Cross-references in Clause headings on contents pages corrected

Online Safety BillEXPLANATORY NOTESExplanatory notes to the Bill, prepared by the Department for Digital, Culture, Mediaand Sport, have been ordered to be published as HL Bill 87-EN.
EUROPEAN CONVENTION ON HUMAN RIGHTS
Lord Parkinson of Whitley Bay has made the following statement under section
19(1)(a) of the Human Rights Act 1998:
In my view the provisions of the Online Safety Bill are compatible with the Convention rights.

HL Bill 87(Rev)58/3

Online Safety BillCONTENTSPART 1INTRODUCTION
1

Overview of Act
PART 2
KEY DEFINITIONS

2
3
4“User-to-user service” and “search service”“Regulated service”, “Part 3 service” etc
Disapplication of Act to certain parts of services
PART 3PROVIDERS OF REGULATED USER-TO-USER SERVICES AND REGULATED SEARCH SERVICES:DUTIES OF CARE

CHAPTER 1
INTRODUCTION
5

Overview of Part 3
CHAPTER 2
PROVIDERS OF USER-TO-USER SERVICES: DUTIES OF CARE
User-to-user services: which duties apply, and scope of duties

6
7

Providers of user-to-user services: duties of care
Scope of duties of care
Illegal content duties for all user-to-user services

89Illegal content risk assessment duties
Safety duties about illegal content

HL Bill 87(Rev)

58/3

ii

Online Safety Bill

User-to-user services likely to be accessed by children
1011Children’s risk assessment duties
Safety duties protecting children
Category 1 services

12
13
14
15

User empowerment duties
Duties to protect content of democratic importanceDuties to protect news publisher content
Duties to protect journalistic content
Duties about content reporting and complaints procedures

16
17

Duty about content reporting
Duties about complaints procedures
Cross-cutting duties

18
19

Duties about freedom of expression and privacy
Record-keeping and review duties
CHAPTER 3
PROVIDERS OF SEARCH SERVICES: DUTIES OF CARE
Search services: which duties apply, and scope of duties

20
21

Providers of search services: duties of care
Scope of duties of care
Illegal content duties for all search services

22
23

Illegal content risk assessment duties
Safety duties about illegal content
Search services likely to be accessed by children

2425Children’s risk assessment duties
Safety duties protecting children
Duties about content reporting and complaints procedures

26
27

Duty about content reporting
Duties about complaints procedures
Cross-cutting duties

28
29

Duties about freedom of expression and privacy
Record-keeping and review duties

iii

Online Safety Bill

CHAPTER 4
CHILDREN'S ACCESS ASSESSMENTS
30
31
32

Children’s access assessments
Duties about children’s access assessments
Meaning of “likely to be accessed by children”
CHAPTER 5
DUTIES ABOUT FRAUDULENT ADVERTISING

33
34
35

Duties about fraudulent advertising: Category 1 services
Duties about fraudulent advertising: Category 2A services
Fraud etc offences
CHAPTER 6
CODES OF PRACTICE AND GUIDANCE
Codes of practice

36
37
38
39
40
41
42
43
44
45
46

Codes of practice about duties
Codes of practice: principles, objectives, content
Procedure for issuing codes of practiceSecretary of State’s powers of direction
Procedure for issuing codes of practice following direction under section 39
Publication of codes of practice
Review of codes of practiceMinor amendments of codes of practice
Relationship between duties and codes of practice
Effects of codes of practice
Duties and the first codes of practiceGuidance

47
48

OFCOM’s guidance about certain duties in Part 3
OFCOM’s guidance: content that is harmful to children and user
empowerment
CHAPTER 7
INTERPRETATION OF PART 3

49
50
51
52
53
54
55
56

“Regulated user-generated content”, “user-generated content”, “newspublisher content”“Recognised news publisher”“Search content”, “search results” etc
Restricting users’ access to content“Illegal content” etc“Content that is harmful to children” etc
Regulations under section 54
Regulations under section 54: OFCOM’s review and report

iv

Online Safety Bill

PART 4OTHER DUTIES OF PROVIDERS OF REGULATED USER-TO-USER SERVICES AND REGULATEDSEARCH SERVICES

CHAPTER 1
USER IDENTITY VERIFICATION
57
58

User identity verification
OFCOM’s guidance about user identity verification
CHAPTER 2REPORTING CHILD SEXUAL EXPLOITATION AND ABUSE CONTENT

59
60
61
62
63

Requirement to report CSEA content to the NCA
Regulations about reports to the NCA
NCA: information sharing
Offence in relation to CSEA reporting
Interpretation of this Chapter
CHAPTER 3

TERMS OF SERVICE: TRANSPARENCY, ACCOUNTABILITY AND FREEDOM OF EXPRESSION
64
65
66
67

Duty not to act against users except in accordance with terms of service
Further duties about terms of service
OFCOM’s guidance about duties set out in sections 64 and 65
Interpretation of this Chapter
CHAPTER 4
TRANSPARENCY REPORTING

68
69

Transparency reports about certain Part 3 services
OFCOM’s guidance about transparency reports
PART 5

DUTIES OF PROVIDERS OF REGULATED SERVICES: CERTAIN PORNOGRAPHIC CONTENT
70
71
72
73

“Pornographic content”, “provider pornographic content”, “regulated
provider pornographic content”
Scope of duties about regulated provider pornographic content
Duties about regulated provider pornographic content
OFCOM’s guidance about duties set out in section 72
PART 6
DUTIES OF PROVIDERS OF REGULATED SERVICES: FEES

74
75

Duty to notify OFCOM
Duty to pay fees

v

Online Safety Bill

76
77
78
79
80
81

OFCOM’s statement about “qualifying worldwide revenue” etc
Threshold figure
Secretary of State’s guidance about fees
OFCOM’s fees statements
Recovery of OFCOM’s initial costs
Meaning of “charging year” and “initial charging year”
PART 7
OFCOM'S POWERS AND DUTIES IN RELATION TO REGULATED SERVICES
CHAPTER 1
GENERAL DUTIES

82
83
84

General duties of OFCOM under section 3 of the Communications Act
Duties in relation to strategic priorities
Duty to carry out impact assessments
CHAPTER 2

REGISTER OF CATEGORIES OF REGULATED USER-TO-USER SERVICES AND REGULATEDSEARCH SERVICES

85
86
87
88

Meaning of threshold conditions etc
Register of categories of certain Part 3 services
Duty to maintain register
List of emerging Category 1 services
CHAPTER 3

RISK ASSESSMENTS OF REGULATED USER-TO-USER SERVICES AND REGULATED SEARCHSERVICES

89
90

OFCOM’s register of risks, and risk profiles, of Part 3 services
OFCOM’s guidance about risk assessments
CHAPTER 4
INFORMATION
Information power and information notices

91
92
93

Power to require information
Information notices
Requirement to name a senior manager
Skilled persons' reports

94

Reports by skilled persons
Investigations and interviews

95

Investigations

vi

Online Safety Bill

96

Power to require interviews
Powers of entry, inspection and audit

97

Powers of entry, inspection and audit
Information offences and penalties

98
99
100
101
102

Offences in connection with information notices
Senior managers’ liability: information offences
Offences in connection with notices under Schedule 12
Other information offences
Penalties for information offences
Disclosure of information

103
104
105
106
107
108
109

Co-operation and disclosure of information: overseas regulators
Disclosure of information
Intelligence service information
Provision of information to the Secretary of State
Amendment of Enterprise Act 2002
Information for users of regulated services
Admissibility of statements
CHAPTER 5

REGULATED USER-TO-USER SERVICES AND REGULATED SEARCH SERVICES: NOTICES TO DEAL
WITH TERRORISM CONTENT AND CSEA CONTENT
110
111
112
113
114
115
116
117

Notices to deal with terrorism content or CSEA content (or both)Warning notices
Matters relevant to a decision to give a notice under section 110(1)Notices under section 110(1): supplementary
Review and further notice under section 110(1)OFCOM’s guidance about functions under this Chapter
OFCOM’s annual report
Interpretation of this Chapter
CHAPTER 6
ENFORCEMENT POWERS
Provisional notices and confirmation decisions

118
119
120
121
122
123
124
125

Provisional notice of contravention
Requirements enforceable by OFCOM against providers of regulated services
Confirmation decisions
Confirmation decisions: requirements to take steps
Confirmation decisions: risk assessments
Confirmation decisions: children’s access assessments
Confirmation decisions: proactive technology
Confirmation decisions: penalties

vii

Online Safety Bill

Penalty notices etc
126
127
128
129

Penalty for failure to comply with confirmation decision
Penalty for failure to comply with notice under section 110(1)Non-payment of fee
Information to be included in notices under sections 127 and 128
Amount of penalties etc

130

Amount of penalties etc
Business disruption measures

131
132
133
134
135

Service restriction orders
Interim service restriction orders
Access restriction orders
Interim access restriction orders
Interaction with other action by OFCOM
Publication of enforcement action

136
137

Publication by OFCOM of details of enforcement action
Publication by providers of details of enforcement action
Guidance

138

OFCOM’s guidance about enforcement action
CHAPTER 7
COMMITTEES, RESEARCH AND REPORTS

139
140
141
142
143
144
145
146
147

Advisory committee on disinformation and misinformation
Functions of the Content Board
Research about users’ experiences of regulated services
Consumer consultation
OFCOM’s statement about freedom of expression and privacy
OFCOM’s reports about news publisher content and journalistic content
OFCOM’s transparency reports
OFCOM’s report about researchers’ access to information
OFCOM’s reports
PART 8APPEALS AND SUPER-COMPLAINTSCHAPTER 1
APPEALS

148
149

Appeals against OFCOM decisions relating to the register under section 86
Appeals against OFCOM notices

viii

Online Safety Bill

CHAPTER 2
SUPER-COMPLAINTS
150
151
152

Power to make super-complaints
Procedure for super-complaints
OFCOM’s guidance about super-complaints
PART 9SECRETARY OF STATE'S FUNCTIONS IN RELATION TO REGULATED SERVICES
Strategic priorities

153
154

Statement of strategic priorities
Consultation and parliamentary procedure
Directions to OFCOM

155
156

Directions about advisory committees
Directions in special circumstances
Guidance

157

Secretary of State’s guidance
Annual report

158

Annual report on the Secretary of State’s functions
Review

159

ReviewPART 10
COMMUNICATIONS OFFENCES
Harmful, false and threatening communications offences

160
161
162
163
164
165
166

False communications offence
Exemptions from offence under section 160
Threatening communications offence
Interpretation of sections 160 to 162
Offences of sending or showing flashing images electronically
Extra-territorial application and jurisdiction
Liability of corporate officers
Offence of sending etc photograph or film of genitals

167

Sending etc photograph or film of genitals

ix

Online Safety Bill

Repeals and amendments in connection with offences
168
169

Repeals in connection with offences under sections 160 and 162
Consequential amendments
PART 11
SUPPLEMENTARY AND GENERAL
Providers' judgements about the status of content

170
171

Providers’ judgements about the status of content
OFCOM’s guidance about illegal content judgements
Liability of providers etc

172
173
174
175

Providers that are not legal persons
Individuals providing regulated services: liability
Liability of parent entities etc
Former providers of regulated services
Offences

176
177
178
179

Information offences: supplementary
Defences
Liability of corporate officers for offences
Application of offences to providers that are not legal persons
Extra-territorial application

180
181

Extra-territorial application
Information offences: extra-territorial application and jurisdiction
Payment of sums into Consolidated Fund

182

Payment of sums into the Consolidated Fund
Publication by OFCOM

183

Publication by OFCOM
Service of notices

184

Service of notices
Repeals and amendments

185
186
187
188
189
190

Amendments of Part 4B of the Communications Act
Repeal of Part 4B of the Communications Act
Repeal of Part 4B of the Communications Act: transitional provision etc
Repeals: Digital Economy Act 2017
Offence under the Obscene Publications Act 1959: OFCOM defence
Offences regarding indecent photographs of children: OFCOM defencex

Online Safety Bill

Powers to amend Act
191
192
193
194

Powers to amend section 35
Powers to amend or repeal provisions relating to exempt content or services
Powers to amend Part 2 of Schedule 1
Powers to amend Schedules 5, 6 and 7
Regulations

195
196
197

Power to make consequential provision
Regulations: general
Parliamentary procedure for regulations
PART 12INTERPRETATION AND FINAL PROVISIONSInterpretation

198
199
200
201
202
203
204
205
206
207
208

“Provider” of internet service“User”, “United Kingdom user” and “interested person”“Internet service”“Search engine”“Proactive technology”
Content communicated “publicly” or “privately”“Functionality”“Harm” etc“Online safety functions” and “online safety matters”
Interpretation: generalIndex of defined terms
Final provisions

209
210
211
212

Financial provisions
ExtentCommencement and transitional provision
Short title

Schedule 1 — Exempt user-to-user and search services
Part 1 — Descriptions of services which are exempt
Part 2 — Paragraph 10 exemption: descriptions of education andchildcarePart 3 — Interpretation
Schedule 2 — User-to-user services and search services that include
regulated provider pornographic content
Schedule 3 — Timing of providers’ assessments
Part 1 — Timing of illegal content risk assessments and children’saccess assessments
Part 2 — Timing of children’s risk assessments
Part 3 — Pre-existing Part 4B services
Part 4 — Interpretation, and extension of three-month periods

Online Safety Bill

xi

Schedule 4 — Codes of practice under section 36: principles, objectives,content
Schedule 5 — Terrorism offences
Schedule 6 — Child sexual exploitation and abuse offences
Part 1 — England and Wales, and Northern IrelandPart 2 — Scotland
Schedule 7 — Priority offences
Schedule 8 — Transparency reports by providers of Category 1 services,
Category 2A services and Category 2B services
Part 1 — Matters about which information may be required: user-touser part of service
Part 2 — Matters about which information may be required: searchenginePart 3 — Further provision and interpretation
Schedule 9 — Certain internet services not subject to duties relating toregulated provider pornographic content
Schedule 10 — Recovery of OFCOM’s initial costs
Schedule 11 — Categories of regulated user-to-user services and regulated
search services: regulations
Schedule 12 — OFCOM’s powers of entry, inspection and audit
Schedule 13 — Penalties imposed by OFCOM under Chapter 6 of Part 7
Schedule 14 — Amendments consequential on offences in Part 10 of this Act
Part 1 — Amendments consequential on offences in sections 160, 162
and 164
Part 2 — Amendments consequential on offence in section 167
Schedule 15 — Liability of parent entities etc
Schedule 16 — Amendments of Part 4B of the Communications Act
Schedule 17 — Video-sharing platform services: transitional provision etc
Part 1 — Interpretation
Part 2 — During the transitional period
Part 3 — Application of Part 6 of this Act: fees
Part 4 — After the end of the transitional period

1Online Safety Bill
Part 1 — Introduction

A

BILL
TO

Make provision for and in connection with the regulation by OFCOM ofcertain internet services; for and in connection with communications offences;and for connected purposes.

B

E IT ENACTED by the King’s most Excellent Majesty, by and with the advice andconsent of the Lords Spiritual and Temporal, and Commons, in this present
Parliament assembled, and by the authority of the same, as follows:—

PART 1INTRODUCTION
1

Overview of Act(1)

Parts 2 to 9 and 11 and 12 of this Act contain provision about the regulation by
OFCOM of certain internet services.

(2)

Part 2 contains key definitions, including the definition of a user-to-userservice, a search service, a Part 3 service and a regulated service.

(3)

Part 3 imposes duties of care on providers of user-to-user services and searchservices and requires OFCOM to issue codes of practice about those duties.

(4)

Part 4 imposes further duties on providers of user-to-user services and searchservices.

(5)

Part 5 imposes duties on providers of internet services (including user-to-userservices and search services) that publish certain pornographic content.

(6)Part 6, which imposes requirements to pay fees to OFCOM, applies toproviders of internet services to which the duties in Part 3, 4 or 5 apply(“regulated services”).

(7)Part 7 is about OFCOM’s powers and duties in relation to regulated services(including powers to obtain information and enforcement powers).

(8)

Part 8 is about appeals and complaints relating to regulated services.

HL Bill 87(Rev)

58/3

5

10

15

2

Online Safety Bill
Part 1 — Introduction(9)Part 9 is about the Secretary of State’s functions in relation to regulated
services.

(10)

Part 10 contains communications offences.

(11)

Parts 11 and 12 contain supplementary provisions including an index of terms
defined in this Act (see section 208).

5

PART 2
KEY DEFINITIONS
2“User-to-user service” and “search service”(1)

In this Act “user-to-user service” means an internet service by means of which
content that is generated directly on the service by a user of the service, or
uploaded to or shared on the service by a user of the service, may be
encountered by another user, or other users, of the service.

(2)

For the purposes of subsection (1)—(a) it does not matter if content is actually shared with another user orusers as long as a service has a functionality that allows such sharing;(b) it does not matter what proportion of content on a service is content
described in that subsection.

10

15

(3)

For the meaning of “content” and “encounter”, see section 207.

(4)

In this Act “search service” means an internet service that is, or includes, asearch engine (see section 201).

20

(5)

Subsections (6) and (7) have effect to determine whether an internet service
that—(a) is of a kind described in subsection (1), and(b) includes a search engine,
is a user-to-user service or a search service for the purposes of this Act.

25

(6)

(7)
3

It is a search service if the only content described in subsection (1) that is
enabled by the service is content of any of the following kinds—(a) content mentioned in paragraph 1, 2 or 3 of Schedule 1 (emails, SMS
and MMS messages, one-to-one live aural communications) andrelated identifying content;(b) content arising in connection with any of the activities described inparagraph 4(1) of Schedule 1 (comments etc on provider content);(c) content present on a part of the service in relation to which theconditions in paragraph 7(2) of Schedule 1 are met (internal businessservice conditions).

30

35

Otherwise, it is a user-to-user service.
“Regulated service”, “Part 3 service” etc(1)This section applies for the purposes of this Act.

(2)

A user-to-user service is a “regulated user-to-user service”, and a search service
is a “regulated search service”, if the service—(a) has links with the United Kingdom (see subsections (5) and (6)), and40

Online Safety Bill
Part 2 — Key definitions(b)3

is not—(i) a service of a description that is exempt as provided for by
Schedule 1, or(ii) a service of a kind described in Schedule 2 (services combining
user-generated content or search content not regulated by thisAct with pornographic content that is regulated).

(3)“Part 3 service” means a regulated user-to-user service or a regulated searchservice.

(4)“Regulated service” means—(a) a regulated user-to-user service,(b) a regulated search service, or(c) an internet service, other than a regulated user-to-user service or aregulated search service, that is within section 71(2) (including a serviceof a kind described in Schedule 2).

5

10

(5)

For the purposes of subsection (2), a user-to-user service or a search service“has links with the United Kingdom” if—(a) the service has a significant number of United Kingdom users, or(b) United Kingdom users form one of the target markets for the service (orthe only target market).

15

(6)

For the purposes of subsection (2), a user-to-user service or a search service also
“has links with the United Kingdom” if—(a) the service is capable of being used in the United Kingdom byindividuals, and(b) there are reasonable grounds to believe that there is a material risk ofsignificant harm to individuals in the United Kingdom presented by—(i) in the case of a user-to-user service, user-generated content
present on the service or (if the service includes a search engine)
search content of the service;(ii) in the case of a search service, search content of the service.

20

(7)

A regulated user-to-user service that includes a public search engine is referred
to in this Act as a “combined service”.
“Public search engine” means a search engine other than one in relation towhich the conditions in paragraph 7(2) of Schedule 1 (internal business service
conditions) are met.

30

(8)

In this section—“search content” has the same meaning as in Part 3 (see section 51);
“user-generated content” has the meaning given by section 49 (seesubsections (3) and (4) of that section).

35

4

25

Disapplication of Act to certain parts of services(1)

This Act does not apply in relation to a part of a Part 3 service if the conditions
in paragraph 7(2) of Schedule 1 (internal business service conditions) are met
in relation to that part.

(2)

This Act does not apply in relation to a part of a regulated search service if—(a) the only user-generated content enabled by that part of the service iscontent of any of the following kinds—

40

45

4

Online Safety Bill
Part 2 — Key definitions

(i)

(b)
(3)

content mentioned in paragraph 1, 2 or 3 of Schedule 1 (emails,
SMS and MMS messages, one-to-one live aural
communications) and related identifying content;(ii) content arising in connection with any of the activities
described in paragraph 4(1) of Schedule 1 (comments etc on
provider content); andno regulated provider pornographic content is published or displayedon that part of the service.

In this section—“regulated provider pornographic content” and “published or displayed”
have the same meaning as in Part 5 (see section 70);
“user-generated content” has the meaning given by section 49 (seesubsections (3) and (4) of that section).

510PART 3PROVIDERS OF REGULATED USER-TO-USER SERVICES AND REGULATED SEARCH SERVICES:

15

DUTIES OF CARE

CHAPTER 1
INTRODUCTION
5

Overview of Part 3(1)

This Part imposes duties of care on providers of regulated user-to-user services
and regulated search services and requires OFCOM to issue codes of practicerelating to some of those duties.

(2)

Chapter 2 imposes duties of care on providers of regulated user-to-userservices in relation to content and activity on their services.

(3)

Chapter 3 imposes duties of care on providers of regulated search services inrelation to content and activity on their services.

(4)

Chapter 4 imposes duties on providers of regulated user-to-user services andregulated search services to assess whether a service is likely to be accessed bychildren.

(5)

Chapter 5 imposes duties on providers of certain regulated user-to-userservices and regulated search services relating to fraudulent advertising.

(6)

Chapter 6 requires OFCOM to issue codes of practice relating to particularduties and explains what effects the codes of practice have.

(7)

Chapter 7 is about the interpretation of this Part, and it includes definitions of
the following key terms—“priority offence”, “illegal content”, “terrorism content”, “CSEA content”
and “priority illegal content” (see section 53);
“primary priority content that is harmful to children”, “priority content
that is harmful to children” and “content that is harmful to children”(see section 54);
“search content” (see section 51).

20

25

30

35

40

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 2 — Providers of user-to-user services: duties of care

5

CHAPTER 2
PROVIDERS OF USER-TO-USER SERVICES: DUTIES OF CARE
User-to-user services: which duties apply, and scope of duties
6

Providers of user-to-user services: duties of care
(1)

Subsections (2) to (6) apply to determine which of the duties set out in this
Chapter (and, in the case of combined services, Chapter 3) must be compliedwith by providers of regulated user-to-user services.

(2)

All providers of regulated user-to-user services must comply with thefollowing duties in relation to each such service which they provide—(a) the duties about illegal content risk assessments set out in section 8,(b) the duties about illegal content set out in section 9,(c) the duty about content reporting set out in section 16,(d) the duties about complaints procedures set out in section 17,(e) the duties about freedom of expression and privacy set out in section
18(2) and (3), and(f) the duties about record-keeping and review set out in section 19.

(3)

Additional duties must be complied with by providers of particular kinds ofregulated user-to-user services, as follows.

(4)

All providers of regulated user-to-user services that are likely to be accessed bychildren must comply with the following duties in relation to each such service
which they provide—(a) the duties about children’s risk assessments set out in section 10, and(b) the duties to protect children’s online safety set out in section 11.

(5)

All providers of Category 1 services must comply with the following duties inrelation to each such service which they provide—(a) the duties to empower adult users set out in section 12,(b) the duties to protect content of democratic importance set out in section
13,(c) the duties to protect news publisher content set out in section 14,(d) the duties to protect journalistic content set out in section 15, and(e) the duties about freedom of expression and privacy set out in section
18(4), (6) and (7).

(6)

All providers of combined services must comply with the following duties inrelation to the search engine of each such service which they provide—(a) if the service is not likely to be accessed by children, the duties set out
in Chapter 3 referred to in section 20(2);(b) if the service is likely to be accessed by children, the duties set out in
Chapter 3 referred to in section 20(2) and (3).

(7)

For the meaning of “likely to be accessed by children”, see section 32.

(8)

For the meaning of “Category 1 service”, see section 86 (register of categories
of services).

5

10

15

20

25

30

35

40

6

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 2 — Providers of user-to-user services: duties of care

7

Scope of duties of care
(1)

(2)

(3)

A duty set out in this Chapter which must be complied with in relation to auser-to-user service that includes regulated provider pornographic content
does not extend to—(a) the regulated provider pornographic content, or(b) the design, operation or use of the service so far as relating to that
content.
See Part 5 for the duties which relate to regulated provider pornographic
content, and the meaning of that term.
A duty set out in this Chapter which must be complied with in relation to a
combined service does not extend to—(a) the search content of the service,(b) any other content that, following a search request, may be encounteredas a result of subsequent interactions with internet services, or(c) anything relating to the design, operation or use of the search engine.
A duty set out in this Chapter which must be complied with in relation to auser-to-user service extends only to—(a) the design, operation and use of the service in the United Kingdom, and(b) in the case of a duty that is expressed to apply in relation to users of aservice, the design, operation and use of the service as it affects United
Kingdom users of the service.

5

10

15

20

Illegal content duties for all user-to-user services
8

Illegal content risk assessment duties(1)

This section sets out the duties about risk assessments which apply in relation
to all regulated user-to-user services.

(2)

A duty to carry out a suitable and sufficient illegal content risk assessment at atime set out in, or as provided by, Schedule 3.

(3)

A duty to take appropriate steps to keep an illegal content risk assessment up
to date, including when OFCOM make any significant change to a risk profilethat relates to services of the kind in question.

(4)

Before making any significant change to any aspect of a service’s design or
operation, a duty to carry out a further suitable and sufficient illegal content
risk assessment relating to the impacts of that proposed change.

(5)

An “illegal content risk assessment” of a service of a particular kind means anassessment of the following matters, taking into account the risk profile that
relates to services of that kind—(a) the user base;(b) the level of risk of individuals who are users of the service encountering
the following by means of the service—(i) each kind of priority illegal content (with each kind separately
assessed), and(ii) other illegal content,
taking into account (in particular) algorithms used by the service, andhow easily, quickly and widely content may be disseminated by meansof the service;

25

30

35

40

45

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 2 — Providers of user-to-user services: duties of care

(c)
(d)
(e)

(f)
(g)
(h)

7

the level of risk of the service being used for the commission or
facilitation of a priority offence;
the level of risk of harm to individuals presented by illegal content ofdifferent kinds or by the use of the service for the commission or
facilitation of a priority offence;
the level of risk of functionalities of the service facilitating the presenceor dissemination of illegal content or the use of the service for thecommission or facilitation of a priority offence, identifying andassessing those functionalities that present higher levels of risk;
the different ways in which the service is used, and the impact of suchuse on the level of risk of harm that might be suffered by individuals;
the nature, and severity, of the harm that might be suffered byindividuals from the matters identified in accordance with paragraphs(b) to (f);how the design and operation of the service (including the businessmodel, governance, use of proactive technology, measures to promoteusers’ media literacy and safe use of the service, and other systems andprocesses) may reduce or increase the risks identified.

(6)

In this section references to risk profiles are to the risk profiles for the time
being published under section 89 which relate to the risk of harm to individuals
presented by illegal content.

(7)

See also—(a) section 19(2) (records of risk assessments), and(b) Schedule 3 (timing of providers’ assessments).

9

Safety duties about illegal content(1)This section sets out the duties about illegal content which apply in relation to
all regulated user-to-user services.

(2)

A duty, in relation to a service, to take or use proportionate measures relating
to the design or operation of the service to—(a) prevent individuals from encountering priority illegal content bymeans of the service,(b) effectively mitigate and manage the risk of the service being used forthe commission or facilitation of a priority offence, as identified in themost recent illegal content risk assessment of the service, and(c) effectively mitigate and manage the risks of harm to individuals, as
identified in the most recent illegal content risk assessment of theservice (see section 8(5)(g)).

(3)

(4)

A duty to operate a service using proportionate systems and processes
designed to—(a) minimise the length of time for which any priority illegal content ispresent;(b) where the provider is alerted by a person to the presence of any illegal
content, or becomes aware of it in any other way, swiftly take downsuch content.
The duties set out in subsections (2) and (3) apply across all areas of a service,including the way it is designed, operated and used as well as content present
on the service, and (among other things) require the provider of a service totake or use measures in the following areas, if it is proportionate to do so—

5

10

15

20

25

30

35

40

45

8

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 2 — Providers of user-to-user services: duties of care

(a)
(b)
(c)
(d)

regulatory compliance and risk management arrangements,
design of functionalities, algorithms and other features,
policies on terms of use,
policies on user access to the service or to particular content present on
the service, including blocking users from accessing the service orparticular content,
content moderation, including taking down content,
functionalities allowing users to control the content they encounter,
user support measures, andstaff policies and practices.

10

A duty to include provisions in the terms of service specifying how individuals
are to be protected from illegal content, addressing each paragraph ofsubsection (3), and (in relation to paragraph (a)) separately addressing
terrorism content, CSEA content (see section 53 and Schedule 6) and otherpriority illegal content.

15

(e)
(f)
(g)
(h)
(5)

(6)

A duty to apply the provisions of the terms of service referred to in subsection(5) consistently.

(7)

A duty to include provisions in the terms of service giving information about
any proactive technology used by a service for the purpose of compliance witha duty set out in subsection (2) or (3) (including the kind of technology, when
it is used, and how it works).

(8)

A duty to ensure that the provisions of the terms of service referred to in
subsections (5) and (7) are clear and accessible.

(9)

In determining what is proportionate for the purposes of this section, thefollowing factors, in particular, are relevant—(a) all the findings of the most recent illegal content risk assessment(including as to levels of risk and as to nature, and severity, of potential
harm to individuals), and(b) the size and capacity of the provider of a service.

(10)

In this section “illegal content risk assessment” has the meaning given by
section 8.

(11)

See also, in relation to duties set out in this section, section 18 (duties about
freedom of expression and privacy).

5

20

25

30

User-to-user services likely to be accessed by children
10Children’s risk assessment duties(1)

This section sets out the duties about risk assessments which apply in relation
to regulated user-to-user services that are likely to be accessed by children (inaddition to the duties about risk assessments set out in section 8).

(2)

A duty to carry out a suitable and sufficient children’s risk assessment at a time
set out in, or as provided by, Schedule 3.

(3)

A duty to take appropriate steps to keep a children’s risk assessment up todate, including when OFCOM make any significant change to a risk profilethat relates to services of the kind in question.

35

40

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 2 — Providers of user-to-user services: duties of care

9(4)Before making any significant change to any aspect of a service’s design or
operation, a duty to carry out a further suitable and sufficient children’s risk
assessment relating to the impacts of that proposed change.

(5)

Where a children’s risk assessment of a service identifies the presence of nondesignated content that is harmful to children, a duty to notify OFCOM of—(a) the kinds of such content identified, and(b) the incidence of those kinds of content on the service.

(6)

A “children’s risk assessment” of a service of a particular kind means anassessment of the following matters, taking into account the risk profile that
relates to services of that kind—(a) the user base, including the number of users who are children indifferent age groups;(b) the level of risk of children who are users of the service encountering
the following by means of the service—(i) each kind of primary priority content that is harmful to children(with each kind separately assessed),(ii) each kind of priority content that is harmful to children (witheach kind separately assessed), and(iii) non-designated content that is harmful to children,
giving separate consideration to children in different age groups, andtaking into account (in particular) algorithms used by the service andhow easily, quickly and widely content may be disseminated by meansof the service;(c) the level of risk of harm to children presented by different kinds ofcontent that is harmful to children, giving separate consideration tochildren in different age groups;(d) the level of risk of harm to children presented by content that is harmful
to children which particularly affects individuals with a certain
characteristic or members of a certain group;(e) the level of risk of functionalities of the service facilitating the presenceor dissemination of content that is harmful to children, identifying andassessing those functionalities that present higher levels of risk,
including functionalities—(i) enabling adults to search for other users of the service(including children), and(ii) enabling adults to contact other users (including children) bymeans of the service;(f) the different ways in which the service is used, and the impact of suchuse on the level of risk of harm that might be suffered by children;(g) the nature, and severity, of the harm that might be suffered by children
from the matters identified in accordance with paragraphs (b) to (f),giving separate consideration to children in different age groups;(h) how the design and operation of the service (including the businessmodel, governance, use of proactive technology, measures to promoteusers’ media literacy and safe use of the service, and other systems andprocesses) may reduce or increase the risks identified.

(7)

In this section references to risk profiles are to the risk profiles for the time
being published under section 89 which relate to the risk of harm to children
presented by content that is harmful to children.

(8)

See also—

5

10

15

20

25

30

35

40

45

50

10

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 2 — Providers of user-to-user services: duties of care

(a)
(b)
11

section 19(2) (records of risk assessments), andSchedule 3 (timing of providers’ assessments).

Safety duties protecting children(1)This section sets out the duties to protect children’s online safety which apply
in relation to regulated user-to-user services that are likely to be accessed bychildren.

5(2)

A duty, in relation to a service, to take or use proportionate measures relating
to the design or operation of the service to effectively—(a) mitigate and manage the risks of harm to children in different age
groups, as identified in the most recent children’s risk assessment of theservice (see section 10(6)(g)), and(b) mitigate the impact of harm to children in different age groups
presented by content that is harmful to children present on the service.

10

(3)

A duty to operate a service using proportionate systems and processes
designed to—(a) prevent children of any age from encountering, by means of the service,primary priority content that is harmful to children (for example, byusing age verification);(b) protect children in age groups judged to be at risk of harm from othercontent that is harmful to children (or from a particular kind of suchcontent) from encountering it by means of the service.

15

20

(4)

Age assurance to identify who is a child user or which age group a child user
is in is an example of a measure which may be taken or used (among others)
for the purpose of compliance with a duty set out in subsection (2) or (3).

(5)

The duties set out in subsections (2) and (3) apply across all areas of a service,including the way it is designed, operated and used as well as content present
on the service, and (among other things) require the provider of a service totake or use measures in the following areas, if it is proportionate to do so—(a) regulatory compliance and risk management arrangements,(b) design of functionalities, algorithms and other features,(c) policies on terms of use,(d) policies on user access to the service or to particular content present on
the service, including blocking users from accessing the service orparticular content,(e) content moderation, including taking down content,(f) functionalities allowing for control over content that is encountered,especially by children,(g) user support measures, and(h) staff policies and practices.

