Schedule.
I58146“Childcare”—
a in relation to provision in England, has same meaning as in the Childcare Act 2006 (see section 18 of that Act);
b in relation to provision in Scotland, means early learning and childcare within the meaning of Part 6 of the Children and Young People (Scotland) Act 2014 (see section 46 of that Act), and any form of care provided outside school hours or during school holidays to children who are in attendance at an educational establishment (and in this paragraph, “educational establishment” has the same meaning as in the Education (Scotland) Act 1980 (see section 135(1) of that Act));
c in relation to provision in Wales, means anything that amounts to child minding or day care for children for the purposes of Part 2 of the Children and Families (Wales) Measure 2010 (see section 19(2) to (4) of that Measure), and any form of care provided by a school outside school hours or during school holidays (and in this paragraph “school” has the same meaning as in the Education Act 1996 as it applies in relation to Wales (see section 4 of that Act));
d in relation to provision in Northern Ireland, means anything that amounts to child minding or day care for the purposes of Part 11 of the Children (Northern Ireland) Order 1995, and any form of care provided by a school outside school hours or during school holidays (and in this paragraph “school” has the same meaning as in the Education and Libraries (Northern Ireland) Order (see Article 2(2) of that Order)).
I76147“Education”—
a in relation to provision in England, Wales and Scotland, means primary education, secondary education, further education or higher education;
b in relation to provision in Northern Ireland, means primary education, secondary education, further education, higher education or education in agriculture and related subjects.
I28948“Education in agriculture and related subjects”, in relation to provision in Northern Ireland, means education consisting of instruction in agriculture and related subjects provided by the Department of Agriculture, Environment and Rural Affairs in Northern Ireland under section 5(2)(a) of the Agriculture Act (Northern Ireland) 1949 (c. 2 (N.I.)), but not where the instruction is provided only to the Department’s employees.
I14249“Further education”—
a in relation to provision in England and Wales, has the same meaning as in the Education Act 1996 (see section 2 of that Act);
b in relation to provision in Scotland, has the same meaning as in Part 1 of the Further and Higher Education (Scotland) Act 1992 (see sections 1(3) and 6 of that Act);
c in relation to provision in Northern Ireland, has the same meaning as in the Further Education (Northern Ireland) Order 1997 (see Article 3 of that Order).
I64650“Higher education”—
a in relation to provision in England and Wales, has the same meaning as in the Education Act 1996 (see section 579(1) of that Act);
b in relation to provision in Scotland, has the same meaning as in Part 2 of the Further and Higher Education (Scotland) Act 1992 (see section 38 of that Act);
c in relation to provision in Northern Ireland, means—
i “higher education” within the meaning of the Further Education (Northern Ireland) Order 1997 (see Article 2(2) of that Order), and
ii any other education provided by a higher education institution within the meaning of the Education and Libraries (Northern Ireland) Order 1993 (S.I. 1993/2810 (N.I. 12)) (see Article 30 of that Order).
I14051“Primary education” and “secondary education”—
a in relation to provision in England and Wales, have the same meaning as in the Education Act 1996 (see section 2 of that Act);
b in relation to provision in Scotland, have the same meaning as in the Education (Scotland) Act 1980 (see section 135(2) of that Act);
c in relation to provision in Northern Ireland, have the same meaning as in the Education and Libraries (Northern Ireland) Order 1986 (see Article 2(2) of that Order).

SCHEDULE 2 

User-to-user services and search services that include regulated provider pornographic content

Section 4

I8401A user-to-user service described in any of paragraphs 1 to 5 of Schedule 1—
a on which regulated provider pornographic content is published or displayed, and
b that has links with the United Kingdom.
I4482
1 A user-to-user service within sub-paragraph (2) or (3).
2 A user-to-user service is within this sub-paragraph if—
a the internal business service conditions are met in relation to a part of the service,
b no user-generated content is enabled by the rest of the service,
c regulated provider pornographic content is published or displayed on the rest of the service, and
d the service has links with the United Kingdom.
3 A user-to-user service is within this sub-paragraph if—
a the internal business service conditions are met in relation to a part of the service,
b the only user-generated content enabled by the rest of the service is—
i content mentioned in paragraph 1, 2 or 3 of Schedule 1 and related identifying content, or
ii content arising in connection with any of the activities described in paragraph 4(1) of Schedule 1,
c regulated provider pornographic content is published or displayed on the rest of the service, and
d the service has links with the United Kingdom.
I1003
1 A search service within sub-paragraph (2).
2 A search service is within this sub-paragraph if—
a the internal business service conditions are met in relation to a part of the service that is a search engine,
b the service does not include a public search engine,
c regulated provider pornographic content is published or displayed on the rest of the service, and
d the service has links with the United Kingdom.
I6574For the purposes of this Schedule, a service “has links with the United Kingdom” if it has links with the United Kingdom within the meaning of section 80(4).
I3765In this Schedule—
  • “the internal business service conditions” means the conditions in paragraph 7(2) of Schedule 1;
  • “public search engine” means a search engine other than one in relation to which the internal business service conditions are met;
  • “regulated provider pornographic content” and “published or displayed” have the same meaning as in Part 5 (see section 79);
  • “the rest of the service” means any part of the user-to-user service or search service other than the part in relation to which the internal business service conditions are met;
  • “user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

SCHEDULE 3 

Timing of providers’ assessments

Sections 9, 11, 14, 26, 28 and 36

PART 1 Timing of illegal content risk assessments and children’s access assessments

I800I5731 Part 3 services already in operation at the outset of the regime provided for by this Act

1 This paragraph applies in relation to a Part 3 service which is in operation immediately before the day on which the first illegal content risk assessment guidance is published.
2 The first illegal content risk assessment of the service must be completed within the period of three months beginning with the day on which that guidance is published.
3 The first CAA of the service must be completed within the period of three months beginning with the day on which the first CAA guidance is published.

I591I72 New Part 3 services which start up, and existing services which become Part 3 services, between publication of the first illegal content risk assessment guidance and the first CAA guidance

1 In this paragraph “the first day”, in relation to a Part 3 service, means—
a the first day on which the service is a Part 3 service (being a new service), or
b the first day on which the service becomes a Part 3 service (having previously not been a Part 3 service).
2 Sub-paragraphs (3) and (4) apply if, on the first day, illegal content risk assessment guidance is available but the first CAA guidance has not yet been published.
3 The first illegal content risk assessment of the service must be completed within the period of three months beginning with the first day.
4 The first CAA of the service must be completed within the period of three months beginning with the day on which the first CAA guidance is published.

I44I8173 New Part 3 services which start up when illegal content risk assessment guidance and CAA guidance are both available

1 In this paragraph “the first day”, in relation to a Part 3 service, means the first day on which the service is a Part 3 service (being a new service).
2 If, on the first day, illegal content risk assessment guidance and CAA guidance are both available, both of the following must be completed within the period of three months beginning with that day—
a the first illegal content risk assessment of the service, and
b the first CAA of the service.

I324I7674 Existing services which become Part 3 services when illegal content risk assessment guidance and CAA guidance are both available

1 In this paragraph “the first day”, in relation to a Part 3 service, means the first day on which the service becomes, or again becomes, a Part 3 service (following a period during which the service was not a Part 3 service).
2 If, on the first day, illegal content risk assessment guidance and CAA guidance are both available, both of the following must be completed within the period of three months beginning with that day—
a an illegal content risk assessment of the service, and
b a CAA of the service.

PART 2 Timing of children’s risk assessments and section 15(2) assessments

I184I7475 Children’s risk assessments

1 In this paragraph “the relevant day”, in relation to a Part 3 service, means—
a the first day on which the service is treated as likely to be accessed by children, or
b the first day on which the service is again treated as likely to be accessed by children (following a period during which the service was not so treated).
2 If, on the relevant day, children’s risk assessment guidance is available, a children’s risk assessment of the service must be completed within the period of three months beginning with that day.
3 Sub-paragraph (4) applies if—
a on the relevant day, the first children’s risk assessment guidance has not yet been published, and
b immediately before the publication of that guidance, the service is still treated as likely to be accessed by children.
4 The first children’s risk assessment of the service must be completed within the period of three months beginning with the day on which the first children’s risk assessment guidance is published.

I245I3496 Section 15(2) assessments

1 In this paragraph “the relevant day”, in relation to a regulated user-to-user service, means—
a the first day on which the service is a Category 1 service, or
b the first day on which the service again becomes a Category 1 service (following a period during which the service was not a Category 1 service).
2 If, on the relevant day, section 15(2) guidance is available, a section 15(2) assessment of the service must be completed within the period of three months beginning with that day.
3 Sub-paragraph (4) applies if—
a on the relevant day, the first section 15(2) guidance has not yet been published, and
b immediately before the publication of that guidance, the service is still a Category 1 service.
4 The first section 15(2) assessment of the service must be completed within the period of three months beginning with the day on which the first section 15(2) guidance is published.

PART 3 Pre-existing Part 4B services

I282I1617 Interpretation of this Part

1 In this Part, “pre-existing Part 4B service” means—
a an internet service which—
i is a video-sharing platform service by reason of the conditions in section 368S(1) and (2) of the Communications Act being met in relation to the service as a whole, and
ii was being provided immediately before Schedule 17 (videosharing platform services: transitional provision etc) comes into force; or
b a dissociable section of an internet service, where that dissociable section—
i is a video-sharing platform service by reason of the conditions in section 368S(1)(a) and (2) of the Communications Act being met in relation to that dissociable section, and
ii was being provided immediately before Schedule 17 comes into force.
2 In sub-paragraph (1), any reference to a service provided before Schedule 17 comes into force includes a reference to a service provided in breach of the requirement in section 368V of the Communications Act.
I492I4598
1 In this Part, “assessment start day”, in relation to a pre-existing Part 4B service, means—
a the date specified in regulations made by the Secretary of State for the purposes of this Part of this Schedule, or
b if the pre-existing Part 4B service ceases to be a video-sharing platform service before the date specified in the regulations, the date when that service ceases to be a video-sharing platform service.
2 But in respect of any period during which this Schedule is fully in force and no regulations under sub-paragraph (1) have yet been made, the definition in sub-paragraph (1) has effect as if—
a for paragraph (a) there were substituted “the date when section 210 comes into force”, and
b in paragraph (b), for “specified in the regulations” there were substituted “when section 210 comes into force”.
I520I2749In this Part “video-sharing platform service” has the same meaning as in Part 4B of the Communications Act (see section 368S of that Act).
I516I79110Any reference in this Part to the effect of Part 1 or 2 of this Schedule is a reference to the effect that Part 1 or 2 would have if this Part were disregarded.

Pre-existing Part 4B services which are regulated user-to-user services

I392I56611 Application of paragraphs 12 to 14

1 This paragraph and paragraphs 12 to 14 apply in relation to a pre-existing Part 4B service which—
a is within the definition in paragraph (a) of paragraph 7(1), and
b is also a regulated user-to-user service.
2 If the effect of Part 1 of this Schedule is that the period within which the first illegal content risk assessment or CAA of the service must be completed begins on a day before the assessment start day, the time for carrying out that assessment is extended as set out in paragraph 12 or 13.
3 If the effect of paragraph 6 is that the period within which the first section 15(2) assessment of the service must be completed begins on a day before the assessment start day, the time for carrying out that assessment is extended as set out in paragraph 14.
4 But paragraphs 12 to 14 do not apply if the service ceases to be a regulated user-to-user service on the assessment start day.

I725I17312 Illegal content risk assessments and children’s access assessments

1 Sub-paragraphs (2) and (3) apply in relation to the service if, on the assessment start day, illegal content risk assessment guidance is available but the first CAA guidance has not yet been published.
2 The first illegal content risk assessment of the service must be completed within the period of three months beginning with the assessment start day.
3 The first CAA of the service must be completed within the period of three months beginning with the day on which the first CAA guidance is published.
I499I55313If, on the assessment start day, illegal content risk assessment guidance and CAA guidance are both available, both of the following must be completed within the period of three months beginning with that day—
a the first illegal content risk assessment of the service, and
b the first CAA of the service.

I563I90214 Section 15(2) assessments

1 If section 15(2) guidance is available on the assessment start day, the first section 15(2) assessment of the service must be completed within the period of three months beginning with that day.
2 If, on the assessment start day, the first section 15(2) guidance has not yet been published, the first section 15(2) assessment of the service must be completed within the period of three months beginning with the day on which the first section 15(2) guidance is published.

Regulated user-to-user services which include a pre-existing Part 4B service

I872I78915 Application of paragraphs 16 to 20

1 Paragraphs 16 to 20 make provision about the timing of assessments in the case of a regulated user-to-user service which includes a pre-existing Part 4B service within the definition in paragraph (b) of paragraph 7(1).
2 In sub-paragraph (3) and paragraphs 16 to 20—
a “the regulated service” means the regulated user-to-user service, and
b “the Part 4B part” means the pre-existing Part 4B service which is included in the regulated service.
3 If the effect of Part 1 or paragraph 6 of this Schedule is that the period within which the first illegal content risk assessment, CAA or section 15(2) assessment of the regulated service must be completed begins on a day before the assessment start day—
a the time for carrying out the assessment in question in relation to the Part 4B part is extended as set out in paragraph 16, 17 or 18 (whichever applies),
b Part 1 and paragraph 6 apply as set out in paragraph 19, and
c paragraph 5 applies as set out in paragraph 20.
4 But paragraphs 16 to 20 do not apply if the service ceases to be a regulated user-to-user service on the assessment start day.

I746I39116 Illegal content risk assessments and children’s access assessments of Part 4B part

1 Sub-paragraphs (2) and (3) apply in relation to the Part 4B part if, on the assessment start day, illegal content risk assessment guidance is available but the first CAA guidance has not yet been published.
2 The first illegal content risk assessment of the Part 4B part must be completed within the period of three months beginning with the assessment start day.
3 The first CAA of the Part 4B part must be completed within the period of three months beginning with the day on which the first CAA guidance is published.
I302I47217If, on the assessment start day, illegal content risk assessment guidance and CAA guidance are both available, both of the following must be completed within the period of three months beginning with that day—
a an illegal content risk assessment of the Part 4B part, and
b a CAA of the Part 4B part.

I496I45118 Section 15(2) assessments of Part 4B part

1 If section 15(2) guidance is available on the assessment start day, a section 15(2) assessment of the Part 4B part must be completed within the period of three months beginning with that day.
2 If, on the assessment start day, the first section 15(2) guidance has not yet been published, a section 15(2) assessment of the Part 4B part must be completed within the period of three months beginning with the day on which the first section 15(2) guidance is published.

I372I84819 Application of Part 1 and paragraph 6

1 This paragraph applies in relation to—
a an illegal content risk assessment or a CAA of the regulated service if an assessment of that kind is due to be carried out in relation to the Part 4B part of the service in accordance with paragraph 16 or 17;
b a section 15(2) assessment of the regulated service if a section 15(2) assessment is due to be carried out in relation to the Part 4B part of the service in accordance with paragraph 18.
References in the rest of this paragraph to an illegal content risk assessment, a CAA or a section 15(2) assessment are to an assessment of that kind to which this paragraph applies.
2 For the purposes of this paragraph—
a the regulated service is “type 1” if it would still be a regulated user-to-user service even if the Part 4B part were to be assumed not to be part of the service;
b the regulated service is “type 2” if it would be a regulated search service if the Part 4B part were to be assumed not to be part of the service;
c the regulated service is “type 3” if it does not fall within paragraph (a) or (b).
3 If the regulated service is type 1, an illegal content risk assessment, a CAA or a section 15(2) assessment is to be treated as being due at the time provided for by Part 1 or paragraph 6 only in relation to the rest of the service.
4 In sub-paragraph (3) “the rest of the service” means any user-to-user part of the regulated service other than the Part 4B part.
5 If the regulated service is type 2—
a an illegal content risk assessment is not required to be carried out at the time provided for by Part 1, but that is not to be taken to prevent an illegal content risk assessment as defined by section 26 from being due in relation to the search engine of the service at the time provided for by Part 1;
b a CAA is to be treated as being due at the time provided for by Part 1 only in relation to the search engine of the service;
c a section 15(2) assessment is not required to be carried out at the time provided for by paragraph 6.
6 If the regulated service is type 3, no illegal content risk assessment, CAA or section 15(2) assessment is required to be carried out at the time provided for by Part 1 or paragraph 6.

I755I39020 Application of paragraph 5

1 This paragraph sets out how paragraph 5 (children’s risk assessments) is to apply if a CAA is required to be carried out in accordance with—
a paragraph 16 or 17 (CAA of Part 4B part of a service),
b paragraph 19(3) (CAA of the rest of a service), or
c paragraph 19(5)(b) (CAA of search engine of a service).
2 The definition of “the relevant day” is to operate by reference to the CAA that was (or was required to be) carried out, and accordingly, references to the day on which the service is to be treated as likely to be accessed by children are to be read as references to the day on which the Part 4B part of the service, the rest of the service or the search engine of the service (as the case may be) is to be treated as likely to be accessed by children.
3 References to a children’s risk assessment of the service are to a children’s risk assessment of the Part 4B part of the service, the rest of the service or the search engine of the service (as the case may be).

PART 4 Interpretation, and extension of three-month periods

I497I81321 Interpretation of this Schedule

In this Schedule—
  • “CAA” means a children’s access assessment (see section 35);
  • “CAA guidance” means OFCOM’s guidance under section 52(3)(b) (guidance about children’s access assessments);
  • “children’s risk assessment guidance” means OFCOM’s guidance under section 99(3);
  • “section 15(2) assessment” means OFCOM’s assessment under section 14 (assessments related to the adult user empowerment duty set out in section 15(2));
  • “section 15(2) guidance” means OFCOM’s guidance under section 52(1).
I311I27122For the meaning of “likely to be accessed by children”, see section 37.
I690I62623In relation to regulated user-to-user services (or in the case of combined services, the user-to-user part of such services)—
a references to an illegal content risk assessment are to an illegal content risk assessment as defined by section 9;
b references to illegal content risk assessment guidance are to OFCOM’s guidance under section 99(1).
I374I72724In relation to regulated search services and the search engine of combined services—
a references to an illegal content risk assessment are to an illegal content risk assessment as defined by section 26;
b references to illegal content risk assessment guidance are to OFCOM’s guidance under section 99(2).
I6I63425In relation to regulated user-to-user services (or in the case of combined services, the user-to-user part of such services)—
a references to a children’s risk assessment are to a children’s risk assessment as defined by section 11;
b references to children’s risk assessment guidance are to be read as references to guidance about such children’s risk assessments.
I775I15426In relation to regulated search services and the search engine of combined services—
a references to a children’s risk assessment are to a children’s risk assessment as defined by section 28;
b references to children’s risk assessment guidance are to be read as references to guidance about such children’s risk assessments.
I286I84427For the purposes of this Schedule, guidance of a particular kind is available at a particular time if at that time there is in existence published guidance of that kind.

I830I65828 Extension of three-month periods

1 This paragraph applies in relation to a time-limit of three months imposed by any provision of this Schedule for completing a CAA, a section 15(2) assessment or a particular kind of risk assessment.
2 Extra time may be allowed—
a by agreement between OFCOM and the provider of a particular Part 3 service, or
b in accordance with a notice published by OFCOM specifying a longer period for CAAs, section 15(2) assessments or risk assessments of that kind (as the case may be) which relate to Part 3 services of a particular kind or size.

SCHEDULE 4 

Codes of practice under section 41: principles, objectives, content

Section 42

I2601 General principles

In preparing a draft of a code of practice or amendments of a code of practice, OFCOM must—
a consider the appropriateness of provisions of the code of practice to different kinds and sizes of Part 3 services and to providers of differing sizes and capacities, and
b have regard to the principles mentioned in paragraph 2.
I4652The principles are as follows—
a providers of Part 3 services must be able to understand which provisions of the code of practice apply in relation to a particular service they provide;
b the measures described in the code of practice must be sufficiently clear, and at a sufficiently detailed level, that providers understand what those measures entail in practice;
c the measures described in the code of practice must be proportionate and technically feasible: measures that are proportionate or technically feasible for providers of a certain size or capacity, or for services of a certain kind or size, may not be proportionate or technically feasible for providers of a different size or capacity or for services of a different kind or size;
d the measures described in the code of practice that apply in relation to Part 3 services of various kinds and sizes must be proportionate to OFCOM’s assessment (under section 98) of the risk of harm presented by services of that kind or size.

I5363 Online safety objectives

OFCOM must ensure that measures described in codes of practice are compatible with pursuit of the online safety objectives.
I8594The online safety objectives for regulated user-to-user services are as follows—
a a service should be designed and operated in such a way that—
i the systems and processes for regulatory compliance and risk management are effective and proportionate to the kind and size of service,
ii the systems and processes are appropriate to deal with the number of users of the service and its user base,
iii United Kingdom users (including children) are made aware of, and can understand, the terms of service,
iv there are adequate systems and processes to support United Kingdom users,
v (in the case of a Category 1 service) users are offered options to increase their control over the content they encounter and the users they interact with,
vi the service provides a higher standard of protection for children than for adults,
vii the different needs of children at different ages are taken into account,
viii there are adequate controls over access to the service by adults, and
ix there are adequate controls over access to, and use of, the service by children, taking into account use of the service by, and impact on, children in different age groups;
b a service should be designed and operated so as to protect individuals in the United Kingdom who are users of the service from harm, including with regard to—
i algorithms used by the service,
ii functionalities of the service, and
iii other features relating to the operation of the service.
I7055The online safety objectives for regulated search services are as follows—
a a service should be designed and operated in such a way that—
i the systems and processes for regulatory compliance and risk management are effective and proportionate to the kind and size of service,
ii the systems and processes are appropriate to deal with the number of users of the service and its user base,
iii United Kingdom users (including children) are made aware of, and can understand, the publicly available statement referred to in sections 27 and 29,
iv there are adequate systems and processes to support United Kingdom users,
v the service provides a higher standard of protection for children than for adults, and
vi the different needs of children at different ages are taken into account;
b a service should be assessed to understand its use by, and impact on, children in different age groups;
c a search engine should be designed and operated so as to protect individuals in the United Kingdom who are users of the service from harm, including with regard to—
i algorithms used by the search engine,
ii functionalities relating to searches (such as a predictive search functionality), and
iii the indexing, organisation and presentation of search results.
I8696In the case of a combined service—
a the online safety objectives set out in paragraph 4 do not apply in relation to the search engine;
b the online safety objectives set out in paragraph 5 apply in relation to the search engine, and accordingly references in that paragraph to a search service are to be read as references to the search engine;
c the reference in paragraph 5(a)(iii) to a publicly available statement includes a reference to provisions of the terms of service which relate to the search engine.
I8257The Secretary of State may by regulations amend paragraph 4 or 5 so as to vary the online safety objectives for regulated user-to-user services or regulated search services, and such regulations may make consequential amendments of paragraph 6.
I4098If regulations are made amending the online safety objectives, OFCOM must, as soon as reasonably practicable after the regulations come into force, consider whether a review of the codes of practice published under section 46 is required and, if OFCOM consider that it is required, carry out a review to assess whether any amendments are needed to reflect the revised objectives.

I8739 Content of codes of practice

1 Codes of practice that describe measures recommended for the purpose of compliance with a duty set out in section 10(2) or (3) (illegal content) must include measures in each of the areas of a service listed in section 10(4).
2 Codes of practice that describe measures recommended for the purpose of compliance with a duty set out in section 12(2) or (3) (children’s online safety) must include measures in each of the areas of a service listed in section 12(8).
3 Codes of practice that describe measures recommended for the purpose of compliance with a duty set out in section 27(2) or (3) (illegal content) must include measures in each of the areas of a service listed in section 27(4).
4 Codes of practice that describe measures recommended for the purpose of compliance with a duty set out in section 29(2) or (3) (children’s online safety) must include measures in each of the areas of a service listed in section 29(4).
5 Sub-paragraphs (1) to (4) apply to the extent that inclusion of the measures in question is consistent with paragraph 1(a) and the principles mentioned in paragraph 2(c) and (d).
I42210
1 Measures described in a code of practice which are recommended for the purpose of compliance with any of the relevant duties must be designed in the light of the principles mentioned in sub-paragraph (2) and (where appropriate) incorporate safeguards for the protection of the matters mentioned in those principles.
2 The principles are—
a the importance of protecting the right of users and (in the case of search services or combined services) interested persons to freedom of expression within the law, and
b the importance of protecting the privacy of users.
3 In sub-paragraph (2)(b) the reference to protecting the privacy of users is to protecting users from a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of a user-to-user service or a search service (including, but not limited to, any such provision or rule concerning the processing of personal data).
4 In this paragraph “the relevant duties” means the duties set out in—
a sections 10 and 27 (illegal content),
b sections 12 and 29 (children’s online safety),
c section 15 (user empowerment),
d section 17 (content of democratic importance),
e section 19 (journalistic content),
f sections 20 and 31 (content reporting),
g sections 21 and 32 (complaints procedures), and
h sections 38 and 39 (fraudulent advertising).
I29211Measures described in a code of practice may relate only to the design or operation of a Part 3 service—
a in the United Kingdom, or
b as it affects United Kingdom users of the service.

