39 Duties about fraudulent advertising: Category 2A services
(1) A provider of a Category 2A service must operate the service using proportionate systems and processes designed to—
(a) prevent individuals from encountering content consisting of fraudulent advertisements in or via search results of the service;
(b) if any such content may be encountered in or via search results of the service, minimise the length of time that that is the case;
(c) where the provider is alerted by a person to the fact that such content may be so encountered, or becomes aware of that fact in any other way, swiftly ensure that individuals are no longer able to encounter such content in or via search results of the service.
(2) A provider of a Category 2A service must include clear and accessible provisions in a publicly available statement giving information about any proactive technology used by the service for the purpose of compliance with the duty set out in subsection (1) (including the kind of technology, when it is used, and how it works).
(3) In relation to a Category 2A service, an advertisement is a “fraudulent advertisement” if—
(a) it is a paid-for advertisement (see section 236), and
(b) it amounts to an offence specified in section 40 (construed in accordance with section 59: see subsections (3), (11) and (12) of that section).
(4) The references to encountering fraudulent advertisements “in or via search results” of a search service—
(a) are references to encountering fraudulent advertisements—
(i) in search results of the service, or
(ii) as a result of interacting with a paid-for advertisement in search results of the service (for example, by clicking on it);
(b) do not include references to encountering fraudulent advertisements as a result of any subsequent interactions with an internet service other than the search service.
(5) If a person is the provider of more than one Category 2A service, the duties set out in this section apply in relation to each such service.
(6) In determining what is proportionate for the purposes of this section, the following factors, in particular, are relevant—
(a) the nature, and severity, of potential harm to individuals presented by different kinds of fraudulent advertisement, and
(b) the degree of control a provider has in relation to the placement of advertisements on the service.
(7) The duties set out in this section extend only to the design, operation and use of a Category 2A service in the United Kingdom.
(8) For the meaning of “Category 2A service”, see section 95 (register of categories of services).
(1) This section specifies offences for the purposes of this Chapter (see sections 38(3)(b) and 39(3)(b)).
(2) An offence under any of the following provisions of the Financial Services and Markets Act 2000—
(a) section 23 (contravention of prohibition on carrying on regulated activity unless authorised or exempt);
(b) section 24 (false claims to be authorised or exempt);
(c) section 25 (contravention of restrictions on financial promotion).
(3) An offence under any of the following provisions of the Fraud Act 2006—
(a) section 2 (fraud by false representation);
(b) section 4 (fraud by abuse of position);
(c) section 7 (making or supplying articles for use in frauds);
(d) section 9 (participating in fraudulent business carried on by sole trader etc).
(4) An offence under any of the following provisions of the Financial Services Act 2012—
(a) section 89 (misleading statements);
(b) section 90 (misleading impressions).
(5) An offence of attempting or conspiring to commit an offence specified in subsection (2), (3) or (4).
(6) An offence under Part 2 of the Serious Crime Act 2007 (encouraging or assisting) in relation to an offence specified in subsection (2), (3) or (4), or (in Scotland) inciting a person to commit such an offence.
(7) An offence of aiding, abetting, counselling or procuring the commission of an offence specified in subsection (2), (3) or (4), or (in Scotland) being involved art and part in the commission of such an offence.
(1) OFCOM must prepare and issue a code of practice for providers of Part 3 services describing measures recommended for the purpose of compliance with duties set out in section 10 or 27 (illegal content) so far as relating to terrorism content or offences within Schedule 5 (terrorism offences).
(2) OFCOM must prepare and issue a code of practice for providers of Part 3 services describing measures recommended for the purpose of compliance with duties set out in section 10 or 27 (illegal content) so far as relating to CSEA content or offences within Schedule 6 (child sexual exploitation and abuse offences).
(3) OFCOM must prepare and issue one or more codes of practice for providers of Part 3 services describing measures recommended for the purpose of compliance with the relevant duties (except to the extent that measures for the purpose of compliance with such duties are described in a code of practice prepared under subsection (1) or (2)).
(4) OFCOM must prepare and issue a code of practice for providers of Category 1 services and providers of Category 2A services describing measures recommended for the purpose of compliance with the duties set out in Chapter 5 (fraudulent advertising).
(5) Where a code of practice under this section is in force, OFCOM may—
(a) prepare a draft of amendments of the code of practice;
(b) prepare a draft of a code of practice under subsection (1), (2), (3) or (4) as a replacement for a code of practice previously issued under the subsection in question;
(c) withdraw the code of practice.
(6) In the course of preparing a draft of a code of practice or amendments of a code of practice under this section, OFCOM must consult—
(a) the Secretary of State,
(b) persons who appear to OFCOM to represent providers of Part 3 services,
(c) persons who appear to OFCOM to represent the interests of United Kingdom users of Part 3 services,
(d) persons who appear to OFCOM to represent the interests of children (generally or with particular reference to online safety matters),
(e) persons who appear to OFCOM to represent the interests of persons who have suffered harm as a result of matters to which the code of practice is relevant,
(f) persons whom OFCOM consider to have relevant expertise in equality issues and human rights, in particular—
(i) the right to freedom of expression set out in Article 10 of the Convention, and
(ii) the right to respect for a person’s private and family life, home and correspondence set out in Article 8 of the Convention,
(g) the Information Commission,
(h) the Children’s Commissioner,
(i) the Commissioner for Victims and Witnesses,
(j) the Domestic Abuse Commissioner,
(k) persons whom OFCOM consider to have expertise in public health, science or medicine that is relevant to online safety matters,
(l) persons whom OFCOM consider to have expertise in innovation, or emerging technology, that is relevant to online safety matters, and
(m) such other persons as OFCOM consider appropriate.
(7) In the course of preparing a draft of a code of practice or amendments to which this subsection applies, OFCOM must also consult persons whom OFCOM consider to have expertise in the enforcement of the criminal law and the protection of national security that is relevant to online safety matters.
(8) Subsection (7) applies to—
(a) a code of practice under subsection (1) and amendments of such a code,
(b) a code of practice under subsection (2) and amendments of such a code,
(c) a code of practice under subsection (3) that describes measures recommended for the purpose of compliance with duties set out in section 10 or 27 (illegal content),
(d) amendments of a code of practice under subsection (3), if and to the extent that those amendments relate to measures recommended for the purpose of compliance with duties set out in section 10 or 27, and
(e) a code of practice under subsection (4) and amendments of such a code.
(9) Subsections (6) and (7) are subject to section 48 (minor amendments of code of practice).
(10) In this section “the relevant duties” means the duties set out in—
(a) sections 10 and 27 (illegal content),
(b) sections 12 and 29 (children’s online safety),
(c) section 15 (user empowerment),
(d) section 17 (content of democratic importance),
(e) section 19 (journalistic content),
(f) sections 20 and 31 (content reporting), and
(g) sections 21 and 32 (complaints procedures).
42 Codes of practice: principles, objectives, content
Schedule 4 contains—
(a) provision about the principles OFCOM must consider when preparing codes of practice under section 41,
(b) the online safety objectives (and a power for the Secretary of State by regulations to revise those objectives),
(c) provision about the measures that may be described in codes of practice (including, in particular, constraints on the recommendation of the use of proactive technology), and
(d) other provision related to codes of practice.
(1) Where OFCOM have prepared a draft of a code of practice under section 41, they must submit the draft to the Secretary of State.
(2) Unless the Secretary of State intends to give a direction to OFCOM under section 44(1), (2) or (3) in relation to the draft, the Secretary of State must, as soon as reasonably practicable, lay the draft before Parliament.
(3) If, within the 40-day period, either House of Parliament resolves not to approve the draft—
(a) OFCOM must not issue the code of practice in the form of that draft, and
(b) OFCOM must prepare another draft of the code of practice under section 41.
(4) If no such resolution is made within that period—
(a) OFCOM must issue the code of practice in the form of the draft laid before Parliament, and
(b) the code of practice comes into force at the end of the period of 21 days beginning with the day on which it is issued.