25

A duty to include provisions in the terms of service specifying—(a) how children of any age are to be prevented from encountering
primary priority content that is harmful to children (with each kind ofprimary priority content separately covered);(b) how children in age groups judged to be at risk of harm from priority
content that is harmful to children (or from a particular kind of suchcontent) are to be protected from encountering it, where they are not

40

(6)

30

35

45

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 2 — Providers of user-to-user services: duties of care

(c)

11

prevented from doing so (with each kind of priority content separately
covered);how children in age groups judged to be at risk of harm from nondesignated content that is harmful to children (or from a particular kindof such content) are to be protected from encountering it, where they
are not prevented from doing so.

(7)

A duty to apply the provisions of the terms of service referred to in subsection(6) consistently.

(8)

If a provider takes or uses a measure designed to prevent access to the wholeof the service or a part of the service by children under a certain age, a duty to—(a) include provisions in the terms of service specifying details about theoperation of the measure, and(b) apply those provisions consistently.

(9)

A duty to include provisions in the terms of service giving information about
any proactive technology used by a service for the purpose of compliance witha duty set out in subsection (2) or (3) (including the kind of technology, when
it is used, and how it works).

(10)

A duty to ensure that the provisions of the terms of service referred to in
subsections (6), (8) and (9) are clear and accessible.

(11)

In determining what is proportionate for the purposes of this section, thefollowing factors, in particular, are relevant—(a) all the findings of the most recent children’s risk assessment (including
as to levels of risk and as to nature, and severity, of potential harm tochildren), and(b) the size and capacity of the provider of a service.

5

10

15

20

25

(12)

So far as a duty set out in this section relates to non-designated content that isharmful to children, the duty is to be taken to extend only to addressing risksof harm from the kinds of such content that have been identified in the mostrecent children’s risk assessment (if any have been identified).

(13)

References in subsections (3)(b) and (6)(b) and (c) to children in age groups
judged to be at risk of harm from content that is harmful to children arereferences to children in age groups judged to be at risk of such harm asassessed by the provider of a service in the most recent children’s risk
assessment of the service.

30

(14)

The duties set out in subsections (3) and (6) are to be taken to extend only tocontent that is harmful to children where the risk of harm is presented by thenature of the content (rather than the fact of its dissemination).

35

(15)

The duties set out in this section extend only to such parts of a service as it ispossible for children to access.

(16)

For the purposes of subsection (15), a provider is only entitled to conclude that
it is not possible for children to access a service, or a part of it, if there aresystems or processes in place (for example, age verification, or another meansof age assurance) that achieve the result that children are not normally able toaccess the service or that part of it.

40

(17)

In this section “children’s risk assessment” has the meaning given by section
10.

45

12

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 2 — Providers of user-to-user services: duties of care(18)

See also, in relation to duties set out in this section, section 18 (duties about
freedom of expression and privacy).
Category 1 services

12

User empowerment duties(1)

This section sets out the duties to empower adult users which apply in relation
to Category 1 services.

5

The duties
(2)

(3)

(4)

A duty to include in a service, to the extent that it is proportionate to do so,features which adult users may use or apply if they wish to increase theircontrol over content to which this subsection applies.
The features referred to in subsection (2) are those which, if used or applied bya user, result in the use by the service of systems or processes designed toeffectively—(a) reduce the likelihood of the user encountering content to which
subsection (2) applies present on the service, or(b) alert the user to content present on the service that is a particular kindof content to which subsection (2) applies.
A duty to ensure that all features included in a service in compliance with theduty set out in subsection (2) are made available to all adult users and are easy
to access.

(5)

A duty to include clear and accessible provisions in the terms of service
specifying which features are offered in compliance with the duty set out in
subsection (2), and how users may take advantage of them.

(6)

A duty to include in a service features which adult users may use or apply ifthey wish to filter out non-verified users.

(7)

The features referred to in subsection (6) are those which, if used or applied bya user, result in the use by the service of systems or processes designed to—(a) prevent non-verified users from interacting with content which thatuser generates, uploads or shares on the service, and(b) reduce the likelihood of that user encountering content which nonverified users generate, upload or share on the service.

10

15

20

25

30

Interpretation
(8)

(9)

In determining what is proportionate for the purposes of subsection (2), thefollowing factors, in particular, are relevant—(a) the likelihood of adult users encountering content to which subsection(2) applies by means of the service, and(b) the size and capacity of the provider of the service.
Subsection (2) applies to content that—(a) is regulated user-generated content in relation to the service inquestion, and(b) is within subsection (10), (11) or (12).

35

40Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 2 — Providers of user-to-user services: duties of care

13

(10)

Content is within this subsection if it encourages, promotes or provides
instructions for—(a) suicide or an act of deliberate self-injury, or(b) an eating disorder or behaviours associated with an eating disorder.

(11)

Content is within this subsection if it is abusive and the abuse targets any of thefollowing characteristics—(a) race,(b) religion,(c) sex,(d) sexual orientation,(e) disability, or(f) gender reassignment.

(12)

(13)

(14)

(15)

13

Content is within this subsection if it incites hatred against people—(a) of a particular race, religion, sex or sexual orientation,(b) who have a disability, or(c) who have the characteristic of gender reassignment.
In this section—“disability” means any physical or mental impairment;“injury” includes poisoning;“non-verified user” means a user who has not verified their identity to theprovider of a service (see section 57(1));“race” includes colour, nationality, and ethnic or national origins.
In this section—(a) references to features include references to functionalities and settings,
and(b) references to religion include references to a lack of religion.
For the purposes of this section, a person has the characteristic of gender
reassignment if the person is proposing to undergo, is undergoing or has
undergone a process (or part of a process) for the purpose of reassigning theperson’s sex by changing physiological or other attributes of sex, and thereference to gender reassignment in subsection (11) is to be construed
accordingly.

5

10

15

20

25

30

Duties to protect content of democratic importance(1)

This section sets out the duties to protect content of democratic importancewhich apply in relation to Category 1 services.

(2)

A duty to operate a service using proportionate systems and processes
designed to ensure that the importance of the free expression of content of
democratic importance is taken into account when making decisions about—(a) how to treat such content (especially decisions about whether to take it
down or restrict users’ access to it), and(b) whether to take action against a user generating, uploading or sharing
such content.

(3)

A duty to ensure that the systems and processes mentioned in subsection (2)apply in the same way to a wide diversity of political opinion.

35

40

14

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 2 — Providers of user-to-user services: duties of care

(4)

A duty to include provisions in the terms of service specifying the policies andprocesses that are designed to take account of the principle mentioned insubsection (2), including, in particular, how that principle is applied todecisions mentioned in that subsection.

(5)

A duty to ensure that—(a) the provisions of the terms of service referred to in subsection (4) areclear and accessible, and(b) those provisions are applied consistently.

(6)

For the purposes of this section content is “content of democratic importance”,
in relation to a user-to-user service, if—(a) the content is—(i) news publisher content in relation to that service, or(ii) regulated user-generated content in relation to that service; and(b) the content is or appears to be specifically intended to contribute todemocratic political debate in the United Kingdom or a part or area of
the United Kingdom.

(7)

In this section, the reference to “taking action” against a user is to giving awarning to a user, or suspending or banning a user from using a service, or inany way restricting a user’s ability to use a service.

(8)

For the meaning of “news publisher content” and “regulated user-generated
content”, see section 49.

14

5

10

15

20

Duties to protect news publisher content(1)This section sets out the duties to protect news publisher content which apply
in relation to Category 1 services.

(2)

Subject to subsections (4), (5) and (8), a duty, in relation to a service, to take thesteps set out in subsection (3) before—(a) taking action in relation to content present on the service that is news
publisher content, or(b) taking action against a user who is a recognised news publisher.

25

(3)

The steps referred to in subsection (2) are—(a) to give the recognised news publisher in question a notification
which—(i) specifies the action that the provider is considering taking,(ii) gives reasons for that proposed action by reference to eachrelevant provision of the terms of service,(iii) where the proposed action relates to news publisher content
that is also journalistic content, explains how the provider took
the importance of the free expression of journalistic content into
account when deciding on the proposed action, and(iv) specifies a reasonable period within which the recognised news
publisher may make representations,(b) to consider any representations that are made, and(c) to notify the recognised news publisher of the decision and the reasonsfor it (addressing any representations made).

30

If a provider of a service reasonably considers that the provider would incur
criminal or civil liability in relation to news publisher content present on the

45

(4)

35

40

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 2 — Providers of user-to-user services: duties of care

15

service if it were not taken down swiftly, the provider may take down that
content without having taken the steps set out in subsection (3).
(5)

A provider of a service may also take down news publisher content present on
the service without having taken the steps set out in subsection (3) if that
content amounts to a relevant offence (see section 53 and also subsection (10)of this section).

5(6)

Subject to subsection (8), if a provider takes action in relation to news publisher
content or against a recognised news publisher without having taken the steps
set out in subsection (3), a duty to take the steps set out in subsection (7).

(7)

The steps referred to in subsection (6) are—(a) to swiftly notify the recognised news publisher in question of the action
taken, giving the provider’s justification for not having first taken thesteps set out in subsection (3),(b) to specify a reasonable period within which the recognised news
publisher may request that the action is reversed, and(c) if a request is made as mentioned in paragraph (b)—(i) to consider the request and whether the steps set out in
subsection (3) should have been taken prior to the action being
taken,(ii) if the provider concludes that those steps should have beentaken, to swiftly reverse the action, and(iii) to notify the recognised news publisher of the decision and thereasons for it (addressing any reasons accompanying therequest for reversal of the action).

10

(8)

If a recognised news publisher has been banned from using a service (and theban is still in force), the provider of the service may take action in relation tonews publisher content present on the service which was generated ororiginally published or broadcast by the recognised news publisher withoutcomplying with the duties set out in this section.

25

(9)

For the purposes of subsection (2)(a), a provider is not to be regarded as taking
action in relation to news publisher content in the following circumstances—(a) a provider takes action in relation to content which is not news
publisher content, that action affects related news publisher content,
the grounds for the action only relate to the content which is not news
publisher content, and it is not technically feasible for the action only torelate to the content which is not news publisher content;(b) a provider takes action against a user, and that action affects news
publisher content that has been uploaded to or shared on the service by
the user.

30

(10)

Section 170 (providers’ judgements about the status of content) applies inrelation to judgements by providers about whether news publisher content
amounts to a relevant offence as it applies in relation to judgements about
whether content is illegal content.

40

(11)

OFCOM’s guidance under section 171 (guidance about illegal content
judgements) must include guidance about the matters dealt with in section 170
as that section applies by reason of subsection (10).

(12)

Any provision of the terms of service has effect subject to this section.

(13)

In this section—

15

20

35

45

16

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 2 — Providers of user-to-user services: duties of care

(a)
(b)

(c)

references to “news publisher content” are to content that is news
publisher content in relation to the service in question;references to “taking action” in relation to content are to—(i) taking down content,(ii) restricting users’ access to content, or(iii) taking other action in relation to content (for example, adding
warning labels to content);
references to “taking action” against a person are to giving a warning toa person, or suspending or banning a person from using a service, or inany way restricting a person’s ability to use a service.

(14)

Taking any step set out in subsection (3) or (7) does not count as “taking action”
for the purposes of this section.

(15)

See—
section 15 for the meaning of “journalistic content”;
section 49 for the meaning of “news publisher content”;
section 50 for the meaning of “recognised news publisher”.

15

5

10

15

Duties to protect journalistic content(1)This section sets out the duties to protect journalistic content which apply in
relation to Category 1 services.
The duties

(2)

(3)

A duty to operate a service using proportionate systems and processes
designed to ensure that the importance of the free expression of journalistic
content is taken into account when making decisions about—(a) how to treat such content (especially decisions about whether to take it
down or restrict users’ access to it), and(b) whether to take action against a user generating, uploading or sharing
such content.
A duty, in relation to a decision by a provider to take down content or to
restrict access to it, to make a dedicated and expedited complaints procedure
available to a person who considers the content to be journalistic content and
who is—(a) the user who generated, uploaded or shared the content on the service,or(b) the creator of the content (see subsections (13) and (14)).

(4)

A duty to make a dedicated and expedited complaints procedure available tousers of a service in relation to a decision by the provider of the service to takeaction against a user because of content generated, uploaded or shared by theuser which the user considers to be journalistic content.

(5)

A duty to ensure that—(a) if a complaint about a decision mentioned in subsection (3) is upheld,
the content is swiftly reinstated on the service;(b) if a complaint about a decision mentioned in subsection (4) is upheld,
the action against the user is swiftly reversed.

(6)

Subsections (3) and (4) do not require a provider to make a dedicated andexpedited complaints procedure available to a recognised news publisher in

20

25

30

35

40

45

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 2 — Providers of user-to-user services: duties of care17

relation to a decision if the provider has taken the steps set out in section 14(3)in relation to that decision.
(7)

(8)

A duty to include provisions in the terms of service specifying—(a) by what methods content present on the service is to be identified as
journalistic content;(b) how the importance of the free expression of journalistic content is tobe taken into account when making decisions mentioned in subsection(2);(c) the policies and processes for handling complaints in relation tocontent which is, or is considered to be, journalistic content.

(10)

(11)

For the purposes of this Part content is “journalistic content”, in relation to auser-to-user service, if—(a) the content is—(i) news publisher content in relation to that service, or(ii) regulated user-generated content in relation to that service;(b) the content is generated for the purposes of journalism; and(c) the content is UK-linked.
For the purposes of this section content is “UK-linked” if—(a) United Kingdom users of the service form one of the target markets forthe content (or the only target market), or(b) the content is or is likely to be of interest to a significant number ofUnited Kingdom users.
In this section references to “taking action” against a user are to giving awarning to a user, or suspending or banning a user from using a service, or inany way restricting a user’s ability to use a service.

(12)

In this section the reference to the “creator” of content is to be read in
accordance with subsections (13) and (14).

(13)

The creator of news publisher content is the recognised news publisher inquestion.

(14)

The creator of content other than news publisher content is—(a) an individual who—(i) created the content, and(ii) is in the United Kingdom; or(b) an entity which—(i) created the content, and(ii) is incorporated or formed under the law of any part of theUnited Kingdom.

(15)

10

A duty to ensure that—(a) the provisions of the terms of service referred to in subsection (7) areclear and accessible, and(b) those provisions are applied consistently.
Interpretation(9)5

For the meaning of “news publisher content”, “regulated user-generated
content” and “recognised news publisher”, see sections 49 and 50.

15

20

25

30

35

40

18

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 2 — Providers of user-to-user services: duties of care

Duties about content reporting and complaints procedures
16

Duty about content reporting(1)

This section sets out the duty about content reporting which applies in relation
to all regulated user-to-user services.

(2)

A duty to operate a service using systems and processes that allow users andaffected persons to easily report content which they consider to be content of akind specified below (with the duty extending to different kinds of content
depending on the kind of service, as indicated by the headings).

5

All services(3)

Illegal content.

10Services likely to be accessed by children(4)

Content that is harmful to children, present on a part of a service that it ispossible for children to access.
Interpretation(5)

In this section “affected person” means a person, other than a user of the service
in question, who is in the United Kingdom and who is—(a) the subject of the content,(b) a member of a class or group of people with a certain characteristic
targeted by the content,(c) a parent of, or other adult with responsibility for, a child who is a userof the service or is the subject of the content, or(d) an adult providing assistance in using the service to another adult who
requires such assistance, where that other adult is a user of the service
or is the subject of the content.

15

(6)

For the purposes of subsection (4), a provider is only entitled to conclude that
it is not possible for children to access a service, or a part of it, if there aresystems or processes in place (for example, age verification, or another meansof age assurance) that achieve the result that children are not normally able toaccess the service or that part of it.

25

(7)

See also—(a) section 18 (duties about freedom of expression and privacy), and(b) section 65(5)(a) (reporting of content that terms of service allow to betaken down or restricted).

30

17

20

Duties about complaints procedures(1)This section sets out the duties about complaints procedures which apply in
relation to all regulated user-to-user services.

(2)

A duty to operate a complaints procedure in relation to a service that—(a) allows for relevant kinds of complaint to be made (as set out under theheadings below),(b) provides for appropriate action to be taken by the provider of theservice in response to complaints of a relevant kind, and(c) is easy to access, easy to use (including by children) and transparent.

35

40

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 2 — Providers of user-to-user services: duties of care

(3)

19

A duty to include in the terms of service provisions which are easily accessible(including to children) specifying the policies and processes that govern thehandling and resolution of complaints of a relevant kind.
All services(4)

The following kinds of complaint are relevant for all services—(a) complaints by users and affected persons about content present on aservice which they consider to be illegal content;(b) complaints by users and affected persons if they consider that theprovider is not complying with a duty set out in—(i) section 9 (illegal content),(ii) section 16 (content reporting), or(iii) section 18(2) or (3) (freedom of expression and privacy);(c) complaints by a user who has generated, uploaded or shared content
on a service if that content is taken down on the basis that it is illegal
content;(d) complaints by a user of a service if the provider has given a warning to
the user, suspended or banned the user from using the service, or in any
other way restricted the user’s ability to use the service, as a result ofcontent generated, uploaded or shared by the user which the provider
considers to be illegal content;(e) complaints by a user who has generated, uploaded or shared content
on a service if—(i) the use of proactive technology on the service results in that
content being taken down or access to it being restricted, or
given a lower priority or otherwise becoming less likely to be
encountered by other users, and(ii) the user considers that the proactive technology has been used
in a way not contemplated by, or in breach of, the terms ofservice (for example, by affecting content not of a kind specified
in the terms of service as a kind of content in relation to which
the technology would operate).

5

10

15

20

25

30

Services likely to be accessed by children(5)

The following kinds of complaint are relevant for services that are likely to beaccessed by children—(a) complaints by users and affected persons about content, present on apart of a service that it is possible for children to access, which they
consider to be content that is harmful to children;(b) complaints by users and affected persons if they consider that theprovider is not complying with a duty set out in section 11 (children’s
online safety);(c) complaints by a user who has generated, uploaded or shared content
on a service if that content is taken down, or access to it is restricted, on
the basis that it is content that is harmful to children;(d) complaints by a user of a service if the provider has given a warning to
the user, suspended or banned the user from using the service, or in any
other way restricted the user’s ability to use the service, as a result ofcontent generated, uploaded or shared by the user which the provider
considers to be content that is harmful to children;

35

40

45

20

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 2 — Providers of user-to-user services: duties of care(e)complaints by a user who is unable to access content because measuresused to comply with a duty set out in section 11(3) have resulted in anincorrect assessment of the user’s age.

Category 1 services(6)

The relevant kind of complaint for Category 1 services is complaints by users
and affected persons if they consider that the provider is not complying with aduty set out in—(a) section 12 (user empowerment),(b) section 13 (content of democratic importance),(c) section 14 (news publisher content),(d) section 15 (journalistic content), or(e) section 18(4), (6) or (7) (freedom of expression and privacy).

510Interpretation(7)

In this section “affected person” has the meaning given by section 16.

(8)

For the purposes of subsection (5)(a), a provider is only entitled to conclude
that it is not possible for children to access a service, or a part of it, if there aresystems or processes in place (for example, age verification, or another meansof age assurance) that achieve the result that children are not normally able toaccess the service or that part of it.

15

(9)

See also—(a) section 18 (duties about freedom of expression and privacy), and(b) section 65(6) (complaints procedure relating to content that terms ofservice allow to be taken down or restricted).

20

Cross-cutting duties
18

Duties about freedom of expression and privacy(1)25This section sets out the duties about freedom of expression and privacy which
apply in relation to regulated user-to-user services as indicated by theheadings.
All services(2)

When deciding on, and implementing, safety measures and policies, a duty tohave particular regard to the importance of protecting users’ right to freedomof expression within the law.

(3)

When deciding on, and implementing, safety measures and policies, a duty tohave particular regard to the importance of protecting users from a breach of
any statutory provision or rule of law concerning privacy that is relevant to theuse or operation of a user-to-user service (including, but not limited to, anysuch provision or rule concerning the processing of personal data).
Additional duties for Category 1 services(4)

A duty—30

35

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 2 — Providers of user-to-user services: duties of care

(a)

(b)
(5)

21

when deciding on safety measures and policies, to carry out anassessment of the impact that such measures or policies would haveon—(i) users’ right to freedom of expression within the law, and(ii) the privacy of users; andto carry out an assessment of the impact of adopted safety measuresand policies on the matters mentioned in paragraph (a)(i) and (ii).

An impact assessment relating to a service must include a section which
considers the impact of the safety measures and policies on the availability andtreatment on the service of content which is news publisher content orjournalistic content in relation to the service.

(6)

A duty to—(a) keep an impact assessment up to date, and(b) publish impact assessments.

(7)

A duty to specify in a publicly available statement the positive steps that theprovider has taken in response to an impact assessment to—(a) protect users’ right to freedom of expression within the law, and(b) protect the privacy of users.

5

10

15

Interpretation(8)

In this section—“impact assessment” means an impact assessment under subsection (4);“safety measures and policies” means measures and policies designed tosecure compliance with any of the duties set out in—(a) section 9 (illegal content),(b) section 11 (children’s online safety),(c) section 12 (user empowerment),(d) section 16 (content reporting), or(e) section 17 (complaints procedures).

(9)

Any reference in this section to the privacy of users or steps taken to protect theprivacy of users is to be construed in accordance with subsection (3).

(10)

See—
section 15 for the meaning of “journalistic content”;
section 49 for the meaning of “news publisher content”.

19

Record-keeping and review duties(1)

This section sets out the record-keeping and review duties which apply in
relation to all regulated user-to-user services.

(2)

A duty to make and keep a written record, in an easily understandable form,of every risk assessment under section 8 or 10.

(3)

A duty to make and keep a written record of any measures taken or in use tocomply with a relevant duty which—(a) are described in a code of practice and recommended for the purposeof compliance with the duty in question, and(b) apply in relation to the provider and the service in question.

20

25

30

35

40

22

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 2 — Providers of user-to-user services: duties of care

In this section such measures are referred to as “applicable measures in a codeof practice”.
(4)

(5)

(6)

If alternative measures have been taken or are in use to comply with a relevant
duty, a duty to make and keep a written record containing the following
information—(a) the applicable measures in a code of practice that have not been taken
or are not in use,(b) the alternative measures that have been taken or are in use,(c) how those alternative measures amount to compliance with the duty inquestion, and(d) how the provider has complied with section 44(5) (freedom of
expression and privacy).
If alternative measures have been taken or are in use to comply with a duty set
out in section 9(2) or (3) or 11(2) or (3), the record required under subsection (4)of this section must also indicate whether such measures have been taken or
are in use in every area listed in section 9(4) or 11(5) (as the case may be) in
relation to which there are applicable measures in a code of practice.
A duty to review compliance with the relevant duties in relation to a service—(a) regularly, and(b) as soon as reasonably practicable after making any significant change
to any aspect of the design or operation of the service.

(7)

OFCOM may provide that particular descriptions of providers of user-to-userservices are exempt from any or all of the duties set out in this section, and may
revoke such an exemption.

(8)

OFCOM must publish details of any exemption or revocation under subsection(7), including reasons for the revocation of an exemption.

(9)

In this section—“alternative measures” means measures other than measures which are(in relation to the provider and the service in question) applicablemeasures in a code of practice;“code of practice” means a code of practice published under section 41;“relevant duties” means the duties set out in—(a) section 9 (illegal content),(b) section 11 (children’s online safety),(c) section 12 (user empowerment),(d) section 13 (content of democratic importance),(e) section 15 (journalistic content),(f) section 16 (content reporting), and(g) section 17 (complaints procedures),and for the purposes of subsection (6), also includes the duties set out
in sections 14 (news publisher content), 64 and 65 (duties about termsof service).

5

10

15

20

25

30

35

40

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 3 — Providers of search services: duties of care

23

CHAPTER 3
PROVIDERS OF SEARCH SERVICES: DUTIES OF CARE
Search services: which duties apply, and scope of duties
20

Providers of search services: duties of care
(1)

Subsections (2) and (3) apply to determine which of the duties set out in this
Chapter must be complied with by providers of regulated search services.

(2)

All providers of regulated search services must comply with the following
duties in relation to each such service which they provide—(a) the duties about illegal content risk assessments set out in section 22,(b) the duties about illegal content set out in section 23,(c) the duty about content reporting set out in section 26,(d) the duties about complaints procedures set out in section 27,(e) the duties about freedom of expression and privacy set out in section
28, and(f) the duties about record-keeping and review set out in section 29.

(3)

(4)
21

In addition, all providers of regulated search services that are likely to beaccessed by children must comply with the following duties in relation to eachsuch service which they provide—(a) the duties about children’s risk assessments set out in section 24, and(b) the duties to protect children’s online safety set out in section 25.

5

10

15

20

For the meaning of “likely to be accessed by children”, see section 32.
Scope of duties of care

(1)

(2)

A duty set out in this Chapter which must be complied with in relation to asearch service extends only to—(a) the search content of the service,(b) the design, operation and use of the search engine in the United
Kingdom, and(c) in the case of a duty that is expressed to apply in relation to users of aservice, the design, operation and use of the search engine as it affects
United Kingdom users of the service.
For the purposes of the application of this Chapter in relation to the searchengine of a combined service (see section 6(6))—(a) a duty set out in this Chapter which requires a matter to be included ina publicly available statement may be satisfied by including the matterin the terms of service;(b) references in this Chapter (except in section 20) to a search service are
to be read as references to the search engine;(c) references in this Chapter (except in section 20) to the provider of asearch service are to be read as references to the provider of the
combined service.

25

30

35

40

24

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 3 — Providers of search services: duties of care

Illegal content duties for all search services
22

Illegal content risk assessment duties(1)

This section sets out the duties about risk assessments which apply in relation
to all regulated search services.

(2)

A duty to carry out a suitable and sufficient illegal content risk assessment at atime set out in, or as provided by, Schedule 3.

(3)

A duty to take appropriate steps to keep an illegal content risk assessment up
to date, including when OFCOM make any significant change to a risk profilethat relates to services of the kind in question.

(4)

Before making any significant change to any aspect of a service’s design or
operation, a duty to carry out a further suitable and sufficient illegal content
risk assessment relating to the impacts of that proposed change.

(5)

An “illegal content risk assessment” of a service of a particular kind means anassessment of the following matters, taking into account the risk profile that
relates to services of that kind—(a) the level of risk of individuals who are users of the service encountering
search content of the following kinds—(i) each kind of priority illegal content (with each kind separately
assessed), and(ii) other illegal content,
taking into account (in particular) risks presented by algorithms usedby the service, and the way that the service indexes, organises andpresents search results;(b) the level of risk of functionalities of the service facilitating individuals
encountering search content that is illegal content, identifying andassessing those functionalities that present higher levels of risk;(c) the nature, and severity, of the harm that might be suffered byindividuals from the matters identified in accordance with paragraphs(a) and (b);(d) how the design and operation of the service (including the businessmodel, governance, use of proactive technology, measures to promoteusers’ media literacy and safe use of the service, and other systems andprocesses) may reduce or increase the risks identified.

(6)

In this section references to risk profiles are to the risk profiles for the time
being published under section 89 which relate to the risk of harm to individuals
presented by illegal content.

(7)

See also—(a) section 29(2) (records of risk assessments), and(b) Schedule 3 (timing of providers’ assessments).

23

Safety duties about illegal content(1)This section sets out the duties about illegal content which apply in relation to
all regulated search services.

(2)

A duty, in relation to a service, to take or use proportionate measures relating
to the design or operation of the service to effectively mitigate and manage the

5

10

15

20

25

30

35

40

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 3 — Providers of search services: duties of care25

risks of harm to individuals, as identified in the most recent illegal content risk
assessment of the service (see section 22(5)(c)).
(3)

(4)

A duty to operate a service using proportionate systems and processes
designed to minimise the risk of individuals encountering search content of thefollowing kinds—(a) priority illegal content;(b) other illegal content that the provider knows about (having been
alerted to it by another person or become aware of it in any other way).
The duties set out in subsections (2) and (3) apply across all areas of a service,including the way the search engine is designed, operated and used as well as
search content of the service, and (among other things) require the provider ofa service to take or use measures in the following areas, if it is proportionate to
do so—(a) regulatory compliance and risk management arrangements,(b) design of functionalities, algorithms and other features relating to thesearch engine,(c) functionalities allowing users to control the content they encounter insearch results,(d) content prioritisation,(e) user support measures, and(f) staff policies and practices.

(5)

A duty to include provisions in a publicly available statement specifying how
individuals are to be protected from search content that is illegal content.

(6)

A duty to apply the provisions of the statement referred to in subsection (5)consistently.

(7)

A duty to include provisions in a publicly available statement giving
information about any proactive technology used by a service for the purposeof compliance with a duty set out in subsection (2) or (3) (including the kind oftechnology, when it is used, and how it works).

(8)

A duty to ensure that the provisions of the publicly available statement
referred to in subsections (5) and (7) are clear and accessible.

(9)

In determining what is proportionate for the purposes of this section, thefollowing factors, in particular, are relevant—(a) all the findings of the most recent illegal content risk assessment(including as to levels of risk and as to nature, and severity, of potential
harm to individuals), and(b) the size and capacity of the provider of a service.

(10)

In this section “illegal content risk assessment” has the meaning given by
section 22.

(11)

See also, in relation to duties set out in this section, section 28 (duties about
freedom of expression and privacy).

5

10

15

20

25

30

35

40

26

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 3 — Providers of search services: duties of care

Search services likely to be accessed by children
24Children’s risk assessment duties(1)

This section sets out the duties about risk assessments which apply in relation
to regulated search services that are likely to be accessed by children (inaddition to the duties about risk assessments set out in section 22).

(2)

A duty to carry out a suitable and sufficient children’s risk assessment at a time
set out in, or as provided by, Schedule 3.

(3)

A duty to take appropriate steps to keep a children’s risk assessment up todate, including when OFCOM make any significant change to a risk profilethat relates to services of the kind in question.

(4)

Before making any significant change to any aspect of a service’s design or
operation, a duty to carry out a further suitable and sufficient children’s risk
assessment relating to the impacts of that proposed change.

(5)

A “children’s risk assessment” of a service of a particular kind means anassessment of the following matters, taking into account the risk profile that
relates to services of that kind—(a) the level of risk of children who are users of the service encountering
search content of the following kinds—(i) each kind of primary priority content that is harmful to children(with each kind separately assessed),(ii) each kind of priority content that is harmful to children (witheach kind separately assessed), and(iii) non-designated content that is harmful to children,
giving separate consideration to children in different age groups, andtaking into account (in particular) risks presented by algorithms usedby the service and the way that the service indexes, organises andpresents search results;(b) the level of risk of children who are users of the service encountering
search content that is harmful to children which particularly affects
individuals with a certain characteristic or members of a certain group;(c) the level of risk of functionalities of the service facilitating children
encountering search content that is harmful to children, identifying andassessing those functionalities that present higher levels of risk;(d) the nature, and severity, of the harm that might be suffered by children
from the matters identified in accordance with paragraphs (a) to (c),giving separate consideration to children in different age groups;(e) how the design and operation of the service (including the businessmodel, governance, use of proactive technology, measures to promoteusers’ media literacy and safe use of the service, and other systems andprocesses) may reduce or increase the risks identified.

(6)

In this section references to risk profiles are to the risk profiles for the time
being published under section 89 which relate to the risk of harm to children
presented by content that is harmful to children.

(7)

See also—(a) section 29(2) (records of risk assessments), and(b) Schedule 3 (timing of providers’ assessments).

5

10

15

20

25

30

35

40

45

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 3 — Providers of search services: duties of care

25

27

Safety duties protecting children(1)This section sets out the duties to protect children’s online safety which apply
in relation to regulated search services that are likely to be accessed bychildren.

(2)

A duty, in relation to a service, to take or use proportionate measures relating
to the design or operation of the service to effectively—(a) mitigate and manage the risks of harm to children in different age
groups, as identified in the most recent children’s risk assessment of theservice (see section 24(5)(d)), and(b) mitigate the impact of harm to children in different age groups
presented by search content that is harmful to children.

(3)

(4)

(5)

A duty to operate a service using proportionate systems and processes
designed to—(a) minimise the risk of children of any age encountering search content
that is primary priority content that is harmful to children;(b) minimise the risk of children in age groups judged to be at risk of harmfrom other content that is harmful to children (or from a particular kindof such content) encountering search content of that kind.
The duties set out in subsections (2) and (3) apply across all areas of a service,including the way the search engine is designed, operated and used as well as
search content of the service, and (among other things) require the provider ofa service to take or use measures in the following areas, if it is proportionate to
do so—(a) regulatory compliance and risk management arrangements,(b) design of functionalities, algorithms and other features relating to thesearch engine,(c) functionalities allowing for control over content that is encountered insearch results, especially by children,(d) content prioritisation,(e) user support measures, and(f) staff policies and practices.
A duty to include provisions in a publicly available statement specifying how
children are to be protected from search content of the following kinds—(a) primary priority content that is harmful to children (with each kind ofprimary priority content separately covered),(b) priority content that is harmful to children (with each kind of priority
content separately covered), and(c) non-designated content that is harmful to children.

(6)

A duty to apply the provisions of the statement referred to in subsection (5)consistently.

(7)

A duty to include provisions in a publicly available statement giving
information about any proactive technology used by a service for the purposeof compliance with a duty set out in subsection (2) or (3) (including the kind oftechnology, when it is used, and how it works).

(8)

A duty to ensure that the provisions of the publicly available statement
referred to in subsections (5) and (7) are clear and accessible.

5

10

15

20

25

30

35

40

45

28

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 3 — Providers of search services: duties of care

(9)

(10)

In determining what is proportionate for the purposes of this section, thefollowing factors, in particular, are relevant—(a) all the findings of the most recent children’s risk assessment (including
as to levels of risk and as to nature, and severity, of potential harm tochildren), and(b) the size and capacity of the provider of a service.
So far as a duty set out in this section relates to non-designated content that isharmful to children, the duty is to be taken to extend only to addressing risksof harm from the kinds of such content that have been identified in the mostrecent children’s risk assessment (if any have been identified).

5

10

(11)

The reference in subsection (3)(b) to children in age groups judged to be at riskof harm from content that is harmful to children is a reference to children in age
groups judged to be at risk of such harm as assessed by the provider of aservice in the most recent children’s risk assessment of the service.

(12)

The duties set out in subsection (3) are to be taken to extend only to content thatis harmful to children where the risk of harm is presented by the nature of thecontent (rather than the fact of its dissemination).