I31012 Content of codes of practice: age assurance

1 This paragraph is about the inclusion of age assurance in a code of practice as a measure recommended for the purpose of compliance with any of the duties set out in section 12(2) or (3) or 29(2) or (3), and sub-paragraph (2) sets out some further principles, in addition to those in paragraphs 1 and 2 (general principles) and 10(2) (freedom of expression and privacy), which are particularly relevant.
2 In deciding whether to recommend the use of age assurance, or which kinds of age assurance to recommend, OFCOM must have regard to the following—
a the principle that age assurance should be effective at correctly identifying the age or age-range of users;
b relevant standards set out in the latest version of the code of practice under section 123 of the Data Protection Act 2018 (age-appropriate design code);
c the need to strike the right balance between—
i the levels of risk and the nature, and severity, of potential harm to children which the age assurance is designed to guard against, and
ii protecting the right of users and (in the case of search services or the search engine of combined services) interested persons to freedom of expression within the law;
d the principle that more effective kinds of age assurance should be used to deal with higher levels of risk of harm to children;
e the principle that age assurance should be easy to use, including by children of different ages and with different needs;
f the principle that age assurance should work effectively for all users regardless of their characteristics or whether they are members of a certain group;
g the principle of interoperability between different kinds of age assurance.
3 In a code of practice that describes measures for the purpose of compliance with the duty set out in section 12(3)(a), OFCOM must recommend (among other things) age verification or age estimation which is such of a kind, and which is to be used in such a way, that it is highly effective at correctly determining whether or not a particular user is a child (see section 12(6)).
4 In deciding which kinds and uses of age verification or age estimation to recommend for the purpose of compliance with the duty set out in section 12(3)(a), OFCOM must have regard to their guidance under section 82 that gives examples of kinds and uses of age verification and age estimation that are, or are not, highly effective at correctly determining whether or not a particular user is a child.
5 Nothing in sub-paragraph (2) is to be read as allowing OFCOM to recommend, for the purpose of compliance with the duty set out in section 12(3)(a) by providers subject to the requirement in section 12(4), a kind or use of age verification or age estimation which does not meet the requirement to be highly effective as mentioned in section 12(6).
6 A code of practice that recommends the use of age assurance for the purpose of compliance with the duties set out in section 12(2) or (3) must also describe measures recommended for the purpose of compliance with the duties set out in—
a section 12(9), (11) and (13) (inclusion of clear information in terms of service), and
b section 21(2) and (3) (see, in particular, section 21(5)(e) (complaints about age assurance)).
7 A code of practice that recommends the use of age assurance for the purpose of compliance with the duties set out in section 29(2) or (3) must also describe measures recommended for the purpose of compliance with the duties set out in—
a section 29(5) and (8) (inclusion of clear information in publicly available statement), and
b section 32(2) and (3) (see, in particular, section 32(5)(d) (complaints about age assurance)).
8 A code of practice may—
a refer to industry or technical standards for age assurance (where they exist);
b elaborate on the principles mentioned in paragraphs (a) and (c) to (g) of sub-paragraph (2).
9 In this paragraph “age assurance” means age verification or age estimation, and see in particular section 230(4) (self-declaration of age not to be regarded as age verification or age estimation).

I84713 Content of codes of practice: proactive technology

1 If OFCOM consider it appropriate to do so, and in accordance with the principles to which they must have regard (see paragraphs 1 and 2 and, in particular, 10(2)), they may include in a code of practice a measure describing the use of a kind of technology.
2 But there are constraints, set out in the rest of this paragraph, on OFCOM’s power to include in a code of practice a measure describing the use of proactive technology as a way (or one of the ways) of complying with a duty set out in this Act (a “proactive technology measure”).
3 A proactive technology measure may be recommended only for the purpose of compliance with any of the duties set out in—
a section 10(2) or (3) (illegal content),
b section 12(2) or (3) (children’s online safety),
c section 27(2) or (3) (illegal content),
d section 29(2) or (3) (children’s online safety), or
e section 38(1) or 39(1) (fraudulent advertising).
4 A proactive technology measure may relate to the use of a kind of technology on or in relation to any Part 3 service or any part of such a service, but if the technology operates (or may operate) by analysing user-generated content or metadata relating to such content, the measure may not recommend the use of the technology to analyse user-generated content communicated privately, or metadata relating to user-generated content communicated privately.
5 A proactive technology measure may be included in a code of practice in relation to Part 3 services of a particular kind or size only if OFCOM are satisfied that use of the technology in question by such services would be proportionate to the risk of harm that the measure is designed to safeguard against (taking into account, in particular, the risk profile for the time being published by OFCOM under section 98 relating to such services).
6 In deciding whether to include a proactive technology measure in a code of practice, OFCOM must have regard to the degree of accuracy, effectiveness and lack of bias achieved by the technology in question, and may—
a refer in the code of practice to industry or technical standards for the technology (where they exist);
b set out principles in the code of practice designed to ensure that the technology or its use is (so far as possible) accurate, effective and free of bias.
7 Sub-paragraph (6) does not apply in relation to proactive technology which is a kind of age verification or age estimation technology.

I42414 General

A code of practice may make different provision for different purposes and may, in particular—
a make different provision with regard to—
i user-to-user services, and
ii search services;
b make different provision with regard to user-to-user services of different kinds or search services of different kinds; and
c otherwise differentiate between Part 3 services, and between providers of such services, in such manner as OFCOM consider appropriate.
I38415A code of practice may apply in relation to a person who provides a Part 3 service from outside the United Kingdom.

I48616 Interpretation

In this Schedule—
  • “code of practice” means a code of practice under section 41;
  • “search results” has the meaning given by section 57(3);
  • “user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

SCHEDULE 5 

Terrorism offences

Section 59

I7881 An offence under any of the following provisions of the Terrorism Act 2000—
a section 11 (membership of a proscribed organisation);
b section 12(1) (inviting support for a proscribed organisation);
c section 12(1A) (expressing an opinion or belief supportive of a proscribed organisation);
d section 12(2) (arranging a meeting supportive of a proscribed organisation);
e section 13(1A) (publishing image of uniform of proscribed organisation);
f section 15 (terrorist fund-raising);
g section 16(1) (use of money or property for terrorist purposes);
h section 16(2) (possession of money or property for terrorist purposes);
i section 17 (involvement in terrorist funding arrangements);
j section 18 (laundering of terrorist property);
k section 54(1) (providing weapons training);
l section 54(3) (inviting another to receive weapons training);
m section 56 (directing a terrorist organisation);
n section 58 (collection of information likely to be of use to a terrorist);
o section 58A (publishing information about members of the armed forces etc);
p sections 59 to 61 (inciting terrorism outside the United Kingdom).
I9102 An offence under section 113 of the Anti-terrorism, Crime and Security Act 2001 (use of noxious substances or things).
I663 An offence under any of the following provisions of the Terrorism Act 2006—
a section 1 (encouragement of terrorism);
b section 2 (dissemination of terrorist publications);
c section 5 (preparation of terrorist acts);
d section 6 (training for terrorism);
e section 11 (terrorist threats relating to radioactive devices etc).

I8804 Inchoate offences

1 An offence of attempting or conspiring to commit an offence specified in this Schedule.
2 An offence under Part 2 of the Serious Crime Act 2007 (encouraging or assisting) in relation to an offence specified in this Schedule, or (in Scotland) inciting a person to commit such an offence.
3 An offence of aiding, abetting, counselling or procuring the commission of an offence specified in this Schedule, or (in Scotland) being involved art and part in the commission of such an offence.

SCHEDULE 6 

Child sexual exploitation and abuse offences

Section 59

PART 1 England and Wales, and Northern Ireland

I1761 An offence under section 2 of the Obscene Publications Act 1959 relating to an obscene article tending to deprave and corrupt others by encouraging them to commit an offence specified in paragraph 2, 4, 5, 7 or 8.
I3592 An offence under section 1 of the Protection of Children Act 1978 (indecent photographs of children).
I5523 An offence under Article 3 of the Protection of Children (Northern Ireland) Order 1978 (S.I. 1978/1047 (N.I. 17)) (indecent photographs of children).
I7714 An offence under section 160 of the Criminal Justice Act 1988 (possession of indecent photograph of a child).
I155 An offence under any of the following provisions of the Sexual Offences Act 2003—
a section 8 (causing or inciting a child under 13 to engage in sexual activity);
b section 10 (causing or inciting a child to engage in sexual activity);
c section 11 (engaging in sexual activity in the presence of a child);
d section 12 (causing a child to watch a sexual act);
e section 13 (child sex offences committed by children or young persons);
f section 14 (arranging or facilitating commission of a child sex offence);
g section 15 (meeting a child following sexual grooming etc);
h section 15A (sexual communication with a child);
i section 47 (paying for sexual services of a child);
j section 48 (causing or inciting sexual exploitation of a child);
k section 49 (controlling a child in relation to sexual exploitation);
l section 50 (arranging or facilitating sexual exploitation of a child).
I6096 An offence under any of the following provisions of the Sexual Offences (Northern Ireland) Order 2008 (S.I. 2008/1769 (N.I. 2))—
a Article 15 (causing or inciting a child under 13 to engage in sexual activity);
b Article 17 (causing or inciting a child to engage in sexual activity);
c Article 18 (engaging in sexual activity in the presence of a child);
d Article 19 (causing a child to watch a sexual act);
e Article 20 (sexual offences against children committed by children or young persons);
f Article 21 (arranging or facilitating commission of a sex offence against a child);
g Article 22 (meeting a child following sexual grooming etc);
h Article 22A (sexual communication with a child);
i Article 37 (paying for sexual services of a child);
j Article 38 (causing or inciting child prostitution or pornography);
k Article 39 (controlling a child prostitute or a child involved in pornography);
l Article 40 (arranging or facilitating child prostitution or pornography).
I4347 An offence under section 62 of the Coroners and Justice Act 2009 (possession of prohibited image of a child).
I3528 An offence under section 69 of the Serious Crime Act 2015 (possession of paedophile manual).

I3199 Inchoate offences

1 An offence of attempting or conspiring to commit an offence specified in this Part.
2 An offence under Part 2 of the Serious Crime Act 2007 (encouraging or assisting) in relation to an offence specified in this Part.
3 An offence of aiding, abetting, counselling or procuring the commission of an offence specified in this Part.

PART 2 Scotland

I80310 An offence under either of the following provisions of the Civic Government (Scotland) Act 1982—
a section 52 (indecent photographs etc of children);
b section 52A (possession of indecent photographs of children).
I83411 An offence under any of the following provisions of the Protection of Children and Prevention of Sexual Offences (Scotland) Act 2005—
a section 1 (meeting a child following certain preliminary contact);
b section 9 (paying for sexual services of a child);
c section 10 (causing or inciting provision by child of sexual services or child pornography);
d section 11 (controlling a child providing sexual services or involved in pornography);
e section 12 (arranging or facilitating provision by child of sexual services or child pornography).
I37512 An offence under any of the following provisions of the Sexual Offences (Scotland) Act 2009—
a section 21 (causing a young child to participate in a sexual activity);
b section 23 (causing a young child to look at a sexual image);
c section 24 (communicating indecently with a young child etc);
d section 31 (causing an older child to participate in a sexual activity);
e section 33 (causing an older child to look at a sexual image);
f section 34 (communicating indecently with an older child etc);
g section 54 (incitement to commit certain sexual acts outside Scotland).

I78113 Inchoate offences

1 An offence of attempting or conspiring to commit an offence specified in this Part.
2 An offence of inciting a person to commit an offence specified in this Part.
3 An offence of aiding, abetting, counselling or procuring the commission of an offence specified in this Part, or being involved art and part in the commission of such an offence.

SCHEDULE 7 

Priority offences

Section 59

I5651 Assisting suicide

An offence under section 2 of the Suicide Act 1961 (assisting suicide etc).
I1702An offence under section 13 of the Criminal Justice Act (Northern Ireland) 1966 (c. 20 (N.I.)) (assisting suicide etc).

2A Encouraging or assisting serious self-harm

An offence under section 184 of this Act (encouraging or assisting serious self-harm).

I6753 Threats to kill

An offence under section 16 of the Offences against the Person Act 1861 (threats to kill).

I4074 Public order offences, harassment, stalking and fear or provocation of violence

An offence under any of the following provisions of the Public Order Act 1986—
a section 4 (fear or provocation of violence);
b section 4A (intentional harassment, alarm or distress);
c section 5 (harassment, alarm or distress);
I1785An offence under any of the following provisions of the Public Order Act 1986—
a section 18 (use of words or behaviour or display of written material);
b section 19 (publishing or distributing written material);
c section 21 (distributing, showing or playing a recording);
d section 29B (use of words or behaviour or display of written material);
e section 29C (publishing or distributing written material);
f section 29E (distributing, showing or playing a recording).
I6516An offence under section 50A of the Criminal Law (Consolidation) (Scotland) Act 1995 (racially-aggravated harassment).
I7497An offence under any of the following provisions of the Protection from Harassment Act 1997—
a section 2 (harassment);
b section 2A (stalking);
c section 4 (putting people in fear of violence);
d section 4A (stalking involving fear of violence or serious alarm or distress).
I5128An offence under any of the following provisions of the Protection from Harassment (Northern Ireland) Order 1997 (S.I. 1997/1180 (N.I. 9))—
a Article 4 (harassment);
b Article 6 (putting people in fear of violence).
I6079An offence under any of the following provisions of the Crime and Disorder Act 1998—
a section 31 (racially or religiously aggravated public order offences);
b section 32 (racially or religiously aggravated harassment etc).
I80610An offence under any of the following provisions of the Criminal Justice and Licensing (Scotland) Act 2010 (asp 13)—
a section 38 (threatening or abusive behaviour);
b section 39 (stalking).
I75911An offence under section 76 of the Serious Crime Act 2015 (controlling or coercive behaviour in an intimate or family relationship).

I12212 Drugs and psychoactive substances

An offence under any of the following provisions of the Misuse of Drugs Act 1971—
a section 4(3) (unlawful supply, or offer to supply, of controlled drugs);
b section 9A (prohibition of supply etc of articles for administering or preparing controlled drugs);
c section 19 (inciting any other offence under that Act).
I9213An offence under section 5 of the Psychoactive Substances Act 2016 (supplying, or offering to supply, a psychoactive substance).

I9614 Firearms and other weapons

An offence under section 1(1) or (2) of the Restriction of Offensive Weapons Act 1959 (sale etc of flick knife etc).
I74015An offence under any of the following provisions of the Firearms Act 1968—
a section 1(1) (purchase etc of firearms or ammunition without certificate);
b section 2(1) (purchase etc of shot gun without certificate);
c section 3(1) (dealing etc in firearms or ammunition by way of trade or business without being registered);
d section 3(2) (sale etc of firearms or ammunition to person other than registered dealer);
e section 5(1), (1A) or (2A) (purchase, sale etc of prohibited weapons);
f section 21(5) (sale etc of firearms or ammunition to persons previously convicted of crime);
g section 22(1) (purchase etc of firearms or ammunition by person under 18);
h section 24 (supplying firearms to minors);
i section 24A (supplying imitation firearms to minors).
I59016An offence under any of the following provisions of the Crossbows Act 1987—
a section 1 (sale and letting on hire of crossbow);
b section 2 (purchase and hiring of crossbow).
I63017An offence under any of the following provisions of the Criminal Justice Act 1988—
a section 141(1) or (4) (sale etc of offensive weapons);
b section 141A (sale of knives etc to persons under 18).
I54618An offence under any of the following provisions of the Criminal Justice (Northern Ireland) Order 1996 (S.I. 1996/3160 (N.I. 24))—
a Article 53 (sale etc of knives);
b Article 54 (sale of knives etc to minors).
I36019An offence under any of the following provisions of the Knives Act 1997—
a section 1 (unlawful marketing of knives);
b section 2 (publication of material in connection with marketing of knives).
I22820An offence under any of the following provisions of the Firearms (Northern Ireland) Order 2004 (S.I. 2004/702 (N.I. 3))—
a Article 24 (sale etc of firearms or ammunition without certificate);
b Article 37(1) (sale etc of firearms or ammunition to person without certificate etc);
c Article 45(1) or (2) (purchase, sale etc of prohibited weapons);
d Article 63(8) (sale etc of firearms or ammunition to people who have been in prison etc);
e Article 66A (supplying imitation firearms to minors).
I29521An offence under section 36(1)(c) or (d) of the Violent Crime Reduction Act 2006 (sale etc of realistic imitation firearms).
I2822An offence under any of the following provisions of the Air Weapons and Licensing (Scotland) Act 2015 (asp 10)—
a section 2 (requirement for air weapon certificate);
b section 24 (restrictions on sale etc of air weapons).

I53523 Assisting illegal immigration

An offence under any of the following provisions of the Immigration Act 1971—
a section 24(A1), (B1), (C1) or (D1) (illegal entry and similar offences);
b section 25 (assisting unlawful immigration).

I11324 Human trafficking

An offence under section 2 of the Modern Slavery Act 2015 (human trafficking).
I90625An offence under section 1 of the Human Trafficking and Exploitation (Scotland) Act 2015 (asp 12) (human trafficking).
I70226An offence under section 2 of the Human Trafficking and Exploitation (Criminal Justice and Support for Victims) Act (Northern Ireland) 2015 (c. 2 (N.I.)) (human trafficking).

I69527 Sexual exploitation

An offence under any of the following provisions of the Sexual Offences Act 2003—
a section 52 (causing or inciting prostitution for gain);
b section 53 (controlling prostitution for gain).
I65228An offence under any of the following provisions of the Sexual Offences (Northern Ireland) Order 2008 (S.I. 2008/1769 (N.I. 2))—
a Article 62 (causing or inciting prostitution for gain);
b Article 63 (controlling prostitution for gain).

Sexual images

28AAn offence under any of the following provisions of the Sexual Offences Act 2003—
a section 66A (sending etc photograph or film of genitals);
b section 66B (sharing or threatening to share intimate photograph or film).
I49429An offence under section 63 of the Criminal Justice and Immigration Act 2008 (possession of extreme pornographic images).
F830. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
I13931An offence under section 2 of the Abusive Behaviour and Sexual Harm (Scotland) Act 2016 (asp 22) (disclosing, or threatening to disclose, an intimate photograph or film).

I45332 Proceeds of crime

An offence under any of the following provisions of the Proceeds of Crime Act 2002—
a section 327 (concealing etc criminal property);
b section 328 (arrangements facilitating acquisition etc of criminal property);
c section 329 (acquisition, use and possession of criminal property).

I2533 Fraud

An offence under any of the following provisions of the Fraud Act 2006—
a section 2 (fraud by false representation);
b section 4 (fraud by abuse of position);
c section 7 (making or supplying articles for use in frauds);
d section 9 (participating in fraudulent business carried on by sole trader etc).
I69634An offence under section 49(3) of the Criminal Justice and Licensing (Scotland) Act 2010 (articles for use in fraud).

I72635 Financial services

An offence under any of the following provisions of the Financial Services and Markets Act 2000—
a section 23 (contravention of prohibition on carrying on regulated activity unless authorised or exempt);
b section 24 (false claims to be authorised or exempt);
c section 25 (contravention of restrictions on financial promotion).
I40136An offence under any of the following provisions of the Financial Services Act 2012—
a section 89 (misleading statements);
b section 90 (misleading impressions).

I21737 Foreign interference

An offence under section 13 of the National Security Act 2023 (foreign interference).

I52738 Animal welfare

An offence under section 4(1) of the Animal Welfare Act 2006 (unnecessary suffering of an animal).

I88739 Inchoate offences

1 An offence of attempting or conspiring to commit an offence specified in this Schedule.
2 An offence under Part 2 of the Serious Crime Act 2007 (encouraging or assisting) in relation to an offence specified in this Schedule, or (in Scotland) inciting a person to commit such an offence.
3 An offence of aiding, abetting, counselling or procuring the commission of an offence specified in this Schedule, or (in Scotland) being involved art and part in the commission of such an offence.

SCHEDULE 8 

Transparency reports by providers of Category 1 services, Category 2A services and Category 2B services

Section 77

PART 1 Matters about which information may be required: user-to-user part of service

I889I8311 The incidence of illegal content, content that is harmful to children, relevant content and content to which section 15(2) applies on a service.
I841I7622 The dissemination of illegal content, content that is harmful to children, relevant content and content to which section 15(2) applies by means of a service.
I461I3233 The number of users who are assumed to have encountered illegal content, content that is harmful to children, relevant content or content to which section 15(2) applies by means of the service.
I138I4284 The formulation, development, scope and application of the terms of service.
I589I7855 The systems and processes for users to report content which they consider to be illegal content, content that is harmful to children or relevant content.
I109I4236 The systems and processes that a provider operates to deal with illegal content, content that is harmful to children and relevant content, including systems and processes for identifying such content and taking it down.
I647I5627 Functionalities designed to help users manage risks relating to content that is harmful to children and relevant content.
I397I8788 Features, including functionalities, that a provider considers may contribute to risks of harm to individuals using the service, and measures taken or in use by the provider to mitigate and manage those risks.
I632I4799 The design and operation of algorithms which affect the display, promotion, restriction or recommendation of illegal content, content that is harmful to children, relevant content or content to which section 15(2) applies.
I619I61310 Measures taken or in use by a provider to comply with any duty set out in Chapter 2 or 4 of Part 3 or section 38 (including in particular measures that are described in a code of practice under section 41).
I4911 Measures taken or in use by a provider to comply with the duty set out in section 64(1) (user identity verification).
I278I92712 Arrangements that a provider has in place for the reporting (in the United Kingdom or elsewhere) of content relating to child sexual exploitation and abuse, and measures taken or in use by a provider to comply with a requirement under section 66.
I587I39813 Measures taken or in use by a provider to comply with any duty set out in section 71 or 72 (terms of service).
I89614 Measures taken or in use by a provider to comply with any duty set out in section 75 (deceased child users).
I227I82915 The systems and processes by which a provider assesses the risk of harm to individuals from the presence of illegal content or content that is harmful to children—
a when the service is initially being designed or developed,
b when any further development or update to the service is being considered, and
c while the service is in operation.
I27I18016 The systems and processes that a provider operates—
a to direct users of the service to information about how they can protect themselves from harm in relation to illegal content and content that is harmful to children, and
b to counteract or provide support to users of the service in relation to illegal content and content that is harmful to children present on the service.
I879I45017 Co-operation by a provider with government, regulatory or other public sector bodies in the United Kingdom, in particular those involved in the enforcement of the criminal law.
I621I84518 Measures taken or in use by a provider to provide for a higher standard of protection for children than for adults.
I296I3519 Measures taken or in use by a provider to improve the media literacy of users, and an evaluation of the effectiveness of such measures.
I75I71220 Any other measures taken or in use by a provider which relate to online safety matters.

PART 2 Matters about which information may be required: search engine

I126I86421 The incidence of illegal search content and search content that is harmful to children on a service.
I47I29322 The number of users who are assumed to have encountered illegal search content or search content that is harmful to children.
I642I50523 The formulation, development, scope and application of the statements of policies and procedures mentioned in sections 27(5) and 29(5).
I882I59624 The systems and processes for users to report search content which they consider to be illegal content or content that is harmful to children, or other content which they consider breaches any statements of policies and procedures which have been made publicly available by the provider of a service.
I678I63825 The systems and processes that a provider operates to deal with illegal search content and search content that is harmful to children, including systems and processes for identifying such content and minimising the risk of those kinds of content being encountered by means of the service.
I886I82626 Functionalities designed to help users manage risks relating to search content that is harmful to children.
I155I25427 The design and operation of algorithms which affect the display, promotion, restriction or recommendation of illegal search content or search content that is harmful to children.
I304I91228 Measures taken or in use by a provider to comply with any duty set out in Chapter 3 or 4 of Part 3 or section 39 (including in particular measures that are described in a code of practice under section 41).
I85729 Arrangements that a provider has in place for the reporting (in the United Kingdom or elsewhere) of content relating to child sexual exploitation and abuse, and measures taken or in use by a provider to comply with a requirement under section 66.
I60130 Measures taken or in use by a provider to comply with any duty set out in section 75 (deceased child users).
I485I14531 The systems and processes by which a provider assesses the risk of harm to individuals from illegal search content or search content that is harmful to children—
a when the service is initially being designed or developed,
b when any further development or update to the service is being considered, and
c while the service is in operation.
I381I60232 The systems and processes that a provider operates—
a to direct users of the service to information about how they can protect themselves from harm in relation to illegal content and content that is harmful to children, and
b to counteract or provide support to users of the service in relation to illegal search content and search content that is harmful to children.
I665I36133 Co-operation by a provider with government, regulatory or other public sector bodies in the United Kingdom, in particular those involved in the enforcement of the criminal law.
I867I51534 Measures taken or in use by a provider to provide a higher standard of protection for children than for adults.
I898I80435 Measures taken or in use by a provider to improve the media literacy of users, and an evaluation of the effectiveness of such measures.
I130I55136 Any other measures taken or in use by a provider which relate to online safety matters.