(5) “The 40-day period” is the period of 40 days beginning with the day on which the draft is laid before Parliament (or, if it is not laid before each House of Parliament on the same day, the later of the days on which it is laid).
(6) In calculating the 40-day period, no account is to be taken of any period during which Parliament is dissolved or prorogued or during which both Houses are adjourned for more than 4 days.
(7) Subsections (1) to (6) apply in relation to a draft of amendments of a code of practice prepared under section 41 as they apply in relation to a draft of a code of practice prepared under that section.
(8) This section is subject to section 48 (minor amendments of codes of practice).
(9) Subsection (11) applies to—
(a) a draft of the first code of practice prepared under section 41(1) (terrorism code of practice);
(b) a draft of the first code of practice prepared under section 41(2) (CSEA code of practice);
(c) a draft of the first code of practice prepared under section 41(3) relating to a duty set out in section 10 or 27 (illegal content);
(d) a draft of the first code of practice prepared under section 41(3) relating to a duty set out in section 12 or 29 (children’s online safety);
(e) a draft of the first code of practice prepared under section 41(3) relating to a duty set out in section 20 or 31 (content reporting);
(f) a draft of the first code of practice prepared under section 41(3) relating to—
(i) a duty set out in section 21 (complaints procedures) that concerns complaints of a kind mentioned in subsection (4) or (5) of that section, or
(ii) a duty set out in section 32 (complaints procedures).
(10) For the purposes of paragraphs (c) to (f) of subsection (9) a draft of a code of practice is a draft of the first code of practice relating to a duty if—
(a) it describes measures recommended for the purpose of compliance with the duty, and
(b) it is a draft of the first code of practice prepared under section 41(3) that describes measures for that purpose.
(11) OFCOM must submit a draft to which this subsection applies to the Secretary of State under subsection (1) within the period of 18 months beginning with the day on which this Act is passed.
(12) If OFCOM consider that it is necessary to extend the period mentioned in subsection (11) in relation to a draft mentioned in any of paragraphs (a) to (f) of subsection (9), OFCOM may extend the period in relation to that draft by up to 12 months by making and publishing a statement.
But this is subject to subsection (15).
(13) A statement under subsection (12) must set out—
(a) the reasons why OFCOM consider that it is necessary to extend the period mentioned in subsection (11) in relation to the draft concerned, and
(b) the period of extension.
(14) A statement under subsection (12) may be published at the same time as (or incorporate) a statement under section 194(3) (extension of time to prepare certain guidance).
(15) But a statement under subsection (12) may not be made in relation to a draft mentioned in a particular paragraph of subsection (9) if—
(a) a statement has previously been made under subsection (12) (whether in relation to a draft mentioned in the same or a different paragraph of subsection (9)), or
(b) a statement has previously been made under section 194(3).
(1) The Secretary of State may direct OFCOM to modify a draft of a code of practice submitted under section 43(1) if the Secretary of State believes that modifications are required for the purpose of securing compliance with an international obligation of the United Kingdom.
(2) The Secretary of State may direct OFCOM to modify a draft of a code of practice, other than a terrorism or CSEA code of practice, submitted under section 43(1) if the Secretary of State believes that modifications are required for exceptional reasons relating to—
(a) national security,
(b) public safety,
(c) public health, or
(d) relations with the government of a country outside the United Kingdom.
(3) The Secretary of State may direct OFCOM to modify a draft of a terrorism or CSEA code of practice submitted under section 43(1) if the Secretary of State believes that modifications are required—
(a) for reasons of national security or public safety, or
(b) for exceptional reasons relating to public health or relations with the government of a country outside the United Kingdom.
(4) But if a draft of a terrorism or CSEA code of practice is submitted under section 43(1) following a review under section 47(2), the Secretary of State may only direct OFCOM to modify the draft if the Secretary of State believes that modifications are required for reasons of national security or public safety.
(5) If, following a review of a terrorism or CSEA code of practice under section 47(2), OFCOM submit a statement to the Secretary of State under section 47(3)(b) (“OFCOM’s review statement”), the Secretary of State may direct OFCOM to modify the code of practice if the Secretary of State believes that modifications are required for reasons of national security or public safety.
(6) A direction given under subsection (5)—
(a) must be given within the period of 45 days beginning with the day on which OFCOM’s review statement is submitted to the Secretary of State, and
(b) must make particular reference to OFCOM’s review statement.
(7) A direction given under this section—
(a) may not require OFCOM to include in a code of practice provision about a particular measure recommended to be taken or used by providers of Part 3 services,
(b) must set out the Secretary of State’s reasons for requiring modifications, except in a case where the Secretary of State considers that doing so would be against the interests of national security, public safety or relations with the government of a country outside the United Kingdom, and
(c) must, as soon as reasonably practicable, be published and laid before Parliament.
(8) If the Secretary of State considers that publishing and laying before Parliament a direction given under this section would be against the interests of national security, public safety or relations with the government of a country outside the United Kingdom—
(a) subsection (7)(c) does not apply in relation to the direction, and
(b) the Secretary of State must, as soon as reasonably practicable, publish and lay before Parliament a document stating—
(i) that a direction has been given,
(ii) the kind of code of practice to which it relates, and
(iii) the reasons for not publishing it.
(9) If the Secretary of State gives a direction under this section, OFCOM must, as soon as reasonably practicable—
(a) comply with the direction,
(b) submit to the Secretary of State a draft of the code of practice modified in accordance with the direction,
(c) submit to the Secretary of State a document containing—
(i) (except in a case mentioned in subsection (7)(b)) details of the direction, and
(ii) details about how the draft has been revised in response to the direction,
(d) publish the document, and
(e) inform the Secretary of State about modifications that OFCOM have made to the draft that are not in response to the direction (if there are any).
(10) The Secretary of State may give OFCOM one or more further directions requiring OFCOM to modify the draft of the code of practice.
(11) Such further directions may only be given for the reasons set out in subsection (1), (2), (3), (4) or (5) (as the case may be), and subsections (7) to (9) apply again in relation to such further directions.
(12) When the Secretary of State is satisfied that no further modifications to the draft are required, the Secretary of State must, as soon as reasonably practicable, lay before Parliament—
(a) the modified draft,
(b) any document submitted by OFCOM as mentioned in subsection (9)(c), and
(c) in the case of a direction under subsection (5), OFCOM’s review statement.
(13) Before laying OFCOM’s review statement before Parliament, the Secretary of State may, with OFCOM’s agreement, remove or obscure information in the statement (whether by redaction or otherwise) in order to prevent the disclosure of matters that the Secretary of State considers would be against the interests of national security, public safety or relations with the government of a country outside the United Kingdom.
(14) This section applies in relation to a draft of amendments of a code of practice submitted under section 43(1) as it applies in relation to a draft of a code of practice submitted under that provision.
(15) In this section “terrorism or CSEA code of practice” means a code of practice under section 41(1) or (2).
45 Procedure for issuing codes of practice following direction under section 44
(1) This section sets out the procedure that applies where a draft of a code of practice is laid before Parliament under section 44(12).
(2) If the draft contains modifications made following a direction given under section 44(1), (2) or (3)(b), the affirmative procedure applies.
(3) If the draft contains modifications made following a direction given under section 44(3)(a), (4) or (5), the negative procedure applies.
(4) The “affirmative procedure” is as follows—
(a) a code of practice in the form of the draft laid before Parliament must not be issued by OFCOM unless the draft has been approved by a resolution of each House of Parliament;
(b) if the draft is so approved, the code of practice comes into force at the end of the period of 21 days beginning with the day on which it is issued;
(c) if the draft is not so approved, OFCOM must prepare another draft of the code of practice under section 41.
(5) The “negative procedure” is as follows—
(a) if, within the 40-day period, either House of Parliament resolves not to approve the draft—
(i) OFCOM must not issue the code of practice in the form of that draft, and
(ii) OFCOM must prepare another draft of the code of practice under section 41;
(b) if no such resolution is made within that period—
(i) OFCOM must issue the code of practice in the form of the draft laid before Parliament, and
(ii) the code of practice comes into force at the end of the period of 21 days beginning with the day on which it is issued.