(13)

The duties set out in this section extend only to such parts of a service as it ispossible for children to access.

(14)

For the purposes of subsection (13), a provider is only entitled to conclude that
it is not possible for children to access a service, or a part of it, if there aresystems or processes in place (for example, age verification, or another meansof age assurance) that achieve the result that children are not normally able toaccess the service or that part of it.

20

(15)

In this section “children’s risk assessment” has the meaning given by section
24.

25

(16)

See also, in relation to duties set out in this section, section 28 (duties about
freedom of expression and privacy).

15

Duties about content reporting and complaints procedures
26

Duty about content reporting(1)

This section sets out the duty about content reporting which applies in relation
to all regulated search services.

(2)

A duty to operate a service using systems and processes that allow users andaffected persons to easily report search content which they consider to becontent of a kind specified below (with the duty extending to content that isharmful to children depending on the kind of service, as indicated by theheadings).

30

35

All services(3)

Illegal content.
Services likely to be accessed by children(4)

Content that is harmful to children.

40Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 3 — Providers of search services: duties of care

29

Interpretation
(5)

(6)

27

In this section “affected person” means a person, other than a user of the service
in question, who is in the United Kingdom and who is—(a) the subject of the content,(b) a member of a class or group of people with a certain characteristic
targeted by the content,(c) a parent of, or other adult with responsibility for, a child who is a userof the service or is the subject of the content, or(d) an adult providing assistance in using the service to another adult who
requires such assistance, where that other adult is a user of the service
or is the subject of the content.

5

10

See also, in relation to the duty set out in this section, section 28 (duties about
freedom of expression and privacy).
Duties about complaints procedures(1)This section sets out the duties about complaints procedures which apply in
relation to all regulated search services.

(2)

A duty to operate a complaints procedure in relation to a service that—(a) allows for relevant kinds of complaint to be made (as set out under theheadings below),(b) provides for appropriate action to be taken by the provider of theservice in response to complaints of a relevant kind, and(c) is easy to access, easy to use (including by children) and transparent.

(3)

A duty to make the policies and processes that govern the handling andresolution of complaints of a relevant kind publicly available and easily
accessible (including to children).

15

20

25

All services(4)

The following kinds of complaint are relevant for all services—(a) complaints by users and affected persons about search content which
they consider to be illegal content;(b) complaints by users and affected persons if they consider that theprovider is not complying with a duty set out in—(i) section 23 (illegal content),(ii) section 26 (content reporting), or(iii) section 28 (freedom of expression and privacy);(c) complaints by an interested person if the provider of a search service
takes or uses measures in order to comply with a duty set out in section
23 that result in content relating to that interested person no longer
appearing in search results or being given a lower priority in search
results;(d) complaints by an interested person if—(i) the use of proactive technology on a search service results incontent relating to that interested person no longer appearing insearch results or being given a lower priority in search results,and(ii) the interested person considers that the proactive technology
has been used in a way not contemplated by, or in breach of, the

30

35

40

45

30

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 3 — Providers of search services: duties of careprovider’s policies on its use (for example, by affecting content
not of a kind specified in those policies as a kind of content inrelation to which the technology would operate).
Services likely to be accessed by children(5)

The following kinds of complaint are relevant for services that are likely to beaccessed by children—(a) complaints by users and affected persons about search content which
they consider to be content that is harmful to children;(b) complaints by users and affected persons if they consider that theprovider is not complying with a duty set out in section 25 (children’s
online safety);(c) complaints by an interested person if the provider of a search service
takes or uses measures in order to comply with a duty set out in section
25 that result in content relating to that interested person no longer
appearing in search results or being given a lower priority in search
results;(d) complaints by a user who is unable to access content because measuresused to comply with a duty set out in section 25(3) have resulted in anincorrect assessment of the user’s age.
Interpretation

5

10

15

20

(6)

In this section—“affected person” has the meaning given by section 26;“interested person” has the meaning given by section 199(7).

(7)

See also, in relation to duties set out in this section, section 28 (duties about
freedom of expression and privacy).

25

Cross-cutting duties
28

Duties about freedom of expression and privacy(1)This section sets out the duties about freedom of expression and privacy which
apply in relation to all regulated search services.

(2)

When deciding on, and implementing, safety measures and policies, a duty tohave particular regard to the importance of protecting the rights of users andinterested persons to freedom of expression within the law.

(3)

When deciding on, and implementing, safety measures and policies, a duty tohave particular regard to the importance of protecting users from a breach of
any statutory provision or rule of law concerning privacy that is relevant to theuse or operation of a search service (including, but not limited to, any suchprovision or rule concerning the processing of personal data).

(4)

In this section—“interested person” has the meaning given by section 199(7);“safety measures and policies” means measures and policies designed tosecure compliance with any of the duties set out in—(a) section 23 (illegal content),(b) section 25 (children’s online safety),(c) section 26 (content reporting), or

30

35

40

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 3 — Providers of search services: duties of care

(d)
29

31

section 27 (complaints procedures).

Record-keeping and review duties(1)

This section sets out the record-keeping and review duties which apply in
relation to all regulated search services.

(2)

A duty to make and keep a written record, in an easily understandable form,of every risk assessment under section 22 or 24.

(3)

A duty to make and keep a written record of any measures taken or in use tocomply with a relevant duty which—(a) are described in a code of practice and recommended for the purposeof compliance with the duty in question, and(b) apply in relation to the provider and the service in question.
In this section such measures are referred to as “applicable measures in a codeof practice”.

(4)

If alternative measures have been taken or are in use to comply with a relevant
duty, a duty to make and keep a written record containing the following
information—(a) the applicable measures in a code of practice that have not been taken
or are not in use,(b) the alternative measures that have been taken or are in use,(c) how those alternative measures amount to compliance with the duty inquestion, and(d) how the provider has complied with section 44(5) (freedom of
expression and privacy).

(5)

If alternative measures have been taken or are in use to comply with a duty set
out in section 23(2) or (3) or 25(2) or (3), the record required under subsection(4) of this section must also indicate whether such measures have been taken
or are in use in every area listed in subsection (4) of those sections in relation towhich there are applicable measures in a code of practice.

(6)

A duty to review compliance with the relevant duties in relation to a service—(a) regularly, and(b) as soon as reasonably practicable after making any significant change
to any aspect of the design or operation of the service.

(7)

OFCOM may provide that particular descriptions of providers of searchservices are exempt from any or all of the duties set out in this section, and may
revoke such an exemption.

(8)

OFCOM must publish details of any exemption or revocation under subsection(7), including reasons for the revocation of an exemption.

(9)

In this section—“alternative measures” means measures other than measures which are(in relation to the provider and the service in question) applicablemeasures in a code of practice;“code of practice” means a code of practice published under section 41;“relevant duties” means the duties set out in—(a) section 23 (illegal content),(b) section 25 (children’s online safety),

5

10

15

20

25

30

35

40

45

32

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 3 — Providers of search services: duties of care

(c)
(d)

section 26 (content reporting), andsection 27 (complaints procedures).
CHAPTER 4
CHILDREN'S ACCESS ASSESSMENTS

30

Children’s access assessments
(1)

(2)

(3)

(4)

(5)

31

In this Part, a “children’s access assessment” means an assessment of a Part 3
service—(a) to determine whether it is possible for children to access the service ora part of the service, and(b) if it is possible for children to access the service or a part of the service,
to determine whether the child user condition is met in relation to theservice or a part of the service.
A provider is only entitled to conclude that it is not possible for children toaccess a service, or a part of it, if there are systems or processes in place (forexample, age verification, or another means of age assurance) that achieve theresult that children are not normally able to access the service or that part of it.
The “child user condition” is met in relation to a service, or a part of a service,if—(a) there is a significant number of children who are users of the service orof that part of it, or(b) the service, or that part of it, is of a kind likely to attract a significant
number of users who are children.
For the purposes of subsection (3)—(a) the reference to a “significant” number includes a reference to a number
which is significant in proportion to the total number of United
Kingdom users of a service or (as the case may be) a part of a service;(b) whether the test in paragraph (a) of that subsection is met is to be basedon evidence about who actually uses a service, rather than who theintended users of the service are.

10

15

20

25

In this Chapter—(a) references to children are to children in the United Kingdom;(b) references to a part of a service do not include any part of a service thatis not, or is not included in, a user-to-user part of a service or a searchengine.

30

Duties about children’s access assessments

35

(1)

A provider of a Part 3 service must carry out the first children’s accessassessment at a time set out in, or as provided by, Schedule 3.

(2)

Subsections (3) and (4) apply to a provider of a Part 3 service during any period
when the service is not treated as likely to be accessed by children (see section
32).

(3)

5

The provider must carry out children’s access assessments of the service notmore than one year apart.

40

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 4 — Children's access assessments

(4)

33

The provider must carry out a children’s access assessment of the service—(a) before making any significant change to any aspect of the service’s
design or operation to which such an assessment is relevant,(b) in response to evidence about reduced effectiveness of any systems orprocesses that are in place as mentioned in section 30(2), or(c) in response to evidence about a significant increase in the number ofchildren using the service.

(5)

If a person is the provider of more than one Part 3 service, children’s accessassessments must be carried out for each service separately.

(6)Children’s access assessments must be suitable and sufficient for the purposesof this Part.

(7)

A provider must make and keep a written record, in an easily understandable
form, of every children’s access assessment.

32

5

10

Meaning of “likely to be accessed by children”(1)

For the purposes of this Part, a Part 3 service is to be treated as “likely to beaccessed by children” in the following three cases (with the result that theduties set out in sections 10 and 11, or (as the case may be) sections 24 and 25,
apply in relation to the service).

(2)

The first case is where a children’s access assessment carried out by theprovider of the service concludes that—(a) it is possible for children to access the service or a part of it, and(b) the child user condition is met in relation to—(i) the service, or(ii) a part of the service that it is possible for children to access.
This subsection is to be interpreted consistently with section 30.

(3)

In that case, the service is to be treated as likely to be accessed by children fromthe date on which the children’s access assessment is completed.

(4)

The second case is where the provider of the service fails to carry out the firstchildren’s access assessment as required by section 31(1).

(5)

In that case—(a) the service is to be treated as likely to be accessed by children from thedate by which the first children’s access assessment was required tohave been completed (see Part 1 of Schedule 3), and(b) the service is to continue to be treated as likely to be accessed bychildren by reason of subsection (4) until such time as the provider
completes the first children’s access assessment of the service.

(6)

The third case is where, following an investigation into a failure to comply witha duty set out in section 31, OFCOM determine that a service should be treatedas likely to be accessed by children: see section 123(4) and (5).

(7)

In that case, the service is to be treated as likely to be accessed by children fromthe date of, or specified in, the confirmation decision given to the provider ofthe service (as the case may be: see section 123(5)).

15

20

25

30

35

40

34

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 5 — Duties about fraudulent advertising

CHAPTER 5
DUTIES ABOUT FRAUDULENT ADVERTISING
33

Duties about fraudulent advertising: Category 1 services
(1)

(2)

(3)

A provider of a Category 1 service must operate the service using
proportionate systems and processes designed to—(a) prevent individuals from encountering content consisting offraudulent advertisements by means of the service;(b) minimise the length of time for which any such content is present;(c) where the provider is alerted by a person to the presence of suchcontent, or becomes aware of it in any other way, swiftly take downsuch content.
A provider of a Category 1 service must include clear and accessible provisions
in the terms of service giving information about any proactive technology usedby the service for the purpose of compliance with the duty set out in subsection(1) (including the kind of technology, when it is used, and how it works).
In relation to a Category 1 service, an advertisement is a “fraudulent
advertisement” if—(a) it is a paid-for advertisement (see section 207),(b) it amounts to an offence specified in section 35 (construed inaccordance with section 53: see subsections (3), (11) and (12) of that
section), and(c) it is not regulated user-generated content (see section 49) in relation to
the service.

(4)

If a person is the provider of more than one Category 1 service, the duties set
out in this section apply in relation to each such service.

(5)

In determining what is proportionate for the purposes of this section, thefollowing factors, in particular, are relevant—(a) the nature, and severity, of potential harm to individuals presented bydifferent kinds of fraudulent advertisement, and(b) the degree of control a provider has in relation to the placement ofadvertisements on the service.

(6)

In the case of a Category 1 service which is a combined service, the duties set
out in this section do not extend to—(a) fraudulent advertisements that may be encountered in search results ofthe service or, following a search request, as a result of subsequentinteractions with internet services, or(b) anything relating to the design, operation or use of the search engine.
But if the service is also a Category 2A service, the duties set out in section 34
apply as well as the duties set out in this section.

(7)

The duties set out in this section extend only to the design, operation and useof a Category 1 service in the United Kingdom.

(8)

For the meaning of “Category 1 service”, see section 86 (register of categories
of services).

5

10

15

20

25

30

35

40

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 5 — Duties about fraudulent advertising

34

35

Duties about fraudulent advertising: Category 2A services
(1)

(2)

(3)

(4)

A provider of a Category 2A service must operate the service using
proportionate systems and processes designed to—(a) prevent individuals from encountering content consisting offraudulent advertisements in or via search results of the service;(b) if any such content may be encountered in or via search results of theservice, minimise the length of time that that is the case;(c) where the provider is alerted by a person to the fact that such content
may be so encountered, or becomes aware of that fact in any other way,
swiftly ensure that individuals are no longer able to encounter suchcontent in or via search results of the service.
A provider of a Category 2A service must include clear and accessible
provisions in a publicly available statement giving information about any
proactive technology used by the service for the purpose of compliance withthe duty set out in subsection (1) (including the kind of technology, when it isused, and how it works).
In relation to a Category 2A service, an advertisement is a “fraudulent
advertisement” if—(a) it is a paid-for advertisement (see section 207), and(b) it amounts to an offence specified in section 35 (construed inaccordance with section 53: see subsections (3), (11) and (12) of that
section).
The references to encountering fraudulent advertisements “in or via search
results” of a search service—(a) are references to encountering fraudulent advertisements—(i) in search results of the service, or(ii) as a result of interacting with a paid-for advertisement in search
results of the service (for example, by clicking on it);(b) do not include references to encountering fraudulent advertisements asa result of any subsequent interactions with an internet service otherthan the search service.

(5)

If a person is the provider of more than one Category 2A service, the duties set
out in this section apply in relation to each such service.

(6)

In determining what is proportionate for the purposes of this section, thefollowing factors, in particular, are relevant—(a) the nature, and severity, of potential harm to individuals presented bydifferent kinds of fraudulent advertisement, and(b) the degree of control a provider has in relation to the placement ofadvertisements on the service.

(7)

The duties set out in this section extend only to the design, operation and useof a Category 2A service in the United Kingdom.

(8)

For the meaning of “Category 2A service”, see section 86 (register of categories
of services).

35

5

10

15

20

25

30

35

40

Fraud etc offences(1)

This section specifies offences for the purposes of this Chapter (see sections
33(3)(b) and 34(3)(b)).

45

36

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 5 — Duties about fraudulent advertising

(2)

(3)

(4)

An offence under any of the following provisions of the Financial Services andMarkets Act 2000—(a) section 23 (contravention of prohibition on carrying on regulated
activity unless authorised or exempt);(b) section 24 (false claims to be authorised or exempt);(c) section 25 (contravention of restrictions on financial promotion).
An offence under any of the following provisions of the Fraud Act 2006—(a) section 2 (fraud by false representation);(b) section 4 (fraud by abuse of position);(c) section 7 (making or supplying articles for use in frauds);(d) section 9 (participating in fraudulent business carried on by sole traderetc).
An offence under any of the following provisions of the Financial Services Act
2012—(a) section 89 (misleading statements);(b) section 90 (misleading impressions).

(5)

An offence of attempting or conspiring to commit an offence specified insubsection (2), (3) or (4).

(6)

An offence under Part 2 of the Serious Crime Act 2007 (encouraging or
assisting) in relation to an offence specified in subsection (2), (3) or (4), or (inScotland) inciting a person to commit such an offence.

(7)

An offence of aiding, abetting, counselling or procuring the commission of an
offence specified in subsection (2), (3) or (4), or (in Scotland) being involved art
and part in the commission of such an offence.
CHAPTER 6

5

10

15

20

25

CODES OF PRACTICE AND GUIDANCE
Codes of practice36

Codes of practice about duties(1)

OFCOM must prepare and issue a code of practice for providers of Part 3
services describing measures recommended for the purpose of compliancewith duties set out in section 9 or 23 (illegal content) so far as relating toterrorism content or offences within Schedule 5 (terrorism offences).

(2)

OFCOM must prepare and issue a code of practice for providers of Part 3
services describing measures recommended for the purpose of compliancewith duties set out in section 9 or 23 (illegal content) so far as relating to CSEA
content or offences within Schedule 6 (child sexual exploitation and abuse
offences).

35

OFCOM must prepare and issue one or more codes of practice for providers ofPart 3 services describing measures recommended for the purpose ofcompliance with the relevant duties (except to the extent that measures for the
purpose of compliance with such duties are described in a code of practice
prepared under subsection (1) or (2)).

40

(3)

30

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 6 — Codes of practice and guidance

37

(4)

OFCOM must prepare and issue a code of practice for providers of Category 1
services and providers of Category 2A services describing measures
recommended for the purpose of compliance with the duties set out in Chapter
5 (fraudulent advertising).

(5)

Where a code of practice under this section is in force, OFCOM may—(a) prepare a draft of amendments of the code of practice;(b) prepare a draft of a code of practice under subsection (1), (2), (3) or (4)as a replacement for a code of practice previously issued under thesubsection in question;(c) withdraw the code of practice.

(6)

In the course of preparing a draft of a code of practice or amendments of a codeof practice under this section, OFCOM must consult—(a) the Secretary of State,(b) persons who appear to OFCOM to represent providers of Part 3
services,(c) persons who appear to OFCOM to represent the interests of United
Kingdom users of Part 3 services,(d) persons who appear to OFCOM to represent the interests of children(generally or with particular reference to online safety matters),(e) persons who appear to OFCOM to represent the interests of persons
who have suffered harm as a result of matters to which the code ofpractice is relevant,(f) persons whom OFCOM consider to have relevant expertise in equality
issues and human rights, in particular—(i) the right to freedom of expression set out in Article 10 of theConvention, and(ii) the right to respect for a person’s private and family life, homeand correspondence set out in Article 8 of the Convention,(g) the Information Commissioner,(h) persons whom OFCOM consider to have expertise in public health,science or medicine that is relevant to online safety matters,(i) persons whom OFCOM consider to have expertise in innovation, or
emerging technology, that is relevant to online safety matters, and(j) such other persons as OFCOM consider appropriate.

(7)

In the course of preparing a draft of a code of practice or amendments to which
this subsection applies, OFCOM must also consult persons whom OFCOM
consider to have expertise in the enforcement of the criminal law and theprotection of national security that is relevant to online safety matters.

(8)

Subsection (7) applies to—(a) a code of practice under subsection (1) and amendments of such a code,(b) a code of practice under subsection (2) and amendments of such a code,(c) a code of practice under subsection (3) that describes measures
recommended for the purpose of compliance with duties set out insection 9 or 23 (illegal content),(d) amendments of a code of practice under subsection (3), if and to theextent that those amendments relate to measures recommended for the
purpose of compliance with duties set out in section 9 or 23, and(e) a code of practice under subsection (4) and amendments of such a code.

5

10

15

20

25

30

35

40

45

38

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 6 — Codes of practice and guidance(9)

Subsections (6) and (7) are subject to section 43 (minor amendments of code ofpractice).

(10)

In this section “the relevant duties” means the duties set out in—(a) sections 9 and 23 (illegal content),(b) sections 11 and 25 (children’s online safety),(c) section 12 (user empowerment),(d) section 13 (content of democratic importance),(e) section 15 (journalistic content),(f) sections 16 and 26 (content reporting), and(g) sections 17 and 27 (complaints procedures).

37

5

10

Codes of practice: principles, objectives, content
Schedule 4 contains—(a) provision about the principles OFCOM must consider when preparing
codes of practice under section 36,(b) the online safety objectives (and a power for the Secretary of State by
regulations to revise those objectives),(c) provision about the measures that may be described in codes ofpractice (including, in particular, constraints on the recommendation of
the use of proactive technology), and(d) other provision related to codes of practice.

38

15

20

Procedure for issuing codes of practice(1)

Where OFCOM have prepared a draft of a code of practice under section 36,
they must submit the draft to the Secretary of State.

(2)

Unless the Secretary of State intends to give a direction to OFCOM under
section 39(1) in relation to the draft, the Secretary of State must, as soon asreasonably practicable, lay the draft before Parliament.

(3)

If, within the 40-day period, either House of Parliament resolves not toapprove the draft—(a) OFCOM must not issue the code of practice in the form of that draft,and(b) OFCOM must prepare another draft of the code of practice under
section 36.

(4)

(5)

(6)

If no such resolution is made within that period—(a) OFCOM must issue the code of practice in the form of the draft laid
before Parliament, and(b) the code of practice comes into force at the end of the period of 21 days
beginning with the day on which it is issued.
“The 40-day period” is the period of 40 days beginning with the day on which
the draft is laid before Parliament (or, if it is not laid before each House of
Parliament on the same day, the later of the days on which it is laid).
In calculating the 40-day period, no account is to be taken of any period during
which Parliament is dissolved or prorogued or during which both Houses areadjourned for more than 4 days.

25

30

35

40

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 6 — Codes of practice and guidance

39

(7)

This section applies in relation to a draft of amendments of a code of practice
prepared under section 36 as it applies in relation to a draft of a code of practice
prepared under that section.

(8)

This section is subject to section 43 (minor amendments of codes of practice).

39

Secretary of State’s powers of direction
(1)

(2)

(3)

(4)

(5)

(6)

The Secretary of State may direct OFCOM to modify a draft of a code ofpractice submitted under section 38(1) if the Secretary of State believes thatmodifications are required—(a) for reasons of public policy, or(b) in the case of a terrorism or CSEA code of practice, for reasons ofnational security or public safety.

5

10

But if a draft of a terrorism or CSEA code of practice is submitted under section
38(1) following a review under section 42(2), the Secretary of State may only
direct OFCOM to modify the draft if the Secretary of State believes thatmodifications are required for reasons of national security or public safety.

15

If, following a review of a terrorism or CSEA code of practice under section
42(2), OFCOM submit a statement to the Secretary of State under section
42(3)(b) (“OFCOM’s review statement”), the Secretary of State may direct
OFCOM to modify the code of practice if the Secretary of State believes thatmodifications are required for reasons of national security or public safety.

20

A direction given under subsection (3)—(a) must be given within the period of 45 days beginning with the day on
which OFCOM’s review statement is submitted to the Secretary ofState, and(b) must make particular reference to OFCOM’s review statement.

25

A direction given under this section—(a) may not require OFCOM to include in a code of practice provision
about a particular measure recommended to be taken or used byproviders of Part 3 services, and(b) must set out the Secretary of State’s reasons for requiring
modifications, except in a case where the Secretary of State considers
that doing so would be against the interests of national security, public
safety or relations with the government of a country outside the United
Kingdom.
If the Secretary of State gives a direction under this section, OFCOM must, assoon as reasonably practicable—(a) comply with the direction,(b) submit to the Secretary of State a draft of the code of practice modified
in accordance with the direction,(c) submit to the Secretary of State a document containing—(i) (except in a case mentioned in subsection (5)(b)) details of thedirection, and(ii) details about how the draft has been revised in response to thedirection, and(d) inform the Secretary of State about modifications that OFCOM havemade to the draft that are not in response to the direction (if there are
any).

30

35

40

45

40

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 6 — Codes of practice and guidance(7)

The Secretary of State may give OFCOM one or more further directions
requiring OFCOM to modify the draft of the code of practice.

(8)

Such further directions may only be given for the reasons set out in subsection(1), (2) or (3) (as the case may be), and subsections (5) and (6) apply again in
relation to such further directions.

(9)

When the Secretary of State is satisfied that no further modifications to thedraft are required, the Secretary of State must, as soon as reasonably
practicable, lay before Parliament—(a) the modified draft,(b) any document submitted by OFCOM as mentioned in subsection (6)(c),and(c) in the case of a direction under subsection (3), OFCOM’s review
statement.

(10)

Before laying OFCOM’s review statement before Parliament, the Secretary ofState may, with OFCOM’s agreement, remove or obscure information in thestatement (whether by redaction or otherwise) in order to prevent thedisclosure of matters that the Secretary of State considers would be against theinterests of national security, public safety or relations with the government ofa country outside the United Kingdom.

(11)This section applies in relation to a draft of amendments of a code of practicesubmitted under section 38(1) as it applies in relation to a draft of a code ofpractice submitted under that provision.

(12)

In this section “terrorism or CSEA code of practice” means a code of practiceunder section 36(1) or (2).

40

Procedure for issuing codes of practice following direction under section 39(1)

This section sets out the procedure that applies where a draft of a code ofpractice is laid before Parliament under section 39(9).

(2)

If the draft contains modifications made following a direction given under
section 39(1)(a), the affirmative procedure applies.

(3)

If the draft contains modifications made following a direction given under
section 39(1)(b), (2) or (3), the negative procedure applies.

(4)

The “affirmative procedure” is as follows—(a) a code of practice in the form of the draft laid before Parliament mustnot be issued by OFCOM unless the draft has been approved by aresolution of each House of Parliament;(b) if the draft is so approved, the code of practice comes into force at theend of the period of 21 days beginning with the day on which it isissued;(c) if the draft is not so approved, OFCOM must prepare another draft ofthe code of practice under section 36.

(5)

The “negative procedure” is as follows—(a) if, within the 40-day period, either House of Parliament resolves not toapprove the draft—(i) OFCOM must not issue the code of practice in the form of thatdraft, and

5

10

15

20

25

30

35

40

45

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 6 — Codes of practice and guidance

41

(ii)

(b)

OFCOM must prepare another draft of the code of practiceunder section 36;
if no such resolution is made within that period—(i) OFCOM must issue the code of practice in the form of the draft
laid before Parliament, and(ii) the code of practice comes into force at the end of the period of
21 days beginning with the day on which it is issued.

(6)“The 40-day period” has the same meaning as in section 38 (see subsections (5)and (6) of that section).

(7)

This section applies in relation to a draft of amendments of a code of practicelaid before Parliament under section 39(9) as it applies in relation to a draft ofa code of practice laid under that provision.

41

5

10

Publication of codes of practice(1)

OFCOM must publish each code of practice issued under section 38 or 40
within the period of three days beginning with the day on which it is issued.

(2)

Where amendments of a code of practice are issued under either of thosesections, OFCOM must publish the amended code of practice within the periodof three days beginning with the day on which the amendments are issued.

(3)

Where a code of practice is withdrawn, OFCOM must publish a notice to that
effect.

42

15

20

Review of codes of practice(1)

OFCOM must keep under review each code of practice published under
section 41.

(2)

The Secretary of State may require OFCOM to review a terrorism or CSEA codeof practice published under section 41 if the Secretary of State considers areview to be necessary for reasons of national security or public safety (and theSecretary of State must notify OFCOM whether the reasons fall into thecategory of national security or public safety).

(3)

OFCOM must carry out a review of the code of practice under subsection (2) assoon as reasonably practicable, and when it is completed—(a) if OFCOM consider that changes are required, they must prepare a
draft of amendments to the code of practice or a draft of a replacement
code of practice under section 36, or(b) if OFCOM consider that no changes are required, they must submit to
the Secretary of State a statement which explains the reasons for that
conclusion.

(4)

Subsection (5) applies if—(a) OFCOM submit a statement under subsection (3)(b) to the Secretary ofState,(b) the period of 45 days beginning with the day on which the statement
was submitted has elapsed, and(c) the Secretary of State has not given a direction under section 39(3).

25

30

35

40

42

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 6 — Codes of practice and guidance(5)

OFCOM must publish the statement as soon as reasonably practicable after theend of the period mentioned in subsection (4)(b), making it clear which code ofpractice the statement relates to.

(6)

In advance of publication, the Secretary of State may make representations to
OFCOM about the desirability of removing or obscuring information in thestatement (whether by redaction or otherwise) in order to prevent thedisclosure of matters that the Secretary of State considers would be against theinterests of national security, public safety or relations with the government ofa country outside the United Kingdom (and see also section 105(3)).

(7)

In this section “terrorism or CSEA code of practice” means a code of practiceunder section 36(1) or (2).

43

5

10

Minor amendments of codes of practice(1)This section applies if—(a) OFCOM propose to amend a code of practice under section 36, and(b) OFCOM consider that the minor nature of the proposal means that—(i) consultation is unnecessary, and(ii) the proposed amendments should not be required to be laid
before Parliament.

(2)

OFCOM must notify the Secretary of State of the proposed amendments.

(3)

If the Secretary of State agrees with OFCOM that it is appropriate—(a) the consultation requirements set out in section 36(6) and (7) do not
apply in relation to the proposed amendments, and(b) section 38 does not apply to the amendments, once prepared.

(4)

If the Secretary of State agrees with OFCOM as mentioned in subsection (3),
OFCOM may prepare and issue the amendments of the code of practice.

(5)

Amendments of a code of practice issued under this section come into force atthe end of the period of 21 days beginning with the day on which theamendments are issued.

(6)

Section 41(2) applies in relation to amendments of a code of practice issued
under this section as it applies in relation to amendments of a code of practiceissued under section 38 or 40.

44

15

20

25

30

Relationship between duties and codes of practice
Duties set out in Chapters 2 and 3(1)

A provider of a Part 3 service is to be treated as complying with a relevant duty
if the provider takes or uses the measures described in a code of practice which
are recommended for the purpose of compliance with the duty in question.

35

(2)

A provider of a user-to-user service—(a) is to be treated as complying with the duty set out in section 18(2)(freedom of expression) if the provider takes or uses such of therelevant recommended measures as incorporate safeguards to protect
users’ right to freedom of expression within the law;(b) is to be treated as complying with the duty set out in section 18(3)(privacy) if the provider takes or uses such of the relevant40Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 6 — Codes of practice and guidance

43

recommended measures as incorporate safeguards to protect theprivacy of users.
(3)

A provider of a search service—(a) is to be treated as complying with the duty set out in section 28(2)(freedom of expression) if the provider takes or uses such of therelevant recommended measures as incorporate safeguards to protect
the rights of users and interested persons to freedom of expression
within the law;(b) is to be treated as complying with the duty set out in section 28(3)(privacy) if the provider takes or uses such of the relevant
recommended measures as incorporate safeguards to protect theprivacy of users.

5

10

Duties set out in Chapter 5(4)

A provider of a Category 1 service or a Category 2A service (or a provider of aservice which is both a Category 1 service and a Category 2A service) is to betreated as complying with a duty set out in Chapter 5 if the provider takes oruses the measures described in a fraudulent advertising code of practice which
are recommended for the purpose of compliance with the duty in question.

15

Alternative measures
(5)

(6)

A provider of a Part 3 service who seeks to comply with a relevant duty byacting otherwise than by taking or using a measure described in a code ofpractice or a fraudulent advertising code of practice which is recommended forthe purpose of compliance with the duty must have particular regard to theimportance of the following (where relevant)—(a) protecting the right of users and (in the case of search services)interested persons to freedom of expression within the law, and(b) protecting the privacy of users.
When assessing whether a provider of a Part 3 service is compliant with arelevant duty where the provider has acted otherwise than by taking or using
a measure described in a code of practice or a fraudulent advertising code ofpractice which is recommended for the purpose of compliance with the duty,
OFCOM must consider the extent to which the alternative measures taken or
in use by the provider—(a) extend across all areas of a service as mentioned in section 9(4), 11(5),23(4) or 25(4) (if relevant to the duty in question), and(b) (where appropriate) incorporate safeguards for the protection of thematters mentioned in subsection (5)(a) and (b).

20

25

30

35

Interpretation(7)

In subsections (1) to (4), references to taking or using measures recommended
for the purpose of compliance with a duty, or to taking or using relevant
recommended measures, are to taking or using such of those measures as are
relevant to the provider and the service in question.

(8)

In this section—(a) references to protecting the privacy of users are to protecting users
from a breach of any statutory provision or rule of law concerning
privacy that is relevant to the use or operation of a user-to-user service

40

45

44

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 6 — Codes of practice and guidance

(b)
(9)

45

or search service (including, but not limited to, any such provision orrule concerning the processing of personal data);
references to a search service include references to a combined service(see section 6(6)).

In this section—“Chapter 2 safety duty” means a duty set out in—(a) section 9 (illegal content), or(b) section 11 (children’s online safety);“Chapter 3 safety duty” means a duty set out in—(a) section 23 (illegal content), or(b) section 25 (children’s online safety);“code of practice” means a code of practice published under section 41,
except a fraudulent advertising code of practice;“fraudulent advertising code of practice” means a code of practice
prepared under section 36(4) and published under section 41;“relevant duty” means—(a) a Chapter 2 safety duty,(b) a Chapter 3 safety duty,(c) a duty set out in section 12 (user empowerment),(d) a duty set out in section 13 (content of democratic importance),(e) a duty set out in section 15 (journalistic content),(f) a duty set out in section 16 or 26 (content reporting), or(g) a duty set out in section 17 or 27 (complaints procedures);“relevant recommended measures” means the measures described in acode of practice which are recommended for the purpose of compliance
with—(a) in the case of a user-to-user service—(i) a Chapter 2 safety duty, or(ii) a duty set out in section 12 (user empowerment);(b) in the case of a search service, a Chapter 3 safety duty.

5

10

15

20

25

30

Effects of codes of practice(1)

A failure by a provider of a Part 3 service to act in accordance with a provisionof a code of practice does not of itself make the provider liable to legal
proceedings in a court or tribunal.

(2)

A code of practice is admissible in evidence in legal proceedings.

(3)

In any proceedings in a court or tribunal, the court or tribunal must take into
account a provision of a code of practice in determining a question arising in
the proceedings if—(a) the question relates to a time when the provision was in force, and(b) the provision appears to the court or tribunal to be relevant to thequestion.

(4)

OFCOM must take into account a provision of a code of practice indetermining a question arising in connection with their exercise of any relevant
function if—(a) the question relates to a time when the provision was in force, and(b) the provision appears to OFCOM to be relevant to the question.