PART 3 Further provision and interpretation

I149I13337 When determining which information to require in a notice under section 77(1) in relation to a particular service, OFCOM must take into account—
a the kind of service it is;
b the functionalities of the service;
c the number of users of the service;
d the capacity of the provider;
e the duties set out in Chapter 2 or 3 of Part 3 or Chapters 1 to 4 of Part 4 that apply in relation to the service;
f the proportion of users of the service who are children.
I569I71038 The Secretary of State may by regulations—
a amend Part 1 or Part 2 of this Schedule so as to add further matters about which information may be required, or to vary or omit matters about which information may be required, and
b amend paragraph 37 in connection with any such amendment.
I220I69339 The Secretary of State must consult OFCOM before making regulations under paragraph 38.
I605I71840 In the application of Part 2 of this Schedule to a combined service, references to statements of policies and procedures include references to provisions of the terms of service which relate to the search engine.
I685I31741
1 For the purposes of this Schedule, content of a particular kind is “relevant content” if—
a a term of service, other than a term of service within sub-paragraph (2), indicates (in whatever words) that the presence of content of that kind is prohibited on the service or that users’ access to content of that kind is restricted, and
b it is regulated user-generated content.
2 The terms of service within this sub-paragraph are as follows—
a terms of service which make provision of the kind mentioned in section 10(5) (protecting individuals from illegal content) or 12(9) (protecting children from content that is harmful to children);
b terms of service which deal with the treatment of consumer content.
3 References in this Schedule to relevant content are to content that is relevant content in relation to the service in question.
4 The reference in sub-paragraph (1) to users’ access to content being restricted is to be construed in accordance with sections 58 and 236(6).
I836I20742 In this Schedule—
  • “consumer content” has the same meaning as in Chapter 3 of Part 4 (see section 74(3));
  • “content that is harmful to children” has the same meaning as in Part 3 (see section 60);
  • “illegal content” has the same meaning as in Part 3 (see section 59);
  • “illegal search content” means search content that is illegal content;
  • “regulated user-generated content” has the same meaning as in Part 3 (see section 55), and references to such content are to content that is regulated user-generated content in relation to the service in question;
  • “search content” has the same meaning as in Part 3 (see section 57);
  • “users” means United Kingdom users (see section 227), except in paragraphs 16(a) and 32(a) where “users” means individuals in the United Kingdom who are users of a service.

SCHEDULE 9 

Certain internet services not subject to duties relating to regulated provider pornographic content

Section 80

I312I7961 Internal business services (entire internet service)

1 An internet service, other than a user-to-user service or a search service, in relation to which the conditions in sub-paragraph (2) are met.
2 The conditions are—
a the internet service is an internal resource or tool for a business, or for more than one business carried on by the same person,
b the person carrying on the business (or businesses) (“P”) is the provider of the internet service, and
c the internet service is available only to a closed group of people comprising some or all of the following—
i where P is an individual or individuals, that individual or those individuals,
ii where P is an entity, officers of P,
iii persons who work for P (including as employees or volunteers) for the purposes of any activities of the business (or any of the businesses) in question, and
iv any other persons authorised by a person within sub-paragraph (i), (ii) or (iii) to use the service for the purposes of any activities of the business (or any of the businesses) in question (for example, a contractor, consultant or auditor, or in the case of an educational institution, pupils or students).
3 In this paragraph—
  • “business” includes trade, profession, educational institution or other concern (whether or not carried on for profit);
  • “officer” includes a director, manager, partner, associate, secretary, governor, trustee or other similar officer.

I539I4172 Internal business services (part of internet service)

1 An internet service, other than a user-to-user service or a search service, within sub-paragraph (2).
2 An internet service is within this sub-paragraph if—
a the conditions in paragraph 1(2) are met in relation to a part of the service, and
b no regulated provider pornographic content is published or displayed on the rest of the service.
3 In sub-paragraph (2)(b), “the rest of the service” means all parts of the internet service other than the part in relation to which the conditions in paragraph 1(2) are met.

I709I5023 Services provided by public bodies

1 An internet service, other than a user-to-user service or a search service, which is provided by a public body.
2 An internet service is “provided by a public body” if—
a both of the following conditions are met in relation to the service—
i the provider of the service is a public authority within the meaning of section 6 of the Human Rights Act 1998, and
ii the service is provided in the exercise of public functions only,
b the provider of the service is Parliament, either House of Parliament, the Scottish Parliament, Senedd Cymru, the Northern Ireland Assembly or a person acting on behalf of any of those institutions,
c the provider of the service is a foreign sovereign power, or
d both of the following conditions are met in relation to the service—
i the provider of the service is an entity formed under the law of a country outside the United Kingdom, which exercises functions of a public nature, and
ii the service is provided in the exercise of such functions only.
3 But an internet service is not within this paragraph if—
a the provider of the service is a person providing education or childcare, and
b the service is provided for the purposes of that education or childcare.
See paragraph 4.
4 This paragraph is without prejudice to the fact that this Act does not apply in relation to an internet service provided by the Crown.
5 In this paragraph, “public function” means a function that is a function of a public nature for the purposes of the Human Rights Act 1998.

I739I2764 Services provided by persons providing education or childcare

1 An internet service, other than a user-to-user service or a search service—
a of which the provider is—
i the person with legal responsibility for education or childcare of a description listed in Part 2 of Schedule 1 (“the responsible person”), or where the responsible person is a body, a member of that body, or
ii a person who is employed or engaged to provide education or childcare of a description listed in Part 2 of Schedule 1, and who is subject to safeguarding duties which relate to the provision of that education or childcare, and
b which is provided for the purposes of that education or childcare.
2 In sub-paragraph (1)(a)(ii), “safeguarding duties” means duties or requirements which are related to the safeguarding of children arising under enactments other than this Act, under guidance or requirements (however referred to) produced under enactments other than this Act, or as a result of contractual arrangements made by the responsible person.
3 For the purposes of this paragraph, the person with legal responsibility for education or childcare of a particular description is the person with legal responsibility for its day-to-day provision (for example, the person with legal responsibility for a particular school), rather than any other person who has a duty to ensure that, in general, education or childcare of that description (or education or childcare which includes education or childcare of that description) is provided.

I181I6595 On-demand programme services and non-UK on-demand programme services that are Tier 1 services (entire internet service)

1 An internet service that is an on-demand programme service or a non-UK on-demand programme service that is a Tier 1 service.
2 In this paragraph and paragraph 6, “on-demand programme service” , “non-UK on-demand programme service” and “Tier 1 service” have the same meaning as in the Communications Act (see sections 368A, 368AA and 368HA of that Act).

I447I7986 On-demand programme services and non-UK on-demand programme services that are Tier 1 services (part of internet service)

1 An internet service within sub-paragraph (2).
2 An internet service is within this sub-paragraph if—
a part of the service is an on-demand programme service or a non-UK on-demand programme service that is a Tier 1 service, and
b no regulated provider pornographic content is published or displayed on the rest of the service.
3 In sub-paragraph (2)(b), “the rest of the service” means all parts of the internet service other than the part which is an on-demand programme service or a non-UK on-demand programme service that is a Tier 1 service.

I60I1667 Interpretation

In this Schedule—
  • “education” and “childcare” have the same meaning as in Schedule 1 (see Part 3 of that Schedule);
  • “enactment” includes—
    1. an enactment contained in subordinate legislation (within the meaning of the Interpretation Act 1978),
    2. an enactment contained in, or in an instrument made under, an Act of the Scottish Parliament,
    3. an enactment contained in, or in an instrument made under, a Measure or Act of Senedd Cymru, and
    4. an enactment contained in, or in an instrument made under, Northern Ireland legislation;
  • “regulated provider pornographic content” and “published or displayed” have the same meaning as in Part 5 (see section 79).

SCHEDULE 10 

Recovery of OFCOM’s initial costs

Section 89

I470I4211 Recovery of initial costs

1 This Schedule concerns the recovery by OFCOM of an amount equal to the aggregate of the amounts of WTA receipts which, in accordance with section 401(1) of the Communications Act and OFCOM’s statement under that section, are retained by OFCOM for the purpose of meeting their initial costs.
2 OFCOM must seek to recover the amount described in sub-paragraph (1) (“the total amount of OFCOM’s initial costs”) by charging providers of regulated services fees under this Schedule (“additional fees”).
3 In this Schedule—
  • “initial costs” means the costs incurred by OFCOM before the first day of the initial charging year on—
    1. preparations for the exercise of their online safety functions, or
    2. the exercise of their online safety functions;
  • “WTA receipts” means the amounts described in section 401(1)(a) of the Communications Act which are paid to OFCOM (certain receipts under the Wireless Telegraphy Act 2006).

I206I3852 Recovery of initial costs: first phase

1 The first phase of OFCOM’s recovery of their initial costs is to take place over a period of several charging years to be specified in regulations under paragraph 7 (“specified charging years”).
2 Over that period OFCOM must, in aggregate, charge providers of regulated services additional fees of an amount equal to the total amount of OFCOM’s initial costs.
3 OFCOM may not charge providers additional fees in respect of any charging year which falls before the first specified charging year.
4 OFCOM may require a provider to pay an additional fee in respect of a charging year only if the provider is required to pay a fee in respect of that year under section 84 (and references in this Schedule to charging providers are to be read accordingly).
5 The amount of an additional fee payable by a provider is to be calculated in accordance with regulations under paragraph 7.

I8I4553 Further recovery of initial costs

1 The second phase of OFCOM’s recovery of their initial costs begins after the end of the last of the specified charging years.
2 As soon as reasonably practicable after the end of the last of the specified charging years, OFCOM must publish a statement specifying—
a the amount which is at that time the recoverable amount (see paragraph 6), and
b the amounts of the variables involved in the calculation of the recoverable amount.
3 OFCOM’s statement must also specify the amount which is equal to that portion of the recoverable amount which is not likely to be paid or recovered. The amount so specified is referred to in sub-paragraphs (4) and (5) as “the outstanding amount”.
4 Unless a determination is made as mentioned in sub-paragraph (5), OFCOM must, in aggregate, charge providers of regulated services additional fees of an amount equal to the outstanding amount.
5 The Secretary of State may, as soon as reasonably practicable after the publication of OFCOM’s statement, make a determination specifying an amount by which the outstanding amount is to be reduced, and in that case OFCOM must, in aggregate, charge providers of regulated services additional fees of an amount equal to the difference between the outstanding amount and the amount specified in the determination.
6 Additional fees mentioned in sub-paragraph (4) or (5) must be charged in respect of the charging year immediately following the last of the specified charging years (“year 1”).
7 The process set out in sub-paragraphs (2) to (6) is to be repeated in successive charging years, applying those sub-paragraphs as if—
a in sub-paragraph (2), the reference to the end of the last of the specified charging years were to the end of year 1 (and so on for successive charging years);
b in sub-paragraph (6), the reference to year 1 were to the charging year immediately following year 1 (and so on for successive charging years).
8 Any determination by the Secretary of State under this paragraph must be published in such manner as the Secretary of State considers appropriate.
9 Sub-paragraphs (4) and (5) of paragraph 2 apply to the charging of additional fees under this paragraph as they apply to the charging of additional fees under that paragraph.
10 The process set out in this paragraph comes to an end in accordance with paragraph 4.

I700I7454 End of the recovery process

1 The process set out in paragraph 3 comes to an end if a statement by OFCOM under that paragraph records that—
a the recoverable amount is nil, or
b all of the recoverable amount is likely to be paid or recovered.
2 Or the Secretary of State may bring that process to an end by making a determination that OFCOM are not to embark on another round of charging providers of regulated services additional fees.
3 The earliest time when such a determination may be made is after the publication of OFCOM’s first statement under paragraph 3.
4 A determination under sub-paragraph (2)—
a must be made as soon as reasonably practicable after the publication of a statement by OFCOM under paragraph 3;
b must be published in such manner as the Secretary of State considers appropriate.
5 A determination under sub-paragraph (2) does not affect OFCOM’s power—
a to bring proceedings for the recovery of the whole or part of an additional fee for which a provider became liable at any time before the determination was made, or
b to act in accordance with the procedure set out in section 141 in relation to such a liability.

I179I2315 Providers for part of a year only

1 For the purposes of this Schedule, the “provider” of a regulated service, in relation to a charging year, includes a person who is the provider of the service for part of the year.
2 Where a person is the provider of a regulated service for part of a charging year only, OFCOM may refund all or part of an additional fee paid to OFCOM under paragraph 2 or 3 by that provider in respect of that year.

I855I3376 Calculation of the recoverable amount

For the purposes of a statement by OFCOM under paragraph 3, the “recoverable amount” is given by the formula—
C-(F-R)-D
where—
  • C is the total amount of OFCOM’s initial costs,
  • F is the aggregate amount of the additional fees received by OFCOM at the time of the statement in question,
  • R is the aggregate amount of the additional fees received by OFCOM that at the time of the statement in question have been, or are due to be, refunded (see paragraph 5(2)), and
  • D is the amount specified in a determination made by the Secretary of State under paragraph 3 (see paragraph 3(5)) at a time before the statement in question or, where more than one such determination has been made, the sum of the amounts specified in those determinations.

I820I4847 Regulations about recovery of initial costs

1 The Secretary of State must make regulations making such provision as the Secretary of State considers appropriate in connection with the recovery by OFCOM of their initial costs.
2 The regulations must include provision as set out in sub-paragraphs (3), (4) and (6).
3 The regulations must specify the total amount of OFCOM’s initial costs.
4 For the purposes of paragraph 2, the regulations must specify—
a the charging years in respect of which additional fees are to be charged, and
b the proportion of the total amount of initial costs which OFCOM must seek to recover in each of the specified charging years.
5 The following rules apply to provision made in accordance with sub-paragraph (4)(a)—
a the initial charging year may not be specified;
b only consecutive charging years may be specified;
c at least three charging years must be specified;
d no more than five charging years may be specified.
6 The regulations must specify the computation model that OFCOM must use to calculate fees payable by individual providers of regulated services under paragraphs 2 and 3 (and that computation model may be different for different charging years).
7 The regulations may make provision about what OFCOM may or must do if the operation of this Schedule results in them recovering more than the total amount of their initial costs.
8 The regulations may amend this Schedule or provide for its application with modifications in particular cases.
9 Before making regulations under this paragraph, the Secretary of State must consult—
a OFCOM,
b providers of regulated user-to-user services,
c providers of regulated search services,
d providers of internet services within section 80(2), and
e such other persons as the Secretary of State considers appropriate.

I640I7318 Interpretation

In this Schedule—
  • “additional fees” means fees chargeable under this Schedule in respect of the recovery of OFCOM’s initial costs;
  • “charging year” has the meaning given by section 90;
  • “initial charging year” has the meaning given by section 90;
  • “initial costs” has the meaning given by paragraph 1(3), and the “total amount” of initial costs means the amount described in paragraph 1(1);
  • “recoverable amount” has the meaning given by paragraph 6;
  • “specified charging year” means a charging year specified in regulations under paragraph 7 for the purposes of paragraph 2.

SCHEDULE 11 

Categories of regulated user-to-user services and regulated search services: regulations

Section 94

I6041 Regulations specifying threshold conditions for categories of Part 3 services

1 The Secretary of State must make regulations specifying conditions (“Category 1 threshold conditions”) for the user-to-user part of regulated user-to-user services relating to each of the following—
a number of users of the user-to-user part of the service,
b functionalities of that part of the service, and
c any other characteristics of that part of the service or factors relating to that part of the service that the Secretary of State considers relevant.
2 The Secretary of State must make regulations specifying conditions (“Category 2A threshold conditions”) for the search engine of regulated search services and combined services relating to each of the following—
a number of users of the search engine, and
b any other characteristics of the search engine or factors relating to the search engine that the Secretary of State considers relevant.
3 The Secretary of State must make regulations specifying conditions (“Category 2B threshold conditions”) for the user-to-user part of regulated user-to-user services relating to each of the following—
a number of users of the user-to-user part of the service,
b functionalities of that part of the service, and
c any other characteristics of that part of the service or factors relating to that part of the service that the Secretary of State considers relevant.
4 Regulations under this paragraph must specify the way or ways in which the relevant threshold conditions may be met, and that may be by meeting the conditions in any specified combination, subject to the rule that—
a in relation to the Category 1 threshold conditions and the Category 2B threshold conditions, at least one specified condition about number of users or functionality must be met, and
b in relation to the Category 2A threshold conditions, at least one specified condition about number of users must be met.
5 In making regulations under sub-paragraph (1), the Secretary of State must take into account the likely impact of the number of users of the user-to-user part of the service, and its functionalities, on how easily, quickly and widely regulated user-generated content is disseminated by means of the service.
6 In making regulations under sub-paragraph (2), the Secretary of State must take into account the likely impact of the number of users of the search engine on the level of risk of harm to individuals from search content that is illegal content or search content that is harmful to children.
7 In making regulations under sub-paragraph (3), the Secretary of State must take into account the likely impact of the number of users of the user-to-user part of the service, and its functionalities, on the level of risk of harm to individuals from illegal content and content that is harmful to children disseminated by means of the service.
8 In this paragraph “specified” means specified in the regulations.

I7012 Procedure for first regulations under paragraph 1

1 This paragraph describes the procedure that must be followed in relation to the making of the first regulations under each of sub-paragraphs (1), (2) and (3) of paragraph 1.
2 In the case of regulations under paragraph 1(1), within the period of six months beginning with the day on which this Act is passed, OFCOM must carry out research into—
a how easily, quickly and widely regulated user-generated content is disseminated by means of regulated user-to-user services,
b the number of users and functionalities of the user-to-user part of such services, and
c such other characteristics of that part of such services or factors relating to that part of such services as OFCOM consider to be relevant to specifying the Category 1 threshold conditions.
3 In the case of regulations under paragraph 1(2), within the period of six months beginning with the day on which this Act is passed, OFCOM must carry out research into the following aspects of the search engine of regulated search services and combined services—
a the prevalence of search content that is illegal content and search content that is harmful to children,
b the number of users of the search engine, and
c such other characteristics or factors as OFCOM consider to be relevant to specifying the Category 2A threshold conditions.
4 In the case of regulations under paragraph 1(3), within the period of six months beginning with the day on which this Act is passed, OFCOM must carry out research into—
a the dissemination of illegal content and content that is harmful to children by means of regulated user-to-user services,
b the number of users and functionalities of the user-to-user part of such services, and
c such other characteristics of that part of such services or factors relating to that part of such services as OFCOM consider to be relevant to specifying the Category 2B threshold conditions.
5 OFCOM must provide the Secretary of State with advice based on the research under sub-paragraph (2), (3) or (4) (as the case may be) as to the provision which OFCOM consider it is appropriate for the regulations in question to make.
6 Such advice may include advice that the regulations should include another characteristic or factor in addition to number of users and (in the case of regulations under paragraph 1(1) or (3)) functionalities, and what that other characteristic or factor should be.
7 As soon as reasonably practicable after OFCOM provide advice as mentioned in sub-paragraph (5)—
a OFCOM must publish the advice, and
b the Secretary of State must make the regulations.
8 If the regulations include provision which differs in any material respect from provision advised by OFCOM, the Secretary of State must publish a statement which explains why the Secretary of State has departed from that advice.
9 A statement mentioned in sub-paragraph (8) must be published—
a no later than the time at which the regulations to which the statement relates are made, and
b in such manner as the Secretary of State considers appropriate for bringing it to the attention of persons who may be affected by it.
10 The Secretary of State may give OFCOM extra time to carry out their research in the case of regulations under paragraph 1(2) or (3), but OFCOM must carry out such research within the period of 18 months beginning with the day on which this Act is passed.
11 The Secretary of State may not make regulations under paragraph 1 until OFCOM have carried out research and provided advice to the Secretary of State as required by this paragraph.

I7993 Procedure for amending or replacing regulations under paragraph 1

1 Regulations in force under paragraph 1(1) may not be amended or replaced by further regulations under that provision except following further research carried out by OFCOM into the matters mentioned in paragraph 2(2).
2 Regulations in force under paragraph 1(2) may not be amended or replaced by further regulations under that provision except following further research carried out by OFCOM into the matters mentioned in paragraph 2(3).
3 Regulations in force under paragraph 1(3) may not be amended or replaced by further regulations under that provision except following further research carried out by OFCOM into the matters mentioned in paragraph 2(4).
4 The further research in question—
a may be initiated by OFCOM or carried out in response to a request from the Secretary of State, and
b may be in as much depth as OFCOM consider appropriate.
5 A request from the Secretary of State to OFCOM to carry out further research must indicate why the Secretary of State considers that to be necessary.
6 Where such research is carried out, OFCOM must provide the Secretary of State with advice as to whether, in OFCOM’s opinion—
a it is appropriate to make changes to the regulations in question, specifying the changes that OFCOM recommend, or
b it is not appropriate to make any changes to the regulations in question.
7 OFCOM must publish such advice as soon as reasonably practicable after providing it to the Secretary of State.
8 Where, following such advice, regulations are amended or replaced by further regulations under the provision in question (“new regulations”)—
a if the new regulations include provision which differs in any material respect from provision advised by OFCOM, the Secretary of State must publish a statement explaining the departures from that advice;
b if OFCOM’s advice was as mentioned in sub-paragraph (6)(b), the Secretary of State must publish a statement explaining the reasons for the new regulations.
9 Where OFCOM’s advice is as mentioned in sub-paragraph (6)(a) and the Secretary of State does not make new regulations, the Secretary of State must, as soon as reasonably practicable, publish a statement explaining that decision.
10 A statement mentioned in sub-paragraph (8) must be published no later than the time at which the regulations to which the statement relates are made.
11 A statement mentioned in sub-paragraph (8) or (9) must be published in such manner as the Secretary of State considers appropriate for bringing it to the attention of persons who may be affected by it.
12 Sub-paragraphs (1) to (3) do not apply to regulations made only for the purpose of correcting existing regulations under paragraph 1.

I2364 Publication of OFCOM’s advice under paragraphs 2 and 3

1 In arranging for the publication of advice under paragraph 2(7)(a) or 3(7), OFCOM must have regard to the need to exclude from publication, so far as that is practicable, matters which are confidential in accordance with sub-paragraphs (2) and (3).
2 A matter is confidential under this sub-paragraph if—
a it relates specifically to the affairs of a particular body, and
b publication of that matter would or might, in OFCOM’s opinion, seriously and prejudicially affect the interests of that body.
3 A matter is confidential under this sub-paragraph if—
a it relates to the private affairs of an individual, and
b publication of that matter would or might, in OFCOM’s opinion, seriously and prejudicially affect the interests of that individual.

I6285 Interpretation

References in this Schedule to the number of users of a user-to-user part of a service or a search engine are to the number of United Kingdom users of such a part or search engine.
I7576In this Schedule the “characteristics” of a user-to-user part of a service or a search engine include its user base, business model, governance and other systems and processes.
I1887In this Schedule—
  • “content that is harmful to children” has the same meaning as in Part 3 (see section 60);
  • “illegal content” has the same meaning as in Part 3 (see section 59);
  • “regulated user-generated content” has the same meaning as in Part 3 (see section 55);
  • “search content” has the same meaning as in Part 3 (see section 57).

SCHEDULE 12 

OFCOM’s powers of entry, inspection and audit

Section 107

I413I5081 Authorised persons

1 OFCOM may authorise persons to—
a exercise powers of entry and inspection under paragraph 2;
b carry out audits in accordance with notices under paragraph 4;
c apply for a warrant to be issued under paragraph 5, and execute such a warrant that has been issued.
2 “Authorised person” means—
a in paragraph 2, a person authorised for the purposes mentioned in sub-paragraph (1)(a);
b in paragraph 4, a person authorised for the purposes mentioned in sub-paragraph (1)(b);
c in other paragraphs of this Schedule, a person authorised for the purposes mentioned in sub-paragraph (1)(c).
3 An authorisation under this paragraph must be in writing.

I901I5252 Power of entry and inspection without a warrant

1 The powers conferred by this paragraph may be exercised in relation to premises only if OFCOM—
a believe that the premises are being used by the provider of a regulated service in connection with the provision of a regulated service, and
b have given the occupier of the premises seven days’ notice that they propose to exercise the powers.
2 The powers conferred by this paragraph must be exercised at a reasonable hour.
3 Before exercising a power of entry under this paragraph, an authorised person must, if requested to do so by a person on the premises—
a produce evidence of the authorised person’s identity, and
b outline the purpose for which the power is exercised.
4 An authorised person may—
a enter the premises,
b inspect the premises,
c observe the carrying on of the regulated service at the premises,
d inspect any document or equipment found on the premises,
e require any person on the premises to provide any information, or produce any document in the person’s possession or control, that the authorised person considers is relevant to the provision of the regulated service, and
f require any person on the premises to provide an explanation of any document or to state where it may be found.
5 The power to observe the carrying on of the regulated service at the premises includes the power to view, using equipment or a device on the premises, information generated in real time by the performance of a test or demonstration required by a notice given under paragraph 3.
6 An authorised person may take copies of any document found or produced under sub-paragraph (4).
7 An authorised person may exercise powers conferred by this paragraph only so far as is required in connection with the exercise by OFCOM of their functions under this Act.

I542I6373 Notice requiring information, documents or tests at inspection

1 This paragraph applies where OFCOM intend to exercise the powers conferred by paragraph 2 to enter and inspect premises.
2 OFCOM may give the occupier of the premises a notice requiring relevant information to be provided, relevant documents to be produced, or a relevant test or demonstration to be performed, during the inspection.
3 Any such notice must be given at least seven days in advance of the proposed inspection date.
4 For the purposes of this paragraph, information or a document, test or demonstration is “relevant” if it is required in connection with the exercise by OFCOM of their functions under this Act.
5 A notice under this paragraph must—
a specify or describe the information to be provided, the documents to be produced, or the test or demonstration to be performed, during the inspection, and
b contain information about the consequences of not complying with the notice.