(6) “The 40-day period” has the same meaning as in section 43 (see subsections (5) and (6) of that section).
(7) This section applies in relation to a draft of amendments of a code of practice laid before Parliament under section 44(12) as it applies in relation to a draft of a code of practice laid under that provision.
(1) OFCOM must publish each code of practice issued under section 43 or 45 within the period of three days beginning with the day on which it is issued.
(2) Where amendments of a code of practice are issued under either of those sections, OFCOM must publish the amended code of practice within the period of three days beginning with the day on which the amendments are issued.
(3) Where a code of practice is withdrawn, OFCOM must publish a notice to that effect.
(1) OFCOM must keep under review each code of practice published under section 46.
(2) The Secretary of State may require OFCOM to review a terrorism or CSEA code of practice published under section 46 if the Secretary of State considers a review to be necessary for reasons of national security or public safety (and the Secretary of State must notify OFCOM whether the reasons fall into the category of national security or public safety).
(3) OFCOM must carry out a review of the code of practice under subsection (2) as soon as reasonably practicable, and when it is completed—
(a) if OFCOM consider that changes are required, they must prepare a draft of amendments to the code of practice or a draft of a replacement code of practice under section 41, or
(b) if OFCOM consider that no changes are required, they must submit to the Secretary of State a statement which explains the reasons for that conclusion.
(4) Subsection (5) applies if—
(a) OFCOM submit a statement under subsection (3)(b) to the Secretary of State,
(b) the period of 45 days beginning with the day on which the statement was submitted has elapsed, and
(c) the Secretary of State has not given a direction under section 44(5).
(5) OFCOM must publish the statement as soon as reasonably practicable after the end of the period mentioned in subsection (4)(b), making it clear which code of practice the statement relates to.
(6) In advance of publication, the Secretary of State may make representations to OFCOM about the desirability of removing or obscuring information in the statement (whether by redaction or otherwise) in order to prevent the disclosure of matters that the Secretary of State considers would be against the interests of national security, public safety or relations with the government of a country outside the United Kingdom (and see also section 116(3)).
(7) In this section “terrorism or CSEA code of practice” means a code of practice under section 41(1) or (2).
(1) This section applies if—
(a) OFCOM propose to amend a code of practice under section 41, and
(b) OFCOM consider that the minor nature of the proposal means that—
(i) consultation is unnecessary, and
(ii) the proposed amendments should not be required to be laid before Parliament.
(2) OFCOM must notify the Secretary of State of the proposed amendments.
(3) If the Secretary of State agrees with OFCOM that it is appropriate—
(a) the consultation requirements set out in section 41(6) and (7) do not apply in relation to the proposed amendments, and
(b) section 43 does not apply to the amendments, once prepared.
(4) If the Secretary of State agrees with OFCOM as mentioned in subsection (3), OFCOM may prepare and issue the amendments of the code of practice.
(5) Amendments of a code of practice issued under this section come into force at the end of the period of 21 days beginning with the day on which the amendments are issued.
(6) Section 46(2) applies in relation to amendments of a code of practice issued under this section as it applies in relation to amendments of a code of practice issued under section 43 or 45.
49 Relationship between duties and codes of practice
Duties set out in Chapters 2 and 3
(1) A provider of a Part 3 service is to be treated as complying with a relevant duty if the provider takes or uses the measures described in a code of practice which are recommended for the purpose of compliance with the duty in question.
(2) A provider of a user-to-user service—
(a) is to be treated as complying with the duty set out in section 22(2) (freedom of expression) if the provider takes or uses such of the relevant recommended measures as incorporate safeguards to protect users’ right to freedom of expression within the law;
(b) is to be treated as complying with the duty set out in section 22(3) (privacy) if the provider takes or uses such of the relevant recommended measures as incorporate safeguards to protect the privacy of users.
(3) A provider of a search service—
(a) is to be treated as complying with the duty set out in section 33(2) (freedom of expression) if the provider takes or uses such of the relevant recommended measures as incorporate safeguards to protect the rights of users and interested persons to freedom of expression within the law;
(b) is to be treated as complying with the duty set out in section 33(3) (privacy) if the provider takes or uses such of the relevant recommended measures as incorporate safeguards to protect the privacy of users.
Duties set out in Chapter 5
(4) A provider of a Category 1 service or a Category 2A service (or a provider of a service which is both a Category 1 service and a Category 2A service) is to be treated as complying with a duty set out in Chapter 5 if the provider takes or uses the measures described in a fraudulent advertising code of practice which are recommended for the purpose of compliance with the duty in question.
Alternative measures
(5) A provider of a Part 3 service who seeks to comply with a relevant duty by acting otherwise than by taking or using a measure described in a code of practice or a fraudulent advertising code of practice which is recommended for the purpose of compliance with the duty must have particular regard to the importance of the following (where relevant)—
(a) protecting the right of users and (in the case of search services) interested persons to freedom of expression within the law, and
(b) protecting the privacy of users.
(6) When assessing whether a provider of a Part 3 service is compliant with a relevant duty where the provider has acted otherwise than by taking or using a measure described in a code of practice or a fraudulent advertising code of practice which is recommended for the purpose of compliance with the duty, OFCOM must consider the extent to which the alternative measures taken or in use by the provider—
(a) extend across all areas of a service as mentioned in section 10(4), 12(8), 27(4) or 29(4) (if relevant to the duty in question), and
(b) (where appropriate) incorporate safeguards for the protection of the matters mentioned in subsection (5)(a) and (b).
Interpretation
(7) In subsections (1) to (4), references to taking or using measures recommended for the purpose of compliance with a duty, or to taking or using relevant recommended measures, are to taking or using such of those measures as are relevant to the provider and the service in question.
(8) In this section—
(a) references to protecting the privacy of users are to protecting users from a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of a user-to-user service or search service (including, but not limited to, any such provision or rule concerning the processing of personal data);
(b) references to a search service include references to a combined service (see section 7(6)).
(9) In this section—
“Chapter 2 safety duty” means a duty set out in—
section 10 (illegal content), or
section 12 (children’s online safety);
“Chapter 3 safety duty” means a duty set out in—
section 27 (illegal content), or
section 29 (children’s online safety);
“code of practice” means a code of practice published under section 46, except a fraudulent advertising code of practice;
“fraudulent advertising code of practice” means a code of practice prepared under section 41(4) and published under section 46;
“relevant duty” means—
a Chapter 2 safety duty,
a Chapter 3 safety duty,
a duty set out in section 15 (user empowerment),
a duty set out in section 17 (content of democratic importance),
a duty set out in section 19 (journalistic content),
a duty set out in section 20 or 31 (content reporting), or
a duty set out in section 21 or 32 (complaints procedures);
“relevant recommended measures” means the measures described in a code of practice which are recommended for the purpose of compliance with—
in the case of a user-to-user service—
a Chapter 2 safety duty, or
a duty set out in section 15 (user empowerment);
in the case of a search service, a Chapter 3 safety duty.
(1) A failure by a provider of a Part 3 service to act in accordance with a provision of a code of practice does not of itself make the provider liable to legal proceedings in a court or tribunal.
(2) A code of practice is admissible in evidence in legal proceedings.
(3) In any proceedings in a court or tribunal, the court or tribunal must take into account a provision of a code of practice in determining a question arising in the proceedings if—
(a) the question relates to a time when the provision was in force, and
(b) the provision appears to the court or tribunal to be relevant to the question.
(4) OFCOM must take into account a provision of a code of practice in determining a question arising in connection with their exercise of any relevant function if—
(a) the question relates to a time when the provision was in force, and
(b) the provision appears to OFCOM to be relevant to the question.
(5) In this section—
“code of practice” means a code of practice published under section 46;
“relevant functions” means OFCOM’s functions under—
Chapter 4 of Part 7 (information),
Chapter 5 of Part 7 (notices to deal with terrorism content and CSEA content),
Chapter 6 of Part 7 (enforcement), and
Chapter 2 of Part 8 (super-complaints).
(1) A duty mentioned in subsection (3) applies to providers of Part 3 services from the day on which a code of practice prepared under section 41(3) that is the first code of practice relating to that duty comes into force.