35

40

45

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 6 — Codes of practice and guidance

(5)

46

45

In this section—“code of practice” means a code of practice published under section 41;“relevant functions” means OFCOM’s functions under—(a) Chapter 4 of Part 7 (information),(b) Chapter 5 of Part 7 (notices to deal with terrorism content and
CSEA content),(c) Chapter 6 of Part 7 (enforcement), and(d) Chapter 2 of Part 8 (super-complaints).

5

Duties and the first codes of practice(1)

A duty mentioned in subsection (3) applies to providers of Part 3 services fromthe day on which a code of practice prepared under section 36(3) that is the firstcode of practice relating to that duty comes into force.

(2)

In the case of the duties set out in sections 9 and 23, subsection (1) is subject tosubsections (5) and (6).

(3)

The duties referred to in subsection (1) are the duties set out in—(a) sections 9 and 23 (illegal content),(b) sections 11 and 25 (children’s online safety),(c) section 12 (user empowerment),(d) section 13 (content of democratic importance),(e) section 15 (journalistic content),(f) sections 16 and 26 (content reporting), and(g) sections 17 and 27 (complaints procedures).

(4)

For the purposes of subsection (1) a code of practice is the first code of practicerelating to a duty if—(a) it describes measures recommended for the purpose of compliancewith that duty, and(b) it is the first code of practice prepared under section 36(3) that describes
measures for that purpose.

(5)

The duties set out in sections 9 and 23, so far as relating to terrorism content or
offences within Schedule 5 (terrorism offences), apply to providers of Part 3
services from the day on which the first code of practice prepared under
section 36(1) comes into force.

(6)

The duties set out in sections 9 and 23, so far as relating to CSEA content or
offences within Schedule 6 (child sexual exploitation and abuse offences),
apply to providers of Part 3 services from the day on which the first code ofpractice prepared under section 36(2) comes into force.

(7)

(8)

The duties set out in Chapter 5 (fraudulent advertising) apply to providers of
a Category 1 service and providers of a Category 2A service (and to providersof a service which is both a Category 1 service and a Category 2A service) fromthe day on which the first code of practice prepared under section 36(4) comes
into force.
In relation to the provider of a particular Part 3 service, references in thissection to duties applying to providers of Part 3 services (or to providers of
Category 1 services or Category 2A services) are to such duties as apply in
relation to that service in accordance with sections 6 and 20 or (as the case maybe) Chapter 5.

10

15

20

25

30

35

40

45

46

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 6 — Codes of practice and guidance(9)This section is subject to Part 2 of Schedule 17 (video-sharing platform services:transitional provision etc).
Guidance

47

OFCOM’s guidance about certain duties in Part 3(1)

OFCOM must produce guidance for providers of Category 1 services to assist
them in complying with their duties set out in section 14 (news publisher
content).

(2)

OFCOM must produce guidance for providers of Part 3 services to assist themin complying with—(a) their duties set out in section 19 or 29 (record-keeping and review), and(b) their duties set out in section 31 (children’s access assessments).

(3)

Before producing guidance under subsection (2) (including revised or
replacement guidance), OFCOM must consult the Information Commissioner.

(4)

OFCOM must publish guidance under this section (and any revised or
replacement guidance).

48

5

10

15

OFCOM’s guidance: content that is harmful to children and user
empowerment
(1)

(2)

OFCOM must produce guidance for providers of Part 3 services whichcontains examples of content or kinds of content that OFCOM consider to be,or consider not to be—(a) primary priority content that is harmful to children, or(b) priority content that is harmful to children.
OFCOM must produce guidance for providers of Category 1 services whichcontains examples of content or kinds of content that OFCOM consider to be,or consider not to be, content to which section 12(2) applies (see section 12(9)).

(3)

Before producing any guidance under this section (including revised or
replacement guidance), OFCOM must consult such persons as they consider
appropriate.

(4)

OFCOM must publish guidance under this section (and any revised or
replacement guidance).

20

25

30

CHAPTER 7
INTERPRETATION OF PART 3
49“Regulated user-generated content”, “user-generated content”, “newspublisher content”(1)This section applies for the purposes of this Part.

(2)“Regulated user-generated content”, in relation to a regulated user-to-userservice, means user-generated content, except—(a) emails,(b) SMS messages,

35Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 7 — Interpretation of Part 3

(c)
(d)
(e)
(f)
(g)
(3)

(4)

(5)

47

MMS messages,
one-to-one live aural communications (see subsection (5)),
comments and reviews on provider content (see subsection (6)),
identifying content that accompanies content within any of paragraphs(a) to (e), andnews publisher content (see subsection (8)).

“User-generated content”, in relation to a user-to-user service, means content—(a) that is—(i) generated directly on the service by a user of the service, or(ii) uploaded to or shared on the service by a user of the service,and(b) that may be encountered by another user, or other users, of the service
by means of the service.
For the purposes of subsection (3)—(a) the reference to content generated, uploaded or shared by a user
includes content generated, uploaded or shared by means of softwareor an automated tool applied by the user;(b) a bot is to be regarded as a user of a service if—(i) the bot’s functions include interacting with user-generated
content, and(ii) the bot is not controlled by or on behalf of the provider of theservice.
“One-to-one live aural communications”, in relation to a user-to-user service,means content—(a) consisting of speech or other sounds conveyed in real time between two
users of the service by means of the service,(b) that is not a recording, and(c) that is not accompanied by user-generated content of any otherdescription, except identifying content.

(6)“Comments and reviews on provider content”, in relation to a user-to-userservice, means content present on the service consisting of comments orreviews relating to provider content (together with any further comments onsuch comments or reviews).

(7)

In subsection (6) “provider content” means content published on a service by
the provider of the service or by a person acting on behalf of the provider(including where the publication of the content is effected or controlled bymeans of software or an automated tool or algorithm applied by the provider
or by a person acting on behalf of the provider).
For the purposes of subsection (6), content that is user-generated content inrelation to a service is not to be regarded as provider content in relation to that
service.

(8)“News publisher content”, in relation to a regulated user-to-user service,means any content present on the service that is within subsection (9) or (10).

(9)

Content is within this subsection if it was generated directly on the service bya user of the service that is a recognised news publisher.

(10)

Content is within this subsection if—

5

10

15

20

25

30

35

40

45

48

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 7 — Interpretation of Part 3

(a)
(b)

the content was uploaded to or shared on the service by a user of theservice, andthe content either—(i) reproduces in full an article or written item that was originallypublished by a recognised news publisher (and is not ascreenshot or photograph of that article or item or of part of it),(ii) is a recording of an item originally broadcast by a recognised
news publisher (and is not an excerpt of such a recording), or(iii) is a link to a full article or written item originally published bya recognised news publisher, or to a full recording of an item
originally broadcast by a recognised news publisher.

(11)

For the meaning of “recognised news publisher”, see section 50.

(12)

In this section—“MMS message” means a Multimedia Messaging Service message (thatmay include images, sounds and short videos) that may be sent
between telephone numbers allocated in accordance with a national orinternational numbering plan;“SMS message” means a Short Message Service text message composed
principally of letters or numbers that may be sent between telephone
numbers allocated in accordance with a national or international
numbering plan.

50

5

10

15

20

“Recognised news publisher”
(1)

(2)

In this Part, “recognised news publisher” means any of the following entities—(a) the British Broadcasting Corporation,(b) Sianel Pedwar Cymru,(c) the holder of a licence under the Broadcasting Act 1990 or 1996 who
publishes news-related material in connection with the broadcasting
activities authorised under the licence, and(d) any other entity which—(i) meets all of the conditions in subsection (2), and(ii) is not an excluded entity (see subsection (3)).
The conditions referred to in subsection (1)(d)(i) are that the entity—(a) has as its principal purpose the publication of news-related material,and such material—(i) is created by different persons, and(ii) is subject to editorial control,(b) publishes such material in the course of a business (whether or not
carried on with a view to profit),(c) is subject to a standards code,(d) has policies and procedures for handling and resolving complaints,(e) has a registered office or other business address in the United
Kingdom,(f) is the person with legal responsibility for material published by it in the
United Kingdom, and(g) publishes—(i) the entity’s name, the address mentioned in paragraph (e) andthe entity’s registered number (if any), and

25

30

35

40

45

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 7 — Interpretation of Part 3

(ii)

49

the name and address of any person who controls the entity(including, where such a person is an entity, the address of that
person’s registered or principal office and that person’s
registered number (if any)).

(3)

An “excluded entity” is an entity—(a) which is a proscribed organisation under the Terrorism Act 2000 (seesection 3 of that Act), or(b) the purpose of which is to support a proscribed organisation under that
Act.

5

(4)

For the purposes of subsection (2)—(a) news-related material is “subject to editorial control” if there is a person(whether or not the publisher of the material) who has editorial orequivalent responsibility for the material, including responsibility for
how it is presented and the decision to publish it;(b) “control” has the same meaning as it has in the Broadcasting Act 1990
by virtue of section 202 of that Act.

10

(5)

51

In this section—“news-related material” means material consisting of—(a) news or information about current affairs,(b) opinion about matters relating to the news or current affairs, or(c) gossip about celebrities, other public figures or other persons in
the news;“publish” means publish by any means (including by broadcasting), andreferences to a publisher and publication are to be construed
accordingly;“standards code” means—(a) a code of standards that regulates the conduct of publishers,
that is published by an independent regulator, or(b) a code of standards that regulates the conduct of the entity inquestion, that is published by the entity itself.

15

20

25

30

“Search content”, “search results” etc(1)This section applies for the purposes of this Part.

(2)“Search content” means content that may be encountered in or via search
results of a search service, except—(a) paid-for advertisements (see section 207),(b) content on the website of a recognised news publisher (see section 50),and(c) content that—(i) reproduces in full an article or written item that was originallypublished by a recognised news publisher (and is not ascreenshot or photograph of that article or item or of part of it),(ii) is a recording of an item originally broadcast by a recognised
news publisher (and is not an excerpt of such a recording), or(iii) is a link to a full article or written item originally published bya recognised news publisher, or to a full recording of an item
originally broadcast by a recognised news publisher.

35

40

45

50

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 7 — Interpretation of Part 3(3)“Search results”, in relation to a search service, means content presented to auser of the service by operation of the search engine in response to a searchrequest made by the user.

(4)“Search” means search by any means, including by input of text or images orby speech, and references to a search request are to be construed accordingly.

(5)

In subsection (2), the reference to encountering content “via search results”—(a) is to encountering content as a result of interacting with search results(for example, by clicking on them);(b) does not include a reference to encountering content as a result ofsubsequent interactions with an internet service other than the searchservice.

(6)

52

5

10

In this section references to a search service include references to a user-to-userservice that includes a search engine.
Restricting users’ access to content(1)This section applies for the purposes of this Part.

(2)

References to restricting users’ access to content, and related references,include any case where a provider takes or uses a measure which has the effectthat—(a) a user is unable to access content without taking a prior step (whether
or not taking that step might result in access being denied), or(b) content is temporarily hidden from a user.

(3)

(4)
53

But such references do not include any case where—(a) the effect mentioned in subsection (2) results from the use orapplication by a user of features, functionalities or settings which a
provider includes in a service in compliance with the duty set out insection 12(2) (user empowerment), or(b) access to content is controlled by another user, rather than the provider.

15

20

25

See also section 207(5).
“Illegal content” etc(1)This section applies for the purposes of this Part.

(2)“Illegal content” means content that amounts to a relevant offence.

(3)

Content consisting of certain words, images, speech or sounds amounts to arelevant offence if—(a) the use of the words, images, speech or sounds amounts to a relevant
offence,(b) the possession, viewing or accessing of the content constitutes arelevant offence, or(c) the publication or dissemination of the content constitutes a relevant
offence.

(4)“Relevant offence” means—(a) a priority offence, or(b) an offence within subsection (5).

30

35

40

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 7 — Interpretation of Part 3

(5)

(6)

(7)

51

An offence is within this subsection if—(a) it is not a priority offence,(b) the victim or intended victim of the offence is an individual (orindividuals), and(c) the offence is created by this Act or, before or after this Act is passed,by—(i) another Act,(ii) an Order in Council,(iii) an order, rules or regulations made under an Act by the
Secretary of State or other Minister of the Crown, including
such an instrument made jointly with a devolved authority, or(iv) devolved subordinate legislation made by a devolved authority
with the consent of the Secretary of State or other Minister of the
Crown.
But an offence is not within subsection (5) if—(a) the offence concerns—(i) the infringement of intellectual property rights,(ii) the safety or quality of goods (as opposed to what kind of goods
they are), or(iii) the performance of a service by a person not qualified toperform it; or(b) it is an offence under the Consumer Protection from Unfair Trading
Regulations 2008 (S.I. 2008/1277).
“Priority offence” means—(a) an offence specified in Schedule 5 (terrorism offences),(b) an offence specified in Schedule 6 (offences related to child sexual
exploitation and abuse), or(c) an offence specified in Schedule 7 (other priority offences).

(8)“Terrorism content” means content that amounts to an offence specified in
Schedule 5.

(9)“CSEA content” means content that amounts to an offence specified in
Schedule 6.

(10)“Priority illegal content” means—(a) terrorism content,(b) CSEA content, and(c) content that amounts to an offence specified in Schedule 7.

(11)

For the purposes of determining whether content amounts to an offence, noaccount is to be taken of whether or not anything done in relation to the content
takes place in any part of the United Kingdom.

(12)

References in subsection (3) to conduct of particular kinds are not to be taken
to prevent content generated by a bot or other automated tool from being
capable of amounting to an offence (see also section 170(7) (providers’judgements about the status of content)).

(13)

Subsection (14) applies in relation to a regulated user-to-user service (but, inthe case of a combined service, does not apply in relation to the search content
of the service).

5

10

15

20

25

30

35

40

45

52

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 7 — Interpretation of Part 3

(14)

(15)

References to “illegal content”, “terrorism content”, “CSEA content” and“priority illegal content” are to be read as—(a) limited to content within the definition in question that is regulateduser-generated content in relation to the service, and(b) including material which, if it were present on the service, would becontent within paragraph (a) (and this section is to be read with suchmodifications as may be necessary for the purpose of this paragraph).
In this section—“devolved authority” means—(a) the Scottish Ministers,(b) the Welsh Ministers, or(c) a Northern Ireland department;“devolved subordinate legislation” means—(a) an instrument made under an Act of the Scottish Parliament,(b) an instrument made under an Act or Measure of Senedd
Cymru, or(c) an instrument made under Northern Ireland legislation;“Minister of the Crown” has the meaning given by section 8 of the
Ministers of the Crown Act 1975 and also includes the Commissionersfor His Majesty’s Revenue and Customs;“offence” means an offence under the law of any part of the United
Kingdom.

(16)

See also section 170 (providers’ judgements about the status of content).

54“Content that is harmful to children” etc(1)This section applies for the purposes of this Part.

(2)“Primary priority content that is harmful to children” means content of a
description designated in regulations made by the Secretary of State as
primary priority content that is harmful to children.

(3)“Priority content that is harmful to children” means content of a description
designated in regulations made by the Secretary of State as priority content
that is harmful to children.

(4)“Content that is harmful to children” means—(a) primary priority content that is harmful to children,(b) priority content that is harmful to children, or(c) content, not within paragraph (a) or (b), of a kind which presents amaterial risk of significant harm to an appreciable number of children
in the United Kingdom.

(5)

For the purposes of this section—(a) illegal content (see section 53) is not to be regarded as within subsection(4)(c), and(b) content is not to be regarded as within subsection (4)(c) if the risk ofharm flows from—(i) the content’s potential financial impact,(ii) the safety or quality of goods featured in the content, or

5

10

15

20

25

30

35

40

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 7 — Interpretation of Part 3

(iii)

53

the way in which a service featured in the content may be
performed (for example, in the case of the performance of aservice by a person not qualified to perform it).

(6)

“Non-designated content that is harmful to children” means content withinsubsection (4)(c).

(7)

Subsection (8) applies in relation to a regulated user-to-user service (but, in thecase of a combined service, does not apply in relation to the search content of
the service).

(8)

References to “primary priority content that is harmful to children”, “priority
content that is harmful to children”, “content that is harmful to children” and“non-designated content that is harmful to children” are to be read as—(a) limited to content within the definition in question that is regulateduser-generated content in relation to the service, and(b) including material which, if it were present on the service, would becontent within paragraph (a) (and this section is to be read with suchmodifications as may be necessary for the purpose of this paragraph).

(9)

55

5

10

15

Sections 55 and 56 contain further provision about regulations made under thissection.
Regulations under section 54(1)

The Secretary of State may specify a description of content in regulations under
section 54(2) (primary priority content that is harmful to children) only if theSecretary of State considers that, in relation to Part 3 services—(a) there is a material risk of significant harm to an appreciable number ofchildren presented by content of that description that is regulated usergenerated content or search content, and(b) it is appropriate for the duties set out in sections 11(3)(a) and 25(3)(a)(duty in relation to children of all ages) to apply in relation to content
of that description.

(2)

The Secretary of State may specify a description of content in regulations under
section 54(3) (priority content that is harmful to children) only if the Secretaryof State considers that, in relation to Part 3 services, there is a material risk ofsignificant harm to an appreciable number of children presented by content ofthat description that is regulated user-generated content or search content.

(3)

The Secretary of State may not specify a description of content in regulations
under section 54 if—(a) any content of that description is illegal content (see section 53), or(b) the risk of harm presented by content of that description flows from—(i) the content’s potential financial impact,(ii) the safety or quality of goods featured in the content, or(iii) the way in which a service featured in the content may be
performed (for example, in the case of the performance of aservice by a person not qualified to perform it).

(4)

The Secretary of State must consult OFCOM before making regulations under
section 54.

(5)

In this section references to children are to children in the United Kingdom.

20

25

30

35

40

45

54

Online Safety Bill
Part 3 — Providers of regulated user-to-user services and regulated search services: duties of care
Chapter 7 — Interpretation of Part 3

56

Regulations under section 54: OFCOM’s review and report(1)

In this section “regulations” means regulations under section 54.

(2)

For so long as regulations are in force, OFCOM must carry out reviews of—(a) the incidence on regulated user-to-user services of content that isharmful to children,(b) the incidence on regulated search services and combined services ofsearch content that is harmful to children, and(c) the severity of harm that children in the United Kingdom suffer, or may
suffer, as a result of those kinds of content.

(3)

OFCOM must produce and publish a report on the outcome of each review.

(4)

The report must include advice as to whether, in OFCOM’s opinion, it isappropriate to make changes to the regulations, specifying the changes that
OFCOM recommend.

(5)

The reports must be published not more than three years apart.

(6)

The first report must be published before the end of the period of three years
beginning with the day on which the first statutory instrument containing
regulations is made.

(7)

OFCOM must send a copy of each report to the Secretary of State.

5

10

15

PART 4OTHER DUTIES OF PROVIDERS OF REGULATED USER-TO-USER SERVICES AND REGULATED

20

SEARCH SERVICES

CHAPTER 1
USER IDENTITY VERIFICATION
57

User identity verification(1)

A provider of a Category 1 service must offer all adult users of the service theoption to verify their identity (if identity verification is not required for accessto the service).

(2)

The verification process may be of any kind (and in particular, it need not
require documentation to be provided).

(3)

A provider of a Category 1 service must include clear and accessible provisions
in the terms of service explaining how the verification process works.

(4)

If a person is the provider of more than one Category 1 service, the duties set
out in this section apply in relation to each such service.

(5)

The duty set out in subsection (1) applies in relation to all adult users, not justthose who begin to use a service after that duty begins to apply.

(6)

The duties set out in this section extend only to—(a) the user-to-user part of a service, and(b) the design, operation and use of a service in the United Kingdom.

25

30

35

Online Safety Bill
Part 4 — Other duties of providers of regulated user-to-user services and regulated search services
Chapter 1 — User identity verification

55

(7)

For the purposes of this section a person is an “adult user” of a service if theperson is an adult in the United Kingdom who—(a) is a user of the service, or(b) seeks to begin to use the service (for example by setting up an account).

(8)

For the meaning of “Category 1 service”, see section 86 (register of categories
of services).

58

5

OFCOM’s guidance about user identity verification(1)

OFCOM must produce guidance for providers of Category 1 services to assist
them in complying with the duty set out in section 57(1).

(2)

In producing the guidance (including revised or replacement guidance),
OFCOM must have particular regard to the desirability of ensuring thatproviders of Category 1 services offer users a form of identity verification
likely to be available to vulnerable adult users.

(3)

Before producing the guidance (including revised or replacement guidance),
OFCOM must consult—(a) the Information Commissioner,(b) persons whom OFCOM consider to have technological expertise
relevant to the duty set out in section 57(1),(c) persons who appear to OFCOM to represent the interests of vulnerable
adult users of Category 1 services, and(d) such other persons as OFCOM consider appropriate.

(4)

10

15

20

OFCOM must publish the guidance (and any revised or replacement
guidance).
CHAPTER 2REPORTING CHILD SEXUAL EXPLOITATION AND ABUSE CONTENT

59

25

Requirement to report CSEA content to the NCA
(1)

(2)

A UK provider of a regulated user-to-user service must operate the service
using systems and processes which secure (so far as possible) that the provider
reports all detected and unreported CSEA content present on the service to the
NCA.

30

A non-UK provider of a regulated user-to-user service must operate the service
using systems and processes which secure (so far as possible) that the provider
reports all detected and unreported UK-linked CSEA content present on theservice to the NCA (and does not report to the NCA CSEA content which is not
UK-linked).

35

(3)

A UK provider of a regulated search service must operate the service using
systems and processes which secure (so far as possible) that the provider
reports all detected and unreported CSEA content present on websites or
databases capable of being searched by the search engine to the NCA.

(4)

A non-UK provider of a regulated search service must operate the service
using systems and processes which secure (so far as possible) that the provider
reports all detected and unreported UK-linked CSEA content present on

40

56

Online Safety Bill
Part 4 — Other duties of providers of regulated user-to-user services and regulated search services
Chapter 2 — Reporting child sexual exploitation and abuse content

websites or databases capable of being searched by the search engine to theNCA (and does not report to the NCA CSEA content which is not UK-linked).
(5)

A UK provider of a combined service must comply with the requirement undersubsection (3) in relation to the search engine of the service.

(6)

A non-UK provider of a combined service must comply with the requirement
under subsection (4) in relation to the search engine of the service.

(7)

Providers’ reports under this section—(a) must meet the requirements set out in regulations under section 60, and(b) must be sent to the NCA in the manner, and within the time frames, set
out in those regulations.

(8)

If a person is the provider of more than one regulated user-to-user service orregulated search service, requirements under this section apply in relation toeach such service.

(9)

Terms used in this section are defined in section 63.

(10)This section applies only in relation to CSEA content detected on or after thedate on which this section comes into force.

60

Regulations about reports to the NCA
(1)

(2)

(3)

61

The Secretary of State must make regulations in connection with the reportsthat are to be made to the NCA (including by non-UK providers) as requiredby section 59.
The regulations may make provision about—(a) the information to be included in the reports,(b) the format of the reports,(c) the manner in which the reports must be sent to the NCA,(d) the time frames for sending the reports to the NCA (including
provision about cases of particular urgency),(e) the records that providers must keep in relation to the reports, or thedetails that providers must retain as evidence that they have made thereports, and(f) such other matters relating to the reports as the Secretary of State
considers appropriate.
Before making the regulations, the Secretary of State must consult—(a) the NCA,(b) OFCOM, and(c) such other persons as the Secretary of State considers appropriate.

5

10

15

20

25

30

35

NCA: information sharing
In section 16 of the Crime and Courts Act 2013 (interpretation of Part 1), in
subsection (1), in the definition of “permitted purpose”, after paragraph (o)insert—“(oa) the exercise of any function of OFCOM (the Office ofCommunications) under the Online Safety Act 2023;”.

40

Online Safety Bill
Part 4 — Other duties of providers of regulated user-to-user services and regulated search services
Chapter 2 — Reporting child sexual exploitation and abuse content

62

57

Offence in relation to CSEA reporting
(1)

(2)

63

A person commits an offence if, in purported compliance with a requirement
under section 59—(a) the person provides information that is false in a material respect, and(b) at the time the person provides it, the person knows that it is false in amaterial respect or is reckless as to whether it is false in a material
respect.
A person who commits an offence under this section is liable—(a) on summary conviction in England and Wales, to imprisonment for aterm not exceeding the general limit in a magistrates’ court or a fine (orboth);(b) on summary conviction in Scotland, to imprisonment for a term notexceeding 12 months or a fine not exceeding the statutory maximum (orboth);(c) on summary conviction in Northern Ireland, to imprisonment for aterm not exceeding 6 months or a fine not exceeding the statutory
maximum (or both);(d) on conviction on indictment, to imprisonment for a term not exceeding
two years or a fine (or both).
Interpretation of this Chapter(1)This section applies for the purposes of this Chapter.

(2)

A provider of a regulated user-to-user service or a regulated search service is a
“UK provider” of the service if the provider is—(a) an individual or individuals who are habitually resident in the United
Kingdom, or(b) an entity incorporated or formed under the law of any part of theUnited Kingdom.

(3)

Otherwise, a provider of a regulated user-to-user service or a regulated searchservice is a “non-UK provider” of the service.

(4)

CSEA content is “detected” by a provider when the provider becomes aware of
the content, whether by means of the provider’s systems or processes or as aresult of another person alerting the provider.

(5)

CSEA content is “unreported”, in relation to a provider, if the reporting of that
content is not covered by arrangements (mandatory or voluntary)—(a) by which the provider reports content relating to child sexual
exploitation or abuse to a foreign agency, or(b) by which an entity that is a group undertaking in relation to theprovider reports content relating to child sexual exploitation or abuse
to—(i) the NCA, or(ii) a foreign agency.

(6)

CSEA content is “UK-linked” if a provider has evidence of a link between thecontent and the United Kingdom, based on any of the following—(a) the place where the content was published, generated, uploaded or
shared;(b) the nationality of a person suspected of committing the related offence;

5

10

15

20

25

30

35

40

45

58

Online Safety Bill
Part 4 — Other duties of providers of regulated user-to-user services and regulated search services
Chapter 2 — Reporting child sexual exploitation and abuse content(c) the location of a person suspected of committing the related offence;(d) the location of a child who is a suspected victim of the related offence.
For the purposes of paragraphs (b), (c) and (d) an offence is “related” to CSEA
content if the content amounts to that offence (construed in accordance withsection 53: see subsections (3), (11) and (12) of that section).
(7)

(8)

In this Chapter—“CSEA content” has the same meaning as in Part 3 (see section 53);
“foreign agency” means a person exercising functions in a country outside
the United Kingdom which correspond to the NCA’s functions insofar
as they relate to receiving and disseminating reports about CSEA
content;“group undertaking” has the meaning given by section 1161(5) of theCompanies Act 2006;“NCA” means the National Crime Agency.
Sections 1161(5) and 1162 of, and Schedule 7 to, the Companies Act 2006—(a) are to apply in relation to an entity which is not an undertaking (asdefined in section 1161(1) of that Act) as they apply in relation to anundertaking, and(b) are to be read with any necessary modifications if applied to an entity
formed under the law of a country outside the United Kingdom.

5

10

15

20

CHAPTER 3
TERMS OF SERVICE: TRANSPARENCY, ACCOUNTABILITY AND FREEDOM OF EXPRESSION
64

Duty not to act against users except in accordance with terms of service
(1)

(2)

(3)

A provider of a Category 1 service must operate the service using
proportionate systems and processes designed to ensure that the provider does
not—(a) take down regulated user-generated content from the service,(b) restrict users’ access to regulated user-generated content, or(c) suspend or ban users from using the service,
except in accordance with the terms of service.
Nothing in subsection (1) is to be read as preventing a provider from taking
down content from a service or restricting users’ access to it, or suspending or
banning a user, if such an action is taken—(a) to comply with the duties set out in—(i) section 9(2) or (3) (protecting individuals from illegal content),or(ii) section 11(2) or (3) (protecting children from content that isharmful to children), or(b) to avoid criminal or civil liability on the part of the provider that mightreasonably be expected to arise if such an action were not taken.
In addition, nothing in subsection (1) is to be read as preventing a provider
from—(a) taking down content from a service or restricting users’ access to it on
the basis that a user has committed an offence in generating, uploadingor sharing it on the service, or

25

30

35

40

45

Online Safety Bill
Part 4 — Other duties of providers of regulated user-to-user services and regulated search services
Chapter 3 — Terms of service: transparency, accountability and freedom of expression

(b)

59

suspending or banning a user on the basis that—(i) the user has committed an offence in generating, uploading or
sharing content on the service, or(ii) the user is responsible for, or has facilitated, the presence or
attempted placement of a fraudulent advertisement on theservice.

(4)

The duty set out in subsection (1) does not apply in relation to—(a) consumer content (see section 67);(b) terms of service which deal with the treatment of consumer content.

(5)

If a person is the provider of more than one Category 1 service, the duty set out
in subsection (1) applies in relation to each such service.

(6)

The duty set out in subsection (1) extends only to the design, operation and useof a service in the United Kingdom, and references in this section to users are
to United Kingdom users of a service.

(7)

In this section—“criminal or civil liability” includes such a liability under the law of acountry outside the United Kingdom;“fraudulent advertisement” has the meaning given by section 33;“offence” includes an offence under the law of a country outside theUnited Kingdom.

(8)
65

5

10

15

20

See also section 14 (duties to protect news publisher content).
Further duties about terms of service
All services(1)

A provider of a regulated user-to-user service must include clear andaccessible provisions in the terms of service informing users about their rightto bring a claim for breach of contract if—(a) regulated user-generated content which they generate, upload or shareis taken down, or access to it is restricted, in breach of the terms ofservice, or(b) they are suspended or banned from using the service in breach of theterms of service.

25

30

Category 1 services
(2)

(3)

The duties set out in subsections (3) to (7) apply in relation to a Category 1
service, and references in subsections (3) to (9) to “provider” and “service” areto be read accordingly.
A provider must operate a service using proportionate systems and processes
designed to ensure that—(a) if the terms of service state that the provider will take down a particularkind of regulated user-generated content from the service, the provider
does take down such content;(b) if the terms of service state that the provider will restrict users’ accessto a particular kind of regulated user-generated content in a specified
way, the provider does restrict users’ access to such content in that
way;

35

40

60

Online Safety Bill
Part 4 — Other duties of providers of regulated user-to-user services and regulated search services
Chapter 3 — Terms of service: transparency, accountability and freedom of expression

(c)

(4)

if the terms of service state cases in which the provider will suspend or
ban a user from using the service, the provider does suspend or ban theuser in those cases.

A provider must ensure that—(a) terms of service which make provision about the provider taking down
regulated user-generated content from the service or restricting users’
access to such content, or suspending or banning a user from using theservice, are—(i) clear and accessible, and(ii) written in sufficient detail to enable users to be reasonably
certain whether the provider would be justified in taking thespecified action in a particular case, and(b) those terms of service are applied consistently.

(5)

A provider must operate a service using systems and processes that allow
users and affected persons to easily report—(a) content which they consider to be relevant content (see section 67);(b) a user who they consider should be suspended or banned from using
the service in accordance with the terms of service.

(6)

A provider must operate a complaints procedure in relation to a service that—(a) allows for complaints of a kind mentioned in subsection (8) to be made,(b) provides for appropriate action to be taken by the provider of theservice in response to complaints of those kinds, and(c) is easy to access, easy to use (including by children) and transparent.

(7)

A provider must include in the terms of service provisions which are easily
accessible (including to children) specifying the policies and processes thatgovern the handling and resolution of complaints of a kind mentioned insubsection (8).

(8)

The kinds of complaints referred to in subsections (6) and (7) are—(a) complaints by users and affected persons about content present on aservice which they consider to be relevant content;(b) complaints by users and affected persons if they consider that theprovider is not complying with a duty set out in any of subsections (1)or (3) to (5);(c) complaints by a user who has generated, uploaded or shared content
on a service if that content is taken down, or access to it is restricted, on
the basis that it is relevant content;(d) complaints by users who have been suspended or banned from using aservice.

(9)

The duties set out in subsections (3) and (4) do not apply in relation to terms ofservice which—(a) make provision of the kind mentioned in section 9(5) (protecting
individuals from illegal content) or 11(6) (protecting children fromcontent that is harmful to children), or(b) deal with the treatment of consumer content.

5

10

15

20

25

30

35

40

Online Safety Bill
Part 4 — Other duties of providers of regulated user-to-user services and regulated search services
Chapter 3 — Terms of service: transparency, accountability and freedom of expression

61

Further provision(10)

If a person is the provider of more than one regulated user-to-user service or
Category 1 service, the duties set out in this section apply in relation to eachsuch service.

(11)

The duties set out in this section extend only to the design, operation and useof a service in the United Kingdom, and references to users are to United
Kingdom users of a service.

(12)

See also section 14 (duties to protect news publisher content).

66

OFCOM’s guidance about duties set out in sections 64 and 65(1)

OFCOM must produce guidance for providers of Category 1 services to assist
them in complying with their duties set out in sections 64 and 65(3) to (7).

(2)

OFCOM must publish the guidance (and any revised or replacement
guidance).

67

5

10

Interpretation of this Chapter(1)This section applies for the purposes of this Chapter.

(2)“Regulated user-generated content” has the same meaning as in Part 3 (seesection 49), and references to such content are to content that is regulated usergenerated content in relation to the service in question.

(3)“Consumer content” means—(a) regulated user-generated content that constitutes, or is directly
connected with content that constitutes, an offer to sell goods or to
supply services,(b) regulated user-generated content that amounts to an offence under theConsumer Protection from Unfair Trading Regulations 2008 (S.I. 2008/1277) (construed in accordance with section 53: see subsections (3), (11)and (12) of that section), or(c) any other regulated user-generated content in relation to which an
enforcement authority has functions under those Regulations (seeregulation 19 of those Regulations).

(4)

References to restricting users’ access to content, and related references, are to
be construed in accordance with sections 52 and 207(5).

(5)

Content of a particular kind is “relevant content” if—(a) a term of service, other than a term of service mentioned in section
65(9), states that a provider may or will take down content of that kindfrom the service or restrict users’ access to content of that kind, and(b) it is regulated user-generated content.
References to relevant content are to content that is relevant content in relation
to the service in question.

