xmlns:atom="http://www.w3.org/2005/Atom"

PART 12Interpretation and final provisions

Interpretation

226“Provider” of internet service

(1)This section applies to determine who is the “provider” of an internet service for the purposes of this Act.

User-to-user services (other than combined services)

(2)The provider of a user-to-user service is to be treated as being the entity that has control over who can use the user-to-user part of the service (and that entity alone).

(3)If no entity has control over who can use the user-to-user part of a user-to-user service, but an individual or individuals have control over who can use that part, the provider of the service is to be treated as being that individual or those individuals.

Search services

(4)The provider of a search service is to be treated as being the entity that has control over the operations of the search engine (and that entity alone).

(5)If no entity has control over the operations of the search engine, but an individual or individuals have control over those operations, the provider of the search service is to be treated as being that individual or those individuals.

Combined services

(6)The provider of a combined service is to be treated as being the entity that has control over both—

(a)who can use the user-to-user part of the service, and

(b)the operations of the search engine,

(and that entity alone).

(7)If no entity has control over the matters mentioned in paragraphs (a) and (b) of subsection (6), but an individual or individuals have control over both those matters, the provider of the combined service is to be treated as being that individual or those individuals.

Internet services other than user-to-user services or search services

(8)The provider of an internet service, other than a user-to-user service or a search service, is to be treated as being the entity that has control over which content is published or displayed on the service.

(9)If no entity has control over which content is published or displayed on such an internet service, but an individual or individuals have control over which content is published or displayed, the provider of the service is to be treated as being that individual or those individuals.

Machine-generated services

(10)The provider of an internet service that is generated by a machine is to be treated as being the entity that controls the machine (and that entity alone).

(11)If no entity controls the machine, but an individual or individuals control it, the provider of the internet service is to be treated as being that individual or those individuals.

Interpretation

(12)A person who provides an access facility in relation to a user-to-user service, within the meaning of section 146, is not to be regarded as a person who has control over who can use the user-to-user part of the service for the purposes of this section.

(13)In this section “operations of the search engine” means operations which—

(a)enable users of a search service or a combined service to make search requests, and

(b)generate responses to those requests.

(14)In this section “published or displayed” is to be construed in accordance with section 79(6).

(15)For the purposes of subsections (8) and (9), a person who makes available on a service an automated tool or algorithm by means of which content is generated is to be regarded as having control over content so generated.

227“User”, “United Kingdom user” and “interested person”

(1)For the purposes of this Act a user is a “United Kingdom user” of a service if—

(a)where the user is an individual, the individual is in the United Kingdom;

(b)where the user is an entity, the entity is incorporated or formed under the law of any part of the United Kingdom.

(2)For the purposes of references in this Act to a user of a service it does not matter whether a person is registered to use a service.

(3)References in this Act to a user of a service do not include references to any of the following when acting in the course of the provider’s business—

(a)where the provider of the service is an individual or individuals, that individual or those individuals;

(b)where the provider is an entity, officers of the entity;

(c)persons who work for the provider (including as employees or volunteers);

(d)any other person providing a business service to the provider such as a contractor, consultant or auditor.

(4)In subsection (3)acting in the course of the provider’s business” means (as the case may be)—

(a)acting in the course of the provider’s business of providing the service, or

(b)acting in the course of a business, trade, profession or other concern—

(i)carried on (whether or not for profit) by the provider of the service, and

(ii)for the purposes of which the service is provided.

(5)In subsections (1) to (4)service” (except in the term “business service”) means internet service, user-to-user service or search service.

(6)In subsection (3)officer” includes a director, manager, partner, associate, secretary or other similar officer.

(7)In this Act “interested person”, in relation to a search service or a combined service, means a person that is responsible for a website or database capable of being searched by the search engine, provided that—

(a)in the case of an individual, the individual is in the United Kingdom;

(b)in the case of an entity, the entity is incorporated or formed under the law of any part of the United Kingdom.

228“Internet service”

(1)In this Act “internet service” means a service that is made available by means of the internet.

(2)For the purposes of subsection (1) a service is “made available by means of the internet” even where it is made available by means of a combination of—

(a)the internet, and

(b)an electronic communications service.

(3)Electronic communications service” has the same meaning as in the Communications Act (see section 32(2) of that Act).

229“Search engine”

(1)In this Act “search engine”—

(a)includes a service or functionality which enables a person to search some websites or databases (as well as a service or functionality which enables a person to search (in principle) all websites or databases);

(b)does not include a service which enables a person to search just one website or database.