(2) In the case of the duties set out in sections 10 and 27, subsection (1) is subject to subsections (5) and (6).
(3) The duties referred to in subsection (1) are the duties set out in—
(a) sections 10 and 27 (illegal content),
(b) sections 12 and 29 (children’s online safety),
(c) section 15 (user empowerment),
(d) section 17 (content of democratic importance),
(e) section 19 (journalistic content),
(f) sections 20 and 31 (content reporting), and
(g) sections 21 and 32 (complaints procedures).
(4) For the purposes of subsection (1) a code of practice is the first code of practice relating to a duty if—
(a) it describes measures recommended for the purpose of compliance with that duty, and
(b) it is the first code of practice prepared under section 41(3) that describes measures for that purpose.
(5) The duties set out in sections 10 and 27, so far as relating to terrorism content or offences within Schedule 5 (terrorism offences), apply to providers of Part 3 services from the day on which the first code of practice prepared under section 41(1) comes into force.
(6) The duties set out in sections 10 and 27, so far as relating to CSEA content or offences within Schedule 6 (child sexual exploitation and abuse offences), apply to providers of Part 3 services from the day on which the first code of practice prepared under section 41(2) comes into force.
(7) The duties set out in Chapter 5 (fraudulent advertising) apply to providers of a Category 1 service and providers of a Category 2A service (and to providers of a service which is both a Category 1 service and a Category 2A service) from the day on which the first code of practice prepared under section 41(4) comes into force.
(8) In relation to the provider of a particular Part 3 service, references in this section to duties applying to providers of Part 3 services (or to providers of Category 1 services or Category 2A services) are to such duties as apply in relation to that service in accordance with sections 7 and 24 or (as the case may be) Chapter 5.
(9) This section is subject to Part 2 of Schedule 17 (video-sharing platform services: transitional provision etc).
52 OFCOM’s guidance about certain duties in Part 3
(1) OFCOM must produce guidance for providers of Category 1 services to assist them in complying with their duties set out in section 14 (assessments related to the adult user empowerment duty set out in section 15(2)).
(2) OFCOM must produce guidance for providers of Category 1 services to assist them in complying with their duties set out in section 18 (news publisher content).
(3) OFCOM must produce guidance for providers of Part 3 services to assist them in complying with—
(a) their duties set out in section 23 or 34, except the duty set out in section 23(10) or 34(9) (record-keeping and review), and
(b) their duties set out in section 36 (children’s access assessments).
(4) Before producing guidance under subsection (1) or (3) (including revised or replacement guidance), OFCOM must consult the Information Commission.
(5) OFCOM must publish guidance under this section (and any revised or replacement guidance).
53 OFCOM’s guidance: content that is harmful to children and user empowerment
(1) OFCOM must produce guidance for providers of Part 3 services which contains examples of content or kinds of content that OFCOM consider to be, or consider not to be—
(a) primary priority content that is harmful to children, or
(b) priority content that is harmful to children.
(2) OFCOM must produce guidance for providers of Category 1 services which contains examples of content or kinds of content that OFCOM consider to be, or consider not to be, content to which section 15(2) applies (see section 16).
(3) Before producing any guidance under this section (including revised or replacement guidance), OFCOM must consult such persons as they consider appropriate.
(4) OFCOM must publish guidance under this section (and any revised or replacement guidance).
54 OFCOM’s guidance about protecting women and girls
(1) OFCOM must produce guidance for providers of Part 3 services which focuses on content and activity—
(a) in relation to which such providers have duties set out in this Part or Part 4, and
(b) which disproportionately affects women and girls.
(2) The guidance may, among other things—
(a) contain advice and examples of best practice for assessing risks of harm to women and girls from content and activity mentioned in subsection (1), and for reducing such risks;
(b) refer to provisions contained in a code of practice under section 41 which are particularly relevant to the protection of women and girls from such content and activity.
(3) Before producing the guidance (including revised or replacement guidance), OFCOM must consult—
(a) the Commissioner for Victims and Witnesses,
(b) the Domestic Abuse Commissioner, and
(c) such other persons as OFCOM consider appropriate.
(4) OFCOM must publish the guidance (and any revised or replacement guidance).
(1) This section applies for the purposes of this Part.
(2) “Regulated user-generated content”, in relation to a regulated user-to-user service, means user-generated content, except—
(a) emails,
(b) SMS messages,
(c) MMS messages,
(d) one-to-one live aural communications (see subsection (5)),
(e) comments and reviews on provider content (see subsection (6)),
(f) identifying content that accompanies content within any of paragraphs (a) to (e), and
(g) news publisher content (see subsection (8)).
(3) “User-generated content”, in relation to a user-to-user service, means content—
(a) that is—
(i) generated directly on the service by a user of the service, or
(ii) uploaded to or shared on the service by a user of the service, and
(b) that may be encountered by another user, or other users, of the service by means of the service.
(4) For the purposes of subsection (3)—
(a) the reference to content generated, uploaded or shared by a user includes content generated, uploaded or shared by means of software or an automated tool applied by the user;
(b) a bot or other automated tool is to be regarded as a user of a service if—
(i) the functions of the bot or tool include interacting with user-generated content, and
(ii) the bot or tool is not controlled by or on behalf of the provider of the service.
(5) “One-to-one live aural communications”, in relation to a user-to-user service, means content—
(a) consisting of speech or other sounds conveyed in real time between two users of the service by means of the service,
(b) that is not a recording, and
(c) that is not accompanied by user-generated content of any other kind, except identifying content.
(6) “Comments and reviews on provider content”, in relation to a user-to-user service, means content present on the service consisting of comments or reviews relating to provider content (together with any further comments on such comments or reviews).
(7) In subsection (6) “provider content” means content published on a service by the provider of the service or by a person acting on behalf of the provider, including where the publication of the content is effected or controlled by means of—
(a) software or an automated tool or algorithm applied by the provider or by a person acting on behalf of the provider, or
(b) an automated tool or algorithm made available on the service by the provider or by a person acting on behalf of the provider.
For the purposes of subsection (6), content that is user-generated content in relation to a service is not to be regarded as provider content in relation to that service.
(8) “News publisher content”, in relation to a regulated user-to-user service, means any content present on the service that is within subsection (9) or (10).
(9) Content is within this subsection if it was generated directly on the service by a user of the service that is a recognised news publisher.
(10) Content is within this subsection if—
(a) the content was uploaded to or shared on the service by a user of the service, and
(b) the content either—
(i) reproduces in full an article or written item that was originally published by a recognised news publisher (and is not a screenshot or photograph of that article or item or of part of it),
(ii) is video or audio content that was originally published or broadcast by a recognised news publisher, and is not a clipped or edited form of such content (unless it is the recognised news publisher who has clipped or edited it), or
(iii) is a link to an article or item within sub-paragraph (i) or to content within sub-paragraph (ii).
(11) For the meaning of “recognised news publisher”, see section 56.
(12) In this section—
“MMS message” means a Multimedia Messaging Service message (that may include images, sounds and short videos) that may be sent between telephone numbers allocated in accordance with a national or international numbering plan;
“SMS message” means a Short Message Service text message composed principally of letters or numbers that may be sent between telephone numbers allocated in accordance with a national or international numbering plan.
(1) In this Part, “recognised news publisher” means any of the following entities—
(a) the British Broadcasting Corporation,
(b) Sianel Pedwar Cymru,
(c) the holder of a licence under the Broadcasting Act 1990 or 1996 who publishes news-related material in connection with the broadcasting activities authorised under the licence, and
(d) any other entity which—
(i) meets all of the conditions in subsection (2),
(ii) is not an excluded entity (see subsection (3)), and
(iii) is not a sanctioned entity (see subsection (4)).
