The Online Safety (CSEA Content Reporting by Regulated User-to-User Service Providers) Regulations 2026

Interpretation

2.  In these Regulations—

“the Act” means the Online Safety Act 2023;

“API” means an application programming interface which can be used to submit reports of CSEA content to the NCA(1);

“connections with other accounts” means connections created as a result of a provider’s service functionality that allow users to establish a direct link between two user accounts;

“CSEA content” has the meaning given in section 59 of the Act;

“data protection legislation” has the meaning given in section 3(9) of the Data Protection Act 2018(2);

“exif data”—

(a)

means metadata embedded within a digital image or video file created in accordance with the exchangeable image file format standard, and

(b)

includes information relating to the circumstances of the file’s creation, such as the date and time of capture, device identifiers, technical camera settings and, where applicable, geolocation co-ordinates;

“hash value” means a string of characters generated by applying mathematical algorithms to a digital file which uniquely represents the content of that file, such as an image or video;

“IP address” means the internet protocol address of a device;

“online portal” means the online portal managed by the NCA which has been provided for the purpose of enabling an organisation administrator or an authorised person to send reports of CSEA content to the NCA;

“platform” means a user-to-user part of a user-to-user service(3);

“port number” means a connection endpoint;

“provider” means a UK provider(4) of a regulated user-to-user service(5), or a non-UK provider(6) of a regulated user-to-user service;

“registering party” means the provider or the third party provider who is registering prescribed information with the NCA;

“reporting duty” means the requirement under section 66 of the Act on providers to report detected(7) and unreported(8) CSEA content to the NCA;

“reporting person” means the person who is submitting a manual report through the online portal, or the person who is the point of contact for reports submitted using the API;

“senior manager” means an individual who plays a significant role in making decisions about, managing or organising the registering party’s activities in relation to the reporting duty, and who could reasonably be expected to ensure compliance;

“third party provider” means a person with whom the provider has contracted to carry out its reporting duty;

“URL” means the full universal resource locator.

(1)

“NCA” has the meaning given in section 70(7) of the Act.

(2)

2018 c. 12; section 3(9) was amended by S.I. 2019/419, Schedule 2, paragraph 4(3) and The Data (Use and Access) Act 2025 (c. 18), section 107(2) and Schedule 11, paragraph 14.

(3)

“User-to-user service” has the meaning given in section 3 of the Act.

(4)

“UK provider” has the meaning given in section 70(2) of the Act.

(5)

“Regulated user-to-user” service has the meaning given in section 4(2) of the Act.

(6)

“Non-UK provider” has the meaning given in section 70(3) of the Act.

(7)

“Detected” has the meaning given in section 70(4) of the Act.

(8)

“Unreported” has the meaning given in section 70(5) of the Act.