I821I4634 Audit

1 OFCOM may give the provider of a regulated service a notice (an “audit notice”) requiring the provider to permit OFCOM to carry out an audit—
a to assess whether the provider has complied or is complying with enforceable requirements that apply in respect of the service, or
b to assess—
i the nature and level of risk of the provider failing to comply with an enforceable requirement that applies in respect of the service, and
ii ways to mitigate such a risk.
2 An audit notice may require the provider to take any of the following actions for a purpose mentioned in sub-paragraph (1)—
a to permit an authorised person to enter and inspect specified premises;
b to permit an authorised person to observe the carrying on of the regulated service at the premises;
c to direct an authorised person to documents on the premises that are of a specified description;
d to assist an authorised person to view information of a specified description that is capable of being viewed using equipment or a device on the premises;
e to assist an authorised person to view, using equipment or a device on the premises, information demonstrating in real time the operation of systems, processes or features of a specified description, including functionalities or algorithms of a specified description;
f to assist an authorised person to view, using equipment or a device on the premises, information generated in real time by the performance of a test or demonstration of a specified description;
g to comply with a request from an authorised person for a copy (in such form as may be requested) of the documents or information to which the person is directed or which the person is assisted to view;
h to permit an authorised person to inspect the documents, information or equipment to which the person is directed or which the person is assisted to view;
i to provide an authorised person with an explanation of such documents or information;
j to make available for interview by the authorised person a specified number of people of a specified description who are involved in the provision of the regulated service (not exceeding the number who are willing to be interviewed).
3 An audit notice—
a must be given at least 28 days in advance of the start of the audit, and
b must specify the time or times at which, or period or periods within which, each requirement imposed by the notice must be complied with.
4 An audit notice may not require a provider to permit an authorised person to enter domestic premises.
5 An audit notice may not require a provider to do anything that would result in the disclosure of information or documents in respect of which a claim to legal professional privilege, or (in Scotland) to confidentiality of communications, could be maintained in legal proceedings.
6 An audit notice must contain information about the consequences of not complying with the requirements which it imposes.
7 An audit notice may by further notice—
a be revoked by OFCOM;
b be varied by OFCOM so as to make it less onerous.
8 OFCOM may require a provider to pay some or all of the reasonable costs of an audit carried out in accordance with an audit notice.
9 If OFCOM require a provider to pay an amount as mentioned in sub-paragraph (8), paragraph 6 of Schedule 13 applies in relation to the amount as it applies in relation to a penalty within the meaning of that Schedule.
10 In this paragraph “specified” means specified in an audit notice.

I905I1415 Conditions for issue of a warrant

1 A justice of the peace or (in Northern Ireland) a lay magistrate may issue a warrant in relation to premises specified in an application only if satisfied on sworn information in writing given by an authorised person that—
a the premises are being used by the provider of a regulated service in connection with the provision of a regulated service;
b there are reasonable grounds to suspect that—
i the provider is failing to comply, or has failed to comply, with an enforceable requirement that applies in respect of that service, and
ii there is information or equipment on the premises, or there are documents on the premises, relevant to OFCOM’s investigation into that failure (or possible failure); and
c any of the conditions in sub-paragraph (2) are met.
2 The conditions are that, in relation to the premises specified in the application for a warrant—
a OFCOM have previously given notice to enter the premises, as required in relation to entry without a warrant under paragraph 2, but a person authorised by OFCOM to exercise powers under that paragraph was denied access,
b a requirement imposed by a person acting in the exercise of powers conferred by paragraph 2 has not been complied with,
c a requirement of a notice under paragraph 3 has not been complied with,
d a requirement of a notice under paragraph 4 (audit notice) has not been complied with,
e giving notice to enter the premises would defeat the object of entry, or
f OFCOM require access to the premises urgently.

I441I7506 Evidence of authority

1 Before exercising a power of entry under a warrant, an authorised person must—
a produce a copy of the warrant,
b supply the occupier (if present), or any other person appearing to the authorised person to be in charge of the premises, with a copy of the warrant, and
c if requested to do so—
i produce evidence of the authorised person’s identity, and
ii outline the purpose for which the power is exercised.
2 If neither the occupier nor any other person appearing to the authorised person to be in charge of the premises is present, the authorised person must leave a copy of the warrant in a prominent place on the premises.

I74I3067 Powers exercisable by warrant

An authorised person executing a warrant may do any of the following for the purposes of OFCOM’s investigation into whether there is, or has been, a failure referred to in paragraph 5(1)(b)(i)—
a enter the premises specified in the warrant;
b search the premises;
c inspect any documents or equipment found on the premises, or any information capable of being viewed using equipment or a device on the premises;
d require any person on the premises to provide information, including requiring an explanation of any document found on the premises or any information capable of being viewed using equipment or a device on the premises;
e require any person on the premises to produce any document in the person’s possession or control;
f take copies of any document found on the premises or produced in response to a requirement under paragraph (e);
g require information which is stored in electronic form and may be accessed from the premises to be produced in a form in which it can be taken away and in which it is visible and legible (or from which it can readily be produced in a visible and legible form);
h operate any equipment found on the premises for the purposes of producing such information in such a form;
i require any person on the premises to give the authorised person any assistance that the authorised person may reasonably require (including for the purposes of paragraphs (g) and (h));
j take copies of anything produced in accordance with paragraph (g);
k seize any document found on the premises or produced in response to a requirement under paragraph (e), or anything produced in accordance with paragraph (g), or any equipment found on the premises;
l open any container found on the premises;
m take a photograph or video recording of anything found on the premises.

I3I8508 Powers of seizure: supplementary

1 This paragraph applies where the person executing a warrant seizes a document or other thing.
2 The person must, on request—
a give a receipt for it, and
b (in the case of a document) give an occupier of the premises a copy of it.
3 Sub-paragraph (2)(b) does not apply if the person executing the warrant considers that providing a copy would result in undue delay.
4 Anything seized may be retained for so long as is necessary in all the circumstances.

I112I2139 Further provision about executing warrants

Entry and search under a warrant must be at a reasonable hour, unless it appears to the person executing it that the purpose of a search would be frustrated or seriously prejudiced by entry at a reasonable hour.
I571I53210Entry and search under a warrant must be within the period of one month starting with the date of its issue.
I17I77311An authorised person executing a warrant may take such other persons and such equipment and materials onto the premises as appear to that person to be necessary.
I214I85112A person taken on to the premises under paragraph 11 may exercise any power conferred on an authorised person by paragraph 7 if the person is in the company and under the supervision of an authorised person executing a warrant.
I582I68013An authorised person may use reasonable force, if necessary, for the purpose of exercising a power under a warrant.
I440I39914A warrant authorises entry on one occasion only, unless it specifies that it authorises multiple entries.
I20I42915If the premises are unoccupied or the occupier is temporarily absent, an authorised person executing a warrant must leave the premises as effectively secured against trespassers as that person found them.

I627I1616 Return of warrants

1 Where a warrant is executed—
a it must be returned to the appropriate person (see sub-paragraph (3)) after being executed, and
b the person by whom it is executed must write on the warrant a statement of the powers that have been exercised under the warrant.
2 Where a warrant is not executed, it must be returned to the appropriate person within the time authorised for its execution.
3 The appropriate person is—
a in the case of a warrant issued in England and Wales, the designated officer for the local justice area in which the justice of the peace was acting when issuing the warrant;
b in the case of a warrant issued in Scotland, the clerk of the justice of the peace court;
c in the case of a warrant issued in Northern Ireland, the clerk of petty sessions.
4 The appropriate person must retain a search warrant returned under sub-paragraph (1) or (2) until the end of the period of 12 months starting with the date of its return.
5 If during that period the occupier of premises to which the warrant relates asks to inspect it, the occupier must be allowed to do so.

I688I48317 Restrictions on powers

1 This paragraph applies in relation to—
a powers conferred by paragraph 2 (entry and inspection without warrant), and
b powers exercisable under a warrant.
2 Those powers are not exercisable in respect of domestic premises.
3 Those powers are not exercisable in relation to information or documents in respect of which a claim to legal professional privilege, or (in Scotland) to confidentiality of communications, could be maintained in legal proceedings.

I649I30018 Offences

1 A person commits an offence if—
a the person intentionally obstructs a person acting under this Schedule;
b the person fails, without reasonable excuse, to comply with any requirement imposed by a person acting under this Schedule;
c in response to a requirement imposed by a person acting under this Schedule, the person provides information that is false in a material respect, knowing that it is false in a material respect or being reckless as to whether it is false in a material respect.
2 A person who commits an offence under this paragraph is liable—
a on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);
b on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum (or both);
c on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);
d on conviction on indictment, to imprisonment for a term not exceeding 2 years or a fine (or both).

I252I30919 Interpretation

In this Schedule—
  • “domestic premises” means premises, or a part of premises, used as a dwelling;
  • “premises” means premises in the United Kingdom.
I233I78320References in this Schedule to a person “acting under this Schedule” are to a person acting—
a in the exercise of powers conferred by paragraph 2 (entry and inspection without warrant), or
b in the execution of a warrant,
and the reference in paragraph 18(1)(a) also includes a person carrying out an audit in accordance with an audit notice.
I511I32021In this Schedule “enforceable requirement” has the same meaning as in Chapter 6 of Part 7 (see section 131), except that—
a it does not include—
i a requirement under (or a requirement of a notice under) section 104 (reports by skilled persons), or
ii a requirement imposed by a person acting under this Schedule;
b it includes a requirement imposed by a notice under section 121(1) (notices to deal with terrorism content and CSEA content).
I135I36622In paragraphs 6 to 17 and 20 “warrant” means a warrant issued under paragraph 5.
I280I41023In the application of paragraph 5(1) to Scotland, the reference to sworn information in writing has effect as a reference to evidence on oath.
I414I9424In the application of paragraph 5(1) to Northern Ireland, the reference to sworn information in writing has effect as a reference to a complaint on oath.

SCHEDULE 13 

Penalties imposed by OFCOM under Chapter 6 of Part 7

Section 143

I405I1181 Meaning of “penalty” in this Schedule

Except as otherwise indicated, references in this Schedule to a “penalty” are to any of the following—
a a penalty imposed by a confirmation decision (see sections 132(5)(b) and 137), whether that is—
i a penalty of a single amount, or
ii a penalty calculated by reference to a daily rate;
b a penalty imposed by a penalty notice under section 139;
c a penalty imposed by a penalty notice under section 140(5);
d a penalty imposed by a penalty notice under section 141(6).

I427I2222 Amount of penalties: principles

1 In determining the amount of a penalty to be imposed on a person, OFCOM must, in particular, take into account—
a any representations made, and evidence provided, by the person, and
b the effects of the failure (or failures) in respect of which the penalty is imposed.
2 In the case of a penalty imposed by a confirmation decision, OFCOM must also take into account any representations made, and evidence provided, by any other person to whom the earlier provisional notice of contravention relating to the same matter was given.
3 OFCOM must also take into account—
a in the case of a penalty imposed by a confirmation decision, any steps taken by the person towards—
i complying with any duty or requirement specified in the provisional notice of contravention given to the person, or
ii remedying the failure to comply with any such duty or requirement;
b in the case of a penalty imposed by a penalty notice under section 139, any steps taken by the person towards—
i complying with any duty or requirement specified in the confirmation decision given to the person, or
ii remedying the failure to comply with any such duty or requirement;
c in the case of a penalty imposed by a penalty notice under section 140(5), any steps taken by the person towards complying with the notice under section 121(1);
d in the case of a penalty imposed by a penalty notice under section 141(6), any steps taken by the person towards paying any amount of the fee due to OFCOM.
4 A penalty must be of an amount that OFCOM consider to be—
a appropriate, and
b proportionate to the failure (or failures) in respect of which it is imposed.
5 See also section 392 of the Communications Act (which requires OFCOM to produce guidelines about their determination of the amount of penalties that they impose).

I37I2183 Limitation to type and amount of penalties previously proposed

1 A confirmation decision or penalty notice may not impose a penalty of a different kind, of a greater amount or (in the case of a penalty calculated by reference to a daily rate) payable over a longer period than that proposed in the earlier notice in relation to the same matter.
2 Sub-paragraph (1) applies in a case where a provisional notice of contravention and confirmation decision in relation to the same matter are both given jointly (in accordance with Schedule 15) to the same entities, but does not otherwise apply in relation to a penalty for which two or more entities are jointly and severally liable.
3 In this paragraph “penalty notice” means a penalty notice under section 139, 140(5) or 141(6).

I578I4574 Maximum amount of penalties

1 Where a penalty is imposed on a person in respect of a regulated service provided by that person, the maximum amount of the penalty for which the person is liable is whichever is the greater of—
a £18 million, and
b 10% of the person’s qualifying worldwide revenue for the person’s most recent complete accounting period (subject to sub-paragraph (5)).
2 But if the person does not have an accounting period, the maximum amount of the penalty for which the person is liable is £18 million.
3 The maximum amount of a penalty for which a person not within sub-paragraph (1) is liable is £18 million.
4 If the person’s first accounting period has not yet ended, sub-paragraph (1)(b) is to be read as referring to 10% of the amount that OFCOM estimate to be the person’s likely qualifying worldwide revenue for that period.
5 If the duration of the accounting period by reference to which an amount of qualifying worldwide revenue is calculated is less than a year, the amount mentioned in sub-paragraph (1)(b) is to be proportionately increased. If the duration of that accounting period is more than a year, that amount is to be proportionately reduced.
6 The amount of a person’s qualifying worldwide revenue for an accounting period is, in the event of a disagreement between the person and OFCOM, the amount determined by OFCOM.
7 In the case of a confirmation decision that imposes a penalty of a single amount and a penalty calculated by reference to a daily rate, references in sub-paragraphs (1) to (3) to the maximum amount for which a person is liable are to the maximum amount of both those penalties taken together.
8 In this paragraph “accounting period”, in relation to a person, means a period in respect of which accounts are prepared in relation to that person or, where that person is an individual, in respect of that individual’s business of providing a regulated service.
9 Regulations made by OFCOM under section 85(1)(a) (including regulations making provision of a kind mentioned in section 85(3), (4) or (5)) apply for the purpose of determining the qualifying worldwide revenue of a provider of a regulated service for an accounting period as mentioned in this paragraph as they apply for the purpose of determining the qualifying worldwide revenue of a provider of a regulated service for a qualifying period for the purposes of Part 6.

I426I2815 Maximum amount of penalties: group of entities

1 This paragraph contains modifications of paragraph 4 in a case where, in accordance with Schedule 15, two or more entities are jointly and severally liable for a penalty.
2 Sub-paragraphs (3) to (5) of this paragraph apply instead of paragraph 4(1) to (4).
3 The maximum amount of the penalty for which the entities are liable is whichever is the greater of—
a £18 million, and
b 10% of the qualifying worldwide revenue of the group of entities that consists of—
i the entity that is the provider of the regulated service to which the decision or notice in question relates (“entity E”), and
ii every other entity which (at the time the decision or notice is given) is a group undertaking in relation to entity E.
4 In sub-paragraph (3)(b), the reference to the qualifying worldwide revenue of a group of entities is to—
a the amount of the group’s qualifying worldwide revenue for the most recent complete accounting period of the entities liable for the penalty, or
b if the first accounting period of the entities liable for the penalty has not yet ended, the amount that OFCOM estimate to be the group’s likely qualifying worldwide revenue for that period.
5 In a case where the accounting periods of the entities liable for the penalty are different—
a the reference in sub-paragraph (4)(a) to the accounting period of the entities is to be read as a reference to the accounting period of any of the entities (at OFCOM’s discretion), and
b sub-paragraph (4)(b) is to apply as if—
i for “the first accounting period of the entities” there were substituted “the first accounting period of all of the entities”, and
ii for “that period” there were substituted “the accounting period of any of the entities (at OFCOM’s discretion)”.
6 Sub-paragraphs (5), (6) and (7) of paragraph 4 are to be read with the necessary modifications in their application for the purposes of this paragraph.
7 In this paragraph—
  • “accounting period”, in relation to an entity, means a period in respect of which accounts are prepared in relation to that entity;
  • “group undertaking” has the meaning given by section 1161(5) of the Companies Act 2006.
8 For the purposes of this paragraph, sections 1161(5) and 1162 of, and Schedule 7 to, the Companies Act 2006—
a are to apply in relation to an entity which is not an undertaking (as defined in section 1161(1) of that Act) as they apply in relation to an undertaking, and
b are to be read with any necessary modifications if applied to an entity formed under the law of a country outside the United Kingdom.
9 OFCOM may by regulations make provision about how the qualifying worldwide revenue of a group of entities is to be determined for the purposes of this paragraph.
10 Before making regulations under sub-paragraph (9) OFCOM must consult—
a the Secretary of State,
b the Treasury, and
c such other persons as OFCOM consider appropriate.
11 Regulations under sub-paragraph (9) may make provision subject to such exemptions and exceptions as OFCOM consider appropriate.

I415I8906 Recovery of penalties

1 In England and Wales, a penalty is recoverable—
a if the county court so orders, as if it were payable under an order of that court;
b if the High Court so orders, as if it were payable under an order of that court.
2 In Scotland, a penalty may be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution issued by the sheriff court of any sheriffdom in Scotland.
3 In Northern Ireland, a penalty is recoverable—
a if a county court so orders, as if it were payable under an order of that court;
b if the High Court so orders, as if it were payable under an order of that court.

SCHEDULE 14 

Amendments consequential on offences in Part 10 of this Act

Section 191

PART 1 Amendments consequential on offences in sections 179, 181 and 183

I284I5041 Football Spectators Act 1989

In Schedule 1 to the Football Spectators Act 1989 (football banning orders: relevant offences), after paragraph 1(z) insert—

I706I7542 Sexual Offences Act 2003

In Schedule 5 to the Sexual Offences Act 2003, in the list of offences for England and Wales, after paragraph 63C insert—
I549I9083In Schedule 5 to the Sexual Offences Act 2003, in the list of offences for Northern Ireland, after paragraph 171H insert—

I436I7374 Regulatory Enforcement and Sanctions Act 2008

In Schedule 3 to the Regulatory Enforcement and Sanctions Act 2008 (relevant enactments for the purposes of relevant functions to which Parts 1 and 2 of that Act apply), at the appropriate place insert—
.

I343I485 Elections Act 2022

In Schedule 9 to the Elections Act 2022 (offences for purposes of Part 5), in Part 2, after paragraph 52 insert—

PART 2 Amendments consequential on offence in section 184

I185I3336 Children and Young Persons Act 1933

In Schedule 1 to the Children and Young Persons Act 1933 (offences against children and young persons with respect to which special provisions of Act apply), after the entry relating to the Suicide Act 1961 insert—

I229I3307 Visiting Forces Act 1952

1 The Schedule to the Visiting Forces Act 1952 (offences referred to in section 3) is amended as follows.
2 In paragraph 1(b), after paragraph (xv) insert—
.
3 In paragraph 2(b), after paragraph (iv) insert—
.

I744I7488 Children and Young Persons Act (Northern Ireland) 1968 (c. 34 (N.I.))

In Schedule 1 to the Children and Young Persons Act (Northern Ireland) 1968 (offences against children and young persons with respect to which special provisions of Act apply), after the entry relating to the Criminal Justice Act (Northern Ireland) 1966 insert—

I238I5509 Criminal Attempts Act 1981

In section 1 of the Criminal Attempts Act 1981 (attempting to commit an offence), in subsection (4), after paragraph (c) insert—

I473I78610 Criminal Attempts and Conspiracy (Northern Ireland) Order 1983 (S.I. 1983/1120 (N.I. 13))

In Article 3 of the Criminal Attempts and Conspiracy (Northern Ireland) Order 1983 (attempting to commit an offence), in paragraph (4), after sub-paragraph (c) insert—
.

I61I111 Armed Forces Act 2006

In Schedule 2 to the Armed Forces Act 2006 (“Schedule 2 offences”), in paragraph 12, at the end insert—

I81I83312 Serious Crime Act 2007

1 The Serious Crime Act 2007 is amended as follows.
2 In section 51A (exceptions to section 44 for encouraging or assisting suicide)—
a the existing text becomes subsection (1);
b after that subsection insert—
;
c in the heading, at the end insert “or serious self-harm”.
3 In Part 1 of Schedule 3 (listed offences: England and Wales and Northern Ireland), after paragraph 24A insert—

PART 3 Amendments consequential on offences in sections 187 and 188

I661I29113 Children and Young Persons Act 1933

In Schedule 1 to the Children and Young Persons Act 1933 (offences against children and young persons with respect to which special provisions of Act apply), in the first entry relating to the Sexual Offences Act 2003, after “66” insert “, 66A, 66B”.

I648I73014 Police and Criminal Evidence Act 1984

In section 65A of the Police and Criminal Evidence Act 1984 (“qualifying offences” for the purposes of Part 5 of that Act), in subsection (2)(p) after “61 to” insert “66A, 66B(2) and (3),”.

I466I5315 Sexual Offences (Amendment) Act 1992

In section 6 of the Sexual Offences (Amendment) Act 1992 (interpretation), after subsection (2A) insert—

I43I88316 Sexual Offences Act 2003

1 The Sexual Offences Act 2003 is amended as follows.
2 In section 78 (meaning of “sexual”), after “15A” insert “, 66B to 66D”.
3 In section 136A(3A) (specified child sex offences), in paragraph (c), after “66” insert “, 66A, 66B(2) and (3)”.
4 In Schedule 3 (sexual offences for purposes of Part 2), after paragraph 33 insert—

I420I85817 Criminal Justice Act 2003

1 The Criminal Justice Act 2003 is amended as follows.
2 In Part 2 of Schedule 15 (specified sexual offences for purposes of section 325), after paragraph 149 insert—
3 In Schedule 34A (child sex offences for purposes of section 327A), in paragraph 10—
a after “66” insert “, 66A, 66B(2) or (3)”, and
b after “exposure” insert “, sending etc photograph or film of genitals, sharing intimate photograph or film with intent to cause alarm, distress or humiliation or for purpose of obtaining sexual gratification”.

I160I27518 Anti-social Behaviour, Crime and Policing Act 2014

In section 116 of the Anti-social Behaviour, Crime and Policing Act 2014 (information about guests at hotels believed to be used for child sexual exploitation), in subsection (8)(c), in the entry that relates to exposure and voyeurism offences in the Sexual Offences Act 2003—
a after “66” insert “, 66A, 66B(2) and (3)”, and
b after “exposure” insert “, sending etc photograph or film of genitals, sharing intimate photograph or film with intent to cause alarm, distress or humiliation or for purpose of obtaining sexual gratification”.

I524I7119 Modern Slavery Act 2015

In Schedule 4 to the Modern Slavery Act 2015 (offences to which defence in section 45 does not apply), in paragraph 33 (offences under Sexual Offences Act 2003), after the entry for section 66 insert—
.

I108I35020 Sentencing Act 2020

In Part 2 of Schedule 18 to the Sentencing Act 2020 (specified sexual offences for purposes of section 306), in paragraph 38 (offences under Sexual Offences Act 2003), after sub-paragraph (ax) insert—
.

I491I20021 Elections Act 2022

In Schedule 9 to the Elections Act 2022 (offences for purposes of Part 5), after paragraph 47(f) insert—

PART 4 Amendments consequential on section 190

I518I47122 Criminal Justice and Courts Act 2015

1 The Criminal Justice and Courts Act 2015 is amended as follows.
2 In section 96 (extent), in subsection (6), omit paragraphs (c) and (g).
3 Omit Schedule 8 (disclosing or threatening to disclose private sexual photographs or films: providers of information society services).

I19I12023 Domestic Abuse Act 2021

1 The Domestic Abuse Act 2021 is amended as follows.
2 Omit section 69 (threats to disclose private sexual photographs and films with intent to cause distress) and the italic heading before it.
3 In section 85 (power to make consequential provision), in subsection (1)(b), omit “69,”.
4 In section 86 (power to make transitional or saving provision), in subsection (1)(b), omit “69,”.

I577I12324 Overseas Operations (Service Personnel and Veterans) Act 2021

In Part 1 of Schedule 1 to the Overseas Operations (Service Personnel and Veterans) Act 2021 (“excluded offences” for the purposes of section 6 of that Act), omit paragraph 11.

I557I47525 Criminal Justice (Electronic Commerce) (Amendment) (EU Exit) Regulations 2021 (S.I. 2021/835)

In the Criminal Justice (Electronic Commerce) (Amendment) (EU Exit) Regulations 2021, omit regulation 8 (amendment of the Criminal Justice and Courts Act 2015).

SCHEDULE 15 

Liability of parent entities etc

Section 197

I393I4901 Joint provisional notices of contravention

1 This paragraph applies if—
a OFCOM are satisfied that there are grounds to give an entity (“E”) a provisional notice of contravention relating to a regulated service, and
b E is the provider of that service.
2 If there is an entity which is a parent undertaking in relation to E, the provisional notice of contravention may be given—
a to E alone, or
b jointly to E and to an entity which is a parent undertaking in relation to E.
3 If there is an entity which is a subsidiary undertaking in relation to E, the provisional notice of contravention may be given—
a to E alone, or
b jointly to E and to an entity which is a subsidiary undertaking in relation to E.
4 If E is a subsidiary undertaking and there is an entity which is a fellow subsidiary undertaking in relation to E, the provisional notice of contravention may be given—
a to E alone, or
b jointly to E and to an entity which is a fellow subsidiary undertaking in relation to E.
5 If an individual or individuals control E (see paragraph 5(4)), the provisional notice of contravention may be given—
a to E alone, or
b jointly to E and to the individual or individuals who control E.
6 If a provisional notice of contravention is given jointly as mentioned in sub-paragraph (2)(b), (3)(b), (4)(b) or (5)(b), section 130(8) is to be read, in its application for the purposes of this paragraph, as if it included a reference to representations about whether joint and several liability would be appropriate.

I616I7522 Liability of parent entities for failures by subsidiary entities

1 This paragraph applies if—
a OFCOM are satisfied that there are grounds to give an entity (“E”) a relevant decision or notice relating to a regulated service,
b E is the provider of that service, and
c there is an entity which is a parent undertaking in relation to E (a “parent entity”).
2 The relevant decision or notice may be given—
a to E alone, or
b (subject to sub-paragraph (4)) jointly to E and to a parent entity.
3 But before giving a penalty notice to a parent entity, or giving a confirmation decision to a parent entity which was not previously given a provisional notice of contravention relating to the same matter, OFCOM must give that entity an opportunity to make representations to OFCOM about—
a the matters contained in the decision or notice, and
b whether joint and several liability would be appropriate.
4 OFCOM may not give a relevant decision or notice to a parent entity (“P”) if—
a P meets the condition in section 1162(2)(a) of the Companies Act in relation to E, and
b P makes representations (under section 130(8) as applied by paragraph 1(6), or under sub-paragraph (3)) which satisfy OFCOM that P does not meet any condition in section 1162(2)(b), (c) or (d) or (4) of the Companies Act in relation to E.
5 If a relevant decision or notice is given to entities jointly as mentioned in sub-paragraph (2)(b), those entities are jointly and severally liable to comply with the requirements, or (as the case may be) pay the penalty, imposed by the decision or notice.
6 See also paragraph 5 of Schedule 13 (maximum amount of penalties: group of entities).