(2) The conditions referred to in subsection (1)(d)(i) are that the entity—
(a) has as its principal purpose the publication of news-related material, and such material—
(i) is created by different persons, and
(ii) is subject to editorial control,
(b) publishes such material in the course of a business (whether or not carried on with a view to profit),
(c) is subject to a standards code,
(d) has policies and procedures for handling and resolving complaints,
(e) has a registered office or other business address in the United Kingdom,
(f) is the person with legal responsibility for material published by it in the United Kingdom, and
(g) publishes—
(i) the entity’s name, the address mentioned in paragraph (e) and the entity’s registered number (if any), and
(ii) the name and address of any person who controls the entity (including, where such a person is an entity, the address of that person’s registered or principal office and that person’s registered number (if any)).
(3) An “excluded entity” is an entity—
(a) which is a proscribed organisation under the Terrorism Act 2000 (see section 3 of that Act), or
(b) the purpose of which is to support a proscribed organisation under that Act.
(4) A “sanctioned entity” is an entity which—
(a) is designated by name under a power contained in regulations under section 1 of the Sanctions and Anti-Money Laundering Act 2018 that authorises the Secretary of State or the Treasury to designate persons for the purposes of the regulations or of any provisions of the regulations, or
(b) is a designated person under any provision included in such regulations by virtue of section 13 of that Act (persons named by or under UN Security Council Resolutions).
(5) For the purposes of subsection (2)—
(a) news-related material is “subject to editorial control” if there is a person (whether or not the publisher of the material) who has editorial or equivalent responsibility for the material, including responsibility for how it is presented and the decision to publish it;
(b) “control” has the same meaning as it has in the Broadcasting Act 1990 by virtue of section 202 of that Act.
(6) In this section—
“news-related material” means material consisting of—
news or information about current affairs,
opinion about matters relating to the news or current affairs, or
gossip about celebrities, other public figures or other persons in the news;
“publish” means publish by any means (including by broadcasting), and references to a publisher and publication are to be construed accordingly;
“standards code” means—
a code of standards that regulates the conduct of publishers, that is published by an independent regulator, or
a code of standards that regulates the conduct of the entity in question, that is published by the entity itself.
(1) This section applies for the purposes of this Part.
(2) “Search content” means content that may be encountered in or via search results of a search service, except—
(a) paid-for advertisements (see section 236),
(b) content on the website of a recognised news publisher (see section 56), and
(c) content that—
(i) reproduces in full an article or written item that was originally published by a recognised news publisher (and is not a screenshot or photograph of that article or item or of part of it),
(ii) is video or audio content that was originally published or broadcast by a recognised news publisher, and is not a clipped or edited form of such content (unless it is the recognised news publisher who has clipped or edited it), or
(iii) is a link to an article or item within sub-paragraph (i) or to content within sub-paragraph (ii).
(3) “Search results”, in relation to a search service, means content presented to a user of the service by operation of the search engine in response to a search request made by the user.
(4) “Search” means search by any means, including by input of text or images or by speech, and references to a search request are to be construed accordingly.
(5) In subsection (2), the reference to encountering content “via search results”—
(a) is to encountering content as a result of interacting with search results (for example, by clicking on them);
(b) does not include a reference to encountering content as a result of subsequent interactions with an internet service other than the search service.
(6) In this section references to a search service include references to a user-to-user service that includes a search engine.
(1) This section applies for the purposes of this Part.
(2) References to restricting users’ access to content, and related references, include any case where a provider takes or uses a measure which has the effect that—
(a) a user is unable to access content without taking a prior step (whether or not taking that step might result in access being denied), or
(b) content is temporarily hidden from a user.
(3) But such references do not include any case where—
(a) the effect mentioned in subsection (2) results from the voluntary use or application by a user of features, functionalities or settings which a provider includes in a service (for example, features, functionalities or settings included in compliance with the duty set out in section 15(2) or (9) (user empowerment)), or
(b) access to content is controlled by another user, rather than the provider.
(4) See also section 236(6).
(1) This section applies for the purposes of this Part.
(2) “Illegal content” means content that amounts to a relevant offence.
(3) Content consisting of certain words, images, speech or sounds amounts to a relevant offence if—
(a) the use of the words, images, speech or sounds amounts to a relevant offence,
(b) the possession, viewing or accessing of the content constitutes a relevant offence, or
(c) the publication or dissemination of the content constitutes a relevant offence.
(4) “Relevant offence” means—
(a) a priority offence, or
(b) an offence within subsection (5).
(5) An offence is within this subsection if—
(a) it is not a priority offence,
(b) the victim or intended victim of the offence is an individual (or individuals), and
(c) the offence is created by this Act or, before or after this Act is passed, by—
(i) another Act,
(ii) an Order in Council,
(iii) an order, rules or regulations made under an Act by the Secretary of State or other Minister of the Crown, including such an instrument made jointly with a devolved authority, or
(iv) devolved subordinate legislation made by a devolved authority with the consent of the Secretary of State or other Minister of the Crown.
(6) But an offence is not within subsection (5) if—
(a) the offence concerns—
(i) the infringement of intellectual property rights,
(ii) the safety or quality of goods (as opposed to what kind of goods they are), or
(iii) the performance of a service by a person not qualified to perform it; or
(b) it is an offence under Chapter 1 of Part 4 of the Digital Markets, Competition and Consumers Act 2024.
(7) “Priority offence” means—
(a) an offence specified in Schedule 5 (terrorism offences),
(b) an offence specified in Schedule 6 (offences related to child sexual exploitation and abuse), or
(c) an offence specified in Schedule 7 (other priority offences).
(8) “Terrorism content” means content that amounts to an offence specified in Schedule 5.
(9) “CSEA content” means content that amounts to an offence specified in Schedule 6.
(10) “Priority illegal content” means—
(a) terrorism content,
(b) CSEA content, and
(c) content that amounts to an offence specified in Schedule 7.
(10A) “Intimate image content” means content that amounts to an offence under section 66B(1), (2) or (3) of the Sexual Offences Act 2003 (sharing intimate image of a person without consent).
(11) For the purposes of determining whether content amounts to an offence, no account is to be taken of whether or not anything done in relation to the content takes place in any part of the United Kingdom.
(12) References in subsection (3) to conduct of particular kinds are not to be taken to prevent content generated by a bot or other automated tool from being capable of amounting to an offence (see also section 192(7) (providers’ judgements about the status of content)).
(13) Subsection (14) applies in relation to a regulated user-to-user service (but, in the case of a combined service, does not apply in relation to the search content of the service).
(14) References to “illegal content”, “terrorism content”, “CSEA content” , “priority illegal content” and “intimate image content” are to be read as—
(a) limited to content within the definition in question that is regulated user-generated content in relation to the service, and
(b) including material which, if it were present on the service, would be content within paragraph (a) (and this section is to be read with such modifications as may be necessary for the purpose of this paragraph).
(15) In this section—
“devolved authority” means—
the Scottish Ministers,
the Welsh Ministers, or
a Northern Ireland department;
“devolved subordinate legislation” means—
an instrument made under an Act of the Scottish Parliament,
an instrument made under an Act or Measure of Senedd Cymru, or
an instrument made under Northern Ireland legislation;
“Minister of the Crown” has the meaning given by section 8 of the Ministers of the Crown Act 1975 and also includes the Commissioners for His Majesty’s Revenue and Customs;
“offence” means an offence under the law of any part of the United Kingdom.
(16) See also section 192 (providers’ judgements about the status of content).
(1) This section and sections 61 and 62 apply for the purposes of this Part.
(2) “Content that is harmful to children” means—
(a) primary priority content that is harmful to children (see section 61),
(b) priority content that is harmful to children (see section 62), or
(c) content, not within paragraph (a) or (b), of a kind which presents a material risk of significant harm to an appreciable number of children in the United Kingdom.
(3) Content is not to be regarded as within subsection (2)(c) if the risk of harm flows from—
(a) the content’s potential financial impact,
(b) the safety or quality of goods featured in the content, or
(c) the way in which a service featured in the content may be performed (for example, in the case of the performance of a service by a person not qualified to perform it).
(4) “Non-designated content that is harmful to children” means content within subsection (2)(c).
(5) Subsection (6) applies in relation to a regulated user-to-user service (but, in the case of a combined service, does not apply in relation to the search content of the service).
