200 Offence of failure to comply with confirmation decision: supplementary
(1) Where a penalty has been imposed on a person by a penalty notice under section 139 in respect of a failure constituting an offence under section 138 (failure to comply with certain requirements of a confirmation decision), no proceedings may be brought against the person for that offence.
(2) A penalty may not be imposed on a person by a penalty notice under section 139 in respect of a failure constituting an offence under section 138 if—
(a) proceedings for the offence have been brought against the person but have not been concluded, or
(b) the person has been convicted of the offence.
(3) Where a service restriction order under section 144 or an access restriction order under section 146 has been made in relation to a regulated service provided by a person in respect of a failure constituting an offence under section 138, no proceedings may be brought against the person for that offence.
(1) Subsection (2) applies where a person relies on a defence under section 109 or 110.
(2) If evidence is adduced which is sufficient to raise an issue with respect to the defence, the court must assume that the defence is satisfied unless the prosecution proves beyond reasonable doubt that it is not.
(1) In this section a “relevant entity” means an entity that is—
(a) the provider of a regulated service, and
(b) a legal person under the law under which it is formed.
(2) If an offence is committed by a relevant entity and it is proved that the offence—
(a) has been committed with the consent or connivance of an officer of the entity, or
(b) is attributable to any neglect on the part of an officer of the entity,
the officer (as well as the entity) commits the offence and (subject to section 199(1)) is liable to be proceeded against and punished accordingly.
(3) In relation to an entity which is a body corporate, “officer” means—
(a) a director, manager, associate, secretary or other similar officer, or
(b) a person purporting to act in any such capacity.
In paragraph (a) “director”, in relation to a body corporate whose affairs are managed by its members, means a member of the body corporate.
(4) In relation to a partnership which is not regarded as a body corporate under the law under which it is formed, “officer” means—
(a) a partner, or
(b) a person purporting to act as a partner.
(5) In this section—
“body corporate” includes an entity incorporated outside the United Kingdom;
“offence” means an offence under this Act, except under Part 10.
203 Application of offences to providers that are not legal persons
(1) In this section a “relevant entity” means an entity that—
(a) is the provider of a regulated service, and
(b) is not a legal person under the law under which it is formed.
(2) Proceedings for an offence alleged to have been committed by a relevant entity must be brought against the entity in its own name (and not in that of any of its officers or members).
(3) For the purposes of such proceedings—
(a) rules of court relating to the service of documents have effect as if the entity were a body corporate; and
(b) the following provisions apply as they apply in relation to a body corporate—
(i) section 33 of the Criminal Justice Act 1925 and Schedule 3 to the Magistrates’ Courts Act 1980;
(ii) section 18 of the Criminal Justice Act (Northern Ireland) 1945 (c. 15 (N.I.)) and Article 166 of, and Schedule 4 to, the Magistrates’ Courts (Northern Ireland) Order 1981 (S.I. 1981/1675 (N.I. 26)).
(4) A fine imposed on a relevant entity on its conviction of an offence must be paid out of the entity’s funds.
(5) If an offence is committed by a relevant entity and it is proved that the offence—
(a) has been committed with the consent or connivance of an officer of the entity, or
(b) is attributable to any neglect on the part of an officer of the entity,
the officer (as well as the entity) commits the offence and (subject to section 199(1)) is liable to be proceeded against and punished accordingly.
(6) In relation to a partnership, “officer” means—
(a) a partner, or
(b) a person purporting to act as a partner.
(7) In relation to a relevant entity other than a partnership, “officer” means—
(a) an officer of the entity or a person concerned in the management or control of the entity, or
(b) a person purporting to act in such a capacity.
(8) Subsection (2) is not to be read as prejudicing any liability of an officer under subsection (5).
(9) In this section “offence” means an offence under this Act, except under Part 10.
(1) References in this Act to an internet service, a user-to-user service or a search service include such a service provided from outside the United Kingdom (as well as such a service provided from within the United Kingdom).
(2) The power to require the production of documents by an information notice includes power to require the production of documents held outside the United Kingdom.
(3) The power conferred by section 106 includes power to require the attendance for interview of an individual who is outside the United Kingdom.
(4) Sections 133(9) and 150(11) (requirements enforceable in civil proceedings against a person) apply whether or not the person is in the United Kingdom.
205 Offences: extra-territorial application and jurisdiction
(1) Sections 69, 109 and 112 apply to acts done by a person in the United Kingdom or elsewhere (information offences).
(2) Section 110 applies to acts done by an individual in the United Kingdom or elsewhere (offences by senior managers of providers of regulated services).
(3) Section 138 applies to acts done by a person in the United Kingdom or elsewhere (offence of failure to comply with confirmation decision).
(4) Sections 202(2) and 203(5), so far as relating to an offence under a section specified in subsection (1) or (3) of this section, apply to acts done by an individual in the United Kingdom or elsewhere (liability of directors etc of providers of regulated services).
(5) In the case of an offence under section 69, 109, 110, 112 or 138 which is committed outside the United Kingdom—
(a) proceedings for the offence may be taken at any place in the United Kingdom, and
(b) the offence may for all incidental purposes be treated as having been committed at any such place.
(6) In the application of subsection (5) to Scotland, any such proceedings against a person may be taken—
(a) in any sheriff court district in which the person is apprehended or is in custody, or
(b) in such sheriff court district as the Lord Advocate may determine.
(7) In this section—
“act” includes a failure to act;
“sheriff court district” is to be construed in accordance with the Criminal Procedure (Scotland) Act 1995 (see section 307(1) of that Act).
(1) Section 400 of the Communications Act (destination of penalties etc) is amended as follows.
(2) In subsection (1), after paragraph (i) insert—
(j) an amount paid to OFCOM in respect of a penalty imposed by them under Chapter 6 of Part 7 of the Online Safety Act 2023;
(k) an amount paid to OFCOM in respect of an additional fee charged under Schedule 10 to the Online Safety Act 2023.
(3) In subsection (2), after “applies” insert “(except an amount mentioned in subsection (1)(j) or (k))”.
(4) After subsection (3) insert—
(3A) Where OFCOM receive an amount mentioned in subsection (1)(j) or (k), it must be paid into the Consolidated Fund of the United Kingdom.
(5) In the heading, omit “licence”.
Anything required by this Act to be published by OFCOM must be published in such manner as OFCOM consider appropriate for bringing it to the attention of the persons who, in their opinion, are likely to be affected by it.
(1) This section applies in relation to a notice that may or must be given by OFCOM to a person under any provision of this Act.
(2) OFCOM may give a notice to a person by—
(a) delivering it by hand to the person,
(b) leaving it at the person’s proper address,
(c) sending it by post to the person at that address, or
(d) sending it by email to the person’s email address.
(3) A notice to a body corporate may be given to any officer of that body.
(4) A notice to a partnership may be given to any partner or to a person who has the control or management of the partnership business.
(5) A notice to an entity that is not a legal person under the law under which it is formed (other than a partnership) may be given to any member of the governing body of the entity.
(6) In the case of a notice given to a person who is a provider of a regulated service, the person’s proper address for the purposes of paragraphs (b) and (c) of subsection (2), and section 7 of the Interpretation Act 1978 in its application to those paragraphs, is any address (within or outside the United Kingdom) at which OFCOM believe, on reasonable grounds, that the notice will come to the attention of the person or (where the person is an entity) any director or other officer of that entity.
(7) In the case of a notice given to a person other than a provider of a regulated service, a person’s proper address for the purposes of paragraphs (b) and (c) of subsection (2), and section 7 of the Interpretation Act 1978 in its application to those paragraphs, is—
(a) in the case of an entity, the address of the entity’s registered or principal office;
(b) in any other case, the person’s last known address.
(8) In the case of an entity registered or carrying on business outside the United Kingdom, or with offices outside the United Kingdom, the reference in subsection (7) to its principal office includes its principal office in the United Kingdom or, if the entity has no office in the United Kingdom, any place in the United Kingdom at which OFCOM believe, on reasonable grounds, that the notice will come to the attention of any director or other officer of that entity.
(9) In the case of a notice given to an individual under section 106 (interviews), the reference in subsection (7) to the person’s last known address is to the individual’s home address or, if the individual is currently connected with a provider of a regulated service, the address of the provider’s registered or principal office.
(10) For the purposes of subsection (2)(d), a person’s email address is—
(a) any email address published for the time being by that person as an address for contacting that person, or
(b) if there is no such published address, any email address by means of which OFCOM believe, on reasonable grounds, that the notice will come to the attention of that person or (where that person is an entity) any director or other officer of that entity.
(11) A notice sent by email is treated as given 48 hours after it was sent, unless the contrary is proved.