I261I6333 Liability of subsidiary entities for failures by parent entities

1 This paragraph applies if—
a OFCOM are satisfied that there are grounds to give an entity (“E”) a relevant decision or notice relating to a regulated service,
b E is the provider of that service, and
c there is an entity which is a subsidiary undertaking in relation to E (a “subsidiary entity”).
2 The relevant decision or notice may be given—
a to E alone, or
b jointly to E and to a subsidiary entity.
3 But—
a before giving a penalty notice to a subsidiary entity, or giving a confirmation decision to a subsidiary entity which was not previously given a provisional notice of contravention relating to the same matter, OFCOM must give that entity an opportunity to make representations to OFCOM about—
i the matters contained in the decision or notice, and
ii whether joint and several liability would be appropriate; and
b a relevant decision or notice may be given to a subsidiary entity only if that entity’s acts or omissions contributed to the failure in respect of which the decision or notice is given.
4 If a relevant decision or notice is given to entities jointly as mentioned in sub-paragraph (2)(b), those entities are jointly and severally liable to comply with the requirements, or (as the case may be) pay the penalty, imposed by the decision or notice.
5 See also paragraph 5 of Schedule 13 (maximum amount of penalties: group of entities).

I861I4934 Liability of fellow subsidiary entities for failures by subsidiary entities

1 This paragraph applies if—
a OFCOM are satisfied that there are grounds to give an entity (“E”) a relevant decision or notice relating to a regulated service,
b E is the provider of that service,
c E is a subsidiary undertaking, and
d there is an entity which is a fellow subsidiary undertaking in relation to E (a “fellow subsidiary entity”).
2 The relevant decision or notice may be given—
a to E alone, or
b jointly to E and to a fellow subsidiary entity.
3 But—
a before giving a penalty notice to a fellow subsidiary entity, or giving a confirmation decision to a fellow subsidiary entity which was not previously given a provisional notice of contravention relating to the same matter, OFCOM must give that entity an opportunity to make representations to OFCOM about—
i the matters contained in the decision or notice, and
ii whether joint and several liability would be appropriate; and
b a relevant decision or notice may be given to a fellow subsidiary entity only if that entity’s acts or omissions contributed to the failure in respect of which the decision or notice is given.
4 If a relevant decision or notice is given to entities jointly as mentioned in sub-paragraph (2)(b), those entities are jointly and severally liable to comply with the requirements, or (as the case may be) pay the penalty, imposed by the decision or notice.
5 See also paragraph 5 of Schedule 13 (maximum amount of penalties: group of entities).

I719I6235 Liability of controlling individuals for failures by entities

1 This paragraph applies if—
a OFCOM are satisfied that there are grounds to give an entity (“E”) a relevant decision or notice relating to a regulated service,
b E is the provider of that service, and
c an individual or individuals control E.
2 The relevant decision or notice may be given—
a to E alone, or
b (subject to sub-paragraph (5)) jointly to E and to the individual or individuals who control E.
3 But before giving a penalty notice to an individual, or giving a confirmation decision to an individual who was not previously given a provisional notice of contravention relating to the same matter, OFCOM must give that individual an opportunity to make representations to OFCOM about—
a the matters contained in the decision or notice, and
b whether joint and several liability would be appropriate.
4 An individual or individuals are to be taken to “control” E if that individual or those individuals would, if they were an undertaking, be a parent undertaking in relation to E within the meaning of section 1162 of the Companies Act by reason of meeting the condition in subsection (2)(a), (b), (c) or (d) or (4)(a) of that section.
5 OFCOM may not give a relevant decision or notice to an individual or individuals (“P”) if—
a the condition by reason of which P controls E is the condition in section 1162(2)(a) of the Companies Act, and
b P makes representations (under section 130(8) as applied by paragraph 1(6), or under sub-paragraph (3)) which satisfy OFCOM that P does not control E by reason of any condition in section 1162(2)(b), (c) or (d) or (4) of the Companies Act.
6 If a relevant decision or notice is given jointly to E and to an individual or individuals as mentioned in sub-paragraph (2)(b), that entity and that individual or those individuals are jointly and severally liable to comply with the requirements, or (as the case may be) pay the penalty, imposed by the decision or notice.

I509I3866 OFCOM’s guidance

OFCOM’s guidance under section 151 must include information about the factors that OFCOM would consider it appropriate to take into account when considering whether to give a decision or notice jointly as mentioned in this Schedule.

Interpretation

I852I137In this Schedule—
  • “the Companies Act” means the Companies Act 2006;
  • “fellow subsidiary undertaking” has the meaning given by section 1161(4) of the Companies Act;
  • “parent undertaking” and “subsidiary undertaking” are to be read in accordance with section 1162 of the Companies Act;
  • “penalty notice” means a penalty notice under section 139, 140(5) or 141(6);
  • “relevant decision or notice” means—
    1. a confirmation decision that includes requirements of a kind described in section 133(1) or imposes a penalty as mentioned in section 137 (or both), or
    2. a penalty notice.
I476I2988In its application for the purposes of this Schedule, paragraph 4 of Schedule 7 to the Companies Act is to be read as if the reference to operating and financial policies were to policies relating to compliance with the regulatory requirements imposed by this Act.
I305I1949For the purposes of this Schedule, sections 1161(4) and 1162 of, and Schedule 7 to, the Companies Act—
a are to apply in relation to an entity which is not an undertaking (as defined in section 1161(1) of that Act) as they apply in relation to an undertaking, and
b are to be read with any necessary modifications if applied to an entity formed under the law of a country outside the United Kingdom.

F25SCHEDULE 16 

Amendments of Part 4B of the Communications Act

Section 209

F251. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
F252. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
F253. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
F254. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
F255. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
F256. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
F257. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

SCHEDULE 17 

Video-sharing platform services: transitional provision etc

Section 211

PART 1 Interpretation

I354I631
1 In this Schedule, “pre-existing Part 4B service” means—
a an internet service which—
i is a video-sharing platform service by reason of the conditions in section 368S(1) and (2) of the Communications Act being met in relation to the service as a whole, and
ii was being provided immediately before this Schedule comes into force; or
b a dissociable section of an internet service, where that dissociable section—
i is a video-sharing platform service by reason of the conditions in section 368S(1)(a) and (2) of the Communications Act being met in relation to that dissociable section, and
ii was being provided immediately before this Schedule comes into force.
2 In sub-paragraph (1), any reference to a service provided before this Schedule comes into force includes a reference to a service provided in breach of the requirement in section 368V of the Communications Act.
I97I1872In this Schedule—
  • “the relevant day”, in relation to a pre-existing Part 4B service or to a service which includes a pre-existing Part 4B service, means—
    1. the date when section 210 comes into force (repeal of Part 4B of the Communications Act), or
    2. if the pre-existing Part 4B service ceases to be a video-sharing platform service before the date mentioned in paragraph (a), the date when that service ceases to be a video-sharing platform service;
  • “safety duties” means the duties mentioned in section 7(2), (4) and (5), except the duties set out in—
    1. section 9 (illegal content risk assessments),
    2. section 11 (children’s risk assessments),
    3. section 14 (assessments related to the adult user empowerment duty set out in section 15(2)), and
    4. section 23(2), (9) and (10) (records of assessments);
  • “the transitional period”, in relation to a pre-existing Part 4B service or to a service which includes a pre-existing Part 4B service, means the period—
    1. beginning with the date when this Schedule comes into force, and
    2. ending with the relevant day;
  • “video-sharing platform service” has the same meaning as in Part 4B of the Communications Act (see section 368S of that Act).

PART 2 During the transitional period

I263I8323 Pre-existing Part 4B services which are regulated user-to-user services

1 This paragraph applies in relation to a pre-existing Part 4B service which—
a is within the definition in paragraph (a) of paragraph 1(1), and
b is also a regulated user-to-user service.
2 Both this Act and Part 4B of the Communications Act apply in relation to the pre-existing Part 4B service during the transitional period.
3 But that is subject to—
a sub-paragraph (4),
b sub-paragraph (5), and
c paragraph 4.
4 The following duties and requirements under this Act do not apply during the transitional period in relation to the pre-existing Part 4B service—
a the safety duties;
b the duties set out in section 38 (fraudulent advertising);
c the duties set out in section 64 (user identity verification);
d the requirements under section 66(1) and (2) (reporting CSEA content to the NCA);
e the duties set out in sections 71 and 72 (terms of service);
f the duties set out in section 75 (deceased child users);
g the duty on OFCOM to give a notice under section 77(1) requiring information in a transparency report;
h the requirements to produce transparency reports under section 77(3) and (4).
5 OFCOM’s powers under Schedule 12 to this Act (powers of entry, inspection and audit) do not apply during the transitional period in relation to the pre-existing Part 4B service.
6 In sub-paragraph (2) the reference to this Act does not include a reference to Part 6 (fees); for the application of Part 6, see Part 3 of this Schedule.

I443I3214 Regulated user-to-user services that include regulated provider pornographic content

1 The duties set out in section 81 of this Act do not apply during the transitional period in relation to any regulated provider pornographic content published or displayed on a pre-existing Part 4B service.
2 In the case of a regulated user-to-user service which includes a pre-existing Part 4B service within the definition in paragraph (b) of paragraph 1(1), nothing in sub-paragraph (1) is to be taken to prevent the duties set out in section 81 from applying during the transitional period in relation to any regulated provider pornographic content published or displayed on any other part of the service.
3 In this paragraph “regulated provider pornographic content” and “published or displayed” have the same meaning as in Part 5 of this Act (see section 79).

I174I4955 Pre-existing Part 4B services which form part of regulated user-to-user services

1 During the transitional period, Part 4B of the Communications Act applies in relation to a pre-existing Part 4B service within the definition in paragraph (b) of paragraph 1(1).
2 Sub-paragraph (3), and paragraphs 6 to 8, apply in relation to a regulated user-to-user service which includes a pre-existing Part 4B service within the definition in paragraph (b) of paragraph 1(1).
3 During the transitional period, this Act applies in relation to the regulated user-to-user service with the modifications set out in paragraph 6, 7, or 8 (whichever applies).
4 In paragraphs 6 to 8 the dissociable section of the service which is the pre-existing Part 4B service is referred to as “the Part 4B part”.
5 In sub-paragraph (3) the reference to this Act does not include a reference to Part 6 (fees); for the application of Part 6, see Part 3 of this Schedule.

I576I2196 Regulated user-to-user services with a Part 4B part and another user-to-user part

1 This paragraph applies in relation to a regulated user-to-user service described in paragraph 5(2) if the service would still be a regulated user-to-user service even if the Part 4B part were to be assumed not to be part of the service.
2 During the transitional period—
a any duty or requirement mentioned in paragraph 3(4) which applies in relation to the regulated service is to be treated as applying only in relation to the rest of the service;
b the powers mentioned in paragraph 3(5) are to be treated as applying only in relation to the rest of the service.
3 In this paragraph “the rest of the service” means any user-to-user part of the regulated service other than the Part 4B part.

I843I5017 Regulated user-to-user services with a Part 4B part and a search engine

1 This paragraph applies in relation to a regulated user-to-user service described in paragraph 5(2) if the service would be a regulated search service if the Part 4B part were to be assumed not to be part of the service.
2 During the transitional period, no duty or requirement mentioned in paragraph 3(4) applies in relation to the Part 4B part of the service (but that is not to be taken to prevent any other duty or requirement under this Act from applying in relation to the search engine of the service during the transitional period).
3 During the transitional period, the powers mentioned in paragraph 3(5) are to be treated as applying only in relation to the search engine of the service.

I503I7358 Regulated user-to-user services with a Part 4B part but no other user-to-user part or search engine

1 This paragraph applies in relation to a regulated user-to-user service described in paragraph 5(2) if the service does not fall within paragraph 6 or 7.
2 The duties, requirements and powers mentioned in paragraph 3(4) and (5) do not apply in relation to the regulated service during the transitional period.

I544I739 Assessments of pre-existing Part 4B services or of services which include a pre-existing Part 4B service

See Part 3 of Schedule 3 for provision about—
a the timing of certain assessments of pre-existing Part 4B services, and
b modifications of Parts 1 and 2 of that Schedule in connection with certain assessments of services which include a pre-existing Part 4B service within the definition in paragraph (b) of paragraph 1(1).

I885I67910 Operation of section 368U of the Communications Act

During the transitional period, section 368U of the Communications Act has effect as a requirement to establish and maintain an up to date list of persons providing a video-sharing platform service to which Part 4B applies.

Video-sharing platform services which start up, or start up again, during the transitional period

I837I18611Part 4B of the Communications Act does not apply in relation to a video-sharing platform service which is first provided on or after the date when this Schedule comes into force.
I208I80712
1 Sub-paragraph (2) applies in relation to a pre-existing Part 4B service if—
a the service ceases to be a video-sharing platform service on a date within the transitional period, and
b the service begins again to be a video-sharing platform service on some later date within the transitional period.
2 Part 4B of the Communications Act does not start applying again in relation to the service on the date mentioned in sub-paragraph (1)(b).
I12I80913Paragraphs 11 and 12 apply regardless of whether, or when, a provider of a service has notified the appropriate regulatory authority in accordance with section 368V of the Communications Act.

PART 3 Application of Part 6 of this Act: fees

Introduction

I239I66214This Part makes provision about the application of the following provisions of this Act in relation to a person who is the provider of a relevant regulated service—
a section 83 (duty to notify OFCOM in relation to the charging of fees);
b section 84 (payment of fees);
c Schedule 10 (additional fees).
I482I72015In this Part “relevant regulated service” means—
a a regulated user-to-user service which is a pre-existing Part 4B service within the definition in paragraph (a) of paragraph 1(1), or
b a regulated user-to-user service which includes a pre-existing Part 4B service within the definition in paragraph (b) of paragraph 1(1).

Application of section 83

I395I43716
1 Sub-paragraph (2) applies in relation to a person who is the provider of a relevant regulated service, whether or not the person is the provider of any other regulated service.
2 Section 83, which makes provision about the notification of OFCOM in relation to a charging year, applies to the provider in relation to every charging year, regardless of whether any part, or all, of a charging year falls within the transitional period.
I827I24717
1 This paragraph applies in relation to a person who is the provider of a relevant regulated service, unless the person is an exempt provider (see paragraph 24).
2 Sub-paragraph (3) applies in relation to the provider if—
a the provider is required by section 83 to give details to OFCOM of the provider’s qualifying worldwide revenue for the qualifying period that relates to a charging year,
b the provider gives such details in relation to that charging year at a time within the transitional period, and
c no regulations under section 240(1) have been made before that time specifying that section 210 is to come into force on or before the first day of that charging year.
3 The provider’s notification under section 83 about qualifying worldwide revenue must include a breakdown indicating the amounts which are wholly referable to a relevant Part 4B service (if any).

Application of section 84: transitional charging year

I172I48118If a person who is the provider of a relevant regulated service is an exempt provider, section 84 and Schedule 10 do not apply in relation to the provider in respect of a transitional charging year (see paragraph 23).
I692I15619
1 If a person who is the provider of a relevant regulated service is not an exempt provider, section 84 and Schedule 10 apply in relation to the provider in respect of a transitional charging year.
2 But sub-paragraphs (3) and (4) apply in relation to the provider in respect of a transitional charging year if the provider’s notification under section 83 in relation to that charging year has included details of amounts wholly referable to a relevant Part 4B service (as mentioned in paragraph 17(3)).
3 For the purposes of the computation of the provider’s fee under section 84 in respect of the transitional charging year, references in that section to the provider’s qualifying worldwide revenue are to be taken to be references to the provider’s non-Part 4B qualifying worldwide revenue.
4 OFCOM may not require the provider to pay a fee under section 84 in respect of the transitional charging year if the provider’s non-Part 4B qualifying worldwide revenue for the qualifying period that relates to that charging year is less than the threshold figure that has effect for that charging year.
5 The amount of a provider’s “non-Part 4B qualifying worldwide revenue” is the amount that would be the provider’s qualifying worldwide revenue (see section 85) if all amounts wholly referable to a relevant Part 4B service were left out of account.

I270I31820 Application of section 84: non-transitional charging year

1 Sub-paragraph (2) applies in relation to a person who is the provider of a relevant regulated service, whether or not the person is the provider of any other regulated service.
2 Section 84 and Schedule 10 apply without modification in relation to the provider in respect of a non-transitional charging year (even if the notification date in relation to such a charging year fell within the transitional period).

I23I41921 Amounts wholly referable to relevant Part 4B service

1 For the purposes of this Part, OFCOM may produce a statement giving information about the circumstances in which amounts do, or do not, count as being wholly referable to a relevant Part 4B service.
2 If OFCOM produce such a statement, they must publish it (and any revised or replacement statement).

Interpretation of this Part

I854I43322In this Part—
  • “non-transitional charging year” means a charging year which is not a transitional charging year;
  • “notification date”, in relation to a charging year, means the latest date by which a notification under section 83 relating to that charging year is required to be given (see section 83(5));
  • “relevant Part 4B service” means—
    1. a regulated user-to-user service described in paragraph 15(a), or
    2. a pre-existing Part 4B service included in a regulated user-to-user service described in paragraph 15(b).
I615I90323For the purposes of this Part a charging year is a “transitional charging year” if—
a the notification date in relation to that charging year fell within the transitional period, and
b no regulations under section 240(1) were made before the notification date specifying that section 210 was to come into force on or before the first day of that charging year.
I456I68624
1 In this Part “exempt provider” means a person within sub-paragraph (2) or (3).
2 A person is within this sub-paragraph if the person is the provider of only one regulated service, and that service is—
a a regulated user-to-user service which is a pre-existing Part 4B service within the definition in paragraph (a) of paragraph 1(1), or
b a regulated user-to-user service which—
i includes a pre-existing Part 4B service within the definition in paragraph (b) of paragraph 1(1), and
ii does not fall within paragraph 6 or 7.
3 A person is within this sub-paragraph if the person is the provider of more than one regulated service, if each regulated service is of a kind described in sub-paragraph (2).
I315I15125In this Part the following terms have the same meaning as in Part 6 of this Act—
  • “charging year”;
  • “qualifying period”;
  • “threshold figure”.

PART 4 After the end of the transitional period

Interpretation of this Part

I610I29726In this Part of this Schedule—
a “the repeal time” means the time when section 210 of this Act comes into force (repeal of Part 4B of the Communications Act);
b (except in paragraph (a)) references to sections are to sections of the Communications Act.
I691I73627For the purposes of this Part an investigation relating to a person begins when OFCOM notify the person to that effect.

I308I19928 OFCOM as appropriate regulatory authority

The repeal of section 368T does not affect OFCOM’s powers to act after the repeal time as the appropriate regulatory authority under Part 4B of the Communications Act as it has effect by virtue of this Part of this Schedule.

I523I90429 Duties of service providers to co-operate with investigations

The repeal of section 368Y(3)(c) (duty to co-operate) does not affect the application of that provision after the repeal time in relation to—
a an investigation as mentioned in section 368Z10(3)(f) begun before that time, or
b any demand for information for the purpose mentioned in section 368Z10(3)(i) resulting from such an investigation.

I240I5930 Demands for information, and enforcement of such demands

1 The repeal of sections 368Y(3)(b) and 368Z10 (demands for information) does not affect the application of those provisions after the repeal time in a case in which—
a OFCOM require information after the repeal time for the purposes of an investigation as mentioned in section 368Z10(3)(f), and
b the investigation was begun before that time.
2 The repeal of sections 368Z2, 368Z4 and 368Z10 does not affect the application of those sections after the repeal time in connection with—
a a failure to comply with a requirement under section 368Z10 imposed before that time, or
b a failure to comply with a requirement imposed after that time under section 368Z10 as it has effect in a case mentioned in sub-paragraph (1).
3 In this paragraph—
a “the purposes of an investigation” include the purposes of any enforcement action or proceedings resulting from an investigation;
b references to sections 368Z2 and 368Z4 include references to those sections as modified by section 368Z10.

I212I57231 Enforcement notifications, financial penalties etc

1 The repeal of sections 368W and 368Z4 (enforcement of section 368V) does not affect the application of those sections after the repeal time in a case in which OFCOM—
a made a determination as mentioned in section 368W(1) before that time, or
b began, before that time, to investigate whether they may have grounds to make such a determination.
2 The repeal of sections 368Z2 and 368Z4 (enforcement of sections 368Y and 368Z1(6) and (7)) does not affect the application of those sections after the repeal time in a case in which OFCOM—
a made a determination as mentioned in section 368Z2(1) before that time, or
b began, before that time, to investigate whether they may have grounds to make such a determination.
3 The repeal of sections 368Z3 and 368Z4 (enforcement of sections 368Z1(1) and (2)) does not affect the application of those sections after the repeal time in a case in which OFCOM—
a made a determination as mentioned in section 368Z3(1) before that time, or
b began, before that time, to investigate whether they may have grounds to make such a determination.

I259I89132 Suspension or restriction of service for contraventions or failures

1 The repeal of section 368Z5 (suspension or restriction of service for contraventions or failures) does not affect the application of that section after the repeal time in a case in which OFCOM—
a made a determination as mentioned in section 368W(1), 368Z2(1) or 368Z3(1) before that time, or
b made such a determination after that time following an investigation begun before that time.
2 The repeal of section 368Z5 does not affect the application of that section (as modified by section 368Z10) after the repeal time in a case in which—
a OFCOM are satisfied that a person failed to comply with a requirement under section 368Z10 imposed before that time, or
b OFCOM are satisfied that a person failed to comply with a requirement imposed after that time under section 368Z10 as it has effect in a case mentioned in paragraph 30(1).
3 The repeal of sections 368Z7 (directions under sections 368Z5 and 368Z6) and 368Z8 (offence relating to such directions) does not affect the application of those sections after the repeal time in connection with a direction given under section 368Z5 as it has effect by virtue of this paragraph.