(6) References to “primary priority content that is harmful to children”, “priority content that is harmful to children”, “content that is harmful to children” and “non-designated content that is harmful to children” are to be read as—
(a) limited to content within the definition in question that is regulated user-generated content in relation to the service, and
(b) including material which, if it were present on the service, would be content within paragraph (a) (and this section and sections 61 and 62 are to be read with such modifications as may be necessary for the purpose of this paragraph).
61 “Primary priority content that is harmful to children”
(1) “Primary priority content that is harmful to children” means content of any of the following kinds.
(2) Pornographic content, other than content within subsection (6).
(3) Content which encourages, promotes or provides instructions for suicide.
(4) Content which encourages, promotes or provides instructions for an act of deliberate self-injury.
(5) Content which encourages, promotes or provides instructions for an eating disorder or behaviours associated with an eating disorder.
(6) Content is within this subsection if it—
(a) consists only of text, or
(b) consists only of text accompanied by—
(i) identifying content which consists only of text,
(ii) other identifying content which is not itself pornographic content,
(iii) a GIF which is not itself pornographic content,
(iv) an emoji or other symbol, or
(v) any combination of content mentioned in sub-paragraphs (i) to (iv).
(7) In this section and section 62 “injury” includes poisoning.
(1) “Priority content that is harmful to children” means content of any of the following kinds.
(2) Content which is abusive and which targets any of the following characteristics—
(a) race,
(b) religion,
(c) sex,
(d) sexual orientation,
(e) disability, or
(f) gender reassignment.
(3) Content which incites hatred against people—
(a) of a particular race, religion, sex or sexual orientation,
(b) who have a disability, or
(c) who have the characteristic of gender reassignment.
(4) Content which encourages, promotes or provides instructions for an act of serious violence against a person.
(5) Bullying content.
(6) Content which—
(a) depicts real or realistic serious violence against a person;
(b) depicts the real or realistic serious injury of a person in graphic detail.
(7) Content which—
(a) depicts real or realistic serious violence against an animal;
(b) depicts the real or realistic serious injury of an animal in graphic detail;
(c) realistically depicts serious violence against a fictional creature or the serious injury of a fictional creature in graphic detail.
(8) Content which encourages, promotes or provides instructions for a challenge or stunt highly likely to result in serious injury to the person who does it or to someone else.
(9) Content which encourages a person to ingest, inject, inhale or in any other way self-administer—
(a) a physically harmful substance;
(b) a substance in such a quantity as to be physically harmful.
(10) In subsections (2) and (3)—
(a) “disability” means any physical or mental impairment;
(b) “race” includes colour, nationality, and ethnic or national origins;
(c) references to religion include references to a lack of religion.
(11) For the purposes of subsection (3), a person has the characteristic of gender reassignment if the person is proposing to undergo, is undergoing or has undergone a process (or part of a process) for the purpose of reassigning the person’s sex by changing physiological or other attributes of sex, and the reference to gender reassignment in subsection (2) is to be construed accordingly.
(12) For the purposes of subsection (5) content may, in particular, be “bullying content” if it is content targeted against a person which—
(a) conveys a serious threat;
(b) is humiliating or degrading;
(c) forms part of a campaign of mistreatment.
(13) In subsection (6) “person” is not limited to a real person.
(14) In subsection (7) “animal” is not limited to a real animal.
63 Content harmful to children: OFCOM’s review and report
(1) OFCOM must carry out reviews of—
(a) the incidence on regulated user-to-user services of content that is harmful to children,
(b) the incidence on regulated search services and combined services of search content that is harmful to children, and
(c) the severity of harm that children in the United Kingdom suffer, or may suffer, as a result of those kinds of content.
(2) OFCOM must produce and publish a report on the outcome of each review.
(3) The report must include advice as to whether, in OFCOM’s opinion, it is appropriate to make changes to sections 61 and 62, specifying the changes that OFCOM recommend.
(4) The reports must be published not more than three years apart.
(5) The first report must be published before the end of the period of three years beginning with the day on which this Act is passed.
(6) OFCOM must send a copy of each report to the Secretary of State.
(1) A provider of a Category 1 service must offer all adult users of the service the option to verify their identity (if identity verification is not required for access to the service).
(2) The verification process may be of any kind (and in particular, it need not require documentation to be provided).
(3) A provider of a Category 1 service must include clear and accessible provisions in the terms of service explaining how the verification process works.
(4) If a person is the provider of more than one Category 1 service, the duties set out in this section apply in relation to each such service.
(5) The duty set out in subsection (1) applies in relation to all adult users, not just those who begin to use a service after that duty begins to apply.
(6) The duties set out in this section extend only to—
(a) the user-to-user part of a service, and
(b) the design, operation and use of a service in the United Kingdom.
(7) For the purposes of this section a person is an “adult user” of a service if the person is an adult in the United Kingdom who—
(a) is a user of the service, or
(b) seeks to begin to use the service (for example by setting up an account).
(8) For the meaning of “Category 1 service”, see section 95 (register of categories of services).
65 OFCOM’s guidance about user identity verification
(1) OFCOM must produce guidance for providers of Category 1 services to assist them in complying with the duty set out in section 64(1).
(2) In producing the guidance (including revised or replacement guidance), OFCOM must have particular regard to the desirability of ensuring that providers of Category 1 services offer users a form of identity verification likely to be available to vulnerable adult users.
(3) Before producing the guidance (including revised or replacement guidance), OFCOM must consult—
(a) the Information Commission,
(b) persons whom OFCOM consider to have technological expertise relevant to the duty set out in section 64(1),
(c) persons who appear to OFCOM to represent the interests of vulnerable adult users of Category 1 services, and
(d) such other persons as OFCOM consider appropriate.
(4) OFCOM must publish the guidance (and any revised or replacement guidance).
(1) A UK provider of a regulated user-to-user service must operate the service using systems and processes which secure (so far as possible) that the provider reports all detected and unreported CSEA content present on the service to the NCA.
(2) A non-UK provider of a regulated user-to-user service must operate the service using systems and processes which secure (so far as possible) that the provider reports all detected and unreported UK-linked CSEA content present on the service to the NCA (and does not report to the NCA CSEA content which is not UK-linked).
(3) A UK provider of a regulated search service must operate the service using systems and processes which secure (so far as possible) that the provider reports all detected and unreported CSEA content present on websites or databases capable of being searched by the search engine to the NCA.
(4) A non-UK provider of a regulated search service must operate the service using systems and processes which secure (so far as possible) that the provider reports all detected and unreported UK-linked CSEA content present on websites or databases capable of being searched by the search engine to the NCA (and does not report to the NCA CSEA content which is not UK-linked).
(5) A UK provider of a combined service must comply with the requirement under subsection (3) in relation to the search engine of the service.
(6) A non-UK provider of a combined service must comply with the requirement under subsection (4) in relation to the search engine of the service.
(7) Providers’ reports under this section—
(a) must meet the requirements set out in regulations under section 67, and
(b) must be sent to the NCA in the manner, and within the time frames, set out in those regulations.
(8) If a person is the provider of more than one regulated user-to-user service or regulated search service, requirements under this section apply in relation to each such service.
(9) Terms used in this section are defined in section 70.
(10) This section applies only in relation to CSEA content detected on or after the date on which this section comes into force.
(1) The Secretary of State must make regulations in connection with the reports that are to be made to the NCA (including by non-UK providers) as required by section 66.
(2) The regulations may make provision about—
(a) the information to be included in the reports,
(b) the format of the reports,
(c) the manner in which the reports must be sent to the NCA,
(d) the time frames for sending the reports to the NCA (including provision about cases of particular urgency),
(e) the records that providers must keep in relation to the reports, or the details that providers must retain as evidence that they have made the reports, and
(f) such other matters relating to the reports as the Secretary of State considers appropriate.
(3) The regulations may also—
(a) require providers to retain, for a specified period, data of a specified description associated with a report, and
(b) impose restrictions or requirements in relation to the retention of such data (including how the data is to be secured or stored or who may access the data).