(12) In this section—
“director” includes any person occupying the position of a director, by whatever name called;
“officer”, in relation to an entity, includes a director, a manager, a partner, an associate, a secretary or, where the affairs of the entity are managed by its members, a member.
(1) In the Communications Act, omit Part 4B (video-sharing platform services).
(2) In the Audiovisual Media Services Regulations 2020 (S.I. 2020/1062), omit Part 4 (which inserts Part 4B into the Communications Act).
(3) In this Act, omit—
(a) section 209, and
(b) Schedule 16.
(4) In the Audiovisual Media Services (Amendment) (EU Exit) Regulations 2020 (S.I. 2020/1536), omit regulation 4.
211 Repeal of Part 4B of the Communications Act: transitional provision etc
(1) Schedule 17 contains transitional, transitory and saving provision—
(a) about the application of this Act and Part 4B of the Communications Act during a period before the repeal of Part 4B of the Communications Act (or, in the case of Part 3 of Schedule 17, in respect of charging years as mentioned in that Part);
(b) in connection with the repeal of Part 4B of the Communications Act.
(2) The Secretary of State may by regulations make transitional, transitory or saving provision of the kind mentioned in subsection (1)(a) and (b).
(3) Regulations under subsection (2) may amend or repeal—
(a) Part 3 of Schedule 3;
(b) Schedule 17.
(4) Regulations under subsection (2) may, in particular, make provision about—
(a) the application of Schedule 17 in relation to a service if the transitional period in relation to that service ends on a date before the date when section 210 comes into force;
(b) the application of Part 3 of Schedule 17, including further provision about the calculation of a provider’s non-Part 4B qualifying worldwide revenue for the purposes of paragraph 19 of that Schedule;
(c) the application of Schedule 10 (recovery of OFCOM’s initial costs), and in particular how fees chargeable under that Schedule may be calculated, in respect of charging years to which Part 3 of Schedule 17 relates.
(1) The Digital Economy Act 2017 is amended as follows.
(2) Omit—
(a) Part 3 (online pornography), and
(b) section 119(10) and (11) (power to extend that Part to the Channel Islands or the Isle of Man).
(3) Omit section 103 (code of practice for providers of online social media platforms).
213 Offence under the Obscene Publications Act 1959: OFCOM defence
(1) Section 2 of the Obscene Publications Act 1959 (prohibition of publication of obscene matter) is amended in accordance with subsections (2) and (3).
(2) After subsection (5) insert—
(5A) A person shall not be convicted of an offence against this section of the publication of an obscene article if the person proves that—
(a) at the time of the offence charged, the person was a member of OFCOM, employed or engaged by OFCOM, or assisting OFCOM in the exercise of any of their online safety functions (within the meaning of section 235 of the Online Safety Act 2023), and
(b) the person published the article for the purposes of OFCOM’s exercise of any of those functions.
(3) In subsection (7)—
(a) the words after “In this section” become paragraph (a), and
(b) at the end of that paragraph, insert
;
(b) “OFCOM” means the Office of Communications.
214 Offences regarding indecent photographs of children: OFCOM defence
England and Wales
(1) Section 1B of the Protection of Children Act 1978 (defence to offence relating to indecent photographs of children) is amended in accordance with subsections (2) and (3).
(2) In subsection (1)—
(a) for “he”, in each place, substitute “the defendant”;
(b) for “him”, in each place, substitute “the defendant”;
(c) omit “or” at the end of paragraph (b);
(d) at the end of paragraph (c) insert
, or
(d) the defendant—
(i) was at the time of the offence charged a member of OFCOM, employed or engaged by OFCOM, or assisting OFCOM in the exercise of any of their online safety functions (within the meaning of section 235 of the Online Safety Act 2023), and
(ii) made the photograph or pseudo-photograph for the purposes of OFCOM’s exercise of any of those functions.
(3) After subsection (2) insert—
(3) In this section “OFCOM” means the Office of Communications.
Scotland
(4) Section 52 of the Civic Government (Scotland) Act 1982 (indecent photographs of children) is amended in accordance with subsections (5) and (6).
(5) After subsection (4) insert—
(4A) Where a person is charged with an offence under subsection (1)(a) of making an indecent photograph or pseudo-photograph of a child, it shall be a defence for the person to prove that—
(a) at the time of the offence charged, the person was a member of OFCOM, employed or engaged by OFCOM, or assisting OFCOM in the exercise of any of their online safety functions (within the meaning of section 235 of the Online Safety Act 2023), and
(b) the person made the photograph or pseudo-photograph for the purposes of OFCOM’s exercise of any of those functions.
(6) In subsection (8), after paragraph (d) insert—
(e) “OFCOM” means the Office of Communications.
Northern Ireland
(7) Article 3A of the Protection of Children (Northern Ireland) Order 1978 (S.I. 1978/1047 (N.I. 17)) (defence to offence relating to indecent photographs of children) is amended in accordance with subsections (8) and (9).
(8) In paragraph (1)—
(a) for “he”, in each place, substitute “the defendant”;
(b) for “him”, in each place, substitute “the defendant”;
(c) omit “or” at the end of sub-paragraph (b);
(d) at the end of sub-paragraph (c) insert
, or
(d) the defendant—
(i) was at the time of the offence charged a member of OFCOM, employed or engaged by OFCOM, or assisting OFCOM in the exercise of any of their online safety functions (within the meaning of section 235 of the Online Safety Act 2023), and
(ii) made the photograph or pseudo-photograph for the purposes of OFCOM’s exercise of any of those functions.
(9) After paragraph (2) insert—
(3) In this Article “OFCOM” means the Office of Communications.
214A Power to require providers of internet services to prevent or restrict access by children to internet services
(1) The Secretary of State may, for the purpose of protecting relevant children from a risk of harm (including harm presented by content), make provision by regulations requiring providers of specified internet services—
(a) to prevent access by relevant children to specified internet services which they provide, or to specified functionalities or other features of such services;
(b) to restrict access by relevant children to specified internet services which they provide, or to specified functionalities or other features of such services.
(2) “Relevant child” means a child who is of, or under, a specified age (and different ages may be specified for the purposes of paragraphs (a) and (b) of subsection (1)).
(3) The provision that may be made by regulations under this section includes provision—
(a) about the steps that must or may be taken by a provider for the purposes of complying with a requirement imposed by the regulations;
(b) about the monitoring of compliance with a requirement imposed by the regulations;
(c) about the enforcement of a requirement imposed by the regulations.
(4) The provision that may be made by virtue of subsection (1)(b) includes, for example, provision requiring a provider of an internet service to—
(a) limit the amount of time per day, or over the course of a specified period, for which relevant children may access the service or a specified functionality or other feature of the service;
(b) limit the times of day at which relevant children may access the service or a specified functionality or other feature of the service;
(c) restrict access by relevant children to a service or to a functionality or other feature of a service by virtue of which—
(i) a user of the service could receive unsolicited contact from a person who is not known to the user;
(ii) a user of the service could encounter live oral communications or live video generated directly on the service, or uploaded to or shared on the service, by a person who is not known to the user;
(iii) a person who is not known to a user of the service could encounter live oral communications or live video generated directly on the service, or uploaded to or shared on the service, by the user;
(iv) a person who is not known to a user of the service could identify the actual or approximate location of the user.
(5) The provision that may be made by virtue of subsection (3)(c) includes provision for a requirement to be an enforceable requirement for the purposes of Chapter 6 of Part 7.
(6) In making regulations under this section, the Secretary of State must have regard to—
(a) the different ways in which an internet service of a particular kind is used, including functionalities or other features of the service that affect how much children use the service, and the impact of such use on the level of risk of harm that might be suffered by children, and
(b) the fact that children of different ages may be affected by an internet service, or a functionality or other feature of an internet service, in different ways.
(7) Regulations under this section may—
(a) make provision applying any provision of this Act (with or without modifications);
(b) make provision for exceptions to requirements imposed by the regulations;
(c) make provision about the time by which, or period within which, a thing must be done;
(d) make provision by reference to standards, arrangements, specifications or technical requirements as published from time to time;
(e) confer functions on a person, including functions involving the exercise of a discretion, and make provision in connection with the procedure for exercising the functions;
(f) make consequential provision.
(8) Regulations made by virtue of subsection (7)(f) may amend or repeal primary legislation.
(9) The Secretary of State—
(a) must exercise the power under subsection (1) so as to make such provision as the Secretary of State considers appropriate following the conclusion of the consultation entitled “Growing up in the online world: a national consultation” launched on 2 March 2026 (command paper numbered CP 1528), and
(b) must, in exercising that power, have regard to the responses to the consultation.
(10) OFCOM must, so far as reasonably practicable—
(a) carry out such research or provide such advice as the Secretary of State may request for the purposes of making regulations under this section, and
(b) do so by such time, or within such period, as the Secretary of State may specify in the request.