Footnotes

  1. I1
    Sch. 14 para. 11 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  2. I2
    S. 183 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  3. I3
    Sch. 12 para. 8 not in force at Royal Assent, see s. 240(1)
  4. I4
    S. 37 not in force at Royal Assent, see s. 240(1)
  5. I5
    S. 154 in force at 10.1.2024 in so far as not already in force by S.I. 2023/1420, reg. 2(z18)
  6. I6
    Sch. 3 para. 25 not in force at Royal Assent, see s. 240(1)
  7. I7
    Sch. 3 para. 2 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  8. I8
    Sch. 10 para. 3 not in force at Royal Assent, see s. 240(1)
  9. F1
    Words in Sch. 9 para. 6 heading inserted (23.8.2024) by Media Act 2024 (c. 15), s. 55(3)(d), Sch. 7 para. 5(3)(c); S.I. 2024/858, reg. 2(1)(z1)
  10. I9
    Sch. 1 para. 29 in force at Royal Assent, see s. 240(4)(a)
  11. I10
    S. 77 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  12. I11
    S. 35 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(k)
  13. I12
    Sch. 17 para. 13 not in force at Royal Assent, see s. 240(1)
  14. I13
    Sch. 15 para. 7 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z24)
  15. I14
    S. 53(2) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(p)
  16. I15
    Sch. 6 para. 5 in force at Royal Assent, see s. 240(4)(h)
  17. I16
    Sch. 12 para. 16 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z10)
  18. I17
    Sch. 12 para. 11 not in force at Royal Assent, see s. 240(1)
  19. I18
    S. 173 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z22)
  20. I19
    Sch. 14 para. 23 not in force at Royal Assent, see s. 240(1)
  21. I20
    Sch. 12 para. 15 not in force at Royal Assent, see s. 240(1)
  22. I21
    Sch. 1 para. 9 in force at Royal Assent, see s. 240(4)(a)
  23. I22
    S. 135 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)
  24. I23
    Sch. 17 para. 21 not in force at Royal Assent, see s. 240(1)
  25. I24
    S. 76 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(w)
  26. I25
    Sch. 7 para. 33 in force at Royal Assent, see s. 240(4)(h)
  27. I26
    S. 182 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  28. I27
    Sch. 8 para. 16 not in force at Royal Assent, see s. 240(1)
  29. I28
    Sch. 7 para. 22 in force at Royal Assent, see s. 240(4)(h)
  30. I29
    S. 111 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z11)
  31. I30
    S. 179 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  32. I31
    S. 11 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(d)
  33. I32
    S. 17 not in force at Royal Assent, see s. 240(1)
  34. I33
    S. 102 in force at 1.4.2024 by S.I. 2023/1420, reg. 3(b)
  35. I34
    S. 73 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(v)
  36. I35
    Sch. 8 para. 19 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  37. I36
    Sch. 1 para. 40 in force at Royal Assent, see s. 240(4)(a)
  38. I37
    Sch. 13 para. 3 not in force at Royal Assent, see s. 240(1)
  39. I38
    Sch. 1 para. 38 in force at Royal Assent, see s. 240(4)(a)
  40. I39
    S. 150 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)
  41. I40
    S. 50 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(n)
  42. I41
    S. 19 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(e)
  43. I42
    S. 146 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)
  44. I43
    Sch. 14 para. 16 not in force at Royal Assent, see s. 240(1)
  45. I44
    Sch. 3 para. 3 not in force at Royal Assent, see s. 240(1)
  46. I45
    Sch. 1 para. 4 in force at Royal Assent, see s. 240(4)(a)
  47. I46
    Sch. 1 para. 41 in force at Royal Assent, see s. 240(4)(a)
  48. I47
    Sch. 8 para. 22 not in force at Royal Assent, see s. 240(1)
  49. I48
    Sch. 14 para. 5 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  50. I49
    Sch. 8 para. 11 not in force at Royal Assent, see s. 240(1)
  51. I50
    S. 68 not in force at Royal Assent, see s. 240(1)
  52. I51
    S. 8 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(b)
  53. I52
    S. 174 not in force at Royal Assent, see s. 240(1)
  54. I53
    Sch. 14 para. 15 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  55. I54
    S. 121 not in force at Royal Assent, see s. 240(1)
  56. I55
    S. 145 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)
  57. I56
    S. 32 not in force at Royal Assent, see s. 240(1)
  58. I57
    S. 82 in force at Royal Assent, see s. 240(4)(m)
  59. I58
    S. 171 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z21)
  60. I59
    Sch. 17 para. 30 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  61. I60
    Sch. 9 para. 7 not in force at Royal Assent, see s. 240(1)
  62. I61
    Sch. 14 para. 11 not in force at Royal Assent, see s. 240(1)
  63. I62
    S. 132 not in force at Royal Assent, see s. 240(1)
  64. I63
    Sch. 17 para. 1 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  65. I64
    S. 177 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z22)
  66. I65
    S. 176 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z22)
  67. I66
    Sch. 5 para. 3 in force at Royal Assent, see s. 240(4)(h)
  68. I67
    S. 36 not in force at Royal Assent, see s. 240(1)
  69. I68
    S. 236 in force at Royal Assent, see s. 240(z5)
  70. I69
    S. 200 not in force at Royal Assent, see s. 240(1)
  71. I70
    S. 13 not in force at Royal Assent, see s. 240(1)
  72. F2
    S. 225(8)(9) substituted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 125(4), 142(1)(2)(h); S.I. 2025/904, reg. 2(s)
  73. I71
    Sch. 14 para. 19 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  74. I72
    S. 134 not in force at Royal Assent, see s. 240(1)
  75. I73
    Sch. 17 para. 9 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  76. I74
    Sch. 12 para. 7 not in force at Royal Assent, see s. 240(1)
  77. I75
    Sch. 8 para. 20 not in force at Royal Assent, see s. 240(1)
  78. I76
    S. 114 not in force at Royal Assent, see s. 240(1)
  79. I77
    S. 46 in force at Royal Assent, see s. 240(4)(e)
  80. I78
    S. 221 in force at Royal Assent, see s. 240(z4)
  81. I79
    S. 15 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(e)
  82. F3
    Words in s. 114(7) omitted (30.9.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 124(8), 142(1); S.I. 2025/982, reg. 2
  83. I80
    S. 104(13)(a)(xiii) in force at 10.1.2024 for specified purposes by S.I. 2023/1420, reg. 2(z8)
  84. I81
    Sch. 14 para. 12 not in force at Royal Assent, see s. 240(1)
  85. I82
    S. 204(2)-(4) in force at 10.1.2024 for specified purposes by S.I. 2023/1420, reg. 2(z25)
  86. I83
    S. 59 in force at Royal Assent, see s. 240(4)(h)
  87. I84
    S. 136(2)(b) in force at 17.1.2025 by S.I. 2024/1333, reg. 2(1)(d)
  88. I85
    S. 25 not in force at Royal Assent, see s. 240(1)
  89. I86
    S. 127 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z16)
  90. I87
    S. 201 in force at 10.1.2024 for specified purposes by S.I. 2023/1420, reg. 2(z25)
  91. I88
    S. 161 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z18)
  92. I89
    S. 186 not in force at Royal Assent, see s. 240(1)
  93. I90
    S. 155 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z18)
  94. I91
    S. 234 in force at Royal Assent, see s. 240(z5)
  95. I92
    Sch. 7 para. 13 in force at Royal Assent, see s. 240(4)(h)
  96. I93
    Sch. 1 para. 37 in force at Royal Assent, see s. 240(4)(a)
  97. I94
    Sch. 12 para. 24 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z10)
  98. I95
    S. 94 in force at Royal Assent, see s. 240(4)(p)
  99. I96
    Sch. 7 para. 14 in force at Royal Assent, see s. 240(4)(h)
  100. I97
    Sch. 17 para. 2 not in force at Royal Assent, see s. 240(1)
  101. I98
    S. 23 not in force at Royal Assent, see s. 240(1)
  102. F4
    Words in s. 80(6) omitted (23.8.2024) by virtue of Media Act 2024 (c. 15), s. 55(3)(d), Sch. 7 para. 5(2)(a)(ii); S.I. 2024/858, reg. 2(1)(z1)
  103. I99
    S. 166 not in force at Royal Assent, see s. 240(1)
  104. I100
    Sch. 2 para. 3 in force at Royal Assent, see s. 240(4)(a)
  105. I101
    S. 127 not in force at Royal Assent, see s. 240(1)
  106. I102
    S. 124 not in force at Royal Assent, see s. 240(1)
  107. I103
    S. 138(2)(c)(d) in force at 17.1.2025 by S.I. 2024/1333, reg. 2(1)(e)
  108. I104
    S. 227 in force at Royal Assent, see s. 240(z5)
  109. I105
    S. 126 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z16)
  110. I106
    Sch. 1 para. 17 in force at Royal Assent, see s. 240(4)(a)
  111. I107
    S. 111 not in force at Royal Assent, see s. 240(1)
  112. I108
    Sch. 14 para. 20 not in force at Royal Assent, see s. 240(1)
  113. I109
    Sch. 8 para. 6 not in force at Royal Assent, see s. 240(1)
  114. I110
    S. 148 not in force at Royal Assent, see s. 240(1)
  115. I111
    S. 225 in force at Royal Assent, see s. 240(z4)
  116. I112
    Sch. 12 para. 9 not in force at Royal Assent, see s. 240(1)
  117. I113
    Sch. 7 para. 24 in force at Royal Assent, see s. 240(4)(h)
  118. I114
    S. 128 not in force at Royal Assent, see s. 240(1)
  119. I115
    S. 120 not in force at Royal Assent, see s. 240(1)
  120. I116
    S. 163 not in force at Royal Assent, see s. 240(1)
  121. I117
    S. 141 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)
  122. I118
    Sch. 13 para. 1 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)(z36)
  123. I119
    S. 214 in force at Royal Assent, see s. 240(z2)
  124. I120
    Sch. 14 para. 23 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  125. I121
    S. 49 not in force at Royal Assent, see s. 240(1)
  126. I122
    Sch. 7 para. 12 in force at Royal Assent, see s. 240(4)(h)
  127. I123
    Sch. 14 para. 24 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  128. I124
    S. 106 not in force at Royal Assent, see s. 240(1)
  129. I125
    S. 118 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z13)
  130. I126
    Sch. 8 para. 21 not in force at Royal Assent, see s. 240(1)
  131. I127
    S. 159 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z18)
  132. I128
    S. 144 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)
  133. I129
    S. 119 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z14)
  134. I130
    Sch. 8 para. 36 not in force at Royal Assent, see s. 240(1)
  135. I131
    S. 211 not in force at Royal Assent, see s. 240(1)
  136. I132
    S. 137 not in force at Royal Assent, see s. 240(1)
  137. I133
    Sch. 8 para. 37 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  138. I134
    S. 170 in force at Royal Assent, see s. 240(4)(v)
  139. I135
    Sch. 12 para. 22 not in force at Royal Assent, see s. 240(1)
  140. I136
    S. 165 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z19)
  141. I137
    S. 52(1)(2) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(o)
  142. I138
    Sch. 8 para. 4 not in force at Royal Assent, see s. 240(1)
  143. I139
    Sch. 7 para. 31 in force at Royal Assent, see s. 240(4)(h)
  144. I140
    Sch. 1 para. 51 in force at Royal Assent, see s. 240(4)(a)
  145. I141
    Sch. 12 para. 5 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z10)
  146. I142
    Sch. 1 para. 49 in force at Royal Assent, see s. 240(4)(a)
  147. I143
    S. 152 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z18)
  148. I144
    S. 76 not in force at Royal Assent, see s. 240(1)
  149. I145
    Sch. 8 para. 31 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  150. I146
    S. 104(13)(a)(xvi) in force at 17.1.2025 by S.I. 2024/1333, reg. 2(1)(c)
  151. I147
    Sch. 1 para. 23 in force at Royal Assent, see s. 240(4)(a)
  152. I148
    S. 105 not in force at Royal Assent, see s. 240(1)
  153. I149
    Sch. 8 para. 37 not in force at Royal Assent, see s. 240(1)
  154. I150
    S. 178 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z22)
  155. I151
    Sch. 17 para. 25 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  156. I152
    Sch. 1 para. 45 in force at Royal Assent, see s. 240(4)(a)
  157. I153
    Sch. 1 para. 20 in force at Royal Assent, see s. 240(4)(a)
  158. I154
    Sch. 3 para. 26 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  159. I155
    Sch. 8 para. 27 not in force at Royal Assent, see s. 240(1)
  160. I156
    Sch. 17 para. 19 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  161. I157
    S. 102 in force at 10.1.2024 for specified purposes by S.I. 2023/1420, reg. 2(z6)
  162. I158
    Sch. 1 para. 6 in force at Royal Assent, see s. 240(4)(a)
  163. I159
    S. 61 in force at Royal Assent, see s. 240(4)(h)
  164. I160
    Sch. 14 para. 18 not in force at Royal Assent, see s. 240(1)
  165. I161
    Sch. 3 para. 7 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  166. I162
    S. 5 in force at Royal Assent, see s. 240(4)(a)
  167. F5
    Word in s. 102(3)(c) omitted (30.9.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 124(4)(b)(ii), 142(1); S.I. 2025/982, reg. 2
  168. I163
    S. 98 in force at Royal Assent, see s. 240(4)(q)
  169. I164
    S. 208 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z27)
  170. F6
    Words in s. 80(6) inserted (23.8.2024) by Media Act 2024 (c. 15), s. 55(3)(d), Sch. 7 para. 5(2)(a)(i); S.I. 2024/858, reg. 2(1)(z1)
  171. I165
    S. 121 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z16)
  172. I166
    Sch. 9 para. 7 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(y)
  173. I167
    S. 158 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z18)
  174. I168
    S. 197 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z24)
  175. I169
    S. 87 not in force at Royal Assent, see s. 240(1)
  176. I170
    Sch. 7 para. 2 in force at Royal Assent, see s. 240(4)(h)
  177. I171
    S. 78 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  178. I172
    Sch. 17 para. 18 not in force at Royal Assent, see s. 240(1)
  179. I173
    Sch. 3 para. 12 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  180. F7
    Words in s. 222(6)(b) substituted (6.4.2025) by Digital Markets, Competition and Consumers Act 2024 (c. 13), s. 339(1), Sch. 21 para. 13(5) (with ss. 235, 243, 252); S.I. 2025/272, reg. 2(1)(12)
  181. I174
    Sch. 17 para. 5 not in force at Royal Assent, see s. 240(1)
  182. I175
    S. 108 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z10)
  183. I176
    Sch. 6 para. 1 in force at Royal Assent, see s. 240(4)(h)
  184. I177
    S. 29 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)
  185. I178
    Sch. 7 para. 5 in force at Royal Assent, see s. 240(4)(h)
  186. I179
    Sch. 10 para. 5 not in force at Royal Assent, see s. 240(1)
  187. I180
    Sch. 8 para. 16 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  188. I181
    Sch. 9 para. 5 not in force at Royal Assent, see s. 240(1)
  189. I182
    S. 114(2)(7) in force at 22.11.2023 by S.I. 2023/1242, reg. 2
  190. I183
    Sch. 1 para. 31 in force at Royal Assent, see s. 240(4)(a)
  191. F8
    Sch. 7 para. 30 omitted (10.12.2024) by virtue of The Online Safety Act 2023 (Priority Offences) (Amendment) Regulations 2024 (S.I. 2024/1188), regs. 1(2), 2(3)
  192. I184
    Sch. 3 para. 5 not in force at Royal Assent, see s. 240(1)
  193. I185
    Sch. 14 para. 6 not in force at Royal Assent, see s. 240(1)
  194. I186
    Sch. 17 para. 11 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  195. I187
    Sch. 17 para. 2 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  196. I188
    Sch. 11 para. 7 in force at Royal Assent, see s. 240(4)(p)
  197. I189
    S. 86 not in force at Royal Assent, see s. 240(1)
  198. I190
    S. 12 not in force at Royal Assent, see s. 240(1)
  199. I191
    S. 186 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  200. I192
    S. 167 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z20)
  201. I193
    S. 34(10) in force at 10.1.2024 for specified purposes by S.I. 2023/1420, reg. 2(j)
  202. I194
    Sch. 15 para. 9 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z24)
  203. I195
    S. 140 not in force at Royal Assent, see s. 240(1)
  204. I196
    S. 105 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z9)
  205. I197
    S. 34(1)-(9) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)
  206. I198
    S. 91 in force at Royal Assent, see s. 240(4)(n)
  207. I199
    Sch. 17 para. 28 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  208. I200
    Sch. 14 para. 21 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  209. I201
    S. 134 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)
  210. I202
    Sch. 1 para. 16 in force at Royal Assent, see s. 240(4)(a)
  211. I203
    S. 28 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)
  212. I204
    S. 133 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)
  213. I205
    S. 30 not in force at Royal Assent, see s. 240(1)
  214. I206
    Sch. 10 para. 2 not in force at Royal Assent, see s. 240(1)
  215. I207
    Sch. 8 para. 42 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  216. I208
    Sch. 17 para. 12 not in force at Royal Assent, see s. 240(1)
  217. I209
    S. 172 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z22)
  218. I210
    S. 216 not in force at Royal Assent, see s. 240(1)
  219. I211
    S. 182 not in force at Royal Assent, see s. 240(1)
  220. I212
    Sch. 17 para. 31 not in force at Royal Assent, see s. 240(1)
  221. I213
    Sch. 12 para. 9 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z10)
  222. I214
    Sch. 12 para. 12 not in force at Royal Assent, see s. 240(1)
  223. I215
    S. 38 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(l)
  224. I216
    S. 39 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(l)
  225. I217
    Sch. 7 para. 37 in force at Royal Assent, see s. 240(4)(h)
  226. I218
    Sch. 13 para. 3 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)(z36)
  227. I219
    Sch. 17 para. 6 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  228. I220
    Sch. 8 para. 39 not in force at Royal Assent, see s. 240(1)
  229. I221
    S. 22 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(h)
  230. I222
    Sch. 13 para. 2 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)(z36)
  231. I223
    S. 107 not in force at Royal Assent, see s. 240(1)
  232. I224
    S. 81 in force at 17.1.2025 by S.I. 2024/1333, reg. 2(1)(a)
  233. I225
    Sch. 1 para. 30 in force at Royal Assent, see s. 240(4)(a)
  234. I226
    S. 157 not in force at Royal Assent, see s. 240(1)
  235. I227
    Sch. 8 para. 15 not in force at Royal Assent, see s. 240(1)
  236. F9
    Words in s. 113(2) substituted (30.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 124(7)(a), 142(1); S.I. 2025/982, reg. 2
  237. I228
    Sch. 7 para. 20 in force at Royal Assent, see s. 240(4)(h)
  238. I229
    Sch. 14 para. 7 not in force at Royal Assent, see s. 240(1)
  239. I230
    S. 26 not in force at Royal Assent, see s. 240(1)
  240. I231
    Sch. 10 para. 5 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z)
  241. I232
    S. 125 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z16)
  242. I233
    Sch. 12 para. 20 not in force at Royal Assent, see s. 240(1)
  243. F10
    S. 102(5A)-(5C) inserted (30.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 124(4)(d), 142(1); S.I. 2025/982, reg. 2
  244. I234
    S. 80(4) in force at Royal Assent, see s. 240(4)(l)
  245. I235
    Sch. 1 para. 22 in force at Royal Assent, see s. 240(4)(a)
  246. I236
    Sch. 11 para. 4 in force at Royal Assent, see s. 240(4)(p)
  247. I237
    S. 213 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z30)
  248. I238
    Sch. 14 para. 9 not in force at Royal Assent, see s. 240(1)
  249. I239
    Sch. 17 para. 14 not in force at Royal Assent, see s. 240(1)
  250. I240
    Sch. 17 para. 30 not in force at Royal Assent, see s. 240(1)
  251. I241
    S. 34 not in force at Royal Assent, see s. 240(1)
  252. I242
    S. 31 not in force at Royal Assent, see s. 240(1)
  253. I243
    S. 78 not in force at Royal Assent, see s. 240(1)
  254. I244
    Sch. 1 para. 35 in force at Royal Assent, see s. 240(4)(a)
  255. I245
    Sch. 3 para. 6 not in force at Royal Assent, see s. 240(1)
  256. I246
    S. 79 in force at Royal Assent, see s. 240(4)(k)
  257. I247
    Sch. 17 para. 17 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  258. I248
    Sch. 1 para. 25 in force at Royal Assent, see s. 240(4)(a)
  259. I249
    S. 129 in force at Royal Assent, see s. 240(4)(s)
  260. I250
    S. 218 not in force at Royal Assent, see s. 240(1)
  261. I251
    S. 122 not in force at Royal Assent, see s. 240(1)
  262. I252
    Sch. 12 para. 19 not in force at Royal Assent, see s. 240(1)
  263. I253
    S. 7 not in force at Royal Assent, see s. 240(1)
  264. F11
    Words in Sch. 9 para. 6(3) inserted (23.8.2024) by Media Act 2024 (c. 15), s. 55(3)(d), Sch. 7 para. 5(3)(d)(ii); S.I. 2024/858, reg. 2(1)(z1)
  265. I254
    Sch. 8 para. 27 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  266. I255
    S. 202 in force at 10.1.2024 for specified purposes by S.I. 2023/1420, reg. 2(z25)
  267. I256
    S. 162(1)-(6) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z18)
  268. I257
    S. 195 not in force at Royal Assent, see s. 240(1)
  269. I258
    S. 118 not in force at Royal Assent, see s. 240(1)
  270. I259
    Sch. 17 para. 32 not in force at Royal Assent, see s. 240(1)
  271. I260
    Sch. 4 para. 1 in force at Royal Assent, see s. 240(4)(d)
  272. I261
    Sch. 15 para. 3 not in force at Royal Assent, see s. 240(1)
  273. I262
    S. 40 not in force at Royal Assent, see s. 240(1)
  274. I263
    Sch. 17 para. 3 not in force at Royal Assent, see s. 240(1)
  275. I264
    S. 204(1) in force at Royal Assent, see s. 240(4)(y)
  276. I265
    S. 32 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)
  277. I266
    S. 125 not in force at Royal Assent, see s. 240(1)
  278. I267
    Sch. 1 para. 18 in force at Royal Assent, see s. 240(4)(a)
  279. I268
    S. 235 in force at Royal Assent, see s. 240(z5)
  280. I269
    S. 128 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z16)
  281. I270
    Sch. 17 para. 20 not in force at Royal Assent, see s. 240(1)
  282. I271
    Sch. 3 para. 22 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  283. I272
    S. 51 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(n)
  284. I273
    S. 185 not in force at Royal Assent, see s. 240(1)
  285. I274
    Sch. 3 para. 9 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  286. I275
    Sch. 14 para. 18 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  287. I276
    Sch. 9 para. 4 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(y)
  288. I277
    S. 71 not in force at Royal Assent, see s. 240(1)
  289. I278
    Sch. 8 para. 12 not in force at Royal Assent, see s. 240(1)
  290. I279
    S. 202 not in force at Royal Assent, see s. 240(1)
  291. I280
    Sch. 12 para. 23 not in force at Royal Assent, see s. 240(1)
  292. I281
    Sch. 13 para. 5 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)(z36)
  293. I282
    Sch. 3 para. 7 not in force at Royal Assent, see s. 240(1)
  294. I283
    S. 131 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)
  295. F12
    S. 110(6A) inserted (30.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 124(6)(a), 142(1); S.I. 2025/982, reg. 2
  296. I284
    Sch. 14 para. 1 not in force at Royal Assent, see s. 240(1)
  297. I285
    S. 199 in force at 10.1.2024 for specified purposes by S.I. 2023/1420, reg. 2(z25)
  298. I286
    Sch. 3 para. 27 not in force at Royal Assent, see s. 240(1)
  299. I287
    S. 164 not in force at Royal Assent, see s. 240(1)
  300. I288
    S. 39 not in force at Royal Assent, see s. 240(1)
  301. I289
    Sch. 1 para. 48 in force at Royal Assent, see s. 240(4)(a)
  302. I290
    S. 241 in force at Royal Assent, see s. 240(z5)
  303. I291
    Sch. 14 para. 13 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  304. I292
    Sch. 4 para. 11 in force at Royal Assent, see s. 240(4)(d)
  305. I293
    Sch. 8 para. 22 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  306. I294
    S. 2 in force at Royal Assent, see s. 240(4)(a)
  307. I295
    Sch. 7 para. 21 in force at Royal Assent, see s. 240(4)(h)
  308. I296
    Sch. 8 para. 19 not in force at Royal Assent, see s. 240(1)
  309. I297
    Sch. 17 para. 26 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  310. I298
    Sch. 15 para. 8 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z24)
  311. I299
    S. 188 not in force at Royal Assent, see s. 240(1)
  312. I300
    Sch. 12 para. 18 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z10)
  313. I301
    Sch. 1 para. 39 in force at Royal Assent, see s. 240(4)(a)
  314. I302
    Sch. 3 para. 17 not in force at Royal Assent, see s. 240(1)
  315. I303
    Sch. 1 para. 1 in force at Royal Assent, see s. 240(4)(a)
  316. I304
    Sch. 8 para. 28 not in force at Royal Assent, see s. 240(1)
  317. I305
    Sch. 15 para. 9 not in force at Royal Assent, see s. 240(1)
  318. I306
    Sch. 12 para. 7 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z10)
  319. I307
    S. 14 not in force at Royal Assent, see s. 240(1)
  320. I308
    Sch. 17 para. 28 not in force at Royal Assent, see s. 240(1)
  321. I309
    Sch. 12 para. 19 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z10)
  322. I310
    Sch. 4 para. 12 in force at Royal Assent, see s. 240(4)(d)
  323. I311
    Sch. 3 para. 22 not in force at Royal Assent, see s. 240(1)
  324. I312
    Sch. 9 para. 1 not in force at Royal Assent, see s. 240(1)
  325. I313
    S. 153 not in force at Royal Assent, see s. 240(1)
  326. I314
    S. 16 not in force at Royal Assent, see s. 240(1)
  327. I315
    Sch. 17 para. 25 not in force at Royal Assent, see s. 240(1)
  328. I316
    S. 89 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z)
  329. I317
    Sch. 8 para. 41 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  330. I318
    Sch. 17 para. 20 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  331. I319
    Sch. 6 para. 9 in force at Royal Assent, see s. 240(4)(h)
  332. I320
    Sch. 12 para. 21 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z10)
  333. I321
    Sch. 17 para. 4 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  334. I322
    S. 104(1)-(12) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z8)
  335. F13