(2)For the purposes of this Act, a search engine is not to be taken to be “included” in an internet service or a user-to-user service if the search engine is controlled by a person who does not control other parts of the service.

230“Age verification” and “age estimation”

(1)This section applies for the purposes of this Act.

(2)Age verification” means any measure designed to verify the exact age of users of a regulated service.

(3)Age estimation” means any measure designed to estimate the age or age-range of users of a regulated service.

(4)A measure which requires a user to self-declare their age (without more) is not to be regarded as age verification or age estimation.

231“Proactive technology”

(1)In this Act “proactive technology” means—

(a)content identification technology,

(b)user profiling technology, or

(c)behaviour identification technology,

but this is subject to subsections (3) and (7).

(2)Content identification technology” means technology, such as algorithms, keyword matching, image matching or image classification, which analyses content to assess whether it is content of a particular kind (for example, illegal content).

(3)But content identification technology is not to be regarded as proactive technology if it is used in response to a report from a user or other person about particular content.

(4)User profiling technology” means technology which analyses (any or all of)—

(a)relevant content,

(b)user data, or

(c)metadata relating to relevant content or user data,

for the purposes of building a profile of a user to assess characteristics such as age.

(5)Technology which—

(a)analyses data specifically provided by a user for the purposes of the provider verifying or estimating the user’s age in order to decide whether to allow the user to access a service (or part of a service) or particular content, and

(b)does not analyse any other data or content,

is not to be regarded as user profiling technology.

(6)Behaviour identification technology” means technology which analyses (any or all of)—

(a)relevant content,

(b)user data, or

(c)metadata relating to relevant content or user data,

to assess a user’s online behaviour or patterns of online behaviour (for example, to assess whether a user may be involved in, or be the victim of, illegal activity).

(7)But behaviour identification technology is not to be regarded as proactive technology if it is used in response to concerns identified by another person or an automated tool about a particular user.

(8)Relevant content” means—

(a)in relation to a user-to-user service, content that is user-generated content in relation to the service;

(b)in relation to a search service, the content of websites and databases capable of being searched by the search engine;

(c)in relation to an internet service within section 80(2), content that is provider pornographic content in relation to the service.

(9)User data” means—

(a)data provided by users, including personal data (for example, data provided when a user sets up an account), and

(b)data created, compiled or obtained by providers of regulated services and relating to users (for example, data relating to when or where users access a service or how they use it).

(10)References in this Act to proactive technology include content identification technology, user profiling technology or behaviour identification technology which utilises artificial intelligence or machine learning.

(11)Accredited technology that may be required to be used in relation to the detection of terrorism content or CSEA content (or both) by a notice under section 121(1) is an example of content identification technology.

(12)The reference in subsection (8)(b) to a search service includes a reference to the search engine of a combined service.

(13)In this section—

232Content communicated “publicly” or “privately”

(1)This section specifies factors which OFCOM must, in particular, consider when deciding whether content is communicated “publicly” or “privately” by means of a user-to-user service for the purposes of—

(a)section 121 (notice to deal with terrorism content),

(b)section 136 (requirement to use proactive technology), or

(c)paragraph 13(4) of Schedule 4 (recommendation of proactive technology in codes of practice).

(2)The factors are—

(a)the number of individuals in the United Kingdom who are able to access the content by means of the service;

(b)any restrictions on who may access the content by means of the service (for example, a requirement for approval or permission from a user, or the provider, of the service);

(c)the ease with which the content may be forwarded to or shared with—

(i)users of the service other than those who originally encounter it, or

(ii)users of another internet service.

(3)The following factors do not count as restrictions on access—

(a)a requirement to log in to or register with a service (or part of a service);

(b)a requirement to make a payment or take out a subscription in order to access a service (or part of a service) or to access particular content;

(c)inability to access a service (or part of a service) or to access particular content except by using particular technology or a particular kind of device (as long as that technology or device is generally available to the public).

233“Functionality”

(1)In this Act “functionality”, in relation to a user-to-user service, includes any feature that enables interactions of any description between users of the service by means of the service, and includes any feature enabling a user to do anything listed in subsection (2).