(11) As soon as reasonably practicable after providing advice under subsection (10), OFCOM must publish the advice.
(12) In this section—
“primary legislation” means—
an Act of Parliament,
an Act of the Scottish Parliament,
an Act or Measure of Senedd Cymru, or
Northern Ireland legislation;
“specified” means specified, or of a description specified, in regulations under this section.
(1) Subject to the following provisions of this section and section 216, the Secretary of State may by regulations amend any provision of this Act to make provision for or in connection with the regulation of internet services that are app stores.
(2) Regulations under this section may not be made before OFCOM have published a report under section 161 (report about use of app stores by children).
(3) Regulations under this section may be made only if the Secretary of State, having considered that report, considers that there is a material risk of significant harm to an appreciable number of children presented by either of the following, or by both taken together—
(a) harmful content present on app stores, or
(b) harmful content encountered by means of regulated apps available in app stores.
(4) Before making regulations under this section the Secretary of State must consult—
(a) persons who appear to the Secretary of State to represent providers of app stores,
(b) persons who appear to the Secretary of State to represent the interests of children (generally or with particular reference to online safety matters),
(c) OFCOM,
(d) the Information Commission,
(e) the Children’s Commissioner, and
(f) such other persons as the Secretary of State considers appropriate.
(5) In this section and in section 216—
“amend” includes repeal and apply (with or without modifications);
“app” includes an app for use on any kind of device, and “app store” is to be read accordingly;
“content that is harmful to children” has the same meaning as in Part 3 (see section 60);
“harmful content” means—
content that is harmful to children,
search content that is harmful to children, and
regulated provider pornographic content;
“regulated app” means an app for a regulated service;
“regulated provider pornographic content” has the same meaning as in Part 5 (see section 79);
“search content” has the same meaning as in Part 3 (see section 57).
(6) In this section and in section 216 references to children are to children in the United Kingdom.
(1) In this section (except in subsection (4)(c)) “regulations” means regulations under section 215(1).
(2) Provision may be made by regulations only for or in connection with the purposes of minimising or mitigating the risks of harm to children presented by harmful content as mentioned in section 215(3)(a) and (b).
(3) Regulations may not have the effect that any body other than OFCOM is the regulator in relation to app stores.
(4) Regulations may—
(a) make provision exempting specified descriptions of app stores from regulation under this Act;
(b) make provision amending Part 2, section 55 or Schedule 1 in connection with provision mentioned in paragraph (a);
(c) make provision corresponding or similar to provision which may be made by regulations under paragraph 1 of Schedule 11 (“threshold conditions”), with the effect that only app stores which meet specified conditions are regulated by this Act.
(5) Regulations may make provision having the effect that app stores provided from outside the United Kingdom are regulated by this Act (as well as app stores provided from within the United Kingdom), but, if they do so, must contain provision corresponding or similar to section 4(5) and (6) (UK links).
(6) The provision that may be made by regulations includes provision—
(a) imposing on providers of app stores duties corresponding or similar to duties imposed on providers of Part 3 services by—
(i) section 11 or 12 (children’s online safety: user-to-user services) or any of sections 20 to 23 so far as relating to section 11 or 12;
(ii) section 28 or 29 (children’s online safety: search services) or any of sections 31 to 34 so far as relating to section 28 or 29;
(b) imposing on providers of app stores duties corresponding or similar to duties imposed on providers of internet services within section 80(2) by section 81 (duties about regulated provider pornographic content);
(c) imposing on providers of app stores requirements corresponding or similar to requirements imposed on providers of regulated services by, or by OFCOM under, Part 6 (fees);
(d) imposing on OFCOM duties in relation to app stores corresponding or similar to duties imposed in relation to Part 3 services by Chapter 3 of Part 7 (OFCOM’s register of risks, and risk profiles);
(e) conferring on OFCOM functions in relation to app stores corresponding or similar to the functions that OFCOM have in relation to regulated services under—
(i) Chapter 4 of Part 7 (information), or
(ii) Chapter 6 of Part 7 (enforcement), including provisions of that Chapter conferring power for OFCOM to impose monetary penalties;
(f) about OFCOM’s production of guidance or a code of practice relating to any aspect of the regulation of app stores that is included in the regulations.
(7) The provision that may be made by regulations includes provision having the effect that app stores fall within the definition of “Part 3 service” or “regulated service” for the purposes of specified provisions of this Act (with the effect that specified provisions of this Act which apply in relation to Part 3 services or regulated services, or to providers of Part 3 services or regulated services, also apply in relation to app stores or to providers of app stores).
(8) Regulations may not amend or make provision corresponding or similar to—
(a) Chapter 2 of Part 4 (reporting CSEA content),
(b) Chapter 5 of Part 7 (notices to deal with terrorism content and CSEA content), or
(c) Part 10 (communications offences).
(9) Regulations may make different provision with regard to app stores of different kinds.
(10) In this section “specified” means specified in regulations.
216A Power to amend Act in relation to illegal AI-generated content etc
(1) Subject to subsection (14)(b), the Secretary of State may by regulations amend any provision of this Act for or in connection with the purposes of minimising or mitigating the risks of harm to individuals in the United Kingdom presented by—
(a) illegal AI-generated content;
(b) the use of AI services for the commission or facilitation of priority offences.
(2) In this section, “AI service” means an internet service that is capable (or part of which is capable) of generating AI-generated content (no matter what proportion of content on the service is AI-generated).
(3) The provision that may be made by regulations includes provision securing that any or all of the duties set out in subsection (4) are imposed on providers of AI services in relation to—
(a) illegal AI-generated content;
(b) the design, operation or use of AI services so far as relating to illegal AI-generated content;
(c) the use of AI services for the commission or facilitation of priority offences.
(4) The duties referred to in subsection (3) are—
(a) duties imposed on providers of regulated user-to-user services by section 9 or 10 (illegal content and activity) or any of sections 20 to 23 so far as relating to section 9 or 10;
(b) duties imposed on providers of regulated search services or combined services by section 26 or 27 (search content that is illegal content) or any of sections 31 to 34 so far as relating to section 26 or 27;
(c) duties corresponding or similar to the duties in paragraph (a) or (b).
(5) The provision that may be made by regulations by virtue of subsection (3) includes provision imposing duties on providers of AI services in relation to illegal AI-generated content of all kinds even where a corresponding or similar duty imposed on providers of regulated user-to-user or search services relates only to priority illegal content.
(6) The provision that may be made by regulations includes provision securing that the duties imposed on providers of Category 1 services and Category 2A services by section 38 or 39 (fraudulent advertising), or duties corresponding or similar to those duties, are imposed on providers of AI services in relation to fraudulent advertisements (whether or not AI-generated).
(7) The provision that may be made by regulations includes provision securing that the requirements imposed on providers of Part 3 services by section 66 (reporting CSEA content), or requirements corresponding or similar to those requirements, are imposed on providers of AI services in relation to AI-generated CSEA content (and if such corresponding or similar requirements are imposed, regulations may amend section 67(1) so as to refer to the provision imposing them, as well as to section 66).
(8) The provision that may be made by regulations includes provision securing any of the following—
(a) that providers of AI services are subject to the requirements imposed on providers of regulated services by, or by OFCOM under, Part 6 (fees), or are subject to requirements corresponding or similar to those requirements;
(b) that duties imposed on OFCOM in relation to Part 3 services by Chapter 3 of Part 7 (OFCOM’s register of risks, and risk profiles), or duties corresponding or similar to those duties, are imposed on OFCOM in relation to AI services, so far as relating to illegal AI-generated content generated by such services or their use for the commission or facilitation of priority offences;
(c) that functions conferred on OFCOM in relation to regulated services under the following provisions, or functions corresponding or similar to those functions, are conferred on OFCOM in relation to AI services, so far as relating to provision made by the regulations—
(i) Chapter 4 of Part 7 (information);
(ii) Chapter 6 of Part 7 (enforcement), including provisions of that Chapter conferring power for OFCOM to impose monetary penalties;
(d) that powers conferred on OFCOM in relation to Part 3 services under Chapter 5 of Part 7 (notices to deal with terrorism content and CSEA content), or powers corresponding or similar to those powers, are conferred on OFCOM in relation to AI services, so far as relating to AI-generated terrorism content or AI-generated CSEA content;
(e) that OFCOM have power to make provision in guidance or a code of practice relating to provision made by the regulations.
(9) The provision that may be made by regulations includes provision securing that any provision of this Act that applies in relation to illegal content or illegal content of a particular kind applies (with or without modifications), or does not apply, in relation to illegal AI-generated content or illegal AI-generated content of a particular kind.