    Words in s. 59(6) substituted (6.4.2025) by Digital Markets, Competition and Consumers Act 2024 (c. 13), s. 339(1), Sch. 21 para. 13(2) (with ss. 235, 243, 252); S.I. 2025/272, reg. 2(1)(12)
  336. I323
    Sch. 8 para. 3 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  337. I324
    Sch. 3 para. 4 not in force at Royal Assent, see s. 240(1)
  338. I325
    S. 19 not in force at Royal Assent, see s. 240(1)
  339. I326
    S. 96 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z3)
  340. I327
    S. 138 not in force at Royal Assent, see s. 240(1)
  341. I328
    S. 15 not in force at Royal Assent, see s. 240(1)
  342. I329
    S. 116 in force at Royal Assent, see s. 240(4)(r)
  343. I330
    Sch. 14 para. 7 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  344. I331
    S. 83 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z)
  345. I332
    Sch. 1 para. 24 in force at Royal Assent, see s. 240(4)(a)
  346. F14
    S. 101(5A) inserted (30.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 124(3)(c), 142(1); S.I. 2025/982, reg. 2
  347. I333
    Sch. 14 para. 6 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  348. I334
    S. 138(1)(2)(a)(b)(3)(4) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)
  349. I335
    S. 25 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)
  350. F15
    Words in s. 74(3)(b) substituted (6.4.2025) by Digital Markets, Competition and Consumers Act 2024 (c. 13), s. 339(1), Sch. 21 para. 13(3)(a) (with ss. 235, 243, 252); S.I. 2025/272, reg. 2(1)(12)
  351. I336
    S. 197 not in force at Royal Assent, see s. 240(1)
  352. I337
    Sch. 10 para. 6 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z)
  353. I338
    S. 43 in force at Royal Assent, see s. 240(4)(e)
  354. I339
    S. 203 in force at 10.1.2024 for specified purposes by S.I. 2023/1420, reg. 2(z25)
  355. I340
    S. 101 not in force at Royal Assent, see s. 240(1)
  356. I341
    S. 13 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(d)
  357. I342
    S. 24 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)
  358. I343
    Sch. 14 para. 5 not in force at Royal Assent, see s. 240(1)
  359. I344
    S. 90 in force at Royal Assent, see s. 240(4)(n)
  360. I345
    S. 149 not in force at Royal Assent, see s. 240(1)
  361. I346
    S. 3 in force at Royal Assent, see s. 240(4)(a)
  362. I347
    S. 144 not in force at Royal Assent, see s. 240(1)
  363. I348
    S. 109 not in force at Royal Assent, see s. 240(1)
  364. I349
    Sch. 3 para. 6 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  365. I350
    Sch. 14 para. 20 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  366. I351
    S. 177 not in force at Royal Assent, see s. 240(1)
  367. I352
    Sch. 6 para. 8 in force at Royal Assent, see s. 240(4)(h)
  368. I353
    S. 49 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(n)
  369. F16
    Words in s. 237 inserted (30.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 124(11), 142(1); S.I. 2025/982, reg. 2
  370. I354
    Sch. 17 para. 1 not in force at Royal Assent, see s. 240(1)
  371. I355
    Sch. 1 para. 15 in force at Royal Assent, see s. 240(4)(a)
  372. I356
    S. 203 not in force at Royal Assent, see s. 240(1)
  373. I357
    S. 199 not in force at Royal Assent, see s. 240(1)
  374. I358
    S. 224 in force at Royal Assent, see s. 240(z4)
  375. I359
    Sch. 6 para. 2 in force at Royal Assent, see s. 240(4)(h)
  376. I360
    Sch. 7 para. 19 in force at Royal Assent, see s. 240(4)(h)
  377. I361
    Sch. 8 para. 33 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  378. I362
    S. 130 not in force at Royal Assent, see s. 240(1)
  379. I363
    S. 152 not in force at Royal Assent, see s. 240(1)
  380. I364
    S. 103 not in force at Royal Assent, see s. 240(1)
  381. I365
    S. 210 not in force at Royal Assent, see s. 240(1)
  382. I366
    Sch. 12 para. 22 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z10)
  383. I367
    S. 100(6)(a)(iv) in force at 10.1.2024 for specified purposes by S.I. 2023/1420, reg. 2(z5)
  384. I368
    Sch. 1 para. 27 in force at Royal Assent, see s. 240(4)(a)
  385. I369
    S. 8 not in force at Royal Assent, see s. 240(1)
  386. I370
    Sch. 1 para. 8 in force at Royal Assent, see s. 240(4)(a)
  387. I371
    Sch. 1 para. 5 in force at Royal Assent, see s. 240(4)(a)
  388. I372
    Sch. 3 para. 19 not in force at Royal Assent, see s. 240(1)
  389. I373
    S. 217 not in force at Royal Assent, see s. 240(1)
  390. I374
    Sch. 3 para. 24 not in force at Royal Assent, see s. 240(1)
  391. I375
    Sch. 6 para. 12 in force at Royal Assent, see s. 240(4)(h)
  392. I376
    Sch. 2 para. 5 in force at Royal Assent, see s. 240(4)(a)
  393. I377
    Sch. 1 para. 14 in force at Royal Assent, see s. 240(4)(a)
  394. I378
    S. 29 not in force at Royal Assent, see s. 240(1)
  395. I379
    S. 148 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)
  396. I380
    S. 137 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)
  397. I381
    Sch. 8 para. 32 not in force at Royal Assent, see s. 240(1)
  398. I382
    S. 231 in force at Royal Assent, see s. 240(z5)
  399. I383
    S. 87 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z)
  400. I384
    Sch. 4 para. 15 in force at Royal Assent, see s. 240(4)(d)
  401. I385
    Sch. 10 para. 2 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z)
  402. I386
    Sch. 15 para. 6 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z24)
  403. I387
    S. 238 in force at Royal Assent, see s. 240(z5)
  404. I388
    S. 141 not in force at Royal Assent, see s. 240(1)
  405. I389
    S. 169 in force at Royal Assent, see s. 240(4)(v)
  406. I390
    Sch. 3 para. 20 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  407. I391
    Sch. 3 para. 16 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  408. I392
    Sch. 3 para. 11 not in force at Royal Assent, see s. 240(1)
  409. I393
    Sch. 15 para. 1 not in force at Royal Assent, see s. 240(1)
  410. I394
    S. 175 not in force at Royal Assent, see s. 240(1)
  411. I395
    Sch. 17 para. 16 not in force at Royal Assent, see s. 240(1)
  412. I396
    S. 172 not in force at Royal Assent, see s. 240(1)
  413. F17
    Words in s. 110(7) substituted (30.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 124(6)(b), 142(1); S.I. 2025/982, reg. 2
  414. I397
    Sch. 8 para. 8 not in force at Royal Assent, see s. 240(1)
  415. I398
    Sch. 8 para. 13 in force at 10.1.2024 for specified purposes by S.I. 2023/1420, reg. 2(x)
  416. I399
    Sch. 12 para. 14 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z10)
  417. I400
    S. 223 in force at Royal Assent, see s. 240(z4)
  418. I401
    Sch. 7 para. 36 in force at Royal Assent, see s. 240(4)(h)
  419. I402
    S. 68 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(t)
  420. I403
    S. 205 in force at 10.1.2024 for specified purposes by S.I. 2023/1420, reg. 2(z25)
  421. I404
    S. 130 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)
  422. I405
    Sch. 13 para. 1 not in force at Royal Assent, see s. 240(1)
  423. I406
    S. 196 not in force at Royal Assent, see s. 240(1)
  424. I407
    Sch. 7 para. 4 in force at Royal Assent, see s. 240(4)(h)
  425. I408
    S. 33 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)
  426. C1
    S. 239(7) power extended (19.6.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 141(10), 142(2)(g)
  427. F18
    S. 102(4) omitted (30.9.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 124(4)(c), 142(1); S.I. 2025/982, reg. 2
  428. I409
    Sch. 4 para. 8 in force at Royal Assent, see s. 240(4)(d)
  429. I410
    Sch. 12 para. 23 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z10)
  430. I411
    S. 233 in force at Royal Assent, see s. 240(z5)
  431. F19
    Words in s. 102(1) substituted (30.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 124(4)(a), 142(1); S.I. 2025/982, reg. 2
  432. I412
    S. 104 not in force at Royal Assent, see s. 240(1)
  433. I413
    Sch. 12 para. 1 not in force at Royal Assent, see s. 240(1)
  434. I414
    Sch. 12 para. 24 not in force at Royal Assent, see s. 240(1)
  435. I415
    Sch. 13 para. 6 not in force at Royal Assent, see s. 240(1)
  436. I416
    S. 119 not in force at Royal Assent, see s. 240(1)
  437. I417
    Sch. 9 para. 2 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(y)
  438. I418
    S. 168 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z20)
  439. I419
    Sch. 17 para. 21 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  440. I420
    Sch. 14 para. 17 not in force at Royal Assent, see s. 240(1)
  441. I421
    Sch. 10 para. 1 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z)
  442. I422
    Sch. 4 para. 10 in force at Royal Assent, see s. 240(4)(d)
  443. I423
    Sch. 8 para. 6 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  444. I424
    Sch. 4 para. 14 in force at Royal Assent, see s. 240(4)(d)
  445. I425
    S. 149 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)
  446. I426
    Sch. 13 para. 5 not in force at Royal Assent, see s. 240(1)
  447. I427
    Sch. 13 para. 2 not in force at Royal Assent, see s. 240(1)
  448. I428
    Sch. 8 para. 4 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  449. I429
    Sch. 12 para. 15 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z10)
  450. I430
    S. 52(3)-(5) in force at Royal Assent, see s. 240(4)(f)
  451. I431
    S. 95 not in force at Royal Assent, see s. 240(1)
  452. I432
    Sch. 1 para. 44 in force at Royal Assent, see s. 240(4)(a)
  453. I433
    Sch. 17 para. 22 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  454. I434
    Sch. 6 para. 7 in force at Royal Assent, see s. 240(4)(h)
  455. I435
    S. 161 not in force at Royal Assent, see s. 240(1)
  456. I436
    Sch. 14 para. 4 not in force at Royal Assent, see s. 240(1)
  457. I437
    Sch. 17 para. 16 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  458. I438
    S. 80(1)-(3)(5)-(8) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(y)
  459. I439
    S. 196 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z24)
  460. I440
    Sch. 12 para. 14 not in force at Royal Assent, see s. 240(1)
  461. I441
    Sch. 12 para. 6 not in force at Royal Assent, see s. 240(1)
  462. I442
    S. 183 not in force at Royal Assent, see s. 240(1)
  463. I443
    Sch. 17 para. 4 not in force at Royal Assent, see s. 240(1)
  464. I444
    S. 101 in force at 1.4.2024 by S.I. 2023/1420, reg. 3(a)
  465. I445
    S. 188 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  466. I446
    S. 36 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(k)
  467. I447
    Sch. 9 para. 6 not in force at Royal Assent, see s. 240(1)
  468. I448
    Sch. 2 para. 2 in force at Royal Assent, see s. 240(4)(a)
  469. I449
    S. 4 in force at Royal Assent, see s. 240(4)(a)
  470. F20
    Words in Sch. 9 para. 5(2) substituted (23.8.2024) by Media Act 2024 (c. 15), s. 55(3)(d), Sch. 7 para. 5(3)(b)(iii); S.I. 2024/858, reg. 2(1)(z1)
  471. I450
    Sch. 8 para. 17 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  472. I451
    Sch. 3 para. 18 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  473. I452
    S. 145 not in force at Royal Assent, see s. 240(1)
  474. I453
    Sch. 7 para. 32 in force at Royal Assent, see s. 240(4)(h)
  475. I454
    S. 155 not in force at Royal Assent, see s. 240(1)
  476. I455
    Sch. 10 para. 3 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z)
  477. I456
    Sch. 17 para. 24 not in force at Royal Assent, see s. 240(1)
  478. I457
    Sch. 13 para. 4 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)(z36)
  479. F21
    Words in s. 113(2) substituted (30.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 124(7)(b), 142(1); S.I. 2025/982, reg. 2
  480. I458
    S. 54 not in force at Royal Assent, see s. 240(1)
  481. I459
    Sch. 3 para. 8 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  482. I460
    S. 72(1)(10)(11) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(u)
  483. I461
    Sch. 8 para. 3 not in force at Royal Assent, see s. 240(1)
  484. I462
    S. 27 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)
  485. I463
    Sch. 12 para. 4 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z10)
  486. I464
    S. 198 not in force at Royal Assent, see s. 240(1)
  487. I465
    Sch. 4 para. 2 in force at Royal Assent, see s. 240(4)(d)
  488. I466
    Sch. 14 para. 15 not in force at Royal Assent, see s. 240(1)
  489. I467
    Sch. 1 para. 32 in force at Royal Assent, see s. 240(4)(a)
  490. I468
    S. 33 not in force at Royal Assent, see s. 240(1)
  491. I469
    S. 9 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(c)
  492. I470
    Sch. 10 para. 1 not in force at Royal Assent, see s. 240(1)
  493. I471
    Sch. 14 para. 22 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  494. I472
    Sch. 3 para. 17 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  495. I473
    Sch. 14 para. 10 not in force at Royal Assent, see s. 240(1)
  496. I474
    S. 17 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(e)
  497. I475
    Sch. 14 para. 25 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  498. I476
    Sch. 15 para. 8 not in force at Royal Assent, see s. 240(1)
  499. I477
    S. 65 not in force at Royal Assent, see s. 240(1)
  500. I478
    S. 215 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z31)
  501. I479
    Sch. 8 para. 9 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  502. F22
    S. 102(9A) inserted (30.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 124(4)(e), 142(1); S.I. 2025/982, reg. 2
  503. I480
    S. 143 not in force at Royal Assent, see s. 240(1)
  504. I481
    Sch. 17 para. 18 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  505. I482
    Sch. 17 para. 15 not in force at Royal Assent, see s. 240(1)
  506. I483
    Sch. 12 para. 17 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z10)
  507. I484
    Sch. 10 para. 7 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z)
  508. I485
    Sch. 8 para. 31 not in force at Royal Assent, see s. 240(1)
  509. I486
    Sch. 4 para. 16 in force at Royal Assent, see s. 240(4)(d)
  510. I487
    S. 201 not in force at Royal Assent, see s. 240(1)
  511. I488
    S. 190 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  512. I489
    S. 217 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z32)
  513. I490
    Sch. 15 para. 1 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z24)
  514. I491
    Sch. 14 para. 21 not in force at Royal Assent, see s. 240(1)
  515. I492
    Sch. 3 para. 8 not in force at Royal Assent, see s. 240(1)
  516. I493
    Sch. 15 para. 4 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z24)
  517. I494
    Sch. 7 para. 29 in force at Royal Assent, see s. 240(4)(h)
  518. I495
    Sch. 17 para. 5 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  519. F23
    Words in s. 102(3) inserted (30.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 124(4)(b)(i), 142(1); S.I. 2025/982, reg. 2
  520. I496
    Sch. 3 para. 18 not in force at Royal Assent, see s. 240(1)
  521. I497
    Sch. 3 para. 21 not in force at Royal Assent, see s. 240(1)
  522. I498
    S. 41(1)-(3)(5)-(10) in force at Royal Assent, see s. 240(4)(c)
  523. F24
    Words in Sch. 9 para. 5(2) substituted (23.8.2024) by Media Act 2024 (c. 15), s. 55(3)(d), Sch. 7 para. 5(3)(b)(ii); S.I. 2024/858, reg. 2(1)(z1)
  524. I499
    Sch. 3 para. 13 not in force at Royal Assent, see s. 240(1)
  525. I500
    S. 16 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(e)
  526. I501
    Sch. 17 para. 7 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  527. I502
    Sch. 9 para. 3 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(y)
  528. I503
    Sch. 17 para. 8 not in force at Royal Assent, see s. 240(1)
  529. I504
    Sch. 14 para. 1 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  530. I505
    Sch. 8 para. 23 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  531. I506
    S. 146 not in force at Royal Assent, see s. 240(1)
  532. I507
    S. 215 not in force at Royal Assent, see s. 240(1)
  533. I508
    Sch. 12 para. 1 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z10)
  534. I509
    Sch. 15 para. 6 not in force at Royal Assent, see s. 240(1)
  535. I510
    S. 9 not in force at Royal Assent, see s. 240(1)
  536. I511
    Sch. 12 para. 21 not in force at Royal Assent, see s. 240(1)
  537. I512
    Sch. 7 para. 8 in force at Royal Assent, see s. 240(4)(h)
  538. I513
    S. 65 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(r)
  539. I514
    S. 50 not in force at Royal Assent, see s. 240(1)
  540. I515
    Sch. 8 para. 34 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  541. I516
    Sch. 3 para. 10 not in force at Royal Assent, see s. 240(1)
  542. I517
    S. 58 in force at Royal Assent, see s. 240(4)(h)
  543. F25
    Sch. 16 omitted (25.7.2025) by virtue of Online Safety Act 2023 (c. 50), ss. 210(3)(b), 240(1); S.I. 2025/888, reg. 2
  544. I518
    Sch. 14 para. 22 not in force at Royal Assent, see s. 240(1)
  545. I519
    S. 26 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)
  546. I520
    Sch. 3 para. 9 not in force at Royal Assent, see s. 240(1)
  547. I521
    S. 157 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z18)
  548. I522
    S. 21 not in force at Royal Assent, see s. 240(1)
  549. I523
    Sch. 17 para. 29 not in force at Royal Assent, see s. 240(1)
  550. I524
    Sch. 14 para. 19 not in force at Royal Assent, see s. 240(1)
  551. I525
    Sch. 12 para. 2 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z10)
  552. I526
    S. 147 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)
  553. I527
    Sch. 7 para. 38 in force at Royal Assent, see s. 240(4)(h)
  554. I528
    S. 93 in force at Royal Assent, see s. 240(4)(o)
  555. I529
    S. 168 not in force at Royal Assent, see s. 240(1)
  556. I530
    S. 81 not in force at Royal Assent, see s. 240
  557. I531
    S. 205 not in force at Royal Assent, see s. 240(1)
  558. F26
    S. 109(6A)(6B) inserted (30.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 124(5)(b), 142(1); S.I. 2025/982, reg. 2
  559. I532
    Sch. 12 para. 10 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z10)
  560. I533
    S. 69 not in force at Royal Assent, see s. 240(1)
  561. I534
    S. 100(6)(a)(i) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z5)
  562. I535
    Sch. 7 para. 23 in force at Royal Assent, see s. 240(4)(h)
  563. I536
    Sch. 4 para. 3 in force at Royal Assent, see s. 240(4)(d)
  564. I537
    S. 192 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z23)
  565. I538
    S. 232 in force at Royal Assent, see s. 240(z5)
  566. F27
    Words in Sch. 9 para. 5(1) inserted (23.8.2024) by Media Act 2024 (c. 15), s. 55(3)(d), Sch. 7 para. 5(3)(b)(i); S.I. 2024/858, reg. 2(1)(z1)
  567. I539
    Sch. 9 para. 2 not in force at Royal Assent, see s. 240(1)
  568. I540
    S. 97 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z4)
  569. I541
    S. 211 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  570. I542
    Sch. 12 para. 3 not in force at Royal Assent, see s. 240(1)
  571. I543
    S. 239 in force at Royal Assent, see s. 240(z5)
  572. I544
    Sch. 17 para. 9 not in force at Royal Assent, see s. 240(1)
  573. I545
    S. 89 not in force at Royal Assent, see s. 240(1)
  574. F28
    Words in Sch. 9 para. 6(2)(a) inserted (23.8.2024) by Media Act 2024 (c. 15), s. 55(3)(d), Sch. 7 para. 5(3)(d)(i); S.I. 2024/858, reg. 2(1)(z1)
  575. I546
    Sch. 7 para. 18 in force at Royal Assent, see s. 240(4)(h)
  576. I547
    S. 30 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)
  577. I548
    S. 95 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z2)
  578. I549
    Sch. 14 para. 3 not in force at Royal Assent, see s. 240(1)
  579. I550
    Sch. 14 para. 9 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  580. I551
    Sch. 8 para. 36 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  581. I552
    Sch. 6 para. 3 in force at Royal Assent, see s. 240(4)(h)
  582. I553
    Sch. 3 para. 13 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  583. I554
    S. 113 not in force at Royal Assent, see s. 240(1)
  584. I555
    S. 21(1)-(5)(6)(a)(b)(d)(e)(7)(8)(9)(a) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(g)
  585. I556
    S. 171 not in force at Royal Assent, see s. 240(1)
  586. I557
    Sch. 14 para. 25 not in force at Royal Assent, see s. 240(1)
  587. I558
    S. 104(13)(a)(i)-(x)(xv)(b)(c) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z8)
  588. I559
    S. 100(1)-(5) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z5)
  589. I560
    S. 20(1)-(6)(7)(a) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(f)
  590. I561
    S. 210 in force at 25.7.2025 by S.I. 2025/888, reg. 2
  591. I562
    Sch. 8 para. 7 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  592. I563
    Sch. 3 para. 14 not in force at Royal Assent, see s. 240(1)
  593. I564
    S. 123 not in force at Royal Assent, see s. 240(1)
  594. I565
    Sch. 7 para. 1 in force at Royal Assent, see s. 240(4)(h)
  595. I566
    Sch. 3 para. 11 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  596. I567
    S. 51 not in force at Royal Assent, see s. 240(1)
  597. I568
    S. 237 in force at Royal Assent, see s. 240(z5)
  598. I569
    Sch. 8 para. 38 not in force at Royal Assent, see s. 240(1)
  599. I570
    S. 10 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(c)
  600. I571
    Sch. 12 para. 10 not in force at Royal Assent, see s. 240(1)
  601. I572
    Sch. 17 para. 31 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  602. I573
    Sch. 3 para. 1 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  603. I574
    S. 20 not in force at Royal Assent, see s. 240(1)
  604. I575
    Sch. 1 para. 36 in force at Royal Assent, see s. 240(4)(a)
  605. I576
    Sch. 17 para. 6 not in force at Royal Assent, see s. 240(1)
  606. I577
    Sch. 14 para. 24 not in force at Royal Assent, see s. 240(1)
  607. I578
    Sch. 13 para. 4 not in force at Royal Assent, see s. 240(1)
  608. I579
    Sch. 1 para. 26 in force at Royal Assent, see s. 240(4)(a)
  609. I580
    S. 110 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z11)
  610. I581
    Sch. 1 para. 46 in force at Royal Assent, see s. 240(4)(a)
  611. I582
    Sch. 12 para. 13 not in force at Royal Assent, see s. 240(1)
  612. I583
    S. 37 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(k)
  613. I584
    S. 126 not in force at Royal Assent, see s. 240(1)
  614. I585
    S. 156 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z18)
  615. I586
    S. 220 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z34)
  616. I587
    Sch. 8 para. 13 not in force at Royal Assent, see s. 240(1)
  617. I588
    S. 136(1)(2)(a)(3)-(11) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)
  618. I589
    Sch. 8 para. 5 not in force at Royal Assent, see s. 240(1)
  619. I590
    Sch. 7 para. 16 in force at Royal Assent, see s. 240(4)(h)
  620. I591
    Sch. 3 para. 2 not in force at Royal Assent, see s. 240(1)
  621. I592
    S. 67 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(s)
  622. I593
    S. 185 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  623. I594
    S. 131 not in force at Royal Assent, see s. 240(1)
  624. I595
    S. 45 in force at Royal Assent, see s. 240(4)(e)
  625. I596
    Sch. 8 para. 24 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  626. I597
    S. 109 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z11)
  627. I598
    S. 66 not in force at Royal Assent, see s. 240(1)
  628. I599
    S. 230 in force at Royal Assent, see s. 240(z5)
  629. I600
    S. 73 not in force at Royal Assent, see s. 240(1)
  630. I601
    Sch. 8 para. 30 not in force at Royal Assent, see s. 240(1)
  631. I602
    Sch. 8 para. 32 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  632. I603
    S. 24 not in force at Royal Assent, see s. 240(1)
  633. I604
    Sch. 11 para. 1 in force at Royal Assent, see s. 240(4)(p)
  634. F29
    Words in s. 102(10) inserted (30.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 124(4)(f), 142(1); S.I. 2025/982, reg. 2
  635. I605
    Sch. 8 para. 40 not in force at Royal Assent, see s. 240(1)
  636. I606
    S. 86 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z)
  637. I607
    Sch. 7 para. 9 in force at Royal Assent, see s. 240(4)(h)
  638. F30
    S. 162(7)-(10) omitted (20.8.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 125(3), 142(1); S.I. 2025/904, reg. 2(s)
  639. I608
    S. 143 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)
  640. I609
    Sch. 6 para. 6 in force at Royal Assent, see s. 240(4)(h)
  641. I610
    Sch. 17 para. 26 not in force at Royal Assent, see s. 240(1)
  642. I611
    S. 191 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  643. I612
    S. 184 not in force at Royal Assent, see s. 240(1)
  644. F31
    S. 209 omitted (25.7.2025) by virtue of Online Safety Act 2023 (c. 50), ss. 210(3)(a), 240(1); S.I. 2025/888, reg. 2
  645. I613
    Sch. 8 para. 10 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  646. I614
    S. 153 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z18)
  647. I615
    Sch. 17 para. 23 not in force at Royal Assent, see s. 240(1)
  648. I616
    Sch. 15 para. 2 not in force at Royal Assent, see s. 240(1)
  649. I617
    S. 167 not in force at Royal Assent, see s. 240(1)
  650. I618
    S. 112 not in force at Royal Assent, see s. 240(1)
  651. I619
    Sch. 8 para. 10 not in force at Royal Assent, see s. 240(1)
  652. I620
    S. 85 not in force at Royal Assent, see s. 240(1)
  653. I621
    Sch. 8 para. 18 not in force at Royal Assent, see s. 240(1)
  654. I622
    S. 110 not in force at Royal Assent, see s. 240(1)
  655. F32
    Words in s. 236(1) substituted (30.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 124(10)(b), 142(1); S.I. 2025/982, reg. 2
  656. I623
    Sch. 15 para. 5 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z24)
  657. I624
    S. 83 not in force at Royal Assent, see s. 240(1)
  658. I625
    S. 158 not in force at Royal Assent, see s. 240(1)
  659. I626
    Sch. 3 para. 23 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  660. I627