(6)“Affected person” means a person, other than a user of the service in question,
who is in the United Kingdom and who is—(a) the subject of the content,(b) a member of a class or group of people with a certain characteristic
targeted by the content,

15

20

25

30

35

40

62

Online Safety Bill
Part 4 — Other duties of providers of regulated user-to-user services and regulated search services
Chapter 3 — Terms of service: transparency, accountability and freedom of expression

(c)
(d)

a parent of, or other adult with responsibility for, a child who is a userof the service or is the subject of the content, oran adult providing assistance in using the service to another adult who
requires such assistance, where that other adult is a user of the service
or is the subject of the content.

(7)

In determining what is proportionate for the purposes of sections 64 and 65, thesize and capacity of the provider of a service is, in particular, relevant.

(8)

For the meaning of “Category 1 service”, see section 86 (register of categories
of services).
CHAPTER 4

5

10

TRANSPARENCY REPORTING
68

Transparency reports about certain Part 3 services(1)

Once a year, OFCOM must give every provider of a relevant service a notice
which requires the provider to produce a report about the service (a“transparency report”).

(2)

If a person is the provider of more than one relevant service, a notice must be
given to the provider in respect of each such service.

(3)

In response to a notice relating to a relevant service, the provider of the service
must produce a transparency report which must—(a) contain information of a kind specified or described in the notice,(b) be in the format specified in the notice,(c) be submitted to OFCOM by the date specified in the notice, and(d) be published in the manner and by the date specified in the notice.

(4)

A provider must ensure that the information provided in a transparency reportis—(a) complete, and(b) accurate in all material respects.

(5)

A “relevant service” means—(a) a Category 1 service (see section 86(10)(a));(b) a Category 2A service (see section 86(10)(b));(c) a Category 2B service (see section 86(10)(c)).

(6)

In a notice which relates to a Category 1 service or a Category 2B service,
OFCOM may only specify or describe user-to-user information.
But in the case of a service described in subsection (9), that subsection applies
instead.

(7)

In a notice which relates to a regulated search service that is a Category 2A
service, OFCOM may only specify or describe search engine information.

(8)

In a notice which relates to a combined service that is a Category 2A service,
and is not also a Category 1 service or a Category 2B service, OFCOM may only
specify or describe search engine information.

(9)

In a notice which relates to a combined service that is a Category 2A service, as
well as being a Category 1 service or a Category 2B service, OFCOM may

15

20

25

30

35

40

Online Safety Bill
Part 4 — Other duties of providers of regulated user-to-user services and regulated search services
Chapter 4 — Transparency reporting

63

specify or describe user-to-user information or search engine information, orboth those kinds of information.
(10)

In subsections (6) to (9)—(a) “user-to-user information” means information which—(i) is about the matters listed in Part 1 of Schedule 8, and(ii) relates to the user-to-user part of a service;(b) “search engine information” means information which—(i) is about the matters listed in Part 2 of Schedule 8, and(ii) relates to the search engine of a service.

(11)

Part 3 of Schedule 8 makes further provision about transparency reports.

(12)

The Secretary of State may by regulations amend subsection (1) so as to change
the frequency of the transparency reporting process.

(13)

The Secretary of State must consult OFCOM before making regulations undersubsection (12).

(14)

In this section “notice” means a notice under subsection (1).

69

OFCOM’s guidance about transparency reports
(1)

(2)

OFCOM must produce guidance about—(a) how OFCOM will determine which information they will requiretransparency reports under section 68 to contain, including—(i) the principles that they will apply in relation to each of thefactors mentioned in paragraph 33 of Schedule 8, and(ii) the steps that they will take to engage with providers of relevant
services before requiring information in a notice under section
68(1);(b) how information from transparency reports produced by providers of
relevant services under section 68 will be used to produce OFCOM’stransparency reports (see section 145); and(c) any other matter that OFCOM consider to be relevant to the production
and publication of transparency reports under section 68 or 145.
Before producing the guidance (including revised or replacement guidance),
OFCOM must consult such of the following as they consider appropriate—(a) providers of regulated user-to-user services, and of regulated searchservices,(b) persons who appear to OFCOM to represent such providers,(c) persons who appear to OFCOM to represent the interests of children(generally or with particular reference to online safety matters),(d) persons whom OFCOM consider to have expertise in equality issues
and human rights, in particular—(i) the right to freedom of expression set out in Article 10 of theConvention, and(ii) the right to respect for a person’s private and family life, homeand correspondence set out in Article 8 of the Convention,(e) the Information Commissioner,(f) persons who appear to OFCOM to represent the interests of those withprotected characteristics (within the meaning of Part 2 of the Equality
Act 2010), and

5

10

15

20

25

30

35

40

45

64

Online Safety Bill
Part 4 — Other duties of providers of regulated user-to-user services and regulated search services
Chapter 4 — Transparency reporting(g)

persons whom OFCOM consider to have expertise in the enforcementof the criminal law and the protection of national security that isrelevant to online safety matters,
and OFCOM must also consult such other persons as OFCOM consider
appropriate.
(3)

OFCOM must publish the guidance (and any revised or replacement
guidance).

(4)

In exercising their functions under section 68 or 145, OFCOM must have regard
to the guidance for the time being published under this section.

(5)

In this section, “relevant service” has the same meaning as in section 68 (seesubsection (5) of that section).

510PART 5
DUTIES OF PROVIDERS OF REGULATED SERVICES: CERTAIN PORNOGRAPHIC CONTENT
70“Pornographic content”, “provider pornographic content”, “regulated
provider pornographic content”(1)This section applies for the purposes of this Part.

(2)“Pornographic content” means content of such a nature that it is reasonable toassume that it was produced solely or principally for the purpose of sexual
arousal.

(3)“Provider pornographic content”, in relation to an internet service, means
pornographic content that is published or displayed on the service by theprovider of the service or by a person acting on behalf of the provider(including pornographic content published or displayed on the service bymeans of software or an automated tool or algorithm applied by the provider
or by a person acting on behalf of the provider).

(4)“Regulated provider pornographic content”, in relation to an internet service,means provider pornographic content other than—(a) content consisting only of text, or(b) paid-for advertisements (see section 207).

(5)References to pornographic content that is “published or displayed” on aservice—(a) include, in particular—(i) references to pornographic content that is only visible or
audible to users as a result of interacting with content that isblurred, distorted or obscured (for example, by clicking on suchcontent), but only where the pornographic content is present on
the service, and(ii) references to pornographic content that is embedded on theservice;(b) do not include references to pornographic content that appears insearch results of a search service or a combined service.

(6)

Pornographic content that is user-generated content in relation to an internet
service is not to be regarded as provider pornographic content in relation tothat service.

15

20

25

30

35

40

Online Safety Bill
Part 5 — Duties of providers of regulated services: certain pornographic content

(7)

71

65

In this section—“search results” has the meaning given by section 51(3);“user-generated content” has the meaning given by section 49 (seesubsections (3) and (4) of that section).
Scope of duties about regulated provider pornographic content(1)

A provider of an internet service within subsection (2) must comply with theduties set out in section 72 in relation to the service.

(2)

An internet service is within this subsection if—(a) regulated provider pornographic content is published or displayed on
the service,(b) the service is not exempt, and(c) the service has links with the United Kingdom.

(3)

(4)

(5)

A service is “exempt” for the purposes of this Part if it is —(a) a user-to-user service or a search service of a description that is exempt
as provided for by Schedule 1, or(b) an internet service of a kind described in Schedule 9.
A service “has links with the United Kingdom” for the purposes of this Part ifeither of the following conditions is met in relation to the service—(a) the service has a significant number of United Kingdom users, or(b) United Kingdom users form one of the target markets for the service (orthe only target market).

5

10

15

20

This Part does not apply in relation to a part of a regulated service if—(a) in the case of a Part 3 service, the conditions in paragraph 7(2) ofSchedule 1 (internal business service conditions) are met in relation tothat part;(b) in the case of an internet service other than a Part 3 service, theconditions in paragraph 1(2) of Schedule 9 (internal business service
conditions) are met in relation to that part.

25

(6)

This Part does not apply in relation to a part of a regulated service if that partis an on-demand programme service within the meaning of section 368A of theCommunications Act.

30

(7)

If a person is the provider of more than one internet service within subsection(2), the duties set out in section 72 apply in relation to each such service.

(8)

The duties set out in section 72 extend only to the design, operation and use of
an internet service in the United Kingdom.

72

35

Duties about regulated provider pornographic content(1)This section sets out the duties which apply in relation to internet services
within section 71(2).

(2)

A duty to ensure that children are not normally able to encounter content thatis regulated provider pornographic content in relation to the service (forexample, by using age verification).

(3)

A duty to make and keep a written record, in an easily understandable form,
of—

40

66

Online Safety Bill
Part 5 — Duties of providers of regulated services: certain pornographic content

(a)
(b)

73

the measures taken or in use, and the policies implemented, to comply
with the duty set out in subsection (2), andthe way in which the provider, when deciding on and implementing
the measures and policies referred to in paragraph (a), has had regard
to the importance of protecting United Kingdom users from a breach of
any statutory provision or rule of law concerning privacy that isrelevant to the use or operation of a regulated service (including, but
not limited to, any such provision or rule concerning the processing of
personal data).

OFCOM’s guidance about duties set out in section 72(1)

OFCOM must produce guidance for providers of internet services within
section 71(2) to assist them in complying with their duties set out in section 72.

(2)

The guidance must include—(a) examples of measures and policies that may be appropriate for the
purpose of compliance with the duty set out in section 72(2),(b) examples of ways in which a provider may have regard to theimportance of protecting users as mentioned in section 72(3)(b),(c) principles that OFCOM propose to apply when determining whether aprovider has complied with each of the duties set out in section 72, and(d) examples of circumstances in which OFCOM are likely to consider thata provider has not complied with each of those duties.

(3)

(4)

Before producing the guidance (including revised or replacement guidance),
OFCOM must consult—(a) the Secretary of State,(b) persons who appear to OFCOM to represent providers of internet
services within section 71(2),(c) persons who appear to OFCOM to represent adult users of internet
services within section 71(2),(d) persons who appear to OFCOM to represent the interests of children(generally or with particular reference to online safety matters),(e) the Information Commissioner,(f) persons whom OFCOM consider to have expertise in innovation, or
emerging technology, that is relevant to online safety matters, and(g) such other persons as OFCOM consider appropriate.
But if OFCOM propose to revise the guidance, and consider that the minor
nature of the proposal means that consultation is unnecessary—(a) OFCOM must notify the Secretary of State of the proposed changes,
and(b) if the Secretary of State agrees that it is appropriate, the consultation
requirements set out in subsection (3) do not apply in relation to the
proposed changes.

(5)

OFCOM must keep the guidance under review.

(6)

OFCOM must publish the guidance (and any revised or replacement
guidance).

5

10

15

20

25

30

35

40

Online Safety Bill
Part 6 — Duties of providers of regulated services: fees

67

PART 6
DUTIES OF PROVIDERS OF REGULATED SERVICES: FEES
74

Duty to notify OFCOM
(1)

(2)

(3)

A provider of a regulated service must notify OFCOM in relation to a charging
year which is—(a) the first fee-paying year in relation to that provider, or(b) any charging year after the first fee-paying year where—(i) the previous charging year was not a fee-paying year in relation
to the provider, and the charging year in question is a feepaying year in relation to the provider, or(ii) the previous charging year was a fee-paying year in relation to
the provider, and the charging year in question is not a feepaying year in relation to the provider.
A “fee-paying year”, in relation to a provider, means a charging year where
both of the following conditions apply—(a) the provider’s qualifying worldwide revenue for the qualifying periodthat relates to that charging year is equal to or greater than thethreshold figure that has effect for that charging year (see section 77),and(b) the provider is not exempt (see subsection (6)).
A notification under subsection (1) in relation to a charging year must include
details of all regulated services provided by the provider, and where it is a
notification under subsection (1)(a) or (b)(i), it must also include—(a) details of the provider’s qualifying worldwide revenue for thequalifying period that relates to that charging year, and(b) supporting evidence, documents or other information of a kinddescribed in, or about matters described in, regulations made by the
Secretary of State.

(4)

Section 76 makes provision about a statement by OFCOM setting out what ismeant by “qualifying worldwide revenue” and “qualifying period” in thissection and section 75.

(5)

A notification under subsection (1) must be provided to OFCOM—(a) in relation to the initial charging year, within four months of the dateon which the first threshold figure under section 77 is published;(b) in relation to subsequent charging years, at least six months before thebeginning of the charging year to which the notification relates.

(6)

(7)

OFCOM may provide that particular descriptions of providers of regulated
services are exempt for the purposes of this section and section 75 where—(a) OFCOM consider that an exemption for such providers is appropriate,and(b) the Secretary of State approves the exemption.
OFCOM may revoke such an exemption where they consider that it is nolonger appropriate and the Secretary of State approves the revocation.

5

10

15

20

25

30

35

40

68

Online Safety Bill
Part 6 — Duties of providers of regulated services: fees

(8)

Exemptions, or revocations of exemptions, which are approved by the
Secretary of State are to take effect from the beginning of a particular charging
year.

(9)

Details of an exemption or revocation must be published by OFCOM at least
six months before the beginning of the first charging year for which the
exemption or revocation is to have effect.

(10)

But subsection (9) does not apply in relation to any exemptions which are tohave effect for the initial charging year.

(11)

The Secretary of State must consult OFCOM before making regulations undersubsection (3)(b).

(12)

For the purposes of this section and section 75, the “provider” of a regulated
service, in relation to a charging year, includes a person who is the provider ofthe service for part of that year.

75

Duty to pay fees
(1)

OFCOM may require a provider of a regulated service to pay a fee in respectof a charging year which is a fee-paying year.

(2)

Where OFCOM require a provider of a regulated service to pay a fee in respectof a charging year, the fee is to be equal to the amount produced by acomputation—(a) made by reference to—(i) the provider’s qualifying worldwide revenue for the qualifying
period relating to that charging year, and(ii) any other factors that OFCOM consider appropriate, and(b) made in the manner that OFCOM consider appropriate.

(3)

For the purposes of this section and section 74—(a) the amount of a provider’s qualifying worldwide revenue for aqualifying period, or(b) the amount of a fee to be paid to OFCOM, or of an instalment of such afee,
is, in the event of a disagreement between the provider and OFCOM, theamount determined by OFCOM.

(4)

When determining fees payable under this section, OFCOM must do so inaccordance with a statement of principles as mentioned in section 79(1).

(5)

Where a person is the provider of a regulated service for part of a charging year
only, OFCOM may refund all or part of a fee paid to OFCOM under this section
by that provider in respect of that year.

(6)

In this section, “fee-paying year” has the same meaning as in section 74.

76

5

10

15

20

25

30

35

OFCOM’s statement about “qualifying worldwide revenue” etc(1)

For the purposes of sections 74 and 75, OFCOM must produce a statement
giving information about—(a) the amounts which do, or do not, comprise a person’s “qualifying
worldwide revenue”, and40

Online Safety Bill
Part 6 — Duties of providers of regulated services: fees

(b)
(2)

69

the period which is the “qualifying period” in relation to a charging
year.

Provision contained in the statement as mentioned in subsection (1)(a) is also
to apply for the purposes of determining the amount of penalties which
OFCOM may impose under Chapter 6 of Part 7 (see paragraph 4 of Schedule13), and must include provision about the application of that term to a groupof entities for the purposes of paragraph 5 of that Schedule.

5(3)

The statement may make different provision in relation to different kinds ofregulated services.

(4)

Before producing the statement (including a revised or replacement
statement), OFCOM must consult—(a) the Secretary of State,(b) the Treasury, and(c) such other persons as OFCOM consider appropriate.

10

(5)

OFCOM must keep the statement under review.

15

(6)

OFCOM must publish the statement (and any revised or replacement
statement).

(7)

OFCOM must send a copy of the statement (and any revised or replacement
statement) to the Secretary of State, and the Secretary of State must lay it before
Parliament.

77

20

Threshold figure(1)

OFCOM must carry out a consultation to inform the setting of the thresholdfigure for the purposes of sections 74 and 75, consulting such persons as they
consider appropriate.

(2)

After the completion of the consultation, and having taken advice fromOFCOM, the Secretary of State must determine the figure that the Secretary ofState considers appropriate to be the threshold figure for those purposes.

(3)

The Secretary of State must—(a) publish, in such manner as the Secretary of State considers appropriate,a statement specifying the threshold figure, and(b) lay a copy of that statement before Parliament.

(4)

The Secretary of State must keep the threshold figure under review.

(5)

If the Secretary of State considers that it may be appropriate to revise thethreshold figure, the Secretary of State may request OFCOM to carry out afurther consultation, and subsections (1) to (3) apply again.

(6)

A threshold figure is to take effect from the beginning of a particular charging
year.

(7)

A statement specifying a threshold figure must be published at least ninemonths before the beginning of the first charging year for which that figure isto have effect.

(8)

But subsection (7) does not apply in relation to the first threshold figure
published under this section.

25

30

35

40

70

Online Safety Bill
Part 6 — Duties of providers of regulated services: fees

78

Secretary of State’s guidance about fees
(1)

The Secretary of State must issue guidance to OFCOM about the principles tobe included in a statement of principles that OFCOM propose to apply indetermining fees payable under section 75 (see section 79).

(2)

The Secretary of State must consult OFCOM before issuing, revising or
replacing the guidance.

(3)

The guidance may not be revised or replaced more frequently than once every
three years unless—(a) the guidance needs to be corrected because of an amendment, repeal or
modification of any provision of this Part, or(b) the revision or replacement is by agreement between the Secretary ofState and OFCOM.

(4)The Secretary of State must lay the guidance (including revised or replacement
guidance) before Parliament.

(5)

The Secretary of State must publish the guidance (and any revised or
replacement guidance).

(6)

In exercising any functions under this Part, OFCOM must have regard to theguidance for the time being published under this section.

79

5

10

15

OFCOM’s fees statements(1)

OFCOM may not require a provider of a regulated service to pay a fee under
section 75 unless there is in force a statement of the principles that OFCOM
propose to apply in determining fees payable under that section.

(2)

Those principles must be such as appear to OFCOM to be likely to secure, on
the basis of such estimates of the likely costs as it is practicable for them tomake—(a) that on a year by year basis, the aggregate amount of the fees payable
to OFCOM under section 75 is sufficient to meet, but does not exceed,
the annual cost to OFCOM of the exercise of their online safetyfunctions;(b) that the fees required under section 75 are justifiable and proportionate
having regard to the functions in respect of which they are imposed;(c) that the relationship between meeting the cost of the exercise of thosefunctions and the amounts of the fees is transparent.

(3)

(4)

A statement of principles mentioned in subsection (1) must (among otherthings)—(a) include details relating to the computation model used to calculate fees
payable under section 75, including details of factors mentioned insubsection (2)(a)(ii) of that section (if any),(b) include details about the meaning of “qualifying worldwide revenue”
and “qualifying period”, as set out in the statement under section 76 forthe purposes of sections 74 and 75, and(c) specify the threshold figure published in accordance with section 77.
Before making or revising such a statement of principles, OFCOM must
consult such persons as they consider appropriate.

20

25

30

35

40

Online Safety Bill
Part 6 — Duties of providers of regulated services: fees

71

(5)

Such a statement of principles may make different provision in relation todifferent kinds of regulated services.

(6)

OFCOM must publish such a statement of principles (and any revised or
replacement statement).

(7)

As soon as reasonably practicable after the end of each charging year, OFCOM
must publish a statement setting out, in respect of that year—(a) the aggregate amount of the fees payable under section 75 for that yearthat has been received by OFCOM,(b) the aggregate amount of the fees payable under that section for thatyear that remains outstanding and is likely to be paid or recovered, and(c) the cost to OFCOM of the exercise of their online safety functions.

(8)

(9)

80

Any deficit or surplus shown (after applying this subsection for all previous
years) by a statement under subsection (7) must be carried forward and taken
into account in determining what is required to satisfy the requirement
imposed by virtue of subsection (2)(a) in relation to the following year.
For the purposes of this section—(a) OFCOM’s costs of the exercise of their online safety functions during acharging year include the costs of preparations for the exercise of their
online safety functions incurred during that year; and(b) OFCOM’s costs of preparations for the exercise of their online safetyfunctions incurred after the day on which this section comes into force
but before the charging year in which those functions were firstexercised are to be treated as if they were incurred during that year.

5

10

15

20

Recovery of OFCOM’s initial costs
Schedule 10 makes provision about fees chargeable to providers of regulated
services in connection with OFCOM’s recovery of costs incurred on
preparations for the exercise of their online safety functions.

81

25

Meaning of “charging year” and “initial charging year”
In this Part—“charging year” means any period of 12 months beginning with 1 April,
except such a period that falls before the initial charging year;“initial charging year” means the period of 12 months beginning with 1
April specified by OFCOM in a notice published for the purposes ofthis Part.
PART 730

35

OFCOM'S POWERS AND DUTIES IN RELATION TO REGULATED SERVICES
CHAPTER 1
GENERAL DUTIES
82

General duties of OFCOM under section 3 of the Communications Act(1)

Section 3 of the Communications Act (general duties of OFCOM) is amendedin accordance with subsections (2) to (8).

40

72

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 1 — General duties(2)

In subsection (2), after paragraph (f) insert—“(g) the adequate protection of citizens from harm presented bycontent on regulated services, through the appropriate use byproviders of such services of systems and processes designed toreduce the risk of such harm.”(3)

In subsection (4)(c), at the beginning insert “(subject to subsection (5A))”.

(4)

After subsection (4) insert—
“(4A)

(5)

15

20

25

30

Subsection (4)(c) does not apply in relation to the carrying out of any of
OFCOM’s online safety functions.”

35

After subsection (6) insert—“(6ZA)(7)

10

After subsection (5) insert—
“(5A)

(6)

In performing their duties under subsection (1) in relation to matters towhich subsection (2)(g) is relevant, OFCOM must have regard to suchof the following as appear to them to be relevant in the circumstances—(a) the risk of harm to citizens presented by content on regulated
services;(b) the need for a higher level of protection for children than for
adults;(c) the need for it to be clear to providers of regulated services how
they may comply with their duties set out in Chapter 2, 3, 4 or 5
of Part 3, Chapter 1 or 3 of Part 4, or Part 5 of the Online Safety
Act 2023;(d) the need to exercise their functions so as to secure that providersof regulated services may comply with such duties by taking
measures, or using measures, systems or processes, which are(where relevant) proportionate to—(i) the size or capacity of the provider in question, and(ii) the level of risk of harm presented by the service inquestion, and the severity of the potential harm;(e) the desirability of promoting the use by providers of regulated
services of technologies which are designed to reduce the risk ofharm to citizens presented by content on regulated services;(f) the extent to which providers of regulated services
demonstrate, in a way that is transparent and accountable, thatthey are complying with their duties set out in Chapter 2, 3, 4 or
5 of Part 3, Chapter 1 or 3 of Part 4, or Part 5 of the Online Safety
Act 2023.”

5

Where it appears to OFCOM, in relation to the carrying out of any of
their online safety functions, that any of their general duties conflictwith their duty under section 24, priority must be given to their duty
under that section.”

In subsection (14), at the appropriate places insert—““content on regulated services” means—(a) regulated user-generated content present on regulated
services,(b) search content of regulated services,(c) fraudulent advertisements present on regulated
services, and40

45

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 1 — General duties

73

(d)

regulated provider pornographic content present on
regulated services;”;““online safety functions” has the meaning given by section 206 of
the Online Safety Act 2023, except that it does not include
OFCOM’s general duties;”.
(8)

After subsection (14) insert—
“(15)

(9)

In this section the following terms have the same meaning as in theOnline Safety Act 2023—“content” (see section 207 of that Act);“fraudulent advertisement” (see sections 33 and 34 of that Act);“harm” (see section 205 of that Act);“provider”, in relation to a regulated service (see section 198 ofthat Act);“regulated user-generated content” (see section 49 of that Act);“regulated provider pornographic content” (see section 70 of thatAct);
“regulated service” (see section 3 of that Act);“search content” (see section 51 of that Act).”

In section 6 of the Communications Act (duties to review regulatoryburdens)—(a) in subsection (2), after “this section” insert “(except their online safetyfunctions)”, and(b) after subsection (10) insert—
“(11)

83

5

In this section “online safety functions” has the same meaning
as in section 3.”

10

15

20

25

Duties in relation to strategic priorities(1)

This section applies where a statement has been designated under section
153(1) (Secretary of State’s statement of strategic priorities).

(2)

OFCOM must have regard to the statement when carrying out their online
safety functions.

(3)

Within the period of 40 days beginning with the day on which the statement isdesignated, or such longer period as the Secretary of State may allow, OFCOM
must—(a) explain in writing what they propose to do in consequence of thestatement, and(b) publish a copy of that explanation.

(4)

OFCOM must, as soon as reasonably practicable after the end of—(a) the period of 12 months beginning with the day on which the firststatement is designated under section 153(1), and(b) every subsequent period of 12 months,
publish a review of what they have done during the period in question inconsequence of the statement.

30

35

40

74

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 1 — General duties

84

Duty to carry out impact assessments(1)

Section 7 of the Communications Act (duty to carry out impact assessments) is
amended as follows.

(2)

In subsection (2), at the beginning insert “Subject to subsection (2A),”.

(3)

After subsection (2) insert—
“(2A)

(4)

5

A proposal to do any of the following is important for the purposes ofthis section—(a) to prepare a code of practice under section 36 of the Online
Safety Act 2023;(b) to prepare amendments of such a code of practice; or(c) to prepare a code of practice as a replacement for such a code ofpractice.”

10

After subsection (4) insert—“(4A)

An assessment under subsection (3)(a) that relates to a proposal
mentioned in subsection (2A) must include an assessment of the likely
impact of implementing the proposal on small businesses and microbusinesses.

(4B)

An assessment under subsection (3)(a) that relates to a proposal to do
anything else for the purposes of, or in connection with, the carryingout of OFCOM’s online safety functions (within the meaning of section
206 of the Online Safety Act 2023) must, so far as the proposal relates tosuch functions, include an assessment of the likely impact of
implementing the proposal on small businesses and micro businesses.”

15

20

CHAPTER 2
REGISTER OF CATEGORIES OF REGULATED USER-TO-USER SERVICES AND REGULATED

25

SEARCH SERVICES

85

Meaning of threshold conditions etc(1)

Schedule 11 contains provision about regulations specifying the thresholdconditions that a Part 3 service must meet to be included in the relevant part of
the register established by OFCOM under section 86, and associated provision
about the publication of OFCOM’s advice.

(2)

In this Chapter, “Category 1 threshold conditions”, “Category 2A thresholdconditions” and “Category 2B threshold conditions” have the same meaning as
in Schedule 11 (see paragraph 1(1), (2) and (3) of that Schedule).

(3)

For the purposes of this Chapter—(a) a regulated user-to-user service meets the Category 1 thresholdconditions if those conditions are met in relation to the user-to-user partof the service;(b) a regulated search service or a combined service meets the Category 2A
threshold conditions if those conditions are met in relation to the searchengine of the service;

30

35

40

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 2 — Register of categories of regulated user-to-user services and regulated search services

(c)
(d)
(e)

86

75

a regulated user-to-user service meets the Category 2B thresholdconditions if those conditions are met in relation to the user-to-user partof the service;a regulated user-to-user service meets the conditions in section 88(2) if
those conditions are met in relation to the user-to-user part of theservice;references to OFCOM assessing a service (to determine if it meets, or nolonger meets, the relevant threshold conditions or the conditions in
section 88(2)) are accordingly to be read as references to OFCOM
assessing the relevant part (or parts) of a service.

5

10

Register of categories of certain Part 3 services(1)

As soon as reasonably practicable after the first regulations under Schedule 11come into force, OFCOM must comply with subsections (2) to (4).

(2)

OFCOM must establish a register of particular categories of Part 3 services
with—(a) one part for regulated user-to-user services meeting the Category 1
threshold conditions,(b) one part for regulated search services and combined services meeting
the Category 2A threshold conditions, and(c) one part for regulated user-to-user services meeting the Category 2B
threshold conditions.

(3)

(4)

(5)

(6)

OFCOM must assess Part 3 services, as follows—(a) OFCOM must assess each regulated user-to-user service which they
consider is likely to meet the Category 1 threshold conditions, todetermine whether the service does, or does not, meet those conditions;(b) OFCOM must assess each regulated search service and combined
service which they consider is likely to meet the Category 2A thresholdconditions, to determine whether the service does, or does not, meetthose conditions;(c) OFCOM must assess each regulated user-to-user service which they
consider is likely to meet the Category 2B threshold conditions, todetermine whether the service does, or does not, meet those conditions.
If OFCOM consider that a service meets the relevant threshold conditions, theymust add entries relating to that service to the relevant part of the registerestablished under subsection (2).
But—(a) if OFCOM consider that a regulated user-to-user service meets theCategory 1 threshold conditions and the Category 2B thresholdconditions (only), entries relating to that service are to be added to thepart of the register established under subsection (2)(a) (only);(b) if OFCOM consider that a combined service meets the Category 1
threshold conditions, the Category 2A threshold conditions and theCategory 2B threshold conditions, entries relating to that service are to
be added to the parts of the register established under subsection (2)(a)and (b) (only).
If OFCOM consider that a combined service—(a) meets the Category 2A threshold conditions, and

15

20

25

30

35

40

45

76

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 2 — Register of categories of regulated user-to-user services and regulated search services(b)meets either the Category 1 threshold conditions or the Category 2B
threshold conditions (but not both),entries relating to that service are to be added to the part of the registerestablished under subsection (2)(b) and to the part of the register establishedunder subsection (2)(a) or (c) (whichever applies).

5(7)Each part of the register must contain—(a) the name, and a description, of each service that, in OFCOM’s opinion,
meets the relevant threshold conditions, and(b) the name of the provider of each such service.

(8)

OFCOM must publish the register.

(9)

When assessing whether a Part 3 service does, or does not, meet the relevant
threshold conditions, OFCOM must take such steps as are reasonably
practicable to obtain or generate information or evidence for the purposes of
the assessment.

(10)

In this Act—(a) a “Category 1 service” means a regulated user-to-user service for thetime being included in the part of the register established undersubsection (2)(a);(b) a “Category 2A service” means a regulated search service or a
combined service for the time being included in the part of the registerestablished under subsection (2)(b);(c) a “Category 2B service” means a regulated user-to-user service for thetime being included in the part of the register established undersubsection (2)(c).

15

Duty to maintain register

25

87
(1)

(2)

(3)

If regulations are made under paragraph 1(1) of Schedule 11 which amend or
replace regulations previously made under that provision, OFCOM must, assoon as reasonably practicable after the date on which the amending or
replacement regulations come into force—(a) assess each regulated user-to-user service which they consider is likely
to meet the new Category 1 threshold conditions, to determine whether
the service does, or does not, meet those conditions, and(b) make any necessary changes to the register.
If regulations are made under paragraph 1(2) of Schedule 11 which amend or
replace regulations previously made under that provision, OFCOM must, assoon as reasonably practicable after the date on which the amending or
replacement regulations come into force—(a) assess each regulated search service and combined service which they
consider is likely to meet the new Category 2A threshold conditions, todetermine whether the service does, or does not, meet those conditions,and(b) make any necessary changes to the register.
If regulations are made under paragraph 1(3) of Schedule 11 which amend or
replace regulations previously made under that provision, OFCOM must, assoon as reasonably practicable after the date on which the amending or
replacement regulations come into force—

10

20

30

35

40

45

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 2 — Register of categories of regulated user-to-user services and regulated search services

(a)
(b)
(4)

77

assess each regulated user-to-user service which they consider is likely
to meet the new Category 2B threshold conditions, to determine
whether the service does, or does not, meet those conditions, andmake any necessary changes to the register.

At any other time, if OFCOM consider that a Part 3 service not included in aparticular part of the register is likely to meet the threshold conditions relevantto that part, OFCOM must—(a) assess the service accordingly, and(b) (subject to section 86(5)) if they consider that the service meets therelevant conditions, add entries relating to that service to that part of
the register.

5

10

(5)

Nothing in subsection (3) or (4) requires OFCOM to assess a Category 1 service
to determine whether the service meets the Category 2B threshold conditions.

(6)

A provider of a Part 3 service included in the register may at any time request
OFCOM to remove entries relating to that service from the register, or from aparticular part of the register.

15

(7)

If OFCOM are satisfied, on the basis of evidence submitted by a provider withsuch a request, that since the registration day there has been a change to theservice or to regulations under paragraph 1 of Schedule 11 which appears
likely to be relevant, OFCOM must—(a) assess the service, and(b) notify the provider of OFCOM’s decision.

20

(8)

OFCOM must remove entries relating to a Part 3 service from the relevant partof the register if, following an assessment of the service, they consider that it nolonger meets the threshold conditions relevant to that part.

25

(9)

Section 86(9) applies to an assessment under this section as it applies to anassessment under section 86.

(10)

OFCOM must re-publish the register each time a change is made to it.

(11)

See section 148 for provision about appeals against a decision to include a
service in the register (or in a particular part of the register), or not to removea service from the register (or from a particular part of the register).

30

(12)

In this section—“the register” means the register established under section 86;“the registration day”, in relation to a Part 3 service, means—(a) the day on which entries relating to the service were added to
the register, or to the particular part of the register in question,or(b) if later, the day on which OFCOM last completed an assessmentof the service under subsection (1), (2), (3) or (7).

35

List of emerging Category 1 services

40

88
(1)

As soon as reasonably practicable after the first regulations under paragraph1(1) of Schedule 11 come into force (regulations specifying Category 1
threshold conditions), OFCOM must comply with subsections (2) and (3).

78

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 2 — Register of categories of regulated user-to-user services and regulated search services(2)

OFCOM must assess each regulated user-to-user service which they consider
is likely to meet each of the following conditions, to determine whether theservice does, or does not, meet them—(a) the first condition is that the number of United Kingdom users of theuser-to-user part of the service is at least 75% of the figure specified inany of the Category 1 threshold conditions relating to number of users(calculating the number of users in accordance with the thresholdcondition in question);(b) the second condition is that—(i) at least one of the Category 1 threshold conditions relating tofunctionalities of the user-to-user part of the service is met, or(ii) if the regulations under paragraph 1(1) of Schedule 11 specify
that a Category 1 threshold condition relating to a functionalityof the user-to-user part of the service must be met incombination with a Category 1 threshold condition relating toanother characteristic of that part of the service or a factor
relating to that part of the service (see paragraph 1(4) ofSchedule 11), at least one of those combinations of conditions is
met.

(3)

OFCOM must prepare a list of regulated user-to-user services which meet theconditions in subsection (2).