(10) The provision that may be made by regulations includes provision amending any definition in this Act, including (but not limited to)—
(a) provision securing that AI services fall within the definition of “regulated user-to-user service”, “regulated search service”, “combined service”, “Part 3 service” or “regulated service” (so far as that is not already the case) or are excluded from any of those definitions;
(b) provision giving the meaning of any defined term in relation to AI services, AI-generated content or AI-generated content of a particular kind.
(11) Regulations may make provision securing that providers of specified kinds of AI services are exempt from the requirement to comply with specified duties or requirements imposed by the regulations.
(12) The provision that may be made by regulations includes—
(a) provision in relation to AI services that corresponds or is similar to provision in Chapter 2 of Part 7 (register of categories of services);
(b) provision conferring power on the Secretary of State to make regulations containing provision in relation to AI services that corresponds or is similar to provision that may be made by regulations under paragraph 1 of Schedule 11 (“threshold conditions”).
(13) Regulations may make provision having the effect that AI services provided from outside the United Kingdom are regulated by this Act (as well as AI services provided from within the United Kingdom), but, if they do so, must contain equivalent provision to that made in relation to user-to-user services and search services by section 4(5) and (6) (UK links).
(14) Regulations—
(a) may (among other things) amend any provision of this Act that mentions an automated tool or a bot (including section 59(12));
(b) may not amend section 234 (“harm” etc).
(15) Regulations—
(a) may make different provision with regard to AI services of different kinds;
(b) may make provision with regard to AI services generally or any one or more specified kinds of AI service;
(c) may make different provision with regard to AI-generated content generated by different kinds of automated tools or functionalities available on AI services;
(d) may make provision with regard only to AI-generated content generated by specified kinds of automated tools or functionalities available on AI services.
(16) Regulations may make provision as to the meaning of any reference to “AI-generated”, or “AI-generated content”, inserted by the regulations into this Act.
(17) In this section—
“AI” is short for artificial intelligence;
“AI-generated CSEA content” means CSEA content that is AI-generated, and “CSEA content” here has the same meaning as in Part 3 (see section 59) except that section 59(14)(a) is to be disregarded;
“AI-generated terrorism content” means terrorism content that is AI-generated, and “terrorism content” here has the same meaning as in Part 3 (see section 59) except that section 59(14)(a) is to be disregarded;
“amend” includes repeal and apply (with or without modifications);
“fraudulent advertisement” has the meaning given by section 38 or 39 (depending on the kind of AI service in question), disregarding the fact that the definition in those sections applies in relation only to a Category 1 service or a Category 2A service;
“illegal AI-generated content” means illegal content that is AI-generated;
“illegal content” has the same meaning as in Part 3 (see section 59), except that where that term is used in the definition of “illegal AI-generated content”, section 59(14)(a) is to be disregarded;
“priority illegal content” has the same meaning as in Part 3 (see section 59);
“priority offence” has the same meaning as in Part 3 (see section 59);
“regulations”, except in subsection (12)(b), means regulations under subsection (1);
“specified” means specified in regulations.
217 Power to impose duty about alternative dispute resolution procedure
(1) The Secretary of State may by regulations amend this Act for or in connection with the imposition on providers of Category 1 services of an ADR duty.
(2) An “ADR duty”—
(a) is a duty requiring providers of Category 1 services to arrange for and engage in an alternative dispute resolution procedure in specified circumstances for the resolution of disputes about their handling of relevant complaints, and
(b) may include a duty requiring such providers to meet the costs incurred by any other person in using a dispute resolution procedure which is so arranged.
(3) Complaints are “relevant” for the purposes of subsection (2)(a) if they—
(a) relate to a Category 1 service,
(b) are of a specified kind, and
(c) are made by persons of a specified kind.
(4) Regulations under this section may not be made before the publication of a statement by the Secretary of State responding to OFCOM’s report under section 160 (report about reporting and complaints procedures in use by providers of Part 3 services: see subsection (10) of that section).
(5) Before making regulations under this section the Secretary of State must consult—
(a) OFCOM,
(b) the Information Commission, and
(c) such other persons as the Secretary of State considers appropriate.
(6) If the power conferred by subsection (1) is exercised, the first regulations made under the power must—
(a) require the use of a dispute resolution procedure which is impartial, and
(b) prohibit the use of a dispute resolution procedure which restricts or excludes the availability of civil proceedings.
(7) Provision made by regulations under this section may have the effect that the duties set out in any or all of sections 21, 22 and 23 which apply in relation to duties imposed by other provisions of Chapter 2 of Part 3 are also to apply in relation to the ADR duty, and accordingly the regulations may amend—
(a) section 21(6),
(b) the definition of “safety measures and policies” in section 22(8), or
(c) the definition of “relevant duties” in section 23(11).
(8) The provisions of this Act that may be amended by the regulations in connection with the imposition of the ADR duty include, but are not limited to, the following provisions (in addition to those mentioned in subsection (7))—
(a) section 7(5),
(b) section 104(13)(a), and
(c) section 131(2).
(9) If the power conferred by subsection (1) is exercised, the first regulations made under the power must require OFCOM to—
(a) produce and publish guidance for providers of Category 1 services to assist them in complying with the ADR duty, and
(b) consult the Secretary of State, the Information Commission and such other persons as OFCOM consider appropriate before producing the guidance.
(10) Section 204(1) applies for the purposes of the references to Category 1 services in this section.
(11) In this section “specified” means specified in regulations under this section.
(12) For the meaning of “Category 1 service”, see section 95 (register of categories of services).
217A Power to impose duties about pornographic content
(1) The Secretary of State may by regulations amend this Act for or in connection with the imposition, on providers of regulated services or regulated services of a particular kind, of duties relating to—
(a) verifying the age of individuals appearing in pornographic content published or displayed on those regulated services (“age verification duties”);
(b) verifying whether individuals appearing in pornographic content published or displayed on those regulated services consent to the content being published or displayed (“consent verification duties”).
(2) Age verification duties and consent verification duties may include duties relating to the systems and processes used to operate regulated services, or regulated services of a particular kind.
(3) Consent verification duties may include duties relating to cases where consent previously given is withdrawn.
(4) Regulations under this section may make provision requiring OFCOM to issue guidance to providers of regulated services, or regulated services of a particular kind, to assist them to comply with age verification duties and consent verification duties.
(5) The provisions of this Act that may be amended by the regulations in connection with the imposition of age verification duties and consent verification duties include, but are not limited to, section 131(2).
(1) The Secretary of State may by regulations amend section 40 (fraud etc offences).
But the power to add an offence to that section is limited by subsections (2) and (3).
(2) An offence may be added to section 40 only if the Secretary of State considers it appropriate to do so because of—
(a) the prevalence on Category 1 services of content (other than regulated user-generated content) consisting of paid-for advertisements that amount to that offence, or the prevalence in or via search results of Category 2A services of paid-for advertisements that amount to that offence,
(b) the risk of harm to individuals in the United Kingdom presented by such advertisements, and
(c) the severity of that harm.
(3) An offence may not be added to section 40 if—
(a) the offence concerns—
(i) the infringement of intellectual property rights,
(ii) the safety or quality of goods (as opposed to what kind of goods they are), or
(iii) the performance of a service by a person not qualified to perform it; or
(b) it is an offence under Chapter 1 of Part 4 of the Digital Markets, Competition and Consumers Act 2024.
(4) In this section—
(a) “regulated user-generated content” has the same meaning as in Part 3 (see section 55);
(b) the words “in or via search results” are to be construed in accordance with section 39;
(c) references to advertisements that amount to an offence are to be construed in accordance with section 59 (see subsections (3), (11) and (12) of that section).
(1) The Secretary of State may by regulations amend—
(a) section 61 (primary priority content that is harmful to children);
(b) section 62 (priority content that is harmful to children).
But the power to add a kind of content is limited by subsections (2) to (4).
(2) A kind of content may be added to section 61 only if the Secretary of State considers that, in relation to Part 3 services—
(a) there is a material risk of significant harm to an appreciable number of children presented by content of that kind that is regulated user-generated content or search content, and
(b) it is appropriate for the duties set out in sections 12(3)(a) and 29(3)(a) (duty in relation to children of all ages) to apply in relation to content of that kind.
(3) A kind of content may be added to section 62 only if the Secretary of State considers that, in relation to Part 3 services, there is a material risk of significant harm to an appreciable number of children presented by content of that kind that is regulated user-generated content or search content.
(4) A kind of content may not be added to section 61 or 62 if the risk of harm presented by content of that kind flows from—
(a) the content’s potential financial impact,
(b) the safety or quality of goods featured in the content, or
(c) the way in which a service featured in the content may be performed (for example, in the case of the performance of a service by a person not qualified to perform it).
(5) The Secretary of State must consult OFCOM before making regulations under this section.