(2)The things are—

(a)creating a user profile, including an anonymous or pseudonymous profile;

(b)searching within the service for user-generated content or other users of the service;

(c)forwarding content to, or sharing content with, other users of the service;

(d)sharing content on other internet services;

(e)sending direct messages to or speaking to other users of the service, or interacting with them in another way (for example by playing a game);

(f)expressing a view on content, including, for example, by—

(i)applying a “like” or “dislike” button or other button of that nature,

(ii)applying an emoji or symbol of any kind,

(iii)engaging in yes/no voting, or

(iv)rating or scoring content in any way (including giving star or numerical ratings);

(g)sharing current or historic location information with other users of the service, recording a user’s movements, or identifying which other users of the service are nearby;

(h)following or subscribing to particular kinds of content or particular users of the service;

(i)creating lists, collections, archives or directories of content or users of the service;

(j)tagging or labelling content present on the service;

(k)uploading content relating to goods or services;

(l)applying or changing settings on the service which affect the presentation of user-generated content on the service;

(m)accessing other internet services through content present on the service (for example through hyperlinks).

(3)In this Act “functionality”, in relation to a search service, includes (in particular)—

(a)a feature that enables users to search websites or databases;

(b)a feature that makes suggestions relating to users’ search requests (predictive search functionality).

(4)In this section “user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

234“Harm” etc

(1)This section applies for the purposes of this Act, apart from Part 10 (communications offences).

(2)Harm” means physical or psychological harm.

(3)References to harm presented by content, and any other references to harm in relation to content, include references to harm arising or that may arise from any one or combination of the following—

(a)the nature of the content;

(b)the fact of its dissemination;

(c)the manner of its dissemination.

(4)References to harm presented by content, and any other references to harm in relation to content, include references to cumulative harm arising or that may arise in the following circumstances—

(a)where content, or content of a particular kind, is repeatedly encountered by an individual (including, but not limited to, where content, or a kind of content, is sent to an individual by one user or by different users or encountered as a result of algorithms used by, or functionalities of, a service);

(b)where content of a particular kind is encountered by an individual in combination with content of a different kind (including, but not limited to, where a kind of content is sent to an individual by one user or by different users or encountered as a result of algorithms used by, or functionalities of, a service).

(5)References to harm presented by content, and any other references to harm in relation to content, include references to harm arising or that may arise in the following circumstances—

(a)where, as a result of the content, individuals act in a way that results in harm to themselves or that increases the likelihood of harm to themselves;

(b)where, as a result of the content, individuals do or say something to another individual that results in harm to that other individual or that increases the likelihood of such harm (including, but not limited to, where individuals act in such a way as a result of content that is related to that other individual’s characteristics or membership of a group).

(6)References to a risk of harm in relation to functionalities, and references to the risk of functionalities facilitating users encountering particular kinds of content (however expressed), include references to risks arising or that may arise due to multiple functionalities which, used in combination, increase the likelihood of harm arising (for example, as mentioned in subsection (4)).

(7)References to a risk of harm, or to potential harm, are to be read in the same way as references to harm.

(8)In contexts where harm (or a risk of harm or potential harm) relates to children, subsections (4) to (5) are to be read as if they referred to children instead of individuals.

235“Online safety functions” and “online safety matters”

(1)In this Act references to OFCOM’s “online safety functions”—

(a)are references to—

(i)the functions that OFCOM have under this Act,

(ii)the functions that OFCOM have under the provisions of the Communications Act listed in subsection (2), so far as those functions relate to regulated services or Part 3 services (as the case may be), and

(iii)the functions that OFCOM have under section 3 of the Communications Act (general duties), so far as duties under that section relate to a function which is an online safety function by reason of sub-paragraph (i) or (ii);

(b)include references to OFCOM’s power to do anything appearing to them to be incidental or conducive to the carrying out of any of their functions within paragraph (a)(i) or (ii) (see section 1(3) of the Communications Act).

(2)These are the provisions of the Communications Act referred to in subsection (1)(a)(ii)

(a)section 6 (duties to review regulatory burdens);

(b)section 7 (duty to carry out impact assessments);

(c)section 8 (duty to publish and meet promptness standards);

(d)sections 11 and 11A (duties to promote media literacy);

(e)sections 12 and 13 (Content Board);

(f)section 14(6)(a) (research about media literacy);

(g)section 14(6B) (research about users’ experience of regulated services);

(h)section 16 (consumer consultation);

(i)section 20 (advisory committees for different parts of the United Kingdom);

(j)section 21 (advisory committee on elderly and disabled persons);

(k)section 22 (representation on international and other bodies);

(l)section 26 (publication of information and advice for consumers etc).

(3)References to OFCOM’s “online safety functions” also include references to OFCOM’s duty to comply with any of the following, so far as relating to the use of a regulated service by a person who has died—

(a)a notice from a senior coroner under paragraph 1(2) of Schedule 5 to the Coroners and Justice Act 2009 in connection with an investigation into a person’s death;

(b)a request for information in connection with the investigation of a procurator fiscal into, or an inquiry held or to be held in relation to, a person’s death;

(c)a notice from a coroner under section 17A(2) of the Coroners Act (Northern Ireland) 1959 (c. 15 (N.I.)) in connection with—

(i)an investigation to determine whether an inquest into a person’s death is necessary, or

(ii)an inquest in relation to a person’s death.