(4)

The list must contain the following details about a service included in it—(a) the name of the service,(b) a description of the service,(c) the name of the provider of the service, and(d) a description of the Category 1 threshold conditions by reference towhich the conditions in subsection (2) are met.

(5)

OFCOM must take appropriate steps to keep the list up to date, including by
carrying out further assessments of regulated user-to-user services.

(6)

OFCOM must publish the list when it is first prepared and each time it isrevised.

(7)

When assessing whether a service does, or does not, meet the conditions insubsection (2), OFCOM must take such steps as are reasonably practicable toobtain or generate information or evidence for the purposes of the assessment.

(8)

An assessment for the purposes of this section may be included in an
assessment under section 86 or 87 (as the case may be) or carried out separately.

5

10

15

20

25

30

35

CHAPTER 3
RISK ASSESSMENTS OF REGULATED USER-TO-USER SERVICES AND REGULATED SEARCHSERVICES

89(1)

OFCOM’s register of risks, and risk profiles, of Part 3 services

40

OFCOM must carry out risk assessments to identify and assess the following
risks of harm presented by Part 3 services of different kinds—(a) the risks of harm to individuals in the United Kingdom presented byillegal content present on regulated user-to-user services and by the useof such services for the commission or facilitation of priority offences;45

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 3 — Risk assessments of regulated user-to-user services and regulated search services

(b)
(c)

79

the risk of harm to individuals in the United Kingdom presented bysearch content of regulated search services that is illegal content;
the risk of harm to children in the United Kingdom, in different age
groups, presented by content that is harmful to children.

(2)

The risk assessments must, among other things, identify characteristics ofdifferent kinds of Part 3 services that are relevant to such risks of harm, andassess the impact of those kinds of characteristics on such risks.

(3)

OFCOM—(a) may combine assessment of any or all of the risks of harm mentioned
in subsection (1), or may carry out separate assessments of those risks;(b) in the case of the risk of harm mentioned in subsection (1)(c), may
assess regulated user-to-user services and regulated search services
separately or together.

5

10

(4)

The findings of each risk assessment are to be reflected, as soon as reasonably
practicable after completion, in a register of risks of Part 3 services preparedand published by OFCOM.

(5)

As soon as reasonably practicable after completing their assessment of a risk ofharm mentioned in a particular paragraph of subsection (1), OFCOM must
prepare risk profiles for Part 3 services which relate to that risk of harm.

(6)

For the purposes of the risk profiles, OFCOM may group Part 3 services
together in whichever way they consider appropriate, taking into account—(a) the characteristics of the services, and(b) the risk levels and other matters identified in the relevant risk
assessment.

20

(7)

OFCOM must publish risk profiles prepared under this section.

25

(8)

OFCOM must from time to time review and revise the risk assessments andrisk profiles so as to keep them up to date.

(9)

References in this section to Part 3 services—(a) in the case of a risk assessment or risk profiles which relate only toregulated user-to-user services or to regulated search services, are to beread as references to the kind of service in question;(b) in the case of a risk assessment or risk profiles which relate only to therisk of harm mentioned in subsection (1)(a), are to be read as references
to regulated user-to-user services;(c) in the case of a risk assessment or risk profiles which relate only to therisk of harm mentioned in subsection (1)(b), are to be read as references
to regulated search services.

(10)

References in this section to regulated search services include references to thesearch engine of combined services.

(11)

In this section the “characteristics” of a service include its functionalities, userbase, business model, governance and other systems and processes.

(12)

In this section—“content that is harmful to children” has the same meaning as in Part 3(see section 54);
“illegal content” has the same meaning as in Part 3 (see section 53);
“priority offence” has the same meaning as in Part 3 (see section 53).

15

30

35

40

45

80

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 3 — Risk assessments of regulated user-to-user services and regulated search services

90

OFCOM’s guidance about risk assessments(1)

As soon as reasonably practicable after OFCOM have published the first risk
profiles relating to the illegality risks, OFCOM must produce guidance to assist
providers of regulated user-to-user services in complying with their duties tocarry out illegal content risk assessments under section 8.

(2)

As soon as reasonably practicable after OFCOM have published the first risk
profiles relating to the risk of harm from illegal content, OFCOM must produce
guidance to assist providers of regulated search services in complying with
their duties to carry out illegal content risk assessments under section 22.

(3)

As soon as reasonably practicable after OFCOM have published the first risk
profiles relating to the risk of harm to children, OFCOM must produce
guidance to assist providers of Part 3 services in complying with their duties tocarry out children’s risk assessments under section 10 or 24.

(4)

Before producing any guidance under this section (including revised or
replacement guidance), OFCOM must consult the Information Commissioner.

(5)

OFCOM must revise guidance under this section from time to time in response
to further risk assessments under section 89 or to revisions of the risk profiles.

(6)

OFCOM must publish guidance under this section (and any revised or
replacement guidance).

(7)

If the risk profiles mentioned in subsection (3) relate to regulated user-to-userservices only or to regulated search services only, that subsection is to be readas requiring the production of guidance relating only to regulated user-to-userservices or to regulated search services, as the case may be.

(8)

References in this section to regulated search services include references to thesearch engine of combined services.

(9)

In this section—“illegality risks” means the risks mentioned in section 89(1)(a);“risk of harm from illegal content” means the risk of harm mentioned in
section 89(1)(b);“risk of harm to children” means the risk of harm mentioned in section
89(1)(c);“risk profiles” means risk profiles prepared under section 89.

5

10

15

20

25

30

CHAPTER 4
INFORMATION
Information power and information notices
91

35

Power to require information
(1)

(2)

OFCOM may by notice under this subsection (an “information notice”) requirea person within subsection (4) to provide them with any information that theyrequire for the purpose of exercising, or deciding whether to exercise, any of
their online safety functions.
The power conferred by subsection (1) includes power to require a person
within subsection (4) to obtain or generate information.

40

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 4 — Information

81

(3)

But the power conferred by subsection (1) must be exercised in a way that is
proportionate to the use to which the information is to be put in the exercise of
OFCOM’s functions.

(4)

The persons within this subsection are—(a) a provider of a user-to-user service or a search service,(b) a provider of an internet service on which regulated provider
pornographic content is published or displayed,(c) a person who provides an ancillary service (within the meaning ofsection 131) in relation to a regulated service (see subsections (11) and(12) of that section),(d) a person who provides an access facility (within the meaning of section133) in relation to a regulated service (see subsections (10) and (11) ofthat section),(e) a person who was within any of paragraphs (a) to (d) at a time to which
the required information relates, and(f) a person not within any of paragraphs (a) to (e) who appears to
OFCOM to have, or to be able to generate or obtain, information
required by them as mentioned in subsection (1).

(5)

The information that may be required by OFCOM under subsection (1)includes, in particular, information that they require for any one or more of thefollowing purposes—(a) the purpose of assessing compliance with—(i) any duty or requirement set out in Chapter 2, 3, 4 or 5 of Part 3,(ii) any duty set out in section 57 (user identity verification),(iii) any requirement under section 59 (reporting CSEA content),(iv) any duty set out in section 64 or 65 (terms of service),(v) any requirement relating to transparency reporting (see section
68(3) and (4)), or(vi) any duty set out in section 72 (provider pornographic content);(b) the purpose of assessing compliance with a requirement under section
74 (duty to notify OFCOM in relation to the charging of fees);(c) the purpose of a consultation about a threshold figure as mentioned in
section 77 (threshold figure for the purposes of charging fees);(d) the purpose of ascertaining the amount of a person’s qualifying
worldwide revenue for the purposes of—(i) section 75 (duty to pay fees), or(ii) paragraph 4 or 5 of Schedule 13 (amount of penalties etc);(e) the purpose of assessing compliance with any requirements imposedon a person by—(i) a notice under section 110(1) (notices to deal with terrorism
content and CSEA content), or(ii) a confirmation decision;(f) the purpose of assessing the accuracy and effectiveness of technology
required to be used by—(i) a notice under section 110(1), or(ii) a confirmation decision;(g) the purpose of assessing whether to give a notice under section 110(1)relating to the development or sourcing of technology (see subsections(2)(b) and (3)(b) of that section);

5

10

15

20

25

30

35

40

45

82

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 4 — Information

(h)
(i)
(j)
(k)
(l)
(m)
(n)

the purpose of dealing with complaints made to OFCOM under section
150 (super-complaints);
the purpose of OFCOM’s advice to the Secretary of State aboutprovision to be made by regulations under paragraph 1 of Schedule 11(threshold conditions for categories of Part 3 services);the purpose of determining whether a Part 3 service meets thresholdconditions specified in regulations under paragraph 1 of Schedule 11;
the purpose of preparing a code of practice under section 36;
the purpose of preparing guidance in relation to online safety matters;
the purpose of carrying out research, or preparing a report, in relation
to online safety matters;
the purpose of complying with OFCOM’s duty under section 11 of theCommunications Act, so far as relating to regulated services (duty topromote media literacy).

(6)

See also section 93 (power to include a requirement to name a senior manager).

(7)

The power conferred by subsection (1) does not include power to require theprovision of information in respect of which a claim to legal professional
privilege, or (in Scotland) to confidentiality of communications, could bemaintained in legal proceedings.

(8)

In this section—“information” includes documents, and any reference to providing
information includes a reference to producing a document (and see also
section 92(9));“regulated provider pornographic content” and “published or displayed”
have the same meaning as in Part 5 (see section 70).

92

5

10

15

20

25

Information notices(1)

An information notice may require information in any form (including inelectronic form).

(2)

An information notice must—(a) specify or describe the information to be provided,(b) specify why OFCOM require the information,(c) specify the form and manner in which it must be provided, and(d) contain information about the consequences of not complying with thenotice.

(3)

An information notice must specify when the information must be provided(which may be on or by a specified date, within a specified period, or at
specified intervals).

(4)

An information notice may specify a place at which, and a person to whom,
information is to be provided.

(5)

A person to whom a document is produced in response to an information
notice may—(a) take copies of, or extracts from, the document;(b) require the person producing the document, or a person who is or was
an officer of that person, or (in the case of a partnership) a person who
is or was a partner, to give an explanation of it.

30

35

40

45

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 4 — Information

(6)

83

A person to whom an information notice is given has a duty—(a) to provide the information in accordance with the requirements of thenotice, and(b) to ensure that the information provided is accurate in all material
respects.

(7)

OFCOM may cancel an information notice by notice to the person to whom it
was given.

(8)

In this section—“information” includes documents, and any reference to providing
information includes a reference to producing a document;“officer”, in relation to an entity, includes a director, a manager, anassociate, a secretary or, where the affairs of the entity are managed byits members, a member.

(9)

93

In relation to information recorded otherwise than in a legible form, referencesin this section to producing a document are to producing a copy of theinformation—(a) in a legible form, or(b) in a form from which it can readily be produced in a legible form.

5

10

15

Requirement to name a senior manager(1)

This section applies where—(a) OFCOM give a provider of a regulated service an information notice,and(b) the provider is an entity.

(2)

OFCOM may include in the information notice a requirement that the provider
must name, in their response to the notice, an individual who the provider
considers to be a senior manager of the entity and who may reasonably be
expected to be in a position to ensure compliance with the requirements of thenotice.

(3)

If OFCOM impose a requirement to name an individual, the information noticemust—(a) require the provider to inform such an individual, and(b) include information about the consequences for such an individual of
the entity’s failure to comply with the requirements of the notice (seesection 99).

(4)

An individual is a “senior manager” of an entity if the individual plays asignificant role in—(a) the making of decisions about how the entity’s relevant activities are to
be managed or organised, or(b) the actual managing or organising of the entity’s relevant activities.

35

(5)

An entity’s “relevant activities” are activities relating to the entity’s compliancewith the regulatory requirements imposed by this Act in connection with theregulated service to which the information notice in question relates.

40

20

25

30

84

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 4 — Information

Skilled persons' reports
94

Reports by skilled persons(1)

OFCOM may exercise the powers in this section where they consider that it isnecessary to do so for any of the following purposes—(a) assisting OFCOM in identifying and assessing a failure, or possible
failure, by a provider of a regulated service to comply with a relevant
requirement,(b) developing OFCOM’s understanding of—(i) the nature and level of risk of a provider of a regulated service
failing to comply with a relevant requirement, and(ii) ways to mitigate such a risk, or(c) assisting OFCOM in deciding whether to give a provider of a Part 3
service a notice under section 110(1) requiring the provider to use theirbest endeavours to develop or source technology dealing with CSEA
content (see subsections (2)(b) and (3)(b) of that section), or assisting
OFCOM in deciding the requirements to be imposed by such a notice.

5

10

15

(2)

But the powers in this section may be exercised for a purpose mentioned insubsection (1)(b) only where OFCOM consider that the provider in question
may be at risk of failing to comply with a relevant requirement.

(3)

OFCOM may appoint a skilled person to provide them with a report about
matters relevant to the purpose for which the powers under this section are
exercised (“the relevant matters”), and, where OFCOM make such an
appointment, they must notify the provider about the appointment and therelevant matters to be explored in the report.

20

(4)

Alternatively, OFCOM may give a notice to the provider—(a) requiring the provider to appoint a skilled person to provide OFCOM
with a report in such form as may be specified in the notice, and(b) specifying the relevant matters to be explored in the report.

25

(5)

References in this section to a skilled person are to a person—(a) appearing to OFCOM to have the skills necessary to prepare a reportabout the relevant matters, and(b) where the appointment is to be made by the provider, nominated orapproved by OFCOM.

(6)

It is the duty of—(a) the provider of the service (“P”),(b) any person who works for (or used to work for) P, or is providing (orused to provide) services to P related to the relevant matters, and(c) other providers of internet services,
to give the skilled person all such assistance as the skilled person may
reasonably require to prepare the report.

(7)

The provider of the service is liable for the payment, directly to the skilled
person, of the skilled person’s remuneration and expenses relating to the
preparation of the report.

(8)

Subsections (9) to (11) apply in relation to an amount due to a skilled person
under subsection (7).

30

35

40

45

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 4 — Information

(9)

85

In England and Wales, such an amount is recoverable—(a) if the county court so orders, as if it were payable under an order of thatcourt;(b) if the High Court so orders, as if it were payable under an order of thatcourt.

(10)

In Scotland, such an amount may be enforced in the same manner as an extract
registered decree arbitral bearing a warrant for execution issued by the sheriffcourt of any sheriffdom in Scotland.

(11)

In Northern Ireland, such an amount is recoverable—(a) if a county court so orders, as if it were payable under an order of thatcourt;(b) if the High Court so orders, as if it were payable under an order of thatcourt.

(12)

In this section “relevant requirement” means—(a) a duty or requirement set out in any of the following—(i) section 8, 10, 22 or 24 (risk assessments);(ii) section 9 or 23 (illegal content);(iii) section 11 or 25 (children’s online safety);(iv) section 12 (user empowerment);(v) section 16 or 26 (content reporting);(vi) section 17 or 27 (complaints procedures);(vii) section 19 or 29 (record-keeping and review);(viii) section 31 (children’s access assessments);(ix) section 33 or 34 (fraudulent advertising);(x) section 57 (user identity verification);(xi) section 59 (reporting CSEA content);(xii) section 64 or 65 (terms of service);(xiii) section 68(3) or (4) (transparency reports);(xiv) section 72(2) (children’s access to pornographic content);(b) a requirement under section 74 to notify OFCOM in connection withthe charging of fees (see subsections (1), (3) and (5) of that section); or(c) a requirement imposed by a notice under section 110(1) (notices to deal
with terrorism content and CSEA content).

5

10

15

20

25

30

Investigations and interviews
95

Investigations(1)

If OFCOM open an investigation into whether a provider of a regulated service
has failed, or is failing, to comply with any requirement mentioned insubsection (2), the provider must co-operate fully with the investigation.

(2)

The requirements are—(a) a requirement imposed by a notice under section 110(1) (notices to deal
with terrorism content and CSEA content), and(b) an enforceable requirement as defined in section 119 (except therequirement in subsection (1) of this section).

35

40

86

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 4 — Information

96

Power to require interviews(1)

The power conferred by this section is exercisable by OFCOM for the purposesof an investigation that they are carrying out into the failure, or possible failure,of a provider of a regulated service to comply with a relevant requirement.

(2)

OFCOM may give an individual within subsection (4) a notice requiring theindividual—(a) to attend at a time and place specified in the notice, and(b) to answer questions and provide explanations about any matterrelevant to the investigation.

5(3)

A notice under this section must—(a) indicate the subject matter and purpose of the interview, and(b) contain information about the consequences of not complying with thenotice.

10(4)

The individuals within this subsection are—(a) if the provider of the service is an individual or individuals, that
individual or those individuals,(b) an officer of the provider of the service,(c) if the provider of the service is a partnership, a partner,(d) an employee of the provider of the service, and(e) an individual who was within any of paragraphs (a) to (d) at a time towhich the required information or explanation relates.

(5)

If OFCOM give a notice to an individual within subsection (4)(b), (c) or (d),they must give a copy of the notice to the provider of the service.

(6)

An individual is not required under this section to disclose information in
respect of which a claim to legal professional privilege, or (in Scotland) to
confidentiality of communications, could be maintained in legal proceedings.

(7)

In this section—“officer”, in relation to an entity, includes a director, a manager, anassociate, a secretary or, where the affairs of the entity are managed byits members, a member;“relevant requirement” has the meaning given by section 94(12).

15

20

25

30

Powers of entry, inspection and audit
97

Powers of entry, inspection and audit
Schedule 12 makes provision about—(a) OFCOM’s powers of entry and inspection, and(b) the carrying out of audits by OFCOM.

35

Information offences and penalties
98

Offences in connection with information notices(1)

A person commits an offence if the person fails to comply with a requirementof an information notice.

40

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 4 — Information

(2)

(3)

(4)

(5)

(6)

(7)

87

It is a defence for a person charged with an offence under subsection (1) toshow that—(a) it was not reasonably practicable to comply with the requirements of
the information notice at the time required by the notice, but(b) the person has subsequently taken all reasonable steps to comply withthose requirements.
A person commits an offence if, in response to an information notice—(a) the person provides information that is false in a material respect, and(b) at the time the person provides it, the person knows that it is false in amaterial respect or is reckless as to whether it is false in a material
respect.
A person commits an offence if, in response to an information notice, theperson—(a) provides information which is encrypted such that it is not possible for
OFCOM to understand it, or produces a document which is encryptedsuch that it is not possible for OFCOM to understand the information it
contains, and(b) the person’s intention was to prevent OFCOM from understanding
such information.
A person commits an offence if—(a) the person suppresses, destroys or alters, or causes or permits the
suppression, destruction or alteration of, any information required to
be provided, or document required to be produced, by an information
notice, and(b) the person’s intention was to prevent OFCOM from being provided
with the information or document or (as the case may be) from being
provided with it as it was before the alteration.
The reference in subsection (5) to suppressing information or a document
includes a reference to destroying the means of reproducing information
recorded otherwise than in a legible form.
Offences under this section may be committed only in relation to an
information notice which—(a) relates to—(i) a user-to-user service,(ii) a search service, or(iii) an internet service on which regulated provider pornographic
content is published or displayed; and(b) is given to the provider of that service.

(8)

If a person is convicted of an offence under this section, the court may, on an
application by the prosecutor, make an order requiring the person to comply
with a requirement of an information notice within such period as may be
specified by the order.

(9)

See also section 177 (supplementary provision about defences).

(10)

In this section, “regulated provider pornographic content” and “published ordisplayed” have the same meaning as in Part 5 (see section 70).

5

10

15

20

25

30

35

40

45

88

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 4 — Information

99

Senior managers’ liability: information offences(1)

In this section “an individual named as a senior manager of an entity” means
an individual who, as required by an information notice, is named as a senior
manager of an entity in a response to that notice (see section 93).

(2)

An individual named as a senior manager of an entity commits an offence if—(a) the entity commits an offence under section 98(1) (failure to comply
with information notice), and(b) the individual has failed to take all reasonable steps to prevent that
offence being committed.

5(3)

It is a defence for an individual charged with an offence under subsection (2)to show that the individual was a senior manager within the meaning ofsection 93 for such a short time after the information notice in question wasgiven that the individual could not reasonably have been expected to take steps
to prevent that offence being committed.

10

(4)

An individual named as a senior manager of an entity commits an offence if—(a) the entity commits an offence under section 98(3) (false information),and(b) the individual has failed to take all reasonable steps to prevent that
offence being committed.

15

(5)

An individual named as a senior manager of an entity commits an offence if—(a) the entity commits an offence under section 98(4) (encrypted
information), and(b) the individual has failed to take all reasonable steps to prevent that
offence being committed.

20

(6)

An individual named as a senior manager of an entity commits an offence if—(a) the entity commits an offence under section 98(5) (destruction etc of
information), and(b) the individual has failed to take all reasonable steps to prevent that
offence being committed.

25

(7)

It is a defence for an individual charged with an offence under subsection (4),(5) or (6) to show that the individual was not a senior manager within themeaning of section 93 at the time at which the act constituting the offence
occurred.

30(8)

It is a defence for an individual charged with an offence under this section toshow that the individual had no knowledge of being named as a senior
manager in a response to the information notice in question.

(9)

See also section 177 (supplementary provision about defences).

100

35

Offences in connection with notices under Schedule 12(1)

A person commits an offence if the person fails without reasonable excuse tocomply with a requirement of an audit notice.

40

(2)

A person commits an offence if, in response to an audit notice—(a) the person provides information that is false in a material respect, and(b) at the time the person provides it, the person knows that it is false in amaterial respect or is reckless as to whether it is false in a material
respect.

45

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 4 — Information

(3)

89

A person commits an offence if—(a) the person suppresses, destroys or alters, or causes or permits the
suppression, destruction or alteration of, any information required to
be provided, or document required to be produced, by a notice towhich this subsection applies, and(b) the person’s intention was to prevent OFCOM from being provided
with the information or document or (as the case may be) from being
provided with it as it was before the alteration.

(4)

The reference in subsection (3) to suppressing information or a document
includes a reference to destroying the means of reproducing information
recorded otherwise than in a legible form.

(5)

Subsection (3) applies to—(a) a notice under paragraph 3 of Schedule 12 (information required forinspection), and(b) an audit notice (see paragraph 4 of that Schedule).

(6)

101

Other information offences
A person commits an offence if the person intentionally obstructs or delays aperson in the exercise of the power conferred by section 92(5)(a) (copying a
document etc).

(2)

A person commits an offence if the person fails without reasonable excuse tocomply with a requirement under section 96 (interviews).

(3)

A person commits an offence if, in purported compliance with a requirement
under section 96—(a) the person provides information that is false in a material respect, and(b) at the time the person provides it, the person knows that it is false in amaterial respect or is reckless as to whether it is false in a material
respect.

102
(1)

(2)

10

15

If a person is convicted of an offence under this section, the court may, on an
application by the prosecutor, make an order requiring the person, within such
period as may be specified by the order, to comply with a requirement of anotice under paragraph 3 of Schedule 12 or an audit notice (as the case may be).

(1)

(4)

5

If a person is convicted of an offence under this section, the court may, on an
application by the prosecutor, make an order requiring the person, within such
period as may be specified by the order, to permit the making of a copy of adocument, or to comply with a requirement under section 96 (as the case may
be).

20

25

30

35

Penalties for information offences
A person who commits an offence under section 98(1), 99(2) or 100(1) is liable—(a) on summary conviction in England and Wales, to a fine;(b) on summary conviction in Scotland or Northern Ireland, to a fine notexceeding the statutory maximum;(c) on conviction on indictment, to a fine.
A person who commits an offence under section 98(3), (4) or (5), 99(4), (5) or (6),100(2) or (3) or 101(1) is liable—

40

90

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 4 — Information

(a)
(b)
(c)
(d)
(3)

on summary conviction in England and Wales, to imprisonment for aterm not exceeding the general limit in a magistrates’ court or a fine (orboth);
on summary conviction in Scotland, to imprisonment for a term notexceeding 12 months or a fine not exceeding the statutory maximum (orboth);
on summary conviction in Northern Ireland, to imprisonment for aterm not exceeding 6 months or a fine not exceeding the statutory
maximum (or both);on conviction on indictment, to imprisonment for a term not exceeding
two years or a fine (or both).

A person who commits an offence under section 101(2) or (3) is liable—(a) on summary conviction in England and Wales, to a fine;(b) on summary conviction in Scotland, to a fine not exceeding level 5 on
the standard scale;(c) on summary conviction in Northern Ireland, to a fine not exceedinglevel 5 on the standard scale.

5

10

15

Disclosure of information
103(1)

Co-operation and disclosure of information: overseas regulators
OFCOM may co-operate with an overseas regulator, including by disclosing
online safety information to that regulator, for the purposes of—(a) facilitating the exercise by the overseas regulator of any of that
regulator’s online regulatory functions, or(b) criminal investigations or proceedings relating to a matter to which theoverseas regulator’s online regulatory functions relate.

(2)

The power conferred by subsection (1) applies only in relation to an overseas
regulator for the time being specified in regulations made by the Secretary ofState.

(3)

Where information is disclosed to a person in reliance on subsection (1), theperson may not—(a) use the information for a purpose other than the purpose for which it
was disclosed, or(b) further disclose the information,
except with OFCOM’s consent (which may be general or specific) or inaccordance with an order of a court or tribunal.

(4)

(5)

Except as provided by subsection (5), a disclosure of information undersubsection (1) does not breach—(a) any obligation of confidence owed by the person making thedisclosure, or(b) any other restriction on the disclosure of information (however
imposed).
Subsection (1) does not authorise a disclosure of information that—(a) would contravene the restriction imposed by section 105 (intelligence
service information),

20

25

30

35

40

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 4 — Information(b)would contravene the data protection legislation (but in determining
whether a disclosure would do so, the power conferred by that
subsection is to be taken into account), oris prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of theInvestigatory Powers Act 2016.

5

Section 18 of the Anti-terrorism, Crime and Security Act 2001 (restriction on
disclosure of information for overseas purposes) has effect in relation to adisclosure authorised by subsection (1)(b) as it has effect in relation to adisclosure authorised by any of the provisions to which section 17 of that Act
applies.

10

(c)
(6)

(7)

104

91

In this section—“online regulatory functions”, in relation to an overseas regulator, means
functions of that regulator which correspond to OFCOM’s online safetyfunctions;“online safety information” means information held by OFCOM in
connection with any of OFCOM’s online safety functions;“overseas regulator” means a person exercising functions in a country
outside the United Kingdom which correspond to any of OFCOM’s
online safety functions;“the data protection legislation” has the same meaning as in the Data
Protection Act 2018 (see section 3 of that Act).

15

20

Disclosure of information(1)

Section 393 of the Communications Act (general restrictions on disclosure of
information) is amended as follows.

(2)

In subsection (1)—(a) at the end of paragraph (c) omit “or”,(b) at the end of paragraph (d) insert “or”, and(c) after paragraph (d) insert—“(e) the Online Safety Act 2023,”.

25

(3)

In subsection (2)(e), after “this Act” insert “or the Online Safety Act 2023”.

30

(4)

In subsection (6)(a), after “390” insert “, or under section 136 of or Schedule 11
to the Online Safety Act 2023”.

(5)

In subsection (6)(b), at the end insert “or the Online Safety Act 2023”.

105

Intelligence service information(1)

OFCOM may not disclose information received (directly or indirectly) from, orthat relates to, an intelligence service unless the intelligence service consents tothe disclosure.

(2)

If OFCOM have disclosed information described in subsection (1) to a person,
the person must not further disclose the information unless the intelligence
service consents to the disclosure.

(3)

If OFCOM would contravene subsection (1) by publishing in its entirety—(a) a statement required to be published by section 42(5), or(b) a report mentioned in section 147(5),

35

40

92

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 4 — Information

OFCOM must, before publication, remove or obscure the information whichby reason of subsection (1) they must not disclose.
(4)

106

In this section—“information” means information held by OFCOM in connection with an
online safety matter;“intelligence service” means—(a) the Security Service,(b) the Secret Intelligence Service, or(c) the Government Communications Headquarters.
Provision of information to the Secretary of State(1)

Section 24B of the Communications Act (provision of information to assist informulation of policy) is amended as follows.

(2)

In subsection (2)—(a) at the end of paragraph (d) omit “or”,(b) at the end of paragraph (e) insert “or”, and(c) after paragraph (e) insert—“(f) the Online Safety Act 2023,”.

(3)

10

15

After subsection (2) insert—
“(3)

107

5

But subsection (2) does not apply to information—(a) obtained by OFCOM—(i) in the exercise of a power conferred by section 91 of theOnline Safety Act 2023 for the purpose mentioned insubsection (5)(c) of that section (information inconnection with a consultation about a threshold figure
for the purposes of charging fees under that Act), or(ii) in the exercise of a power conferred by section 156(5) ofthat Act (information in connection with circumstancespresenting a threat), and(b) reasonably required by the Secretary of State.”

Amendment of Enterprise Act 2002

20

25

30

In Schedule 15 to the Enterprise Act 2002 (enactments relevant to provisions
about disclosure of information), at the appropriate place insert—“Online Safety Act 2023.”
108

Information for users of regulated services(1)

Section 26 of the Communications Act (publication of information and advice
for consumers etc) is amended as follows.

(2)

In subsection (2), after paragraph (d) insert—“(da) United Kingdom users of regulated services;”.

(3)

After subsection (6) insert—“(7)

In this section the following terms have the same meaning as in theOnline Safety Act 2023—

35

40

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 4 — Information

93“regulated service” (see section 3 of that Act);“United Kingdom user” (see section 199 of that Act).”
109
(1)

(2)

Admissibility of statements
An explanation given, or information provided, by a person in response to arequirement imposed under or by virtue of section 91 or 96 or paragraph2(4)(e) or (f), 4(2)(g) or (h) or 7(d) of Schedule 12, may, in criminal proceedings,
only be used in evidence against that person—(a) on a prosecution for an offence under a provision listed in subsection(2), or(b) on a prosecution for any other offence where—(i) in giving evidence that person makes a statement inconsistent
with that explanation or information, and(ii) evidence relating to that explanation or information is adduced,
or a question relating to it is asked, by that person or on that
person’s behalf.
Those provisions are—(a) section 62(1),(b) section 98(3),(c) section 99(4),(d) section 100(2),(e) section 101(3),(f) paragraph 18 of Schedule 12,(g) section 5 of the Perjury Act 1911 (false statements made otherwise thanon oath),(h) section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995
(false statements made otherwise than on oath), and(i) Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714(N.I. 19)) (false statutory declarations and other false unsworn
statements).
CHAPTER 5

5

10

15

20

25

30

REGULATED USER-TO-USER SERVICES AND REGULATED SEARCH SERVICES: NOTICES TO DEAL
WITH TERRORISM CONTENT AND CSEA CONTENT
110

Notices to deal with terrorism content or CSEA content (or both)(1)

If OFCOM consider that it is necessary and proportionate to do so, they may
give a notice described in subsection (2), (3) or (4) relating to a regulated userto-user service or a regulated search service to the provider of the service.

(2)

A notice under subsection (1) that relates to a regulated user-to-user service is
a notice requiring the provider of the service—(a) to do any or all of the following—(i) use accredited technology to identify terrorism content
communicated publicly by means of the service and to swiftly
take down that content;

35

40

94

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 5 — Regulated user-to-user services and regulated search services: notices to deal with terrorism content
and CSEA content

(ii)

(b)

(3)

(4)

use accredited technology to prevent individuals fromencountering terrorism content communicated publicly bymeans of the service;(iii) use accredited technology to identify CSEA content, whether
communicated publicly or privately by means of the service,and to swiftly take down that content;(iv) use accredited technology to prevent individuals fromencountering CSEA content, whether communicated publicly
or privately, by means of the service; orto use the provider’s best endeavours to develop or source technology
for use on or in relation to the service or part of the service, which—(i) achieves the purpose mentioned in paragraph (a)(iii) or (iv),
and(ii) meets the standards published by the Secretary of State (seesection 113(13)).

A notice under subsection (1) that relates to a regulated search service is a
notice requiring the provider of the service—(a) to do either or both of the following—(i) use accredited technology to identify search content of theservice that is terrorism content and to swiftly take measuresdesigned to secure, so far as possible, that search content of theservice no longer includes terrorism content identified by thetechnology;(ii) use accredited technology to identify search content of theservice that is CSEA content and to swiftly take measuresdesigned to secure, so far as possible, that search content of theservice no longer includes CSEA content identified by thetechnology; or(b) to use the provider’s best endeavours to develop or source technology
for use on or in relation to the service which—(i) achieves the purpose mentioned in paragraph (a)(ii), and(ii) meets the standards published by the Secretary of State (seesection 113(13)).
A notice under subsection (1) that relates to a combined service is a noticerequiring the provider of the service—(a) to do any or all of the things described in subsection (2)(a) in relation to
the user-to-user part of the service, or to use best endeavours to develop
or source technology as described in subsection (2)(b) for use on or in
relation to that part of the service;(b) to do either or both of the things described in subsection (3)(a) inrelation to the search engine of the service, or to use best endeavours todevelop or source technology as described in subsection (3)(b) for use
on or in relation to the search engine of the service;(c) to do any or all of the things described in subsection (2)(a) in relation to
the user-to-user part of the service and either or both of the things
described in subsection (3)(a) in relation to the search engine of theservice; or(d) to use best endeavours to develop or source—(i) technology as described in subsection (2)(b) for use on or in
relation to the user-to-user part of the service, and

5

10

15

20

25

30

35

40

45

50

Online Safety Bill
95
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 5 — Regulated user-to-user services and regulated search services: notices to deal with terrorism content
and CSEA content

(ii)
(5)

(6)

technology as described in subsection (3)(b) for use on or in
relation to the search engine of the service.

For the purposes of subsections (2) and (3), a requirement to use accredited
technology may be complied with by the use of the technology alone or bymeans of the technology together with the use of human moderators.

5See—(a) section 111, which requires OFCOM to give a warning notice before
giving a notice under subsection (1), and(b) section 112 for provision about matters which OFCOM must consider
before giving a notice under subsection (1).

10

(7)

A notice under subsection (1) relating to terrorism content present on a service
must identify the content, or parts of the service that include content, that
OFCOM consider is communicated publicly on that service (see section 203).

(8)

For the meaning of “accredited” technology, see section 113(12) and (13).