(4) The power to require the retention of data associated with a report includes power to require the retention of—
(a) content generated, uploaded or shared by any user mentioned in the report (or metadata relating to such content), and
(b) user data relating to any such person (or metadata relating to such data).
“User data” here has the meaning given by section 231.
(5) Before making regulations under this section, the Secretary of State must consult—
(a) the NCA,
(b) OFCOM, and
(c) such other persons as the Secretary of State considers appropriate.
In section 16 of the Crime and Courts Act 2013 (interpretation of Part 1), in subsection (1), in the definition of “permitted purpose”, after paragraph (o) insert—
(oa) the exercise of any function of OFCOM (the Office of Communications) under the Online Safety Act 2023;
.
(1) A person commits an offence if, in purported compliance with a requirement under section 66—
(a) the person provides information that is false in a material respect, and
(b) at the time the person provides it, the person knows that it is false in a material respect or is reckless as to whether it is false in a material respect.
(2) A person who commits an offence under this section is liable—
(a) on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);
(b) on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum (or both);
(c) on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);
(d) on conviction on indictment, to imprisonment for a term not exceeding 2 years or a fine (or both).
(1) This section applies for the purposes of this Chapter.
(2) A provider of a regulated user-to-user service or a regulated search service is a “UK provider” of the service if the provider is—
(a) an individual or individuals who are habitually resident in the United Kingdom, or
(b) an entity incorporated or formed under the law of any part of the United Kingdom.
(3) Otherwise, a provider of a regulated user-to-user service or a regulated search service is a “non-UK provider” of the service.
(4) CSEA content is “detected” by a provider when the provider becomes aware of the content, whether by means of the provider’s systems or processes or as a result of another person alerting the provider.
(5) CSEA content is “unreported”, in relation to a provider, if the reporting of that content is not covered by arrangements (mandatory or voluntary)—
(a) by which the provider reports content relating to child sexual exploitation or abuse to a foreign agency, or
(b) by which an entity that is a group undertaking in relation to the provider reports content relating to child sexual exploitation or abuse to—
(i) the NCA, or
(ii) a foreign agency.
(6) CSEA content is “UK-linked” if a provider has evidence of a link between the content and the United Kingdom, based on any of the following—
(a) the place where the content was published, generated, uploaded or shared;
(b) the nationality of a person suspected of committing the related offence;
(c) the location of a person suspected of committing the related offence;
(d) the location of a child who is a suspected victim of the related offence.
For the purposes of paragraphs (b), (c) and (d) an offence is “related” to CSEA content if the content amounts to that offence (construed in accordance with section 59: see subsections (3), (11) and (12) of that section).
(7) In this Chapter—
“CSEA content” has the same meaning as in Part 3 (see section 59);
“foreign agency” means a person exercising functions in a country outside the United Kingdom which correspond to the NCA’s functions insofar as they relate to receiving and disseminating reports about CSEA content;
“group undertaking” has the meaning given by section 1161(5) of the Companies Act 2006;
“NCA” means the National Crime Agency.
(8) Sections 1161(5) and 1162 of, and Schedule 7 to, the Companies Act 2006—
(a) are to apply in relation to an entity which is not an undertaking (as defined in section 1161(1) of that Act) as they apply in relation to an undertaking, and
(b) are to be read with any necessary modifications if applied to an entity formed under the law of a country outside the United Kingdom.
71 Duty not to act against users except in accordance with terms of service
(1) A provider of a Category 1 service must operate the service using proportionate systems and processes designed to ensure that the provider does not—
(a) take down regulated user-generated content from the service,
(b) restrict users’ access to regulated user-generated content, or
(c) suspend or ban users from using the service,
except in accordance with the terms of service.
(2) Nothing in subsection (1) is to be read as preventing a provider from taking down content from a service or restricting users’ access to it, or suspending or banning a user, if such an action is taken—
(a) to comply with the duties set out in—
(i) section 10(2) , (3) or (3A) (protecting individuals from illegal content), or
(ii) section 12(2) or (3) (protecting children from content that is harmful to children), or
(b) to avoid criminal or civil liability on the part of the provider that might reasonably be expected to arise if such an action were not taken.
(3) In addition, nothing in subsection (1) is to be read as preventing a provider from—
(a) taking down content from a service or restricting users’ access to it on the basis that a user has committed an offence in generating, uploading or sharing it on the service, or
(b) suspending or banning a user on the basis that—
(i) the user has committed an offence in generating, uploading or sharing content on the service, or
(ii) the user is responsible for, or has facilitated, the presence or attempted placement of a fraudulent advertisement on the service.
(4) The duty set out in subsection (1) does not apply in relation to—
(a) consumer content (see section 74);
(b) terms of service which deal with the treatment of consumer content.
(5) If a person is the provider of more than one Category 1 service, the duty set out in subsection (1) applies in relation to each such service.
(6) The duty set out in subsection (1) extends only to the design, operation and use of a service in the United Kingdom, and references in this section to users are to United Kingdom users of a service.
(7) In this section—
“criminal or civil liability” includes such a liability under the law of a country outside the United Kingdom;
“fraudulent advertisement” has the meaning given by section 38;
“offence” includes an offence under the law of a country outside the United Kingdom.
(8) See also section 18 (duties to protect news publisher content).
All services
(1) A provider of a regulated user-to-user service must include clear and accessible provisions in the terms of service informing users about their right to bring a claim for breach of contract if—
(a) regulated user-generated content which they generate, upload or share is taken down, or access to it is restricted, in breach of the terms of service, or
(b) they are suspended or banned from using the service in breach of the terms of service.
Category 1 services
(2) The duties set out in subsections (3) to (7) apply in relation to a Category 1 service, and references in subsections (3) to (9) to “provider” and “service” are to be read accordingly.
(3) A provider must operate a service using proportionate systems and processes designed to ensure that—
(a) if the terms of service indicate (in whatever words) that the presence of a particular kind of regulated user-generated content is prohibited on the service, the provider takes down such content;
(b) if the terms of service state that the provider will restrict users’ access to a particular kind of regulated user-generated content in a specified way, the provider does restrict users’ access to such content in that way;
(c) if the terms of service state cases in which the provider will suspend or ban a user from using the service, the provider does suspend or ban the user in those cases.
(4) A provider must ensure that—
(a) terms of service which make provision about the provider taking down regulated user-generated content from the service or restricting users’ access to such content, or suspending or banning a user from using the service, are—
(i) clear and accessible, and
(ii) written in sufficient detail to enable users to be reasonably certain whether the provider would be justified in taking the specified action in a particular case, and
(b) those terms of service are applied consistently.
(5) A provider must operate a service using systems and processes that allow users and affected persons to easily report—
(a) content which they consider to be relevant content (see section 74);
(b) a user who they consider should be suspended or banned from using the service in accordance with the terms of service.
(6) A provider must operate a complaints procedure in relation to a service that—
(a) allows for complaints of a kind mentioned in subsection (8) to be made,
(b) provides for appropriate action to be taken by the provider of the service in response to complaints of those kinds, and
(c) is easy to access, easy to use (including by children) and transparent.
(7) A provider must include in the terms of service provisions which are easily accessible (including to children) specifying the policies and processes that govern the handling and resolution of complaints of a kind mentioned in subsection (8).
(8) The kinds of complaints referred to in subsections (6) and (7) are—
(a) complaints by users and affected persons about content present on a service which they consider to be relevant content;
(b) complaints by users and affected persons if they consider that the provider is not complying with a duty set out in any of subsections (1) or (3) to (5);
(c) complaints by a user who has generated, uploaded or shared content on a service if that content is taken down, or access to it is restricted, on the basis that it is relevant content;
(d) complaints by users who have been suspended or banned from using a service.
(9) The duties set out in subsections (3) and (4) do not apply in relation to terms of service which—
(a) make provision of the kind mentioned in section 10(5) (protecting individuals from illegal content) or 12(9) (protecting children from content that is harmful to children), or
(b) deal with the treatment of consumer content.
Further provision
(10) If a person is the provider of more than one regulated user-to-user service or Category 1 service, the duties set out in this section apply in relation to each such service.