(4)In this Act “online safety matters” means the matters to which OFCOM’s online safety functions relate.

(5)In subsection (3)(b)inquiry” means an inquiry held, or to be held, under the Inquiries into Fatal Accidents and Sudden Deaths etc. (Scotland) Act 2016 (asp 2).

236Interpretation: general

(1)In this Act—

(2)The definitions of “encounter” and “person” in subsection (1) do not apply for the purposes of Part 10 (for the definition of “encounter” in that Part, see section 182(5)).

(3)References in this Act to an individual with a certain characteristic include references to an individual with a combination of characteristics.

(4)References in this Act to a kind of user-to-user service or search service (or Part 3 service) include references to user-to-user services or search services grouped together for the purposes of a risk profile prepared by OFCOM under section 98 (and references to different kinds of user-to-user services or search services (or Part 3 services) are to be read accordingly).

(5)References in this Act to content (or content of a particular kind) present or prevalent on a user-to-user service (or on a part of it), or to the presence, incidence or prevalence of content (or content of a particular kind) on a user-to-user service (or on a part of it), do not include, in the case of a user-to-user service that includes a search engine—

(a)search content, or

(b)any other content that, following a search request, may be encountered as a result of subsequent interactions with internet services.

In this subsection “search content” and “search request” have the same meaning as in Part 3 (see section 57).

(6)For the purposes of this Act—

(a)any reference to the use of or access to a service, or to content present, published or displayed on a service, is to be taken to include use of or access to the service or content on registering or on the making of a payment or on subscription;

(b)any reference to content that is made available or that may be accessed, encountered or shared, is to be taken to include content that is made available or that may be accessed, encountered or shared for a limited period of time only;

and references to restrictions on access to a service or to content are to be read accordingly.

(7)For the purposes of this Act, content that is user-generated content in relation to an internet service does not cease to be such content in relation to the service when published or displayed on the service by means of—

(a)software or an automated tool or algorithm applied by the provider of the service or by a person acting on behalf of the provider, or

(b)an automated tool or algorithm made available on the service by the provider or by a person acting on behalf of the provider.

(8)Nothing in this Act (other than section 212) affects any prohibition or restriction in relation to pornographic content, or powers in relation to such content, under another enactment or rule of law.

(9)In this section, “user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).

237Index of defined terms

The following table sets out terms defined or explained for this Act or for a Part of this Act.

TermProvision
adultsection 236
age estimationsection 230
age verificationsection 230
audit noticesection 236
automated toolsection 236
capacity (of a provider)section 236
Category 1 servicesection 95(10)(a)
Category 2A servicesection 95(10)(b)
Category 2B servicesection 95(10)(c)
charging year (in Part 6)section 90
childsection 236
children’s access assessment (in Part 3)section 35
combined servicesection 4(7)
the Communications Act section 236
confirmation decisionsection 236
contentsection 236
content that is harmful to children (in Part 3)section 60
the Conventionsection 236
countrysection 236
CSEA content (in Part 3)section 59
documentsection 236
encounter (content) (except in Part 10)section 236
entitysection 236
freedom of expressionsection 236
functionalitysection 233
harm (except in Part 10)section 234
identifying contentsection 236
illegal content (in Part 3)section 59
information noticesection 236
initial charging year (in Part 6)section 90
interested personsection 227
internet servicesection 228 (see also section 204(1))
journalistic content (in Part 3)section 19
likely to be accessed by children (in Part 3)section 37
measuresection 236
news publisher content (in Part 3)section 55(8) to (10)
non-designated content that is harmful to children (in Part 3)section 60
noticesection 236
notify, notificationsection 236
OFCOMsection 236
online safety functionssection 235
online safety matterssection 235
paid-for advertisementsection 236
Part 3 servicesection 4(3)
person (except in Part 10)section 236
personal datasection 236
pornographic content section 236
primary priority content that is harmful to children (in Part 3)section 61
priority content that is harmful to children (in Part 3)section 62
priority illegal content (in Part 3)section 59
priority offence (in Part 3)section 59
proactive technologysection 231
processing (of data)section 236
providersection 226
provider pornographic content (in Part 5)section 79
provisional notice of contraventionsection 236
publicly availablesection 236
publicly/privately (in relation to communication of content)section 232
published or displayed (in relation to pornographic content) (in Part 5)section 79
recognised news publisher (in Part 3)section 56
regulated provider pornographic content (in Part 5)section 79
regulated search servicesection 4(2)
regulated servicesection 4(4)
regulated user-generated content (in Part 3)section 55
regulated user-to-user servicesection 4(2)
restricting users’ access to content (in Part 3)section 58
searchsection 57
search contentsection 57
search enginesection 229
search requestsection 57
search resultssection 57
search servicesection 3 (see also section 204(1))
systems and/or processessection 236
taking down (content)section 236
terms of servicesection 236
terrorism content (in Part 3)section 59
United Kingdom usersection 227
usersection 227
user-generated content (in Part 3)section 55(3) and (4)
user-to-user part (of a service)section 236
user-to-user servicesection 3 (see also section 204(1))