111

Warning notices(1)

OFCOM may give a notice under section 110(1) to a provider relating to aservice or part of a service only after giving a warning notice to the provider
that they intend to give such a notice relating to that service or that part of it.

(2)

A warning notice under subsection (1) relating to the use of accredited
technology (see section 110(2)(a) and (3)(a)) must—(a) contain details of the technology that OFCOM are considering
requiring the provider to use,(b) specify whether the technology is to be required in relation to terrorism
content or CSEA content (or both),(c) specify any other requirements that OFCOM are considering imposing(see section 113(2) to (4)),(d) specify the period for which OFCOM are considering imposing therequirements (see section 113(7)),(e) state that the provider may make representations to OFCOM (with any
supporting evidence), and(f) specify the period within which representations may be made.

(3)

A warning notice under subsection (1) relating to the development or sourcingof technology (see section 110(2)(b) and (3)(b)) must—(a) describe the proposed purpose for which the technology must be
developed or sourced (see section 110(2)(a)(iii) and (iv) and (3)(a)(ii)),(b) specify steps that OFCOM consider the provider needs to take in order
to comply with the requirement described in section 110(2)(b) or (3)(b),or both those requirements (as the case may be),(c) specify the proposed period within which the provider must take eachof those steps,(d) specify any other requirements that OFCOM are considering imposing,(e) state that the provider may make representations to OFCOM (with any
supporting evidence), and(f) specify the period within which representations may be made.

15

20

25

30

35

40

96

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 5 — Regulated user-to-user services and regulated search services: notices to deal with terrorism content
and CSEA content

(4)

(5)

112
(1)

(2)

(3)

A notice under section 110(1) that relates to both the user-to-user part of a
combined service and the search engine of the service (as described in section
110(4)(c) or (d)) may be given to the provider of the service only if—(a) two separate warning notices have been given to the provider (onerelating to the user-to-user part of the service and the other relating to
the search engine), or(b) a single warning notice relating to both the user-to-user part of theservice and the search engine has been given to the provider.
A notice under section 110(1) may not be given to a provider until the period
allowed by the warning notice for the provider to make representations has
expired.

5

10Matters relevant to a decision to give a notice under section 110(1)This section specifies the matters which OFCOM must particularly consider in
deciding whether it is necessary and proportionate to give a notice under
section 110(1) relating to a Part 3 service to the provider of the service.
In the case of a notice requiring the use of accredited technology, the matters
are as follows—(a) the kind of service it is;(b) the functionalities of the service;(c) the user base of the service;(d) in the case of a notice relating to a user-to-user service (or to the userto-user part of a combined service), the prevalence of relevant content
on the service, and the extent of its dissemination by means of theservice;(e) in the case of a notice relating to a search service (or to the search engine
of a combined service), the prevalence of search content of the service
that is relevant content;(f) the level of risk of harm to individuals in the United Kingdom
presented by relevant content, and the severity of that harm;(g) the systems and processes used by the service which are designed to
identify and remove relevant content;(h) the extent to which the use of the specified technology would or might
result in interference with users’ right to freedom of expression within
the law;(i) the level of risk of the use of the specified technology resulting in a
breach of any statutory provision or rule of law concerning privacy thatis relevant to the use or operation of the service (including, but notlimited to, any such provision or rule concerning the processing of
personal data);(j) whether the use of any less intrusive measures than the specified
technology would be likely to achieve a significant reduction in theamount of relevant content.
The references to relevant content in subsection (2)(f), (g) and (j) are to—(a) in the case of a user-to-user service (or the user-to-user part of a
combined service), relevant content present on the service;(b) in the case of a search service (or the search engine of a combined
service), search content of the service that is relevant content.

15

20

25

30

35

40

45

Online Safety Bill
97
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 5 — Regulated user-to-user services and regulated search services: notices to deal with terrorism content
and CSEA content(4)

In the case of a notice relating to the development or sourcing of technology,
subsection (2) applies—(a) as if references to relevant content were to CSEA content, and(b) with the omission of paragraphs (h), (i) and (j).

(5)

In this section—“relevant content” means terrorism content or CSEA content or both thosekinds of content (depending on the kind, or kinds, of content in relation
to which the specified technology is to operate);“specified technology” means the technology to be specified in the noticeunder section 110(1).

113

In this section “a notice” means a notice under section 110(1) (including afurther notice under that provision).

(2)

If a provider is already using accredited technology in relation to the service inquestion, a notice may require the provider to use it more effectively(specifying the ways in which that must be done).

(3)

A notice relating to a user-to-user service (or to the user-to-user part of a
combined service) may also require a provider to operate an effective
complaints procedure allowing for United Kingdom users to challenge theprovider for taking down content which they have generated, uploaded or
shared on the service.

(5)

(6)

10

Notices under section 110(1): supplementary

(1)

(4)

5

A notice relating to a search service (or to the search engine of a combined
service) may also require a provider to operate an effective complaints
procedure allowing for an interested person (see section 199(7)) to challengemeasures taken or in use by the provider that result in content relating to thatinterested person no longer appearing in search results of the service.
A notice given to a provider of a Part 3 service requiring the use of accredited
technology is to be taken to require the provider to make such changes to thedesign or operation of the service as are necessary for the technology to be usedeffectively.
A notice requiring the use of accredited technology must—(a) give OFCOM’s reasons for their decision to give the notice,(b) contain details of the requirements imposed by the notice,(c) contain details of the technology to be used,(d) contain details about the manner in which the technology is to be
implemented,(e) specify a reasonable period for compliance with the notice,(f) specify the period for which the notice is to have effect,(g) contain details of the rights of appeal under section 149,(h) contain information about when OFCOM intend to review the notice(see section 114), and(i) contain information about the consequences of not complying with thenotice (including information about the further kinds of enforcement
action that it would be open to OFCOM to take).

15

20

25

30

35

40

98

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 5 — Regulated user-to-user services and regulated search services: notices to deal with terrorism content
and CSEA content(7)

A notice requiring the use of accredited technology may impose requirements
for a period of up to 36 months beginning with the last day of the period
specified in the notice in accordance with subsection (6)(e).

(8)

A notice relating to the development or sourcing of technology must—(a) give OFCOM’s reasons for their decision to give the notice,(b) describe the purpose for which technology is required to be developed
or sourced (see section 110(2)(a)(iii) and (iv) and (3)(a)(ii)),(c) specify steps that the provider is required to take (including steps
relating to the use of a system or process) in order to comply with therequirement described in section 110(2)(b) or (3)(b), or both thoserequirements (as the case may be),(d) specify a reasonable period within which each of the steps specified in
the notice must be taken,(e) contain details of any other requirements imposed by the notice,(f) contain details of the rights of appeal under section 149,(g) contain information about when OFCOM intend to review the notice(see section 114), and(h) contain information about the consequences of not complying with thenotice (including information about the further kinds of enforcement
action that it would be open to OFCOM to take).

(9)

In deciding what period or periods to specify for steps to be taken inaccordance with subsection (8)(d), OFCOM must, in particular, consider—(a) the size and capacity of the provider, and(b) the state of development of technology capable of achieving the
purpose described in the notice in accordance with subsection (8)(b).

(10)

A notice may impose requirements only in relation to the design and operationof a Part 3 service—(a) in the United Kingdom, or(b) as it affects United Kingdom users of the service.

(11)

OFCOM may vary or revoke a notice given to a provider by notifying theprovider to that effect.

(12)

For the purposes of this Chapter, technology is “accredited” if it is accredited(by OFCOM or another person appointed by OFCOM) as meeting minimum
standards of accuracy in the detection of terrorism content or CSEA content (asthe case may be).

(13)

Those minimum standards of accuracy must be such standards as are for thetime being approved and published by the Secretary of State, following advice
from OFCOM.

114

Review and further notice under section 110(1)(1)

This section applies where OFCOM have given a provider of a Part 3 service a
notice under section 110(1).

(2)

The power conferred by section 113(11) includes power to revoke the notice if
there are reasonable grounds for believing that the provider is failing tocomply with it.

(3)

If a notice is revoked as mentioned in subsection (2), OFCOM may give theprovider a further notice under section 110(1) if they consider that it is

5

10

15

20

25

30

35

40

45

Online Safety Bill
99
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 5 — Regulated user-to-user services and regulated search services: notices to deal with terrorism content
and CSEA content

necessary and proportionate to do so (taking into account the matters
mentioned in section 112).
(4)

(5)

Except where a notice under section 110(1) is revoked as mentioned insubsection (2), OFCOM must carry out a review of the provider’s compliancewith the notice—(a) in the case of a notice requiring the use of accredited technology, before
the end of the period for which the notice has effect;(b) in the case of a notice relating to the development or sourcing oftechnology, before the last date by which any step specified in thenotice is required to be taken.

10

In the case of a notice requiring the use of accredited technology, the review
must consider—(a) the extent to which the technology specified in the notice has been used,
and(b) the effectiveness of its use.

15

(6)

Following the review, and after consultation with the provider, OFCOM may
give the provider a further notice under section 110(1) if they consider that it isnecessary and proportionate to do so (taking into account the matters
mentioned in section 112).

(7)

If a further notice under section 110(1) is given, subsections (3) to (6) apply
again.

(8)

A further notice under section 110(1) may impose different requirements froman earlier notice under that provision.

(9)

Section 111 (warning notices) does not apply in relation to a further noticeunder section 110(1).

115

OFCOM must produce guidance for providers of Part 3 services about how
OFCOM propose to exercise their functions under this Chapter.

(2)

Before producing the guidance (including revised or replacement guidance),
OFCOM must consult the Information Commissioner.

(3)

OFCOM must keep the guidance under review.

(4)

OFCOM must publish the guidance (and any revised or replacement
guidance).

(5)

In exercising their functions under this Chapter, or deciding whether toexercise them, OFCOM must have regard to the guidance for the time being
published under this section.

(1)

20

25

OFCOM’s guidance about functions under this Chapter

(1)

116

5

30

35

OFCOM’s annual report
OFCOM must produce and publish an annual report about—(a) the exercise of their functions under this Chapter, and(b) technology which meets, or is in the process of development so as tomeet, minimum standards of accuracy (see subsections (12) and (13) ofsection 113) for the purposes of this Chapter.

40

100

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 5 — Regulated user-to-user services and regulated search services: notices to deal with terrorism content
and CSEA content(2)

OFCOM must send a copy of the report to the Secretary of State, and theSecretary of State must lay it before Parliament.

(3)

For further provision about reports under this section, see section 147.

117

Interpretation of this Chapter
In this Chapter—“search content” has the same meaning as in Part 3 (see section 51);
“search results” has the meaning given by section 51(3);“terrorism content” and “CSEA content” have the same meaning as in Part
3 (see section 53).
CHAPTER 6

5

10

ENFORCEMENT POWERS
Provisional notices and confirmation decisions
118

Provisional notice of contravention(1)

OFCOM may give a notice under this section (a “provisional notice ofcontravention”) relating to a regulated service to the provider of the service ifthey consider that there are reasonable grounds for believing that the provider
has failed, or is failing, to comply with any enforceable requirement (seesection 119) that applies in relation to the service.

(2)

OFCOM may also give a provisional notice of contravention to a person oneither of the grounds in subsection (3).

(3)

The grounds are that—(a) the person has been given an information notice and OFCOM consider
that there are reasonable grounds for believing that the person has
failed, or is failing, to comply with either of the duties set out in section
92(6) (duties in relation to information notices), or(b) the person is required by a skilled person appointed under section 94
to give assistance to the skilled person, and OFCOM consider that there
are reasonable grounds for believing that the person has failed, or is
failing, to comply with the duty set out in subsection (6) of that section
to give such assistance.

(4)

A provisional notice of contravention given to a person must—(a) specify the duty or requirement with which (in OFCOM’s opinion) the
person has failed, or is failing, to comply, and(b) give OFCOM’s reasons for their opinion that the person has failed, or
is failing, to comply with it.

(5)

A provisional notice of contravention may also contain details as mentioned insubsection (6) or (7), or both.

(6)

A provisional notice of contravention may specify steps that OFCOM consider
the person needs to take in order to—(a) comply with the duty or requirement, or(b) remedy the failure to comply with it.

15

20

25

30

35

40

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 6 — Enforcement powers

(7)

101

A provisional notice of contravention may state that OFCOM propose toimpose a penalty on the person, and in such a case the notice must—(a) state the reasons why OFCOM propose to impose a penalty,(b) state whether OFCOM propose to impose a penalty of a single amount,a penalty calculated by reference to a daily rate, or both penalties (seesection 125(1)),(c) indicate the amount of a penalty that OFCOM propose to impose,including (in relation to a penalty calculated by reference to a dailyrate) the daily rate and how the penalty would be calculated,(d) in relation to a penalty calculated by reference to a daily rate, specify or
describe the period for which OFCOM propose that the penalty shouldbe payable, and(e) state the reasons for proposing a penalty of that amount, including any
aggravating or mitigating factors that OFCOM propose to take into
account.

(8)

A provisional notice of contravention given to a person must—(a) state that the person may make representations to OFCOM (with any
supporting evidence) about the matters contained in the notice, and(b) specify the period within which such representations may be made.

(9)

A provisional notice of contravention may be given in respect of a failure tocomply with more than one enforceable requirement.

(10)

Where a provisional notice of contravention is given in respect of a continuing
failure, the notice may be given in respect of any period during which the
failure has continued, and must specify that period.

(11)

Where a provisional notice of contravention is given to a person in respect of a
failure to comply with a duty or requirement (“the first notice”), a further
provisional notice of contravention in respect of a failure to comply with thatsame duty or requirement may be given to the person only—(a) in respect of a separate instance of the failure after the first notice wasgiven,(b) where a period was specified in the first notice in accordance withsubsection (10), in respect of the continuation of the failure after the endof that period, or(c) if the first notice has been withdrawn (without a confirmation decision
being given to the person in respect of the failure).

119

Requirements enforceable by OFCOM against providers of regulated services(1)

References in this Chapter to “enforceable requirements” are to—(a) the duties or requirements set out in the provisions of this Act specified
in the table in subsection (2), and(b) the requirements mentioned in subsection (3).

(2)

Here is the table—

Provision
Section 8

Subject matter
Illegal content risk assessments

5

10

15

20

25

30

35

40

102

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 6 — Enforcement powers

Provision

Subject matter

Section 9

Illegal content

Section 10

Children’s risk assessments

Section 11

Children’s online safety

Section 12

User empowerment

Section 13

Content of democratic importance

Section 14

News publisher content

Section 15

Journalistic content

Section 16

Content reporting

Section 17

Complaints procedures

Section 18

Freedom of expression and privacy

Section 19

Record-keeping and review

Section 22

Illegal content risk assessments

Section 23

Illegal content

Section 24

Children’s risk assessments

Section 25

Children’s online safety

Section 26

Content reporting

Section 27

Complaints procedures

Section 28

Freedom of expression and privacy

Section 29

Record-keeping and review

Section 31

Children’s access assessments

Section 33

Fraudulent advertising

Section 34

Fraudulent advertising

Section 57

User identity verification

Section 59

Reporting CSEA content to NCA

Section 64

Acting against users only in accordancewith terms of service

Section 65

Terms of service

Section 68(3) and (4)Transparency reports

Section 72

Provider pornographic content

Section 74

Fees: notification of OFCOM

5

10

15

20

25

30

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 6 — Enforcement powers

Provision

(3)

120
(1)

103

Subject matter

Section 92(6)Information notices

Section 94(6)Assistance to skilled person

Section 95(1)Co-operation with investigation

The requirements referred to in subsection (1)(b) are—(a) requirements of a notice under section 94(4)(a) to appoint a skilled
person;(b) requirements of a notice given by virtue of section 156(3) (duty to makepublic statement);(c) requirements of a notice under section 156(5) (information inconnection with circumstances presenting a threat);(d) requirements imposed by a person acting—(i) in the exercise of powers conferred by paragraph 2 of Schedule
12 (entry and inspection without warrant), or(ii) in the execution of a warrant issued under paragraph 5 of that
Schedule.

10

15

Confirmation decisions
This section applies if—(a) OFCOM have given a provisional notice of contravention to a person in
relation to a failure to comply with a duty or requirement (or with
duties or requirements), and(b) the period allowed for representations has expired.
A duty or requirement to which the provisional notice of contravention relates
is referred to in this section as a “notified requirement”.

(2)

If, after considering any representations and evidence, OFCOM decide not togive the person a notice under this section, they must inform the person of that
fact.

(3)

If OFCOM are satisfied that the person has failed, or has been failing, to comply
with a notified requirement, OFCOM may give the person a notice under thissection (a “confirmation decision”) confirming that that is OFCOM’s opinion.

(4)

A confirmation decision and a notice under section 110(1) may be given in
respect of the same failure.

(5)

A confirmation decision given to a person may—(a) require the person to take steps as mentioned in section 121;(b) require the person to pay a penalty as mentioned in section 125;(c) require the person to do both those things (or neither of them).

(6)

5

See sections 122 and 123 for further provision which a confirmation decision
may include in cases of failure to comply with duties about risk assessments orchildren’s access assessments.

20

25

30

35

104

121
(1)

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 6 — Enforcement powers

Confirmation decisions: requirements to take steps
A confirmation decision may require the person to whom it is given to takesuch steps as OFCOM consider appropriate (including steps relating to the usea system or process) for either or both of the following purposes—(a) complying with a notified requirement;(b) remedying the failure to comply with a notified requirement.

(2)

But see section 124 for constraints on OFCOM’s power to include in aconfirmation decision requirements as described in subsection (1) relating to
the use of proactive technology.

(3)

A confirmation decision may impose requirements as described in subsection(1) only in relation to the design or operation of a regulated service—(a) in the United Kingdom, or(b) as it affects United Kingdom users of the service.

(4)

A confirmation decision that includes requirements as described in subsection(1) must—(a) specify the steps that are required,(b) give OFCOM’s reasons for their decision to impose those requirements,(c) specify each notified requirement to which the steps relate,(d) specify the period during which the failure to comply with a notified
requirement has occurred, and whether the failure is continuing,(e) specify a reasonable period within which each of the steps specified in
the decision must be taken or, if a step requires the use of a system orprocess, a reasonable period within which the system or process must
begin to be used (but see subsection (5) in relation to information
duties),(f) (if relevant) specify the period for which a system or process must beused,(g) contain details of the rights of appeal under section 149, and(h) contain information about the consequences of not complying with therequirements included in the decision (including information about thefurther kinds of enforcement action that it would be open to OFCOM totake).

(5)

A confirmation decision that requires a person to take steps for the purpose ofcomplying with an information duty may require the person to take those steps
immediately.

(6)

A person to whom a confirmation decision is given has a duty to comply withrequirements included in the decision which are of a kind described insubsection (1).

(7)

The duty under subsection (6) is enforceable in civil proceedings by OFCOM—(a) for an injunction,(b) for specific performance of a statutory duty under section 45 of the
Court of Session Act 1988, or(c) for any other appropriate remedy or relief.

(8)

In this section—“information duty” means a duty set out in section 92(6);“notified requirement” has the meaning given by section 120.

5

10

15

20

25

30

35

40

45

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 6 — Enforcement powers

122
(1)

(2)

(3)

(4)

(5)

123
(1)

105

Confirmation decisions: risk assessments
This section applies if—(a) OFCOM are satisfied that a provider of a Part 3 service has failed tocomply with a risk assessment duty,(b) based on evidence resulting from OFCOM’s investigation into that
failure, OFCOM have identified a risk of serious harm to individuals in
the United Kingdom arising from a particular aspect of the service (“theidentified risk”), and(c) OFCOM consider that the identified risk is not effectively mitigated or
managed.
A confirmation decision given to the provider of the service—(a) if the identified risk relates to matters required to be covered by anillegal content risk assessment, may include a determination that the
duty set out in section 9(2)(b) or (c) or 23(2) (as the case may be) applies
as if an illegal content risk assessment carried out by the provider had
identified that risk;(b) if the identified risk relates to matters required to be covered by achildren’s risk assessment, may include a determination that the duty
set out in section 11(2)(a) or 25(2)(a) (as the case may be) applies as if achildren’s risk assessment carried out by the provider had identified
that risk.
A confirmation decision which includes a determination as mentioned insubsection (2) must—(a) give details of the identified risk,(b) specify the duty to which the determination relates, and(c) specify the date by which measures (at the provider’s discretion) tocomply with that duty must be taken or must begin to be used.
A determination as mentioned in subsection (2) ceases to have effect on thedate on which the provider of the service complies with the risk assessment
duty with which the provider had previously failed to comply (andaccordingly, from that date the duty to which the determination relates applies
without the modification mentioned in that subsection).
In this section—“children’s risk assessment” has the meaning given by section 10 or 24 (asthe case may be);“illegal content risk assessment” has the meaning given by section 8 or 22(as the case may be);“risk assessment duty” means a duty set out in—(a) section 8,(b) section 10,(c) section 22, or(d) section 24.

5

10

15

20

25

30

35

40

Confirmation decisions: children’s access assessments
This section applies if OFCOM are satisfied that a provider of a Part 3 service
has failed to comply with a duty set out in section 31 (duties about children’saccess assessments).

45

106

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 6 — Enforcement powers(2)

If OFCOM include in a confirmation decision a requirement to take steps
relating to the carrying out of a children’s access assessment of a service, theymust require that assessment to be completed within three months of the dateof the confirmation decision.

(3)

OFCOM may vary a confirmation decision which includes a requirement as
mentioned in subsection (2) to extend the deadline for completion of achildren’s access assessment.

(4)

Subsection (5) applies if, based on evidence that OFCOM have about a service
resulting from their investigation into compliance with a duty set out in section
31, OFCOM consider that—(a) it is possible for children to access the service or a part of it, and(b) the child user condition is met in relation to—(i) the service, or(ii) a part of the service that it is possible for children to access.

(5)

OFCOM may include in the confirmation decision given to the provider of theservice—(a) a determination that the duties set out in sections 10 and 11, or (as thecase may be) sections 24 and 25, must be complied with—(i) from the date of the confirmation decision, or(ii) from a later date specified in that decision;(b) provision about the circumstances in which that determination may betreated as no longer applying in relation to the service.

(6)

Subsection (4) is to be interpreted consistently with section 30.

(7)

In this section, “children’s access assessment” has the meaning given by section
30.

124
(1)

10

15

20

25

Confirmation decisions: proactive technology
This section sets out constraints on OFCOM’s power to include in aconfirmation decision a requirement to take steps to use a kind, or one of thekinds, of proactive technology specified in the decision (a “proactive
technology requirement”).

(2)

A proactive technology requirement may be imposed in a confirmation
decision only if the decision is given to the provider of a Part 3 service.

(3)

A proactive technology requirement may be imposed in a confirmation
decision only for the purpose of complying with, or remedying the failure tocomply with, any of the duties set out in—(a) section 9(2) or (3) (illegal content),(b) section 11(2) or (3) (children’s online safety),(c) section 23(2) or (3) (illegal content),(d) section 25(2) or (3) (children’s online safety), or(e) section 33(1) or 34(1) (fraudulent advertising).

(4)

5

Proactive technology may be required to be used on or in relation to any Part
3 service or any part of such a service, but if and to the extent that thetechnology operates (or may operate) by analysing content that is usergenerated content in relation to the service, or metadata relating to suchcontent, the technology may not be required to be used except to analyse—

30

35

40

45

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 6 — Enforcement powers

(a)
(b)
(5)

(6)

107

user-generated content communicated publicly, andmetadata relating to user-generated content communicated publicly.

Before imposing a proactive technology requirement in relation to a service ina confirmation decision, OFCOM must particularly consider the matters
mentioned in subsection (6), so far as they are relevant.
The matters are as follows—(a) the kind of service it is;(b) the functionalities of the service;(c) the user base of the service;(d) the prevalence of relevant content on the service and the extent of its
dissemination by means of the service, or (as the case may be) theprevalence of search content of the service that is relevant content;(e) the level of risk of harm to individuals in the United Kingdom
presented by relevant content present on the service, or (as the casemay be) search content of the service that is relevant content, and theseverity of that harm;(f) the degree of accuracy, effectiveness and lack of bias achieved by thekind of technology specified in the decision;(g) the extent to which the use of the kind of proactive technology specified
in the decision would or might result in interference with users’ rightto freedom of expression within the law;(h) the level of risk of the use of the kind of proactive technology specified
in the decision resulting in a breach of any statutory provision or ruleof law concerning privacy that is relevant to the use or operation of theservice (including, but not limited to, any such provision or ruleconcerning the processing of personal data);(i) whether the use of any less intrusive measures than the proactive
technology specified in the decision would be likely to result incompliance with, or would be likely to effectively remedy the failure tocomply with, the duty in question.

(7)

A confirmation decision that imposes a proactive technology requirement on aprovider may also impose requirements about review of the technology by theprovider.

(8)

A confirmation decision relating to a service which requires the use oftechnology of a kind mentioned in subsection (4) must identify the content, orparts of the service that include content, that OFCOM consider iscommunicated publicly on that service (see section 203).

(9)

In this section—“content that is harmful to children” has the same meaning as in Part 3(see section 54);
“fraudulent advertisement” has the meaning given by section 33 or 34(depending on the kind of service in question);“illegal content” has the same meaning as in Part 3 (see section 53);
“relevant content” means illegal content, content that is harmful tochildren or content consisting of fraudulent advertisements, or any or
all of those kinds of content (depending on the duties (as mentioned insubsection (3)) for the purposes of which the proactive technology
requirement is imposed);“search content” has the same meaning as in Part 3 (see section 51);

5

10

15

20

25

30

35

40

45

108

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 6 — Enforcement powers“user-generated content” has the meaning given by section 49 (seesubsections (3) and (4) of that section).
125(1)

Confirmation decisions: penalties
A confirmation decision may require the person to whom it is given to doeither or both of the following, depending on what was proposed in theprovisional notice of contravention (see paragraph 3 of Schedule 13)—(a) pay to OFCOM a penalty of a single amount in sterling determined by
OFCOM (a “single penalty”) and specified in the confirmation decision;(b) if the confirmation decision includes a requirement of the kinddescribed in section 121(1)(a) in respect of a continuous failure tocomply with a notified requirement, pay a daily rate penalty to
OFCOM if that same failure continues after the compliance date.

(2)

A “daily rate penalty” means a penalty of an amount in sterling determined by
OFCOM and calculated by reference to a daily rate.

(3)

A confirmation decision may impose separate single penalties for failure tocomply with separate notified requirements specified in the decision.

(4)

Where a provisional notice of contravention is given in respect of a period ofcontinuing failure to comply with a notified requirement, no more than one
single penalty may be imposed by a confirmation decision in respect of theperiod of failure specified in the provisional notice of contravention.

(5)

(6)

A confirmation decision that imposes a penalty must—(a) give OFCOM’s reasons for their decision to impose the penalty,(b) specify each notified requirement to which the penalty relates,(c) specify the period during which the failure to comply with a notified
requirement has occurred, and whether the failure is continuing,(d) state the reasons for the amount of the penalty, including any
aggravating or mitigating factors that OFCOM have taken into account,(e) specify a reasonable period within which the penalty must be paid,(f) contain details of the rights of appeal under section 149, and(g) contain information about the consequences of not paying the penalty(including information about the further kinds of enforcement actionthat it would be open to OFCOM to take).
The period specified under subsection (5)(e) for the payment of a single penalty
must be at least 28 days beginning with the day on which the confirmation
decision is given.

(7)

If a confirmation decision imposes a single penalty and a daily rate penalty, theinformation mentioned in subsection (5)(a), (b), (d) and (e) must be given in
respect of each kind of penalty.

(8)

As well as containing the information mentioned in subsection (5), a
confirmation decision that imposes a daily rate penalty in respect of acontinuous failure to comply with a notified requirement must—(a) state the daily rate of the penalty and how the penalty is calculated;(b) state that the person will be liable to pay the penalty if that same failure
continues after the compliance date;(c) state the date from which the penalty begins to be payable, which mustnot be earlier than the day after the compliance date;

5

10

15

20

25

30

35

40

45

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 6 — Enforcement powers

(d)

(9)

109

provide for the penalty to continue to be payable at the daily rateuntil—(i) the date on which the notified requirement is complied with,(ii) if the penalty is imposed in respect of a failure to comply withmore than one notified requirement, the date on which the lastof those requirements is complied with, or(iii) an earlier date specified in the confirmation decision.

In this section—“compliance date”, in relation to a notified requirement, means—(a) in a case where the confirmation decision requires steps to betaken immediately to comply with that requirement (see section
121(5)), the date of the confirmation decision;(b) in any other case, the last day of the period specified in theconfirmation decision in accordance with section 121(4)(e) forcompliance with that requirement;“notified requirement” has the meaning given by section 120.

5

10

15

Penalty notices etc
126
(1)

(2)

(3)

(4)

Penalty for failure to comply with confirmation decisionThis section applies if—(a) OFCOM have given a confirmation decision to a person,(b) the decision includes requirements of a kind described in section 121(1)(requirements to take steps),(c) OFCOM are satisfied that the person has failed to comply with one ormore of those requirements, and(d) OFCOM have not imposed a daily rate penalty under section 125(1)(b)in respect of that failure.
OFCOM may give the person a penalty notice under this section in respect of
the failure to comply with the confirmation decision, requiring the person to
pay to OFCOM a penalty of a single amount in sterling determined by
OFCOM.
But OFCOM may give such a notice to the person only after—(a) notifying the person that they propose to give a penalty notice under
this section, specifying the reasons for doing so and indicating theamount of the proposed penalty, and(b) giving the person an opportunity to make representations (with any
supporting evidence).
A penalty notice under this section must—(a) give OFCOM’s reasons for their decision to impose the penalty,(b) state the amount of the penalty,(c) state the reasons for the amount of the penalty, including any
aggravating or mitigating factors that OFCOM have taken into account,(d) specify the period within which the penalty must be paid,(e) contain details of the rights of appeal under section 149, and(f) contain information about the consequences of not paying the penalty(including information about the further kinds of enforcement actionthat it would be open to OFCOM to take).

20

25

30

35

40

45

110

(5)

127
(1)

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 6 — Enforcement powers

The period specified under subsection (4)(d) must be at least 28 days beginningwith the day on which the penalty notice is given.
Penalty for failure to comply with notice under section 110(1)This section applies if—(a) OFCOM have given a notice under section 110(1) relating to a Part 3
service to the provider of that service (notices to deal with terrorism
content and CSEA content), and(b) OFCOM are satisfied that the provider has failed, or is failing, tocomply with the notice.

(2)

OFCOM may give the provider a notice under this subsection stating that they
propose to impose a penalty on the provider in respect of that failure.

(3)

The provider may make representations to OFCOM (with any supporting
evidence) about the matters contained in the notice.

(4)

Subsection (5) applies if—(a) the period allowed for representations has expired, and(b) OFCOM are still satisfied as to the failure mentioned in subsection (1).

(5)

OFCOM may give the provider a penalty notice under this subsection
requiring the provider to pay to OFCOM a penalty of an amount in sterlingdetermined by OFCOM.

(6)

The penalty may consist of any of the following, depending on what was
specified in the notice about the proposed penalty—(a) a single amount;(b) an amount calculated by reference to a daily rate;(c) a combination of a single amount and an amount calculated byreference to a daily rate.

(7)

See section 129 for information which must be included in notices under thissection.

(8)

Nothing in this section is to be taken to prevent OFCOM from giving theprovider a further notice under section 110(1) (see section 114), as well as
giving a penalty notice under subsection (5).

128
(1)

(2)

(3)

5

10

15

20

25

30

Non-payment of fee
This section applies if—(a) the provider of a regulated service is liable to pay a fee to OFCOM
under section 75 or Schedule 10 in respect of the current charging year(within the meaning of Part 6) or a previous charging year, and(b) in OFCOM’s opinion, the provider has not paid the full amount of thefee that the provider is liable to pay.
OFCOM may give the provider a notice under this subsection specifying—(a) the outstanding amount of the fee that OFCOM consider the provider
is due to pay to them under section 75 or Schedule 10, and(b) the period within which the provider must pay it.
A notice under subsection (2)—35

40Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 6 — Enforcement powers

(a)
(b)

111

may be given in respect of liabilities that relate to different charging
years;
may also state that OFCOM propose to impose a penalty on theprovider.

(4)

The provider may make representations to OFCOM (with any supporting
evidence) about the matters contained in the notice.

(5)

Subsection (6) applies if—(a) the notice under subsection (2) stated that OFCOM propose to imposea penalty,(b) the period allowed for representations has expired, and(c) OFCOM are satisfied that an amount of the fee is still due to them.

(6)

OFCOM may give the provider a penalty notice under this subsection
requiring the provider to pay to OFCOM a penalty of an amount in sterlingdetermined by OFCOM.

(7)

The penalty may consist of any of the following, depending on what was
specified in the notice about the proposed penalty—(a) a single amount;(b) an amount calculated by reference to a daily rate;(c) a combination of a single amount and an amount calculated byreference to a daily rate.

(8)

A penalty notice under subsection (6) may require the payment of separate
single amounts in respect of liabilities that relate to different charging years.

(9)

See section 129 for information which must be included in notices under thissection.

(10)

Nothing in this section affects OFCOM’s power to bring proceedings (whether
before or after the imposition of a penalty by a notice under subsection (6)) for
the recovery of the whole or part of an amount due to OFCOM under section
75 or Schedule 10.

(11)

But OFCOM may not bring such proceedings unless a provider has first been
given a notice under subsection (2) specifying the amount due to OFCOM.

129

Information to be included in notices under sections 127 and 128

(1)

(2)

Subsection (2) applies in relation to—(a) a notice under section 127(2), and(b) a notice under section 128(2) stating that OFCOM propose to impose apenalty.
Such a notice must—(a) state the reasons why OFCOM propose to impose the penalty,(b) state whether OFCOM propose that the penalty should consist of asingle amount, an amount calculated by reference to a daily rate, or a
combination of the two,(c) indicate the amount of the proposed penalty, including (in relation toan amount calculated by reference to a daily rate) the daily rate andhow the penalty would be calculated,

5

10

15

20

25

30

35

40

112

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 6 — Enforcement powers

(d)
(e)
(f)
(3)

in relation to an amount calculated by reference to a daily rate, specify
or describe the period for which OFCOM propose that the amountshould be payable,
state the reasons for proposing a penalty of that amount, including any
aggravating or mitigating factors that OFCOM propose to take into
account, andspecify the period within which representations in relation to the
proposed penalty may be made.