(6) In this section references to children are to children in the United Kingdom.
(7) In this section—
“regulated user-generated content” has the same meaning as in Part 3 (see section 55);
“search content” has the same meaning as in Part 3 (see section 57).
220 Powers to amend or repeal provisions relating to exempt content or services
(1) The Secretary of State may by regulations—
(a) amend section 55(5), or
(b) repeal section 55(2)(d) and (5), and make a consequential amendment of sections 3(6), 5(2)(a) and 55(2)(f),
if the Secretary of State considers that it is appropriate to do so because of the risk of harm to individuals in the United Kingdom presented by one-to-one live aural communications.
(2) Subject to subsection (3), the Secretary of State may by regulations amend section 55(2)(e), (6) or (7) if the Secretary of State considers that it is appropriate to do so because of the risk of harm to individuals in the United Kingdom presented by comments and reviews on provider content.
(3) Regulations under subsection (2) may not have the effect that comments and reviews on provider content present on a service of which the provider is a recognised news publisher become regulated user-generated content within the meaning of Part 3.
(4) The Secretary of State may by regulations amend Part 1 of Schedule 1 to provide for a further description of user-to-user service or search service to be exempt, if the Secretary of State considers that the risk of harm to individuals in the United Kingdom presented by a service of that description is low.
(5) Regulations under subsection (4) may amend sections 3, 5 and 55 and Schedule 2 in connection with the amendment of Part 1 of Schedule 1.
(6) The Secretary of State may by regulations amend Schedule 9 to provide for a further description of internet service to be included, if the Secretary of State considers that the risk of harm to children in the United Kingdom presented by regulated provider pornographic content published or displayed on a service of that description is low.
(7) If the condition in subsection (8) is met, the Secretary of State may by regulations amend or repeal either of the following—
(a) paragraph 3 of Schedule 1 (services offering only one-to-one live aural communications);
(b) any provision of that Schedule added in exercise of the power conferred by subsection (4).
(8) The condition is that the Secretary of State considers that it is appropriate to amend or repeal the provision in question (as the case may be) because of the risk of harm to individuals in the United Kingdom presented by a service of the description in question.
(9) Subject to subsection (10), the Secretary of State may by regulations amend paragraph 4 of Schedule 1 (limited functionality services) if the Secretary of State considers that it is appropriate because of the risk of harm to individuals in the United Kingdom presented by a service described in that paragraph.
(10) Regulations under subsection (9) may not have the effect that a service described in paragraph 4 of Schedule 1 of which the provider is a recognised news publisher is no longer exempt under that paragraph.
(11) Regulations under subsection (7) may amend or repeal a provision of Schedule 2 in connection with the amendment or repeal of a provision of Part 1 of Schedule 1.
(12) Regulations under subsection (7)(b) may amend or repeal a provision of sections 3, 5 and 55 in connection with the amendment or repeal of a provision of Part 1 of Schedule 1.
(13) The Secretary of State may by regulations amend or repeal any provision of Schedule 9 added in exercise of the power conferred by subsection (6), if the Secretary of State considers that it is appropriate to do so because of the risk of harm to children in the United Kingdom presented by regulated provider pornographic content published or displayed on a service of that description.
(14) In this section—
“comments and reviews on provider content” and “one-to-one live aural communications” have the meaning given by section 55;
“recognised news publisher” has the meaning given by section 56;
“regulated provider pornographic content” and “published or displayed” have the same meaning as in Part 5 (see section 79).
England
(1) The Secretary of State may by regulations amend the part of the list in Part 2 of Schedule 1 which relates to England—
(a) if there has been an amendment or repeal of legislation, or of a provision of legislation, by reference to which a description of education or childcare is framed;
(b) to add a further description of education or childcare, if the Secretary of State considers that it is appropriate to do so because of the application of enactments other than this Act, or guidance or requirements (however referred to) produced under enactments other than this Act, to persons providing education or childcare of that description;
(c) to omit a description of education or childcare, if the Secretary of State considers that it is appropriate to do so because of the risk of harm to individuals in England presented by services provided by persons providing education or childcare of that description which are provided for the purposes of such education or childcare (other than a service described in paragraph 7 of Schedule 1).
(2) In subsection (1)(b), “enactment” includes an enactment contained in subordinate legislation (within the meaning of the Interpretation Act 1978).
Scotland
(3) The Scottish Ministers may by regulations amend the part of the list in Part 2 of Schedule 1 which relates to Scotland—
(a) if there has been an amendment or repeal of legislation, or of a provision of legislation, by reference to which a description of education or childcare is framed;
(b) to add a further description of education or childcare, if the Scottish Ministers consider that it is appropriate to do so because of the application of enactments other than this Act, or guidance or requirements (however referred to) produced under enactments other than this Act, to persons providing education or childcare of that description;
(c) to omit a description of education or childcare, if the Scottish Ministers consider that it is appropriate to do so because of the risk of harm to individuals in Scotland presented by services provided by persons providing education or childcare of that description which are provided for the purposes of such education or childcare (other than a service described in paragraph 7 of Schedule 1).
(4) In subsection (3)(b), “enactment” includes an enactment contained in, or in an instrument made under, an Act of the Scottish Parliament.
Wales
(5) The Welsh Ministers may by regulations made by statutory instrument amend the part of the list in Part 2 of Schedule 1 which relates to Wales—
(a) if there has been an amendment or repeal of legislation, or of a provision of legislation, by reference to which a description of education or childcare is framed;
(b) to add a further description of education or childcare, if the Welsh Ministers consider that it is appropriate to do so because of the application of enactments other than this Act, or guidance or requirements (however referred to) produced under enactments other than this Act, to persons providing education or childcare of that description;
(c) to omit a description of education or childcare, if the Welsh Ministers consider that it is appropriate to do so because of the risk of harm to individuals in Wales presented by services provided by persons providing education or childcare of that description which are provided for the purposes of such education or childcare (other than a service described in paragraph 7 of Schedule 1).
(6) In subsection (5)(b), “enactment” includes an enactment contained in, or in an instrument made under, a Measure or Act of Senedd Cymru.
Northern Ireland
(7) The relevant Department may by regulations amend the part of the list in Part 2 of Schedule 1 which relates to Northern Ireland—
(a) if there has been an amendment or repeal of legislation, or of a provision of legislation, by reference to which a description of education or childcare is framed;
(b) to add a further description of education or childcare, if the relevant Department considers that it is appropriate to do so because of the application of enactments other than this Act, or guidance or requirements (however referred to) produced under enactments other than this Act, to persons providing education or childcare of that description;
(c) to omit a description of education or childcare, if the relevant Department considers that it is appropriate to do so because of the risk of harm to individuals in Northern Ireland presented by services provided by persons providing education or childcare of that description which are provided for the purposes of such education or childcare (other than a service described in paragraph 7 of Schedule 1).
(8) In subsection (7), “the relevant Department” means—
(a) where the amendment relates to childcare, primary education or secondary education, the Department of Education in Northern Ireland;
(b) where the amendment relates to further education or higher education, the Department for the Economy in Northern Ireland with the concurrence of the Department of Agriculture, Environment and Rural Affairs in Northern Ireland, or the Department of Agriculture, Environment and Rural Affairs in Northern Ireland with the concurrence of the Department for the Economy in Northern Ireland;
(c) where the amendment relates to education in agriculture and related subjects, the Department of Agriculture, Environment and Rural Affairs in Northern Ireland.
(9) In subsection (7)(b), “enactment” includes an enactment contained in, or in an instrument made under, Northern Ireland legislation.
Interpretation
(10) In this section, the following terms have the same meaning as in Schedule 1—
“childcare”;
“education”;
“education in agriculture and related subjects”;
“further education”;
“higher education”;
“primary education”;
“secondary education”.
(1) The Secretary of State may by regulations amend—
(a) Schedule 5 (terrorism offences);
(b) Part 1 of Schedule 6 (child sexual exploitation and abuse offences).
(2) The Scottish Ministers may by regulations amend Part 2 of Schedule 6.
(3) The Secretary of State may by regulations amend Schedule 7 (priority offences).
But an offence may be added to that Schedule only on the grounds in subsection (4) or (5), and subsection (6) limits the power to add an offence.
(4) The first ground for adding an offence to Schedule 7 is that the Secretary of State considers it appropriate to do so because of—
(a) the prevalence on regulated user-to-user services of regulated user-generated content that amounts to that offence, or the prevalence on regulated search services and combined services of search content that amounts to that offence,
(b) the risk of harm to individuals in the United Kingdom presented by regulated user-generated content or search content that amounts to that offence, and
(c) the severity of that harm.