Final provisions

238Financial provisions

There is to be paid out of money provided by Parliament—

(a)any expenditure incurred under or by virtue of this Act by the Secretary of State, and

(b)any increase attributable to this Act in the sums payable under any other Act out of money so provided.

239Extent

(1)Subject to the following provisions of this section, this Act extends to England and Wales, Scotland and Northern Ireland.

(2)The following provisions extend to England and Wales and Northern Ireland—

(a)sections 179 to 183;

(b)section 189(1).

(3)The following provisions extend to England and Wales only—

(a)section 187;

(b)section 188;

(c)section 189(2);

(d)section 190;

(e)section 213;

(f)section 214(1) to (3).

(4)Section 214(4) to (6) extends to Scotland only.

(5)The following provisions extend to Northern Ireland only—

(a)section 189(3);

(b)section 214(7) to (9).

(6)An amendment or repeal made by Schedule 14 has the same extent within the United Kingdom as the provision amended or repealed.

(7)His Majesty may by Order in Council provide for any of the provisions of this Act to extend, with or without modifications, to the Bailiwick of Guernsey or to the Isle of Man.

(8)Subsections (1) and (2) of section 224 apply to an Order in Council under subsection (7) as they apply to regulations under this Act.

(9)The power conferred by section 411(6) of the Communications Act may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment or repeal made by or under this Act of any part of that Act (with or without modifications).

(10)The power conferred by section 338 of the Criminal Justice Act 2003 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man the amendments of provisions of that Act made by paragraph 17 of Schedule 14.

(11)The power conferred by section 60(6) of the Modern Slavery Act 2015 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man the amendments of Schedule 4 to that Act made by paragraph 19 of Schedule 14.

(12)The power conferred by section 415(1) of the Sentencing Act 2020 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man the amendments of Schedule 18 to that Act made by paragraph 20 of Schedule 14.

240Commencement and transitional provision

(1)Except as provided by subsection (4), this Act comes into force on such day as the Secretary of State may by regulations appoint.

(2)The power to make regulations under subsection (1) includes power to appoint different days for different purposes.

(3)Regulations under subsection (1) may not bring section 210 into force before the end of the period of six months beginning with the date specified in regulations under paragraph 8(1) of Schedule 3.

(4)The following provisions come into force on the day on which this Act is passed—

(a)Parts 1 and 2;

(b)Chapter 1 of Part 3;

(c)section 41, except subsection (4) of that section;

(d)section 42 and Schedule 4;

(e)sections 43 to 48;

(f)section 52(3), (4) and (5);

(g)section 53, except subsection (2) of that section;

(h)Chapter 7 of Part 3 and Schedules 5, 6 and 7;

(i)section 70;

(j)section 74;

(k)section 79;

(l)section 80(4);

(m)section 82;

(n)sections 90 and 91;

(o)section 93;

(p)section 94 and Schedule 11;

(q)Chapter 3 of Part 7;

(r)sections 115 to 117;

(s)section 129;

(t)section 151;

(u)section 154 so far as relating to a duty imposed on OFCOM under Schedule 11;

(v)sections 169 and 170;

(w)section 193, except subsection (2)(b) of that section;

(x)section 194;

(y)section 204(1);

(z)section 207;

(z1)section 212;

(z2)section 214;

(z3)section 219;

(z4)sections 221 to 225;

(z5)this Part.

(5)The Secretary of State may by regulations make transitional, transitory or saving provision in connection with the coming into force of any provision of this Act.

(6)The power to make regulations under subsection (5) includes power to make different provision for different purposes.

(7)Regulations under this section are to be made by statutory instrument.

241Short title

This Act may be cited as the Online Safety Act 2023.