    Sch. 12 para. 16 not in force at Royal Assent, see s. 240(1)
  661. I628
    Sch. 11 para. 5 in force at Royal Assent, see s. 240(4)(p)
  662. I629
    S. 120(1)(2)(b)-(i) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z15)
  663. I630
    Sch. 7 para. 17 in force at Royal Assent, see s. 240(4)(h)
  664. I631
    S. 132 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)
  665. I632
    Sch. 8 para. 9 not in force at Royal Assent, see s. 240(1)
  666. I633
    Sch. 15 para. 3 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z24)
  667. I634
    Sch. 3 para. 25 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  668. I635
    S. 181 not in force at Royal Assent, see s. 240(1)
  669. I636
    S. 7(1)-(4)(5)(a)-(e)(g)(i)(6)-(8) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(a)
  670. I637
    Sch. 12 para. 3 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z10)
  671. I638
    Sch. 8 para. 25 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  672. I639
    S. 187 not in force at Royal Assent, see s. 240(1)
  673. I640
    Sch. 10 para. 8 not in force at Royal Assent, see s. 240(1)
  674. I641
    S. 194 in force at Royal Assent, see s. 240(4)(x)
  675. I642
    Sch. 8 para. 23 not in force at Royal Assent, see s. 240(1)
  676. I643
    S. 44 in force at Royal Assent, see s. 240(4)(e)
  677. I644
    S. 173 not in force at Royal Assent, see s. 240(1)
  678. I645
    S. 229 in force at Royal Assent, see s. 240(z5)
  679. I646
    Sch. 1 para. 50 in force at Royal Assent, see s. 240(4)(a)
  680. I647
    Sch. 8 para. 7 not in force at Royal Assent, see s. 240(1)
  681. I648
    Sch. 14 para. 14 not in force at Royal Assent, see s. 240(1)
  682. I649
    Sch. 12 para. 18 not in force at Royal Assent, see s. 240(1)
  683. I650
    S. 64 not in force at Royal Assent, see s. 240(1)
  684. I651
    Sch. 7 para. 6 in force at Royal Assent, see s. 240(4)(h)
  685. I652
    Sch. 7 para. 28 in force at Royal Assent, see s. 240(4)(h)
  686. I653
    S. 206 not in force at Royal Assent, see s. 240(1)
  687. I654
    S. 88 not in force at Royal Assent, see s. 240(1)
  688. I655
    S. 97 not in force at Royal Assent, see s. 240(1)
  689. I656
    S. 208 not in force at Royal Assent, see s. 240(1)
  690. I657
    Sch. 2 para. 4 in force at Royal Assent, see s. 240(4)(a)
  691. I658
    Sch. 3 para. 28 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  692. I659
    Sch. 9 para. 5 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(y)
  693. I660
    S. 175 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z22)
  694. I661
    Sch. 14 para. 13 not in force at Royal Assent, see s. 240(1)
  695. I662
    Sch. 17 para. 14 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  696. I663
    S. 70 in force at Royal Assent, see s. 240(4)(i)
  697. I664
    S. 40 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(l)
  698. F33
    S. 102(3)(ca) inserted (30.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 124(4)(b)(iii), 142(1); S.I. 2025/982, reg. 2
  699. I665
    Sch. 8 para. 33 not in force at Royal Assent, see s. 240(1)
  700. I666
    S. 38 not in force at Royal Assent, see s. 240(1)
  701. I667
    S. 92 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z1)
  702. I668
    Sch. 1 para. 10 in force at Royal Assent, see s. 240(4)(a)
  703. I669
    S. 23(1)-(10) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(i)
  704. I670
    S. 56 in force at Royal Assent, see s. 240(4)(h)
  705. I671
    Sch. 1 para. 33 in force at Royal Assent, see s. 240(4)(a)
  706. I672
    S. 106 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z9)
  707. I673
    S. 213 not in force at Royal Assent, see s. 240(1)
  708. I674
    S. 99 in force at Royal Assent, see s. 240(4)(q)
  709. I675
    Sch. 7 para. 3 in force at Royal Assent, see s. 240(4)(h)
  710. I676
    Sch. 1 para. 43 in force at Royal Assent, see s. 240(4)(a)
  711. I677
    S. 193(1)(2)(a)(3)(4) in force at Royal Assent, see s. 240(4)(w)
  712. I678
    Sch. 8 para. 25 not in force at Royal Assent, see s. 240(1)
  713. I679
    Sch. 17 para. 10 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  714. I680
    Sch. 12 para. 13 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z10)
  715. I681
    S. 184 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  716. I682
    S. 84 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z)
  717. I683
    S. 54 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(q)
  718. I684
    S. 14 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(e)
  719. I685
    Sch. 8 para. 41 not in force at Royal Assent, see s. 240(1)
  720. I686
    Sch. 17 para. 24 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  721. I687
    S. 114(1)(3)-(6) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z12)
  722. I688
    Sch. 12 para. 17 not in force at Royal Assent, see s. 240(1)
  723. I689
    S. 179 not in force at Royal Assent, see s. 240(1)
  724. I690
    Sch. 3 para. 23 not in force at Royal Assent, see s. 240(1)
  725. I691
    Sch. 17 para. 27 not in force at Royal Assent, see s. 240(1)
  726. I692
    Sch. 17 para. 19 not in force at Royal Assent, see s. 240(1)
  727. I693
    Sch. 8 para. 39 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  728. I694
    S. 159 not in force at Royal Assent, see s. 240(1)
  729. I695
    Sch. 7 para. 27 in force at Royal Assent, see s. 240(4)(h)
  730. I696
    Sch. 7 para. 34 in force at Royal Assent, see s. 240(4)(h)
  731. I697
    Sch. 1 para. 12 in force at Royal Assent, see s. 240(4)(a)
  732. I698
    S. 88 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z)
  733. I699
    S. 162 not in force at Royal Assent, see s. 240(1)
  734. I700
    Sch. 10 para. 4 not in force at Royal Assent, see s. 240(1)
  735. I701
    Sch. 11 para. 2 in force at Royal Assent, see s. 240(4)(p)
  736. I702
    Sch. 7 para. 26 in force at Royal Assent, see s. 240(4)(h)
  737. I703
    S. 47 in force at Royal Assent, see s. 240(4)(e)
  738. I704
    S. 160 not in force at Royal Assent, see s. 240(1)
  739. I705
    Sch. 4 para. 5 in force at Royal Assent, see s. 240(4)(d)
  740. I706
    Sch. 14 para. 2 not in force at Royal Assent, see s. 240(1)
  741. I707
    S. 100(7)-(10) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z5)
  742. I708
    S. 35 not in force at Royal Assent, see s. 240(1)
  743. I709
    Sch. 9 para. 3 not in force at Royal Assent, see s. 240(1)
  744. I710
    Sch. 8 para. 38 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  745. I711
    S. 72 not in force at Royal Assent, see s. 240(1)
  746. I712
    Sch. 8 para. 20 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  747. I713
    S. 103 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z7)
  748. I714
    S. 57 in force at Royal Assent, see s. 240(4)(h)
  749. I715
    Sch. 1 para. 2 in force at Royal Assent, see s. 240(4)(a)
  750. I716
    S. 154 in force at Royal Assent for specified purposes, see s. 240(4)(u)
  751. I717
    Sch. 1 para. 42 in force at Royal Assent, see s. 240(4)(a)
  752. I718
    Sch. 8 para. 40 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  753. I719
    Sch. 15 para. 5 not in force at Royal Assent, see s. 240(1)
  754. I720
    Sch. 17 para. 15 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  755. I721
    S. 53(1)(3)(4) in force at Royal Assent, see s. 240(4)(g)
  756. I722
    S. 180 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  757. I723
    S. 240 in force at Royal Assent, see s. 240(z5)
  758. I724
    S. 62 in force at Royal Assent, see s. 240(4)(h)
  759. I725
    Sch. 3 para. 12 not in force at Royal Assent, see s. 240(1)
  760. I726
    Sch. 7 para. 35 in force at Royal Assent, see s. 240(4)(h)
  761. I727
    Sch. 3 para. 24 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  762. I728
    S. 212 in force at Royal Assent, see s. 240(z1)
  763. I729
    S. 180 not in force at Royal Assent, see s. 240(1)
  764. I730
    Sch. 14 para. 14 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  765. I731
    Sch. 10 para. 8 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z)
  766. I732
    S. 164 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z18)
  767. I733
    S. 174 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z22)
  768. I734
    S. 10 not in force at Royal Assent, see s. 240(1)
  769. I735
    Sch. 17 para. 8 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  770. I736
    Sch. 17 para. 27 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  771. I737
    Sch. 14 para. 4 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  772. I738
    S. 191 not in force at Royal Assent, see s. 240(1)
  773. I739
    Sch. 9 para. 4 not in force at Royal Assent, see s. 240(1)
  774. I740
    Sch. 7 para. 15 in force at Royal Assent, see s. 240(4)(h)
  775. I741
    S. 176 not in force at Royal Assent, see s. 240(1)
  776. I742
    S. 222 in force at Royal Assent, see s. 240(z4)
  777. I743
    S. 100 not in force at Royal Assent, see s. 240(1)
  778. I744
    Sch. 14 para. 8 not in force at Royal Assent, see s. 240(1)
  779. I745
    Sch. 10 para. 4 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z)
  780. I746
    Sch. 3 para. 16 not in force at Royal Assent, see s. 240(1)
  781. I747
    Sch. 3 para. 5 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  782. I748
    Sch. 14 para. 8 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  783. I749
    Sch. 7 para. 7 in force at Royal Assent, see s. 240(4)(h)
  784. I750
    Sch. 12 para. 6 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z10)
  785. I751
    S. 206 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z26)
  786. I752
    Sch. 15 para. 2 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z24)
  787. I753
    S. 60 in force at Royal Assent, see s. 240(4)(h)
  788. I754
    Sch. 14 para. 2 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  789. I755
    Sch. 3 para. 20 not in force at Royal Assent, see s. 240(1)
  790. I756
    S. 198 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z24)
  791. F34
    S. 154A inserted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 125(2), 142(1)(2)(h) (with s. 125(5)); S.I. 2025/904, reg. 2(s)
  792. I757
    Sch. 11 para. 6 in force at Royal Assent, see s. 240(4)(p)
  793. I758
    S. 107 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z10)
  794. F35
    Words in s. 74(3)(c) substituted (6.4.2025) by Digital Markets, Competition and Consumers Act 2024 (c. 13), s. 339(1), Sch. 21 para. 13(3)(b) (with ss. 235, 243, 252); S.I. 2025/272, reg. 2(1)(12)
  795. I759
    Sch. 7 para. 11 in force at Royal Assent, see s. 240(4)(h)
  796. I760
    S. 220 not in force at Royal Assent, see s. 240(1)
  797. I761
    Sch. 1 para. 47 in force at Royal Assent, see s. 240(4)(a)
  798. F36
    Words in Sch. 9 para. 5 heading inserted (23.8.2024) by Media Act 2024 (c. 15), s. 55(3)(d), Sch. 7 para. 5(3)(a); S.I. 2024/858, reg. 2(1)(z1)
  799. I762
    Sch. 8 para. 2 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  800. I763
    S. 226 in force at Royal Assent, see s. 240(z5)
  801. I764
    S. 136 not in force at Royal Assent, see s. 240(1)
  802. I765
    S. 156 not in force at Royal Assent, see s. 240(1)
  803. I766
    S. 55 in force at Royal Assent, see s. 240(4)(h)
  804. I767
    Sch. 3 para. 4 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  805. I768
    S. 92 not in force at Royal Assent, see s. 240(1)
  806. I769
    S. 139 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)
  807. I770
    Sch. 1 para. 13 in force at Royal Assent, see s. 240(4)(a)
  808. I771
    Sch. 6 para. 4 in force at Royal Assent, see s. 240(4)(h)
  809. I772
    Sch. 1 para. 34 in force at Royal Assent, see s. 240(4)(a)
  810. I773
    Sch. 12 para. 11 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z10)
  811. F37
    S. 100(8A) inserted (30.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 124(2)(b), 142(1); S.I. 2025/982, reg. 2
  812. I774
    S. 228 in force at Royal Assent, see s. 240(z5)
  813. I775
    Sch. 3 para. 26 not in force at Royal Assent, see s. 240(1)
  814. I776
    S. 113 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z11)
  815. I777
    S. 27 not in force at Royal Assent, see s. 240(1)
  816. I778
    S. 41(4) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(m)
  817. I779
    S. 100(6)(a)(vi) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z5)
  818. I780
    S. 123 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z16)
  819. I781
    Sch. 6 para. 13 in force at Royal Assent, see s. 240(4)(h)
  820. I782
    S. 218 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z33)
  821. I783
    Sch. 12 para. 20 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z10)
  822. I784
    S. 178 not in force at Royal Assent, see s. 240(1)
  823. I785
    Sch. 8 para. 5 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  824. I786
    Sch. 14 para. 10 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  825. I787
    S. 165 not in force at Royal Assent, see s. 240(1)
  826. I788
    Sch. 5 para. 1 in force at Royal Assent, see s. 240(4)(h)
  827. I789
    Sch. 3 para. 15 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  828. I790
    S. 100(6)(b)-(n) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z5)
  829. I791
    Sch. 3 para. 10 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  830. I792
    S. 133 not in force at Royal Assent, see s. 240(1)
  831. I793
    S. 187 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  832. I794
    S. 12 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(d)
  833. I795
    S. 48 in force at Royal Assent, see s. 240(4)(e)
  834. I796
    Sch. 9 para. 1 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(y)
  835. I797
    S. 135 not in force at Royal Assent, see s. 240(1)
  836. I798
    Sch. 9 para. 6 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(y)
  837. I799
    Sch. 11 para. 3 in force at Royal Assent, see s. 240(4)(p)
  838. F38
    Ss. 101(A1)-(G1) inserted (19.6.2025 for specified purposes, 30.9.2025 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 124(3)(a), 142(1)(2)(h); S.I. 2025/982, reg. 2
  839. I800
    Sch. 3 para. 1 not in force at Royal Assent, see s. 240(1)
  840. I801
    S. 150 not in force at Royal Assent, see s. 240(1)
  841. I802
    Sch. 1 para. 21 in force at Royal Assent, see s. 240(4)(a)
  842. I803
    Sch. 6 para. 10 in force at Royal Assent, see s. 240(4)(h)
  843. I804
    Sch. 8 para. 35 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  844. I805
    Sch. 1 para. 11 in force at Royal Assent, see s. 240(4)(a)
  845. I806
    Sch. 7 para. 10 in force at Royal Assent, see s. 240(4)(h)
  846. I807
    Sch. 17 para. 12 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  847. I808
    S. 75 not in force at Royal Assent, see s. 240(1)
  848. I809
    Sch. 17 para. 13 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  849. I810
    S. 190 not in force at Royal Assent, see s. 240(1)
  850. I811
    S. 192 not in force at Royal Assent, see s. 240(1)
  851. I812
    S. 124 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z16)
  852. I813
    Sch. 3 para. 21 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  853. I814
    S. 84 not in force at Royal Assent, see s. 240(1)
  854. I815
    S. 200 in force at 10.1.2024 for specified purposes by S.I. 2023/1420, reg. 2(z25)
  855. I816
    S. 219 in force at Royal Assent, see s. 240(z3)
  856. I817
    Sch. 3 para. 3 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  857. I818
    Sch. 1 para. 19 in force at Royal Assent, see s. 240(4)(a)
  858. I819
    S. 63 in force at Royal Assent, see s. 240(4)(h)
  859. F39
    S. 100(7) omitted (30.9.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 124(2)(a), 142(1); S.I. 2025/982, reg. 2
  860. I820
    Sch. 10 para. 7 not in force at Royal Assent, see s. 240(1)
  861. I821
    Sch. 12 para. 4 not in force at Royal Assent, see s. 240(1)
  862. I822
    S. 108 not in force at Royal Assent, see s. 240(1)
  863. I823
    S. 151 in force at Royal Assent, see s. 240(4)(t)
  864. F40
    S. 80(6A) inserted (23.8.2024) by Media Act 2024 (c. 15), s. 55(3)(d), Sch. 7 para. 5(2)(b); S.I. 2024/858, reg. 2(1)(z1)
  865. I824
    S. 28 not in force at Royal Assent, see s. 240(1)
  866. I825
    Sch. 4 para. 7 in force at Royal Assent, see s. 240(4)(d)
  867. I826
    Sch. 8 para. 26 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  868. I827
    Sch. 17 para. 17 not in force at Royal Assent, see s. 240(1)
  869. I828
    S. 100(6)(a)(vii) in force at 17.1.2025 by S.I. 2024/1333, reg. 2(1)(b)
  870. I829
    Sch. 8 para. 15 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  871. I830
    Sch. 3 para. 28 not in force at Royal Assent, see s. 240(1)
  872. I831
    Sch. 8 para. 1 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  873. I832
    Sch. 17 para. 3 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  874. I833
    Sch. 14 para. 12 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  875. I834
    Sch. 6 para. 11 in force at Royal Assent, see s. 240(4)(h)
  876. I835
    S. 189 not in force at Royal Assent, see s. 240(1)
  877. I836
    Sch. 8 para. 42 not in force at Royal Assent, see s. 240(1)
  878. I837
    Sch. 17 para. 11 not in force at Royal Assent, see s. 240(1)
  879. F41
    Words in s. 236(1) inserted (30.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 124(10)(a), 142(1); S.I. 2025/982, reg. 2
  880. I838
    S. 216 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z31)
  881. I839
    S. 163 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z18)
  882. I840
    Sch. 2 para. 1 in force at Royal Assent, see s. 240(4)(a)
  883. I841
    Sch. 8 para. 2 not in force at Royal Assent, see s. 240(1)
  884. F42
    Words in s. 109(2)(b) substituted (30.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 124(5)(a), 142(1); S.I. 2025/982, reg. 2
  885. I842
    S. 142 not in force at Royal Assent, see s. 240(1)
  886. I843
    Sch. 17 para. 7 not in force at Royal Assent, see s. 240(1)
  887. I844
    Sch. 3 para. 27 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  888. I845
    Sch. 8 para. 18 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  889. I846
    S. 181 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  890. I847
    Sch. 4 para. 13 in force at Royal Assent, see s. 240(4)(d)
  891. I848
    Sch. 3 para. 19 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  892. I849
    S. 96 not in force at Royal Assent, see s. 240(1)
  893. I850
    Sch. 12 para. 8 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z10)
  894. I851
    Sch. 12 para. 12 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z10)
  895. I852
    Sch. 15 para. 7 not in force at Royal Assent, see s. 240(1)
  896. I853
    S. 85 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z)
  897. I854
    Sch. 17 para. 22 not in force at Royal Assent, see s. 240(1)
  898. I855
    Sch. 10 para. 6 not in force at Royal Assent, see s. 240(1)
  899. I856
    S. 115 in force at Royal Assent, see s. 240(4)(r)
  900. I857
    Sch. 8 para. 29 not in force at Royal Assent, see s. 240(1)
  901. I858
    Sch. 14 para. 17 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  902. I859
    Sch. 4 para. 4 in force at Royal Assent, see s. 240(4)(d)
  903. I860
    S. 1 in force at Royal Assent, see s. 240(4)(a)
  904. I861
    Sch. 15 para. 4 not in force at Royal Assent, see s. 240(1)
  905. I862
    Sch. 1 para. 3 in force at Royal Assent, see s. 240(4)(a)
  906. I863
    S. 77 not in force at Royal Assent, see s. 240(1)
  907. I864
    Sch. 8 para. 21 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  908. I865
    S. 147 not in force at Royal Assent, see s. 240(1)
  909. I866
    S. 139 not in force at Royal Assent, see s. 240(1)
  910. I867
    Sch. 8 para. 34 not in force at Royal Assent, see s. 240(1)
  911. I868
    S. 122 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z16)
  912. I869
    Sch. 4 para. 6 in force at Royal Assent, see s. 240(4)(d)
  913. I870
    S. 11 not in force at Royal Assent, see s. 240(1)
  914. I871
    S. 18 not in force at Royal Assent, see s. 240(1)
  915. I872
    Sch. 3 para. 15 not in force at Royal Assent, see s. 240(1)
  916. F43
    Words in s. 218(3)(b) substituted (6.4.2025) by Digital Markets, Competition and Consumers Act 2024 (c. 13), s. 339(1), Sch. 21 para. 13(4) (with ss. 235, 243, 252); S.I. 2025/272, reg. 2(1)(12)
  917. I873
    Sch. 4 para. 9 in force at Royal Assent, see s. 240(4)(d)
  918. I874
    S. 195 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z24)
  919. I875
    S. 6 in force at Royal Assent, see s. 240(4)(b)
  920. I876
    Sch. 1 para. 7 in force at Royal Assent, see s. 240(4)(a)
  921. I877
    S. 102 not in force at Royal Assent, see s. 240(1)
  922. I878
    Sch. 8 para. 8 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  923. I879
    Sch. 8 para. 17 not in force at Royal Assent, see s. 240(1)
  924. F44
    Words in s. 101(3) substituted (30.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 124(3)(b), 142(1); S.I. 2025/982, reg. 2
  925. I880
    Sch. 5 para. 4 in force at Royal Assent, see s. 240(4)(h)
  926. I881
    S. 42 in force at Royal Assent, see s. 240(4)(d)
  927. I882
    Sch. 8 para. 24 not in force at Royal Assent, see s. 240(1)
  928. I883
    Sch. 14 para. 16 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  929. I884
    Sch. 1 para. 28 in force at Royal Assent, see s. 240(4)(a)
  930. I885
    Sch. 17 para. 10 not in force at Royal Assent, see s. 240(1)
  931. I886
    Sch. 8 para. 26 not in force at Royal Assent, see s. 240(1)
  932. I887
    Sch. 7 para. 39 in force at Royal Assent, see s. 240(4)(h)
  933. I888
    S. 117 in force at Royal Assent, see s. 240(4)(r)
  934. I889
    Sch. 8 para. 1 not in force at Royal Assent, see s. 240(1)
  935. I890
    Sch. 13 para. 6 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)(z36)
  936. I891
    Sch. 17 para. 32 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  937. I892
    S. 67 not in force at Royal Assent, see s. 240(1)
  938. I893
    S. 23(11) in force at 10.1.2024 for specified purposes by S.I. 2023/1420, reg. 2(i)
  939. I894
    S. 189 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  940. I895
    S. 112 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z11)
  941. I896
    Sch. 8 para. 14 not in force at Royal Assent, see s. 240(1)
  942. I897
    S. 140 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)
  943. I898
    Sch. 8 para. 35 not in force at Royal Assent, see s. 240(1)
  944. I899
    S. 31 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)
  945. I900
    S. 166 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z19)
  946. I901
    Sch. 12 para. 2 not in force at Royal Assent, see s. 240(1)
  947. I902
    Sch. 3 para. 14 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)
  948. I903
    Sch. 17 para. 23 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  949. I904
    Sch. 17 para. 29 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z29)
  950. F45
    S. 225(10)(ca) inserted (30.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 124(9), 142(1); S.I. 2025/982, reg. 2
  951. I905
    Sch. 12 para. 5 not in force at Royal Assent, see s. 240(1)
  952. I906
    Sch. 7 para. 25 in force at Royal Assent, see s. 240(4)(h)
  953. I907
    S. 142 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)
  954. I908
    Sch. 14 para. 3 in force at 31.1.2024 by S.I. 2024/31, reg. 2
  955. I909
    S. 74 in force at Royal Assent, see s. 240(4)(j)
  956. I910
    Sch. 5 para. 2 in force at Royal Assent, see s. 240(4)(h)
  957. I911
    S. 22 not in force at Royal Assent, see s. 240(1)
  958. I912
    Sch. 8 para. 28 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(x)
  959. I913
    S. 207 in force at Royal Assent, see s. 240(4)(z)
  960. F46
    Sch. 7 para. 2A inserted (8.1.2026) by The Online Safety Act 2023 (Priority Offences) (Amendment) Regulations 2025 (S.I. 2025/1352), regs. 1(2), 2(2)
  961. F47
    Sch. 7 para. 28A substituted (8.1.2026) by The Online Safety Act 2023 (Priority Offences) (Amendment) Regulations 2025 (S.I. 2025/1352), regs. 1(2), 2(3)
  962. I914
    S. 66(7)-(10) in force at 7.4.2026 for specified purposes by S.I. 2026/262, reg. 2(1)(b)(2)
  963. I915
    S. 204(2)-(4) in force at 7.4.2026 for specified purposes by S.I. 2026/262, reg. 2(1)(h)(2)
  964. I916
    S. 66(1)(2) in force at 7.4.2026 by S.I. 2026/262, reg. 2(1)(a)
  965. I917
    S. 69 in force at 7.4.2026 for specified purposes by S.I. 2026/262, reg. 2(1)(c)(2)
  966. I918
    S. 100(6)(a)(iii) in force at 7.4.2026 for specified purposes by S.I. 2026/262, reg. 2(1)(d)(2)
  967. I919
    S. 104(13)(a)(xii) in force at 7.4.2026 for specified purposes by S.I. 2026/262, reg. 2(1)(e)(2)
  968. I920
    S. 120(2)(a) in force at 7.4.2026 for specified purposes by S.I. 2026/262, reg. 2(1)(f)(2)
  969. I921
    S. 199 in force at 7.4.2026 for specified purposes by S.I. 2026/262, reg. 2(1)(g)(2)
  970. I922
    S. 200 in force at 7.4.2026 for specified purposes by S.I. 2026/262, reg. 2(1)(g)(2)
  971. I923
    S. 201 in force at 7.4.2026 for specified purposes by S.I. 2026/262, reg. 2(1)(g)(2)
  972. I924
    S. 202 in force at 7.4.2026 for specified purposes by S.I. 2026/262, reg. 2(1)(g)(2)
  973. I925
    S. 203 in force at 7.4.2026 for specified purposes by S.I. 2026/262, reg. 2(1)(g)(2)
  974. I926
    S. 205 in force at 7.4.2026 for specified purposes by S.I. 2026/262, reg. 2(1)(i)(2)
  975. I927
    Sch. 8 para. 12 in force at 7.4.2026 by S.I. 2026/262, reg. 2(1)(j)
  976. F48
    Sch. 1 para. 36 substituted (1.4.2026) by The Online Safety Act 2023 (Exempt User-to-User and Search Services) (Amendment) Regulations 2026 (W.S.I. 2026/69), regs. 1(2), 2
  977. F49
    S. 225(1)(fa) inserted (29.4.2026) by Crime and Policing Act 2026 (c. 20), ss. 248(3), 255(2)(k)
  978. F50
    S. 225(1)(ea) inserted (29.4.2026) by Children’s Wellbeing and Schools Act 2026 (c. 21), ss. 70(3), 78(1)(b)
  979. F51
    S. 214A and cross-heading inserted (29.4.2026) by Children’s Wellbeing and Schools Act 2026 (c. 21), ss. 70(2), 78(1)(b) (with s. 71)
  980. F52
    S. 216A and cross-heading inserted (29.4.2026) by Crime and Policing Act 2026 (c. 20), ss. 248(2), 255(2)(k)