(11) The duties set out in this section extend only to the design, operation and use of a service in the United Kingdom, and references to users are to United Kingdom users of a service.
(12) See also section 18 (duties to protect news publisher content).
73 OFCOM’s guidance about duties set out in sections 71 and 72
(1) OFCOM must produce guidance for providers of Category 1 services to assist them in complying with their duties set out in sections 71 and 72(3) to (7).
(2) OFCOM must publish the guidance (and any revised or replacement guidance).
(1) This section applies for the purposes of this Chapter.
(2) “Regulated user-generated content” has the same meaning as in Part 3 (see section 55), and references to such content are to content that is regulated user-generated content in relation to the service in question.
(3) “Consumer content” means—
(a) regulated user-generated content that constitutes, or is directly connected with content that constitutes, an offer to sell goods or to supply services,
(b) regulated user-generated content that amounts to an offence under Chapter 1 of Part 4 of the Digital Markets, Competition and Consumers Act 2024 (construed in accordance with section 59: see subsections (3), (11) and (12) of that section), or
(c) any other regulated user-generated content in relation to which an enforcement authority has functions under that Chapter (see section 231 of that Act).
(4) References to restricting users’ access to content, and related references, are to be construed in accordance with sections 58 and 236(6).
(5) Content of a particular kind is “relevant content” if—
(a) a term of service, other than a term of service mentioned in section 72(9), indicates (in whatever words) that the presence of content of that kind is prohibited on the service or that users’ access to content of that kind is restricted, and
(b) it is regulated user-generated content.
References to relevant content are to content that is relevant content in relation to the service in question.
(6) “Affected person” means a person, other than a user of the service in question, who is in the United Kingdom and who is—
(a) the subject of the content,
(b) a member of a class or group of people with a certain characteristic targeted by the content,
(c) a parent of, or other adult with responsibility for, a child who is a user of the service or is the subject of the content, or
(d) an adult providing assistance in using the service to another adult who requires such assistance, where that other adult is a user of the service or is the subject of the content.
(7) In determining what is proportionate for the purposes of sections 71 and 72, the size and capacity of the provider of a service is, in particular, relevant.
(8) For the meaning of “Category 1 service”, see section 95 (register of categories of services).
76 OFCOM’s guidance about duties set out in section 75
(1) OFCOM must produce guidance for providers of relevant services to assist them in complying with their duties set out in section 75.
(2) OFCOM must publish the guidance (and any revised or replacement guidance).
(3) In this section “relevant service” has the meaning given by section 75.
77 Transparency reports about certain Part 3 services
(1) Once a year, OFCOM must give every provider of a relevant service a notice which requires the provider to produce a report about the service (a “transparency report”).
(2) If a person is the provider of more than one relevant service, a notice must be given to the provider in respect of each such service.
(3) In response to a notice relating to a relevant service, the provider of the service must produce a transparency report which must—
(a) contain information of a kind specified or described in the notice,
(b) be in the format specified in the notice,
(c) be submitted to OFCOM by the date specified in the notice, and
(d) be published in the manner and by the date specified in the notice.
(4) A provider must ensure that the information provided in a transparency report is—
(a) complete, and
(b) accurate in all material respects.
(5) A “relevant service” means—
(a) a Category 1 service (see section 95(10)(a));
(b) a Category 2A service (see section 95(10)(b));
(c) a Category 2B service (see section 95(10)(c)).
(6) In a notice which relates to a Category 1 service or a Category 2B service, OFCOM may only specify or describe user-to-user information.
But in the case of a service described in subsection (9), that subsection applies instead.
(7) In a notice which relates to a regulated search service that is a Category 2A service, OFCOM may only specify or describe search engine information.
(8) In a notice which relates to a combined service that is a Category 2A service, and is not also a Category 1 service or a Category 2B service, OFCOM may only specify or describe search engine information.
(9) In a notice which relates to a combined service that is a Category 2A service, as well as being a Category 1 service or a Category 2B service, OFCOM may specify or describe user-to-user information or search engine information, or both those kinds of information.
(10) In subsections (6) to (9)—
(a) “user-to-user information” means information which—
(i) is about the matters listed in Part 1 of Schedule 8, and
(ii) relates to the user-to-user part of a service;
(b) “search engine information” means information which—
(i) is about the matters listed in Part 2 of Schedule 8, and
(ii) relates to the search engine of a service.
(11) Part 3 of Schedule 8 makes further provision about transparency reports.
(12) The Secretary of State may by regulations amend subsection (1) so as to change the frequency of the transparency reporting process.
(13) The Secretary of State must consult OFCOM before making regulations under subsection (12).
(14) In this section “notice” means a notice under subsection (1).
(1) OFCOM must produce guidance about—
(a) how OFCOM will determine which information they will require transparency reports under section 77 to contain, including—
(i) the principles that they will apply in relation to each of the factors mentioned in paragraph 37 of Schedule 8, and
(ii) the steps that they will take to engage with providers of relevant services before requiring information in a notice under section 77(1);
(b) how information from transparency reports produced by providers of relevant services under section 77 will be used to produce OFCOM’s transparency reports (see section 159); and
(c) any other matter that OFCOM consider to be relevant to the production and publication of transparency reports under section 77 or 159.
(2) Before producing the guidance (including revised or replacement guidance), OFCOM must consult such of the following as they consider appropriate—
(a) providers of regulated user-to-user services, and of regulated search services,
(b) persons who appear to OFCOM to represent such providers,
(c) persons who appear to OFCOM to represent the interests of children (generally or with particular reference to online safety matters),
(d) persons whom OFCOM consider to have expertise in equality issues and human rights, in particular—
(i) the right to freedom of expression set out in Article 10 of the Convention, and
(ii) the right to respect for a person’s private and family life, home and correspondence set out in Article 8 of the Convention,
(e) the Information Commission,
(f) persons who appear to OFCOM to represent the interests of those with protected characteristics (within the meaning of Part 2 of the Equality Act 2010), and
(g) persons whom OFCOM consider to have expertise in the enforcement of the criminal law and the protection of national security that is relevant to online safety matters,
and OFCOM must also consult such other persons as OFCOM consider appropriate.
(3) OFCOM must publish the guidance (and any revised or replacement guidance).
(4) In exercising their functions under section 77 or 159, OFCOM must have regard to the guidance for the time being published under this section.
(5) In this section, “relevant service” has the same meaning as in section 77 (see subsection (5) of that section).
79 “Provider pornographic content” and “regulated provider pornographic content”
(1) This section applies for the purposes of this Part.
(2) “Provider pornographic content”, in relation to an internet service, means pornographic content that is published or displayed on the service by the provider of the service or by a person acting on behalf of the provider, including pornographic content published or displayed on the service by means of—
(a) software or an automated tool or algorithm applied by the provider or by a person acting on behalf of the provider, or
(b) an automated tool or algorithm made available on the service by the provider or by a person acting on behalf of the provider.
(3) “Regulated provider pornographic content”, in relation to an internet service, means provider pornographic content other than content within subsection (4) or (5).
(4) Content is within this subsection if it—
(a) consists only of text, or
(b) consists only of text accompanied by—
(i) a GIF which is not itself pornographic content,
(ii) an emoji or other symbol, or
(iii) a combination of content mentioned in sub-paragraphs (i) and (ii).
(5) Content is within this subsection if it consists of a paid-for advertisement (see section 236).
(6) References to pornographic content that is “published or displayed” on a service—
(a) include, in particular—
(i) references to pornographic content that is only visible or audible to users as a result of interacting with content that is blurred, distorted or obscured (for example, by clicking on such content), but only where the pornographic content is present on the service,
(ii) references to pornographic content that is embedded on the service, and
(iii) references to pornographic content that is generated on the service by means of an automated tool or algorithm in response to a prompt by a user and is only visible or audible to that user (no matter for how short a time);
(b) do not include references to pornographic content that appears in search results of a search service or a combined service.
(7) Pornographic content that is user-generated content in relation to an internet service is not to be regarded as provider pornographic content in relation to that service.
(8) In this section—
“search results” has the meaning given by section 57(3);
“user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).