(5) The second ground for adding an offence to Schedule 7 is that the Secretary of State considers it appropriate to do so because of—
(a) the prevalence of the use of regulated user-to-user services for the commission or facilitation of that offence,
(b) the risk of harm to individuals in the United Kingdom presented by the use of such services for the commission or facilitation of that offence, and
(c) the severity of that harm.
(6) An offence may not be added to Schedule 7 if—
(a) the offence concerns—
(i) the infringement of intellectual property rights,
(ii) the safety or quality of goods (as opposed to what kind of goods they are), or
(iii) the performance of a service by a person not qualified to perform it; or
(b) it is an offence under Chapter 1 of Part 4 of the Digital Markets, Competition and Consumers Act 2024.
(7) The Secretary of State must consult the Scottish Ministers before making regulations under subsection (3) which—
(a) add an offence that extends only to Scotland, or
(b) amend or remove an entry specifying an offence that extends only to Scotland.
(8) The Secretary of State must consult the Department of Justice in Northern Ireland before making regulations under subsection (3) which—
(a) add an offence that extends only to Northern Ireland, or
(b) amend or remove an entry specifying an offence that extends only to Northern Ireland.
(9) In this section—
(a) “regulated user-generated content” has the same meaning as in Part 3 (see section 55);
(b) “search content” has the same meaning as in Part 3 (see section 57);
(c) references to content that amounts to an offence are to be construed in accordance with section 59 (see subsections (3), (11) and (12) of that section).
(1) The Secretary of State may by regulations make provision that is consequential on this Act or regulations under this Act.
(2) The regulations may—
(a) amend or repeal provision made by the Communications Act;
(b) amend or revoke provision made under that Act.
(3) The regulations may make transitional, transitory or saving provision.
(1) Regulations under this Act may make different provision for different purposes and may, in particular—
(a) make different provision with regard to—
(i) user-to-user services,
(ii) search services, and
(iii) internet services, other than regulated user-to-user services or regulated search services, that are within section 80(2);
(b) make different provision with regard to user-to-user services of different kinds;
(c) make different provision with regard to search services of different kinds;
(d) make different provision with regard to different kinds of services mentioned in paragraph (a)(iii);
(e) make different provision with regard to different kinds of internet services within section 80(2).
(2) A power to make regulations under this Act includes power to make supplementary, incidental, transitional, transitory or saving provision.
This subsection does not apply to regulations under section 223 (consequential provision).
(3) Any power of the Secretary of State or OFCOM under this Act to make regulations is exercisable by statutory instrument.
(4) The Statutory Instruments Act 1946 applies in relation to OFCOM’s powers to make regulations under this Act as if OFCOM were a Minister of the Crown.
(5) The Documentary Evidence Act 1868 (proof of orders and regulations etc) has effect as if—
(a) OFCOM were included in the first column of the Schedule to that Act;
(b) OFCOM and persons authorised to act on their behalf were mentioned in the second column of that Schedule.
(6) This section does not apply to regulations under section 240 (commencement and transitional provision).
(1) A statutory instrument containing (whether alone or with other provision)—
(a) regulations under section 77(12),
(b) regulations under section 85(1),
(c) regulations under section 114(2),
(d) regulations under section 169(3),
(e) regulations under section 211(2),
(ea) regulations under section 214A(1),
(f) regulations under section 215(1),
(fa) regulations under section 216A(1),
(g) regulations under section 217(1),
(ga) regulations under section 217A,
(h) regulations under section 218(1),
(i) regulations under section 220(1), (2), (4), (6), (7), (9) or (13),
(j) regulations under section 221(1),
(k) regulations under section 222(1) or (3),
(l) regulations under section 223 that amend or repeal provision made by the Communications Act,
(m) regulations under paragraph 7 of Schedule 4,
(n) regulations under paragraph 38 of Schedule 8,
(o) regulations under paragraph 7 of Schedule 10, or
(p) regulations under paragraph 5(9) of Schedule 13,
may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament.
(2) A statutory instrument containing regulations under section 219(1) may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament.
(3) But a statutory instrument mentioned in subsection (2) may be made without a draft of the instrument being laid before, and approved by a resolution of, each House of Parliament if it contains a declaration that the Secretary of State is of the opinion that, because of urgency, it is necessary to make the regulations without a draft being so laid and approved.
(4) After an instrument is made in accordance with subsection (3), it must be laid before Parliament.
(5) Regulations contained in an instrument made in accordance with subsection (3) cease to have effect at the end of the period of 28 days beginning with the day on which the instrument is made unless, during that period, the instrument is approved by a resolution of each House of Parliament.
(6) In calculating the period of 28 days, no account is to be taken of any whole days that fall within a period during which—
(a) Parliament is dissolved or prorogued, or
(b) either House of Parliament is adjourned for more than 4 days.
(7) If regulations cease to have effect as a result of subsection (5), that does not—
(a) affect the validity of anything previously done under or by virtue of the regulations, or
(b) prevent the making of new regulations.
(8) A statutory instrument containing (whether alone or with other provision) the first regulations under the following provisions may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament—
(a) section 154A(1);
(b) paragraph 1(1) of Schedule 11.
(9) Any other statutory instrument containing regulations under a provision mentioned in subsection (8) is subject to annulment in pursuance of a resolution of either House of Parliament.
(10) A statutory instrument containing—
(a) regulations under section 67(1),
(b) regulations under section 85(2),
(c) regulations under section 86,
(ca) regulations under section 101(E1)(a),
(d) regulations under section 170(1),
(e) regulations under section 223 that do not amend or repeal provision made by the Communications Act,
(f) regulations under paragraph 8(1) of Schedule 3, or
(g) regulations under paragraph 1(2) or (3) of Schedule 11,
is subject to annulment in pursuance of a resolution of either House of Parliament.
(11) As soon as a draft of a statutory instrument containing regulations under section 85(1) or paragraph 5(9) of Schedule 13 (whether alone or with provision under section 85(2)) is ready for laying before Parliament, OFCOM must send the draft to the Secretary of State, and the Secretary of State must lay the draft before Parliament.
(12) Immediately after making a statutory instrument containing only regulations under section 85(2), OFCOM must send the instrument to the Secretary of State, and the Secretary of State must lay it before Parliament.
(13) Regulations made by the Scottish Ministers under—
(a) section 221(3), and
(b) section 222(2),
are subject to the affirmative procedure (see section 29 of the Interpretation and Legislative Reform (Scotland) Act 2010 (asp 10)).
(14) A statutory instrument containing regulations under section 221(5) may not be made by the Welsh Ministers unless a draft of the instrument has been laid before and approved by a resolution of Senedd Cymru.
(15) The power of the relevant Department to make regulations under section 221(7) is exercisable by statutory rule for the purposes of the Statutory Rules (Northern Ireland) Order 1979 (S.I. 1979/1573 (N.I. 12)).
(16) Regulations may not be made by the relevant Department under section 221(7) unless a draft of the regulations has been laid before and approved by a resolution of the Northern Ireland Assembly.
(17) In subsections (15) and (16), “the relevant Department” has the same meaning as in section 221(7) (see subsection (8) of that section).
(1) This section applies to determine who is the “provider” of an internet service for the purposes of this Act.
User-to-user services (other than combined services)
(2) The provider of a user-to-user service is to be treated as being the entity that has control over who can use the user-to-user part of the service (and that entity alone).
(3) If no entity has control over who can use the user-to-user part of a user-to-user service, but an individual or individuals have control over who can use that part, the provider of the service is to be treated as being that individual or those individuals.
Search services
(4) The provider of a search service is to be treated as being the entity that has control over the operations of the search engine (and that entity alone).
(5) If no entity has control over the operations of the search engine, but an individual or individuals have control over those operations, the provider of the search service is to be treated as being that individual or those individuals.
Combined services
(6) The provider of a combined service is to be treated as being the entity that has control over both—
(a) who can use the user-to-user part of the service, and
(b) the operations of the search engine,
(and that entity alone).
(7) If no entity has control over the matters mentioned in paragraphs (a) and (b) of subsection (6), but an individual or individuals have control over both those matters, the provider of the combined service is to be treated as being that individual or those individuals.
Internet services other than user-to-user services or search services
(8) The provider of an internet service, other than a user-to-user service or a search service, is to be treated as being the entity that has control over which content is published or displayed on the service.
(9) If no entity has control over which content is published or displayed on such an internet service, but an individual or individuals have control over which content is published or displayed, the provider of the service is to be treated as being that individual or those individuals.
Machine-generated services
(10) The provider of an internet service that is generated by a machine is to be treated as being the entity that controls the machine (and that entity alone).
(11) If no entity controls the machine, but an individual or individuals control it, the provider of the internet service is to be treated as being that individual or those individuals.
Interpretation
(12) A person who provides an access facility in relation to a user-to-user service, within the meaning of section 146, is not to be regarded as a person who has control over who can use the user-to-user part of the service for the purposes of this section.
(13) In this section “operations of the search engine” means operations which—
(a) enable users of a search service or a combined service to make search requests, and
(b) generate responses to those requests.
(14) In this section “published or displayed” is to be construed in accordance with section 79(6).
(15) For the purposes of subsections (8) and (9), a person who makes available on a service an automated tool or algorithm by means of which content is generated is to be regarded as having control over content so generated.
227 “User”, “United Kingdom user” and “interested person”
(1) For the purposes of this Act a user is a “United Kingdom user” of a service if—
(a) where the user is an individual, the individual is in the United Kingdom;
(b) where the user is an entity, the entity is incorporated or formed under the law of any part of the United Kingdom.
(2) For the purposes of references in this Act to a user of a service it does not matter whether a person is registered to use a service.
(3) References in this Act to a user of a service do not include references to any of the following when acting in the course of the provider’s business—
(a) where the provider of the service is an individual or individuals, that individual or those individuals;
(b) where the provider is an entity, officers of the entity;
(c) persons who work for the provider (including as employees or volunteers);
(d) any other person providing a business service to the provider such as a contractor, consultant or auditor.
(4) In subsection (3) “acting in the course of the provider’s business” means (as the case may be)—
(a) acting in the course of the provider’s business of providing the service, or
(b) acting in the course of a business, trade, profession or other concern—
(i) carried on (whether or not for profit) by the provider of the service, and
(ii) for the purposes of which the service is provided.
(5) In subsections (1) to (4) “service” (except in the term “business service”) means internet service, user-to-user service or search service.
(6) In subsection (3) “officer” includes a director, manager, partner, associate, secretary or other similar officer.
(7) In this Act “interested person”, in relation to a search service or a combined service, means a person that is responsible for a website or database capable of being searched by the search engine, provided that—
(a) in the case of an individual, the individual is in the United Kingdom;
(b) in the case of an entity, the entity is incorporated or formed under the law of any part of the United Kingdom.
(1) In this Act “internet service” means a service that is made available by means of the internet.
(2) For the purposes of subsection (1) a service is “made available by means of the internet” even where it is made available by means of a combination of—
(a) the internet, and
(b) an electronic communications service.
(3) “Electronic communications service” has the same meaning as in the Communications Act (see section 32(2) of that Act).
(1) In this Act “search engine”—
(a) includes a service or functionality which enables a person to search some websites or databases (as well as a service or functionality which enables a person to search (in principle) all websites or databases);
(b) does not include a service which enables a person to search just one website or database.
(2) For the purposes of this Act, a search engine is not to be taken to be “included” in an internet service or a user-to-user service if the search engine is controlled by a person who does not control other parts of the service.
(1) This section applies for the purposes of this Act.
(2) “Age verification” means any measure designed to verify the exact age of users of a regulated service.
(3) “Age estimation” means any measure designed to estimate the age or age-range of users of a regulated service.
(4) A measure which requires a user to self-declare their age (without more) is not to be regarded as age verification or age estimation.
(1) In this Act “proactive technology” means—
(a) content identification technology,
(b) user profiling technology, or
(c) behaviour identification technology,
but this is subject to subsections (3) and (7).
(2) “Content identification technology” means technology, such as algorithms, keyword matching, image matching or image classification, which analyses content to assess whether it is content of a particular kind (for example, illegal content).
(3) But content identification technology is not to be regarded as proactive technology if it is used in response to a report from a user or other person about particular content.
(4) “User profiling technology” means technology which analyses (any or all of)—
(a) relevant content,
(b) user data, or
(c) metadata relating to relevant content or user data,
for the purposes of building a profile of a user to assess characteristics such as age.
(5) Technology which—
(a) analyses data specifically provided by a user for the purposes of the provider verifying or estimating the user’s age in order to decide whether to allow the user to access a service (or part of a service) or particular content, and
(b) does not analyse any other data or content,
is not to be regarded as user profiling technology.
(6) “Behaviour identification technology” means technology which analyses (any or all of)—
(a) relevant content,
(b) user data, or
(c) metadata relating to relevant content or user data,
to assess a user’s online behaviour or patterns of online behaviour (for example, to assess whether a user may be involved in, or be the victim of, illegal activity).
(7) But behaviour identification technology is not to be regarded as proactive technology if it is used in response to concerns identified by another person or an automated tool about a particular user.
(8) “Relevant content” means—
(a) in relation to a user-to-user service, content that is user-generated content in relation to the service;
(b) in relation to a search service, the content of websites and databases capable of being searched by the search engine;
(c) in relation to an internet service within section 80(2), content that is provider pornographic content in relation to the service.
(9) “User data” means—
(a) data provided by users, including personal data (for example, data provided when a user sets up an account), and
(b) data created, compiled or obtained by providers of regulated services and relating to users (for example, data relating to when or where users access a service or how they use it).
(10) References in this Act to proactive technology include content identification technology, user profiling technology or behaviour identification technology which utilises artificial intelligence or machine learning.
(11) Accredited technology that may be required to be used in relation to the detection of terrorism content or CSEA content (or both) by a notice under section 121(1) is an example of content identification technology.
(12) The reference in subsection (8)(b) to a search service includes a reference to the search engine of a combined service.
(13) In this section—
“accredited” technology has the same meaning as in Chapter 5 of Part 7 (see section 125(12));
“illegal content”, “terrorism content” and “CSEA content” have the same meaning as in Part 3 (see section 59);
“user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).
232 Content communicated “publicly” or “privately”
(1) This section specifies factors which OFCOM must, in particular, consider when deciding whether content is communicated “publicly” or “privately” by means of a user-to-user service for the purposes of—
(a) section 121 (notice to deal with terrorism content),
(b) section 136 (requirement to use proactive technology), or
(c) paragraph 13(4) of Schedule 4 (recommendation of proactive technology in codes of practice).
(2) The factors are—
(a) the number of individuals in the United Kingdom who are able to access the content by means of the service;
(b) any restrictions on who may access the content by means of the service (for example, a requirement for approval or permission from a user, or the provider, of the service);
(c) the ease with which the content may be forwarded to or shared with—
(i) users of the service other than those who originally encounter it, or
(ii) users of another internet service.
(3) The following factors do not count as restrictions on access—
(a) a requirement to log in to or register with a service (or part of a service);
(b) a requirement to make a payment or take out a subscription in order to access a service (or part of a service) or to access particular content;
(c) inability to access a service (or part of a service) or to access particular content except by using particular technology or a particular kind of device (as long as that technology or device is generally available to the public).
(1) In this Act “functionality”, in relation to a user-to-user service, includes any feature that enables interactions of any description between users of the service by means of the service, and includes any feature enabling a user to do anything listed in subsection (2).
(2) The things are—
(a) creating a user profile, including an anonymous or pseudonymous profile;
(b) searching within the service for user-generated content or other users of the service;
(c) forwarding content to, or sharing content with, other users of the service;
(d) sharing content on other internet services;
(e) sending direct messages to or speaking to other users of the service, or interacting with them in another way (for example by playing a game);
(f) expressing a view on content, including, for example, by—
(i) applying a “like” or “dislike” button or other button of that nature,
(ii) applying an emoji or symbol of any kind,
(iii) engaging in yes/no voting, or
(iv) rating or scoring content in any way (including giving star or numerical ratings);
(g) sharing current or historic location information with other users of the service, recording a user’s movements, or identifying which other users of the service are nearby;
(h) following or subscribing to particular kinds of content or particular users of the service;
(i) creating lists, collections, archives or directories of content or users of the service;
(j) tagging or labelling content present on the service;
(k) uploading content relating to goods or services;
(l) applying or changing settings on the service which affect the presentation of user-generated content on the service;
(m) accessing other internet services through content present on the service (for example through hyperlinks).
(3) In this Act “functionality”, in relation to a search service, includes (in particular)—
(a) a feature that enables users to search websites or databases;
(b) a feature that makes suggestions relating to users’ search requests (predictive search functionality).
(4) In this section “user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).
(1) This section applies for the purposes of this Act, apart from Part 10 (communications offences).
(2) “Harm” means physical or psychological harm.
(3) References to harm presented by content, and any other references to harm in relation to content, include references to harm arising or that may arise from any one or combination of the following—
(a) the nature of the content;
(b) the fact of its dissemination;
(c) the manner of its dissemination.
(4) References to harm presented by content, and any other references to harm in relation to content, include references to cumulative harm arising or that may arise in the following circumstances—
(a) where content, or content of a particular kind, is repeatedly encountered by an individual (including, but not limited to, where content, or a kind of content, is sent to an individual by one user or by different users or encountered as a result of algorithms used by, or functionalities of, a service);
(b) where content of a particular kind is encountered by an individual in combination with content of a different kind (including, but not limited to, where a kind of content is sent to an individual by one user or by different users or encountered as a result of algorithms used by, or functionalities of, a service).
(5) References to harm presented by content, and any other references to harm in relation to content, include references to harm arising or that may arise in the following circumstances—
(a) where, as a result of the content, individuals act in a way that results in harm to themselves or that increases the likelihood of harm to themselves;
(b) where, as a result of the content, individuals do or say something to another individual that results in harm to that other individual or that increases the likelihood of such harm (including, but not limited to, where individuals act in such a way as a result of content that is related to that other individual’s characteristics or membership of a group).
(6) References to a risk of harm in relation to functionalities, and references to the risk of functionalities facilitating users encountering particular kinds of content (however expressed), include references to risks arising or that may arise due to multiple functionalities which, used in combination, increase the likelihood of harm arising (for example, as mentioned in subsection (4)).
(7) References to a risk of harm, or to potential harm, are to be read in the same way as references to harm.
(8) In contexts where harm (or a risk of harm or potential harm) relates to children, subsections (4) to (5) are to be read as if they referred to children instead of individuals.
235 “Online safety functions” and “online safety matters”
(1) In this Act references to OFCOM’s “online safety functions”—
(a) are references to—
(i) the functions that OFCOM have under this Act,
(ii) the functions that OFCOM have under the provisions of the Communications Act listed in subsection (2), so far as those functions relate to regulated services or Part 3 services (as the case may be), and
(iii) the functions that OFCOM have under section 3 of the Communications Act (general duties), so far as duties under that section relate to a function which is an online safety function by reason of sub-paragraph (i) or (ii);
(b) include references to OFCOM’s power to do anything appearing to them to be incidental or conducive to the carrying out of any of their functions within paragraph (a)(i) or (ii) (see section 1(3) of the Communications Act).
(2) These are the provisions of the Communications Act referred to in subsection (1)(a)(ii)—
(a) section 6 (duties to review regulatory burdens);
(b) section 7 (duty to carry out impact assessments);
(c) section 8 (duty to publish and meet promptness standards);
(d) sections 11 and 11A (duties to promote media literacy);
(e) sections 12 and 13 (Content Board);
(f) section 14(6)(a) (research about media literacy);
(g) section 14(6B) (research about users’ experience of regulated services);
(h) section 16 (consumer consultation);
(i) section 20 (advisory committees for different parts of the United Kingdom);
(j) section 21 (advisory committee on elderly and disabled persons);
(k) section 22 (representation on international and other bodies);
(l) section 26 (publication of information and advice for consumers etc).
(3) References to OFCOM’s “online safety functions” also include references to OFCOM’s duty to comply with any of the following, so far as relating to the use of a regulated service by a person who has died—
(a) a notice from a senior coroner under paragraph 1(2) of Schedule 5 to the Coroners and Justice Act 2009 in connection with an investigation into a person’s death;
(b) a request for information in connection with the investigation of a procurator fiscal into, or an inquiry held or to be held in relation to, a person’s death;
(c) a notice from a coroner under section 17A(2) of the Coroners Act (Northern Ireland) 1959 (c. 15 (N.I.)) in connection with—
(i) an investigation to determine whether an inquest into a person’s death is necessary, or
(ii) an inquest in relation to a person’s death.
(4) In this Act “online safety matters” means the matters to which OFCOM’s online safety functions relate.
(5) In subsection (3)(b) “inquiry” means an inquiry held, or to be held, under the Inquiries into Fatal Accidents and Sudden Deaths etc. (Scotland) Act 2016 (asp 2).
(1) In this Act—
“adult” means a person aged 18 or over;
“audit notice” means a notice given under paragraph 4 of Schedule 12;
“automated tool” includes bot;
“capacity”: any reference to the capacity of a provider of a regulated service is to—
the financial resources of the provider, and
the level of technical expertise which is available to the provider, or which it is reasonable to expect would be available to the provider given its size and financial resources;
“child” means a person under the age of 18;
“the Communications Act” means the Communications Act 2003;
“confirmation decision” means a notice given under section 132;
“content” means anything communicated by means of an internet service, whether publicly or privately, including written material or messages, oral communications, photographs, videos, visual images, music and data of any description;
“the Convention” has the meaning given by section 21(1) of the Human Rights Act 1998;
“country” includes territory;
“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3(9) of that Act);
“document” means anything in which information (in whatever form) is recorded;
“encounter”, in relation to content, means read, view, hear or otherwise experience content;
“entity” means a body or association of persons or an organisation, regardless of whether the body, association or organisation is—
formed under the law of any part of the United Kingdom or of a country outside the United Kingdom, or
a legal person under the law under which it is formed;
“freedom of expression”: any reference to freedom of expression (except in sections 41(6)(f) and 78(2)(d)) is to the freedom to receive and impart ideas, opinions or information (referred to in Article 10(1) of the Convention) by means of speech, writing or images;
“identifying content” means content the function of which is to identify a user of an internet service (for example, a user name or profile picture);
“information notice” means a notice given under section 101(C1) or (1) or 101(1);
“measure”: any reference to a measure includes a reference to any system or process relevant to the operation of an internet service or any step or action which may be taken by a provider of an internet service to comply with duties or requirements under this Act;
“notice” means notice in writing;
“notify” means notify in writing, and “notification” is to be construed accordingly;
“OFCOM” means the Office of Communications;
“paid-for advertisement”: an advertisement is a “paid-for advertisement” in relation to an internet service if—
the provider of the service receives any consideration (monetary or non-monetary) for the advertisement (whether directly from the advertiser or indirectly from another person), and
the placement of the advertisement is determined by systems or processes that are agreed between the parties entering into the contract relating to the advertisement;
“person” includes (in addition to an individual and a body of persons corporate or unincorporate) any organisation or association of persons;
“personal data” has the meaning given by section 3(2) of the Data Protection Act 2018;
“pornographic content” means content of such a nature that it is reasonable to assume that it was produced solely or principally for the purpose of sexual arousal;
“processing” has the meaning given by section 3(4) of the Data Protection Act 2018;
“provisional notice of contravention” means a notice given under section 130;
“publicly available” means available to members of the public in the United Kingdom;
“systems and/or processes”: any reference to systems and/or processes is to human or automated systems and/or processes, and accordingly includes technologies;
“taking down” (content): any reference to taking down content is to any action that results in content being removed from a user-to-user service or being permanently hidden so users of the service cannot encounter it (and related expressions are to be read accordingly);
“terms of service”, in relation to a user-to-user service, means all documents (whatever they are called) comprising the contract for use of the service (or of part of it) by United Kingdom users;
“user-to-user part”, in relation to a user-to-user service, means the part of the service on which content that is user-generated content in relation to the service is present.
(2) The definitions of “encounter” and “person” in subsection (1) do not apply for the purposes of Part 10 (for the definition of “encounter” in that Part, see section 182(5)).
(3) References in this Act to an individual with a certain characteristic include references to an individual with a combination of characteristics.
(4) References in this Act to a kind of user-to-user service or search service (or Part 3 service) include references to user-to-user services or search services grouped together for the purposes of a risk profile prepared by OFCOM under section 98 (and references to different kinds of user-to-user services or search services (or Part 3 services) are to be read accordingly).
(5) References in this Act to content (or content of a particular kind) present or prevalent on a user-to-user service (or on a part of it), or to the presence, incidence or prevalence of content (or content of a particular kind) on a user-to-user service (or on a part of it), do not include, in the case of a user-to-user service that includes a search engine—
(a) search content, or
(b) any other content that, following a search request, may be encountered as a result of subsequent interactions with internet services.
In this subsection “search content” and “search request” have the same meaning as in Part 3 (see section 57).
(6) For the purposes of this Act—
(a) any reference to the use of or access to a service, or to content present, published or displayed on a service, is to be taken to include use of or access to the service or content on registering or on the making of a payment or on subscription;
(b) any reference to content that is made available or that may be accessed, encountered or shared, is to be taken to include content that is made available or that may be accessed, encountered or shared for a limited period of time only;
and references to restrictions on access to a service or to content are to be read accordingly.
(7) For the purposes of this Act, content that is user-generated content in relation to an internet service does not cease to be such content in relation to the service when published or displayed on the service by means of—
(a) software or an automated tool or algorithm applied by the provider of the service or by a person acting on behalf of the provider, or
(b) an automated tool or algorithm made available on the service by the provider or by a person acting on behalf of the provider.
(8) Nothing in this Act (other than section 212) affects any prohibition or restriction in relation to pornographic content, or powers in relation to such content, under another enactment or rule of law.
(9) In this section, “user-generated content” has the meaning given by section 55 (see subsections (3) and (4) of that section).