A penalty notice under section 127(5) or 128(6) must—(a) give OFCOM’s reasons for their decision to impose the penalty,(b) state whether the penalty consists of a single amount, an amountcalculated by reference to a daily rate, or a combination of the two, andhow it is calculated,(c) in relation to a single amount, state that amount,(d) in relation to an amount calculated by reference to a daily rate, state thedaily rate,(e) state the reasons for the amount of the penalty, including any
aggravating or mitigating factors that OFCOM have taken into account,(f) specify a reasonable period within which the penalty must be paid,(g) contain details of the rights of appeal under section 149, and(h) contain information about the consequences of not paying the penalty(including information about the further kinds of enforcement actionthat it would be open to OFCOM to take).

(4)

A penalty notice under section 128(6) must also specify the amount of the feethat is (in OFCOM’s opinion) due to be paid to OFCOM.

(5)

The period specified under subsection (3)(f) for the payment of a single
amount must be at least 28 days beginning with the day on which the penalty
notice is given.

(6)

Subsection (7) applies in relation to a penalty notice under section 127(5) or128(6) that includes a requirement to pay an amount calculated by reference toa daily rate.

(7)

Such a notice must—(a) state the date from which the amount begins to be payable, which mustnot be earlier than the day after the day on which the notice is given;(b) provide for the amount to continue to be payable at the daily rateuntil—(i) (in the case of a notice under section 127(5)) the date on which
OFCOM are satisfied that the provider is complying with thenotice under section 110(1), or (in the case of a notice under
section 128(6)) the date on which the full amount of the fee (asspecified in the penalty notice) has been paid to OFCOM, or(ii) an earlier date specified in the penalty notice.

5

10

15

20

25

30

35

40

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 6 — Enforcement powers

113

Amount of penalties etc
130

Amount of penalties etc
Schedule 13 contains provision about the amount of penalties that OFCOM
may impose under this Chapter, and makes further provision about such
penalties.

5

Business disruption measures
131
(1)

(2)

(3)

(4)

(5)

Service restriction orders
OFCOM may apply to the court for an order under this section (a “service
restriction order”) in relation to a regulated service where they consider that—(a) the grounds in subsection (3) apply in relation to the service, or(b) in the case of a Part 3 service, the grounds in subsection (4) apply in
relation to the service.
A service restriction order is an order imposing requirements on one or more
persons who provide an ancillary service (whether from within or outside theUnited Kingdom) in relation to a regulated service (see subsection (11)).
The grounds mentioned in subsection (1)(a) are that—(a) the provider of the regulated service has failed to comply with an
enforceable requirement that applies in relation to the regulated
service,(b) the failure is continuing, and(c) any of the following applies—(i) the provider has failed to comply with a requirement imposedby a confirmation decision that is of a kind described in section
121(1) relating to the failure;(ii) the provider has failed to pay a penalty imposed by aconfirmation decision relating to the failure (and theconfirmation decision did not impose any requirements of akind described in section 121(1));(iii) the provider would be likely to fail to comply withrequirements imposed by a confirmation decision if given;(iv) the circumstances of the failure or the risks of harm toindividuals in the United Kingdom are such that it isappropriate to make the application without having given a
provisional notice of contravention, without having given a
confirmation decision, or (having given a confirmation decision
imposing requirements) without waiting to ascertain
compliance with those requirements.
The grounds mentioned in subsection (1)(b) are that—(a) the provider of the Part 3 service has failed to comply with a noticeunder section 110(1) that relates to the service (notices to deal withterrorism content and CSEA content), and(b) the failure is continuing.
An application by OFCOM for a service restriction order must—(a) specify the regulated service in relation to which the application ismade (“the relevant service”),

10

15

20

25

30

35

40

45

114

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 6 — Enforcement powers

(b)
(c)
(d)
(e)
(f)
(g)

(6)

(7)

(8)

specify the provider of that service (“the non-compliant provider”),
specify the grounds on which the application is based, and containevidence about those grounds,
specify the persons on whom (in OFCOM’s opinion) the requirementsof the order should be imposed,contain evidence as to why OFCOM consider that the persons
mentioned in paragraph (d) provide an ancillary service in relation to
the relevant service, and specify any such ancillary service provided,
specify the requirements which OFCOM consider that the order should
impose on such persons, andin the case of an application made without notice having been given to
the non-compliant provider, or to the persons mentioned in paragraph(d), state why no notice has been given.

The court may make a service restriction order imposing requirements on a
person in relation to the relevant service if the court is satisfied—(a) as to the grounds in subsection (3) or the grounds in subsection (4) (asthe case may be),(b) that the person provides an ancillary service in relation to the relevant
service,(c) that it is appropriate to make the order for the purpose of preventing
harm to individuals in the United Kingdom, and the order is
proportionate to the risk of such harm,(d) in the case of an application made on the ground in subsection (3)(c)(iii)or (iv), that it is appropriate to make the order before a provisional
notice of contravention or confirmation decision has been given, or
before compliance with requirements imposed by a confirmation
decision has been ascertained (as the case may be), and(e) if no notice of the application has been given to the non-compliant
provider, or to the persons on whom requirements are being imposed,that it is appropriate to make the order without notice.
When considering whether to make a service restriction order in relation to therelevant service, and when considering what provision it should contain, thecourt must take into account (among other things) the rights and obligations of
all relevant parties, including those of—(a) the non-compliant provider,(b) the person or persons on whom the court is considering imposing therequirements, and(c) United Kingdom users of the relevant service.
A service restriction order made in relation to the relevant service must—(a) identify the non-compliant provider,(b) identify the persons on whom the requirements are imposed, and any
ancillary service to which the requirements relate,(c) require such persons to take the steps specified in the order, or to put inplace arrangements, that have the effect of withdrawing the ancillary
service to the extent that it relates to the relevant service (or part of it),or preventing the ancillary service from promoting or displaying
content that relates to the relevant service (or part of it) in any way,(d) specify the date by which the requirements in the order must becomplied with, and

5

10

15

20

25

30

35

40

45

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 6 — Enforcement powers

(e)
(9)

115

specify the date on which the order expires, or the period for which theorder has effect.

The steps that may be specified or arrangements that may be required to be put
in place—(a) include steps or arrangements that will or may require the terminationof an agreement (whether or not made before the coming into force of
this section), or the prohibition of the performance of such an
agreement, and(b) are limited, so far as that is possible, to steps or arrangements relating
to the operation of the relevant service as it affects United Kingdom
users.

(10)

OFCOM must inform the Secretary of State as soon as reasonably practicable
after a service restriction order has been made.

(11)

For the purposes of this section, a service is an “ancillary service” in relation toa regulated service if the service facilitates the provision of the regulated
service (or part of it), whether directly or indirectly, or displays or promotes
content relating to the regulated service (or to part of it).

(12)

Examples of ancillary services include—(a) services, provided (directly or indirectly) in the course of a business,
which enable funds to be transferred in relation to a regulated service,(b) search engines which generate search results displaying or promoting
content relating to a regulated service,(c) user-to-user services which make content relating to a regulated service
available to users, and(d) services which use technology to facilitate the display of advertising ona regulated service (for example, an ad server or an ad network).

(13)

132
(1)

(2)

(3)

In this section “the court” means—(a) in England and Wales, the High Court or the county court,(b) in Scotland, the Court of Session or a sheriff, and(c) in Northern Ireland, the High Court or a county court.

5

10

15

20

25

30

Interim service restriction orders
OFCOM may apply to the court for an interim order under this section (an“interim service restriction order”) in relation to a regulated service where they
consider that—(a) the grounds in subsection (3) apply in relation to the service, or(b) in the case of a Part 3 service, the grounds in subsection (4) apply in
relation to the service.
An interim service restriction order is an interim order imposing requirements
on one or more persons who provide an ancillary service (whether from withinor outside the United Kingdom) in relation to a regulated service (seesubsection (9)).
The grounds mentioned in subsection (1)(a) are that—(a) it is likely that the provider of the regulated service is failing to comply
with an enforceable requirement that applies in relation to theregulated service, and

35

40

45

116

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 6 — Enforcement powers

(b)

(4)

(5)

(6)

(7)

the level of risk of harm to individuals in the United Kingdom relating
to the likely failure, and the nature and severity of that harm, are suchthat it would not be appropriate to wait to establish the failure before
applying for the order.

The grounds mentioned in subsection (1)(b) are that—(a) it is likely that the provider of the Part 3 service is failing to comply witha notice under section 110(1) that relates to the service (notices to deal
with terrorism content and CSEA content), and(b) the level of risk of harm to individuals in the United Kingdom relating
to the likely failure, and the nature and severity of that harm, are suchthat it would not be appropriate to wait to establish the failure before
applying for the order.
An application by OFCOM for an interim service restriction order must—(a) specify the regulated service in relation to which the application ismade (“the relevant service”),(b) specify the provider of that service (“the non-compliant provider”),(c) specify the grounds on which the application is based, and containevidence about those grounds,(d) specify the persons on whom (in OFCOM’s opinion) the requirementsof the order should be imposed,(e) contain evidence as to why OFCOM consider that the persons
mentioned in paragraph (d) provide an ancillary service in relation to
the relevant service, and specify any such ancillary service provided,(f) specify the requirements which OFCOM consider that the order should
impose on such persons, and(g) in the case of an application made without notice having been given to
the non-compliant provider, or to the persons mentioned in paragraph(d), state why no notice has been given.
The court may make an interim service restriction order imposing
requirements on a person in relation to the relevant service if the court issatisfied—(a) as to the ground in subsection (3)(a) or the ground in subsection (4)(a)(as the case may be),(b) that the person provides an ancillary service in relation to the relevant
service,(c) that there are prima facie grounds to suggest that an application for aservice restriction order under section 131 would be successful,(d) that the level of risk of harm to individuals in the United Kingdom
relating to the likely failure mentioned in subsection (3)(a) or (4)(a)(whichever applies), and the nature and severity of that harm, are suchthat it is not appropriate to wait for the failure to be established before
making the order, and(e) if no notice of the application has been given to the non-compliant
provider, or to the persons on whom requirements are being imposed,that it is appropriate to make the order without notice.
An interim service restriction order ceases to have effect on the earlier of—(a) the date specified in the order, or the date on which the period specified
in the order expires (as the case may be), and(b) the date on which the court makes a service restriction order under
section 131 in relation to the relevant service that imposes requirements

5

10

15

20

25

30

35

40

45

50

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 6 — Enforcement powers

117

on the same persons on whom requirements are imposed by theinterim order, or dismisses the application for such an order.
(8)

(9)

133
(1)

Subsections (7) to (10) of section 131 apply in relation to an interim service
restriction order under this section as they apply in relation to a service
restriction order under that section.
In this section, “ancillary service” and “the court” have the same meaning as insection 131 (see subsections (11), (12) and (13) of that section).
Access restriction orders
OFCOM may apply to the court for an order under this section (an “access
restriction order”) in relation to a regulated service where they consider that—(a) the grounds in section 131(3) or (4) apply in relation to the service, and(b) either—(i) a service restriction order under section 131 or an interim
service restriction order under section 132 has been made in
relation to the failure, and it was not sufficient to prevent
significant harm arising to individuals in the United Kingdom
as a result of the failure, or(ii) the likely consequences of the failure are such that if a service
restriction order or an interim service restriction order were to
be made, it would be unlikely to be sufficient to prevent
significant harm arising to individuals in the United Kingdom
as a result of the failure,and in this paragraph, “the failure” means the failure mentioned in
section 131(3)(a) or (4)(a) (as the case may be).

(2)

An access restriction order is an order imposing requirements on one or more
persons who provide an access facility (whether from within or outside theUnited Kingdom) in relation to a regulated service (see subsection (10)).

(3)

An application by OFCOM for an access restriction order must—(a) specify the regulated service in relation to which the application ismade (“the relevant service”),(b) specify the provider of that service (“the non-compliant provider”),(c) specify the grounds on which the application is based, and containevidence about those grounds,(d) specify the persons on whom (in OFCOM’s opinion) the requirementsof the order should be imposed,(e) contain evidence as to why OFCOM consider that the persons
mentioned in paragraph (d) provide an access facility in relation to therelevant service, and specify any such access facility provided,(f) specify the requirements which OFCOM consider that the order should
impose on such persons, and(g) in the case of an application made without notice having been given to
the non-compliant provider, or to the persons mentioned in paragraph(d), state why no notice has been given.

(4)5

The court may make an access restriction order imposing requirements on a
person in relation to the relevant service if the court is satisfied—(a) as to the grounds in subsection (1),

10

15

20

25

30

35

40

45

118

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 6 — Enforcement powers

(b)
(c)
(d)

(e)

(5)

(6)

(7)

that the person provides an access facility in relation to the relevant
service,that it is appropriate to make the order for the purpose of preventing
significant harm to individuals in the United Kingdom, and the orderis proportionate to the risk of such harm,in the case of an application made on the ground in subsection (3)(c)(iii)or (iv) of section 131 (by virtue of subsection (1)(a)), that it isappropriate to make the order before a provisional notice ofcontravention or confirmation decision has been given, or before
compliance with requirements imposed by a confirmation decision has
been ascertained (as the case may be), and
if no notice of the application has been given to the non-compliant
provider, or to the persons on whom requirements are being imposed,that it is appropriate to make the order without notice.

When considering whether to make an access restriction order in relation to therelevant service, and when considering what provision it should contain, thecourt must take into account (among other things) the rights and obligations of
all relevant parties, including those of—(a) the non-compliant provider,(b) the person or persons on whom the court is considering imposing therequirements, and(c) United Kingdom users of the relevant service.
An access restriction order made in relation to the relevant service must—(a) identify the non-compliant provider,(b) identify the persons on whom the requirements are imposed, and any
access facility to which the requirements relate,(c) require such persons to take the steps specified in the order, or to put inplace arrangements, to withdraw, adapt or manipulate the accessfacility in order to impede users’ access (by means of that facility) to therelevant service (or to part of it),(d) specify the date by which the requirements in the order must becomplied with, and(e) specify the date on which the order expires, or the period for which theorder has effect.

5

10

15

20

25

30

The steps that may be specified or arrangements that may be required to be put
in place—(a) include steps or arrangements that will or may require the terminationof an agreement (whether or not made before the coming into force of
this section), or the prohibition of the performance of such an
agreement,(b) are limited, so far as that is possible, to steps or arrangements that
impede the access of United Kingdom users, and(c) are limited, so far as that is possible, to steps or arrangements that do
not affect such users’ ability to access any other internet services.

35

(8)

OFCOM must inform the Secretary of State as soon as reasonably practicable
after an access restriction order has been made.

45

(9)

Where a person who provides an access facility takes steps or puts in placearrangements required by an access restriction order, OFCOM may, by notice,require that person to (where possible) notify persons in the United Kingdom

40

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 6 — Enforcement powers

119

who attempt to access the relevant service via that facility of the access
restriction order (and where a confirmation decision has been given to the noncompliant provider, the notification must refer to that decision).
(10)

For the purposes of this section, a facility is an “access facility” in relation to aregulated service if the person who provides the facility is able to withdraw,
adapt or manipulate it in such a way as to impede access (by means of thatfacility) to the regulated service (or to part of it) by United Kingdom users ofthat service.

(11)

Examples of access facilities include—(a) internet access services by means of which a regulated service is madeavailable, and(b) application stores through which a mobile application for a regulated
service may be downloaded or otherwise accessed.

(12)

134
(1)

In this section—“the court” means—(a) in England and Wales, the High Court or the county court,(b) in Scotland, the Court of Session or a sheriff, and(c) in Northern Ireland, the High Court or a county court;“facility” means any kind of service, infrastructure or apparatus enablingusers of a regulated service to access the regulated service;“internet access service” means a service that provides access to virtuallyall (or just some) of the end points of the internet.

5

10

15

20

Interim access restriction orders
OFCOM may apply to the court for an interim order under this section (an“interim access restriction order”) in relation to a regulated service where they
consider that—(a) the grounds in section 132(3) or (4) apply in relation to the service, and(b) either—(i) a service restriction order under section 131 or an interim
service restriction order under section 132 has been made in
relation to the likely failure, and it was not sufficient to prevent
significant harm arising to individuals in the United Kingdom
as a result of the failure, or(ii) the likely consequences of such a failure would be such that if aservice restriction order or an interim service restriction orderwere to be made, it would be unlikely to be sufficient to prevent
significant harm arising to individuals in the United Kingdom
as a result of the failure,and in this section, “the likely failure” means the likely failure
mentioned in section 132(3)(a) or (4)(a) (as the case may be).

(2)

An interim access restriction order is an interim order imposing requirements
on one or more persons who provide an access facility (whether from within or
outside the United Kingdom) in relation to a regulated service (see subsection
(8)).

(3)

An application by OFCOM for an interim access restriction order must—(a) specify the regulated service in relation to which the application ismade (“the relevant service”),

25

30

35

40

45

120

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 6 — Enforcement powers

(b)
(c)
(d)
(e)
(f)
(g)

(4)

(5)

specify the provider of that service (“the non-compliant provider”),
specify the grounds on which the application is based, and containevidence about those grounds,
specify the persons on whom (in OFCOM’s opinion) the requirementsof the order should be imposed,contain evidence as to why OFCOM consider that the persons
mentioned in paragraph (d) provide an access facility in relation to therelevant service, and specify any such access facility provided,
specify the requirements which OFCOM consider that the order should
impose on such persons, andin the case of an application made without notice having been given to
the non-compliant provider, or to the persons mentioned in paragraph(d), state why no notice has been given.

The court may make an interim access restriction order imposing requirements
on a person in relation to the relevant service if the court is satisfied—(a) that the ground in section 132(3)(a) or (4)(a) (as the case may be) applies
in relation to the service,(b) as to the ground in subsection (1)(b)(i) or (ii),(c) that the person provides an access facility in relation to the relevant
service,(d) that there are prima facie grounds to suggest that an application for anaccess restriction order under section 133 would be successful,(e) that the level of risk of harm to individuals in the United Kingdom
relating to the likely failure, and the nature and severity of that harm,
are such that it is not appropriate to wait for the failure to be established
before making the order, and(f) if no notice of the application has been given to the non-compliant
provider, or to the persons on whom requirements are being imposed,that it is appropriate to make the order without notice.
An interim access restriction order ceases to have effect on the earlier of—(a) the date specified in the order, or the date on which the period specified
in the order expires (as the case may be), and(b) the date on which the court makes an access restriction order under
section 133 in relation to the relevant service that imposes requirementson the same persons on whom requirements are imposed by theinterim order, or dismisses an application for such an order.

5

10

15

20

25

30

35

(6)

Subsections (5) to (8) of section 133 apply in relation to an interim access
restriction order under this section as they apply in relation to an access
restriction order under that section.

(7)

Where a person who provides an access facility takes steps or puts in placearrangements required by an interim access restriction order, OFCOM may, by
notice, require that person to (where possible) notify persons in the United
Kingdom who attempt to access the relevant service via that facility of theinterim access restriction order.

40

(8)

In this section, “access facility” and “the court” have the same meaning as insection 133 (see subsections (10), (11) and (12) of that section).

45

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 6 — Enforcement powers

135
(1)

(2)

(3)

121

Interaction with other action by OFCOM
Where OFCOM apply for a business disruption order in respect of a failure bya provider of a regulated service to comply with an enforceable requirement,
nothing in sections 131 to 134 is to be taken to prevent OFCOM also giving theprovider—(a) a confirmation decision in respect of the failure, or(b) a penalty notice under section 126 in relation to a confirmation decision
in respect of the failure.
Where OFCOM apply for a business disruption order in respect of a failure bya provider of a Part 3 service to comply with a notice under section 110(1)(notices to deal with terrorism content and CSEA content), nothing in sections
131 to 134 is to be taken to prevent OFCOM also giving the provider either orboth of the following—(a) a further notice under section 110(1) (see section 114);(b) a penalty notice under section 127(5).
In this section, a “business disruption order” means—(a) a service restriction order under section 131,(b) an interim service restriction order under section 132,(c) an access restriction order under section 133, or(d) an interim access restriction order under section 134.

5

10

15

20

Publication of enforcement action
136
(1)

(2)

Publication by OFCOM of details of enforcement action
Subsections (2) and (3) apply where OFCOM have given a person (and notwithdrawn) any of the following—(a) a confirmation decision;(b) a penalty notice under section 126;(c) a penalty notice under section 127(5);(d) a penalty notice under section 128(6).
OFCOM must publish details identifying the person and describing—(a) the failure (or failures) to which the decision or notice relates, and(b) OFCOM’s response.

(3)

But OFCOM may not publish anything that, in OFCOM’s opinion—(a) is confidential in accordance with subsections (4) and (5), or(b) is otherwise not appropriate for publication.

(4)

A matter is confidential under this subsection if—(a) it relates specifically to the affairs of a particular body, and(b) publication of that matter would or might, in OFCOM’s opinion,
seriously and prejudicially affect the interests of that body.

(5)

A matter is confidential under this subsection if—(a) it relates to the private affairs of an individual, and(b) publication of that matter would or might, in OFCOM’s opinion,
seriously and prejudicially affect the interests of that individual.

25

30

35

40

122

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 6 — Enforcement powers(6)

Where OFCOM have given a person a provisional notice of contravention but
have not given the person a confirmation decision, OFCOM may publish
details identifying the person and describing the reasons for the provisional
notice.

(7)

OFCOM must notify the person concerned that information has been
published under this section.

137
(1)

(2)

5

Publication by providers of details of enforcement action
This section applies where—(a) OFCOM have given a person (and not withdrawn) any of thefollowing—(i) a confirmation decision;(ii) a penalty notice under section 126;(iii) a penalty notice under section 127(5);(iv) a penalty notice under section 128(6), and(b) the appeal period in relation to the decision or notice has ended.
OFCOM may give to the person a notice (a “publication notice”) requiring theperson to—(a) publish details describing—(i) the failure (or failures) to which the decision or noticementioned in subsection (1)(a) relates, and(ii) OFCOM’s response, or(b) otherwise notify users of the service to which the decision or noticementioned in subsection (1)(a) relates of those details.

(3)

A publication notice may require a person to publish details under subsection(2)(a) or give notification of details under subsection (2)(b) or both.

(4)

A publication notice must—(a) specify the decision or notice mentioned in subsection (1)(a) to which it
relates,(b) specify or describe the details that must be published or notified,(c) specify the form and manner in which the details must be published or
notified,(d) specify a date by which the details must be published or notified, and(e) contain information about the consequences of not complying with thenotice.

(5)

Where a publication notice requires a person to publish details undersubsection (2)(a) the notice may also specify a period during which publicationin the specified form and manner must continue.

(6)

Where a publication notice requires a person to give notification of details
under subsection (2)(b) the notice may only require that notification to be given
to United Kingdom users of the service (see section 199).

(7)

A publication notice may not require a person to publish or give notification ofanything that, in OFCOM’s opinion—(a) is confidential in accordance with subsections (8) and (9), or(b) is otherwise not appropriate for publication or notification.

(8)

A matter is confidential under this subsection if—

10

15

20

25

30

35

40

45

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 6 — Enforcement powers

(a)
(b)
(9)

123

it relates specifically to the affairs of a particular body, andpublication or notification of that matter would or might, in OFCOM’sopinion, seriously and prejudicially affect the interests of that body.

A matter is confidential under this subsection if—(a) it relates to the private affairs of an individual, and(b) publication or notification of that matter would or might, in OFCOM’sopinion, seriously and prejudicially affect the interests of that
individual.

(10)

A person to whom a publication notice is given has a duty to comply with it.

(11)

The duty under subsection (10) is enforceable in civil proceedings by
OFCOM—(a) for an injunction,(b) for specific performance of a statutory duty under section 45 of the
Court of Session Act 1988, or(c) for any other appropriate remedy or relief.

(12)

For the purposes of subsection (1)(b) “the appeal period”, in relation to adecision or notice mentioned in subsection (1)(a), means—(a) the period during which any appeal relating to the decision or notice
may be made, or(b) where such an appeal has been made, the period ending with thedetermination or withdrawal of that appeal.

5

10

15

20

Guidance
138

OFCOM’s guidance about enforcement action(1)

OFCOM must produce guidance for providers of regulated services about how
OFCOM propose to exercise their functions under this Chapter.

(2)

The guidance must, in particular, give information about the factors that
OFCOM would consider it appropriate to take into account when taking, orconsidering taking, enforcement action relating to a person’s failure to comply
with different kinds of enforceable requirements.

(3)

In relation to any enforcement action by OFCOM which relates to a failure bya provider of a regulated service to comply with a relevant duty, the guidancemust include provision explaining how OFCOM will take into account the
impact (or possible impact) of such a failure on children.

(4)

Before producing the guidance (including revised or replacement guidance),
OFCOM must consult—(a) the Secretary of State,(b) the Information Commissioner, and(c) such other persons as OFCOM consider appropriate.

(5)

OFCOM must publish the guidance (and any revised or replacement
guidance).

25

30

35

40

124

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 6 — Enforcement powers(6)

Guidelines prepared by OFCOM under section 392 of the Communications Act(amount of penalties) may, so far as relating to penalties imposed under this
Chapter, be included in the same document as guidance under this section.

(7)

In exercising their functions under this Chapter, or deciding whether toexercise them, OFCOM must have regard to the guidance for the time being
published under this section.

(8)

In this section, a “relevant duty” means—(a) a duty set out in section 9 or 23 (illegal content),(b) a duty set out in section 11 or 25 (children’s online safety), or(c) a duty set out in section 72(2) (children’s access to provider
pornographic content).

5

10

CHAPTER 7
COMMITTEES, RESEARCH AND REPORTS
139

Advisory committee on disinformation and misinformation(1)

OFCOM must, in accordance with the following provisions of this section,
exercise their powers under paragraph 14 of the Schedule to the Office ofCommunications Act 2002 (committees of OFCOM) to establish and maintaina committee to provide the advice specified in this section.

(2)

The committee is to consist of—(a) a chairman appointed by OFCOM, and(b) such number of other members appointed by OFCOM as OFCOM
consider appropriate.

(3)

(4)

(5)

In appointing persons to be members of the committee, OFCOM must haveregard to the desirability of ensuring that the members of the committee
include—(a) persons representing the interests of United Kingdom users of
regulated services,(b) persons representing providers of regulated services, and(c) persons with expertise in the prevention and handling of
disinformation and misinformation online.
The function of the committee is to provide advice to OFCOM (including othercommittees established by OFCOM) about—(a) how providers of regulated services should deal with disinformationand misinformation on such services,(b) OFCOM’s exercise of the power conferred by section 68 to require
information about a matter listed in Part 1 or 2 of Schedule 8, so far as
relating to disinformation and misinformation, and(c) OFCOM’s exercise of their functions under section 11 of theCommunications Act (duty to promote media literacy) in relation tocountering disinformation and misinformation on regulated services.
The committee must publish a report within the period of 18 months after
being established, and after that must publish periodic reports.

15

20

25

30

35

40

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 7 — Committees, research and reports

140

125

Functions of the Content Board(1)

Section 13 of the Communications Act (functions of the Content Board) is
amended as follows.

(2)

At the beginning of subsection (2), insert “Subject to subsection (3A),”.

(3)

After subsection (3) insert—
“(3A)

(4)

141

OFCOM may, but need not, confer on the Content Board functions inrelation to matters that concern the nature or kind of online content inrelation to which OFCOM have functions under the Online Safety Act
2023 (see Parts 3 and 5 of that Act).”

After subsection (7) insert—
“(8)

10

In this section references to “matters mentioned in subsection (2)” do
not include references to the matters mentioned in subsection (3A).”

Research about users’ experiences of regulated services(1)

Section 14 of the Communications Act (consumer research) is amended asfollows.

(2)

After subsection (6A) insert—
“(6B)

(6C)

(3)

5

OFCOM must make arrangements for ascertaining—(a) the state of public opinion from time to time concerning
providers of regulated services and their manner of operating
their services;(b) the experiences of United Kingdom users of regulated services
in relation to their use of such services;(c) the experiences of United Kingdom users of regulated user-touser services and regulated search services in relation to thehandling of complaints made by them to providers of suchservices; and(d) the interests and experiences of United Kingdom users of
regulated services in relation to matters that are incidental to orotherwise connected with their experiences of using suchservices.

20

25

30

OFCOM’s report under paragraph 12 of the Schedule to the Office ofCommunications Act 2002 for each financial year must contain astatement by OFCOM about the research that has been carried out inthat year under subsection (6B).”

After subsection (8) insert—
“(8A)

15

In subsection (6B) the following terms have the same meaning as in theOnline Safety Act 2023—“provider” (see section 198 of that Act);“regulated service”, “regulated user-to-user service” and“regulated search service” (see section 3 of that Act);“United Kingdom user” (see section 199 of that Act).”

35

40

126

142

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 7 — Committees, research and reports

Consumer consultation(1)

Section 16 of the Communications Act (consumer consultation) is amended asfollows.

(2)

In subsection (4), after paragraph (d) insert—“(da) regulated services;”.

(3)

After subsection (5) insert—
“(5A)

(4)

5

As regards OFCOM’s functions under the Online Safety Act 2023 inrelation to regulated services—(a) the reference in subsection (5) to “the contents” of a thing
includes a reference to specific pieces of online content, but(b) subsection (5) is not to be read as preventing the Consumer
Panel from being able to give advice about any matter that moregenerally concerns—(i) different kinds of online content in relation to which
OFCOM have functions under that Act (see Parts 3 and
5 of that Act), and(ii) the impact that different kinds of such content may haveon United Kingdom users of regulated services.”

1015After subsection (12) insert—“(12A)

OFCOM’s report under paragraph 12 of the Schedule to the Office ofCommunications Act 2002 for each financial year must contain astatement by OFCOM about the arrangements for consultation thathave been made in that year under this section, so far as thearrangements relate to regulated services.”

20

(5)

In subsection (13), in the definition of “domestic and small business consumer”,
in paragraph (b)(i), after “available” insert “or a provider of a regulated
service”.

25(6)

After subsection (13) insert—
“(14)

143

144
(1)

In this section the following terms have the same meaning as in theOnline Safety Act 2023—“provider”, in relation to a regulated service (see section 198 ofthat Act);“regulated service” (see section 3 of that Act);“United Kingdom user” (see section 199 of that Act).”30

OFCOM’s statement about freedom of expression and privacy

35

OFCOM’s report under paragraph 12 of the Schedule to the Office ofCommunications Act 2002 for each financial year must contain a statement by
OFCOM about the steps they have taken, and the processes they operate, toensure that their online safety functions have been exercised in that year
compatibly with Articles 8 and 10 of the Convention (so far as relevant).

40

OFCOM’s reports about news publisher content and journalistic content
OFCOM must produce and publish a report assessing the impact of theregulatory framework provided for in this Act on the availability andOnline Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 7 — Committees, research and reports

127

treatment of news publisher content and journalistic content on Category 1
services (and in this section, references to a report are to a report described inthis subsection).
(2)

Unless the Secretary of State requires the production of a further report (seesubsection (6)), the requirement in subsection (1) is met by producing andpublishing one report within the period of two years beginning with the dayon which sections 14 and 15 come into force (or if those sections come into force
on different days, the period of two years beginning with the later of thosedays).

(3)

A report must, in particular, consider how effective the duties to protect suchcontent set out in sections 14 and 15 are at protecting it.

(4)

In preparing a report, OFCOM must consult—(a) persons who represent recognised news publishers,(b) persons who appear to OFCOM to represent creators of journalistic
content,(c) persons who appear to OFCOM to represent providers of Category 1
services, and(d) such other persons as OFCOM consider appropriate.

5

10

15

(5)

OFCOM must send a copy of a report to the Secretary of State, and theSecretary of State must lay it before Parliament.

20

(6)

The Secretary of State may require OFCOM to produce and publish a further
report if the Secretary of State considers that the regulatory frameworkprovided for in this Act is, or may be, having a detrimental effect on theavailability and treatment of news publisher content or journalistic content on
Category 1 services.

25

(7)

But such a requirement may not be imposed—(a) within the period of three years beginning with the date on which thefirst report is published, or(b) more frequently than once every three years.

(8)

For further provision about reports under this section, see section 147.

(9)

In this section—“journalistic content” has the meaning given by section 15;“news publisher content” has the meaning given by section 49;“recognised news publisher” has the meaning given by section 50.

(10)

For the meaning of “Category 1 service”, see section 86 (register of categories
of services).

145

OFCOM’s transparency reports

(1)

(2)

OFCOM must produce transparency reports based on information containedin the transparency reports produced by providers of Part 3 services under
section 68.
OFCOM’s transparency reports must contain—(a) a summary of conclusions drawn from the transparency reports
produced under section 68 regarding patterns or trends which OFCOM
have identified in such reports,

30

35

40

128

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 7 — Committees, research and reports

(b)
(c)
(3)

a summary of measures mentioned in such transparency reports which
OFCOM consider to be good industry practice, andany other information from such transparency reports which OFCOM
consider it appropriate to include.

OFCOM’s first transparency report must be published by the end of the periodof one year beginning with—(a) the day on which the first report under section 68 is published by aprovider of a Part 3 service (see subsection (3)(d) of that section), or(b) if later, the earliest date specified by OFCOM for submission of a reportunder section 68 in a notice given to a provider (see subsection (3)(c) ofthat section).

(4)

OFCOM must publish a transparency report at least once a year after the
publication of their first transparency report.

(5)

For further provision about reports under this section, see section 147.

146
(1)

5

10

OFCOM’s report about researchers’ access to information

15

OFCOM must produce a report—(a) describing how, and to what extent, persons carrying out independent
research into online safety matters are currently able to obtain
information from providers of regulated services to inform theirresearch,(b) exploring the legal and other issues which currently constrain the
sharing of information for such purposes, and(c) assessing the extent to which greater access to information for such
purposes might be achieved.

20

(2)

For the purposes of this section a person carries out “independent research” if
the person carries out research on behalf of a person other than a provider of aregulated service.

(3)

In preparing the report, OFCOM must consult—(a) the Information Commissioner,(b) the Centre for Data Ethics and Innovation,(c) United Kingdom Research and Innovation,(d) persons who appear to OFCOM to represent providers of regulated
services, and(e) such other persons as OFCOM consider appropriate.

(4)

OFCOM must publish the report within the period of two years beginning withthe day on which this section comes into force.

(5)

OFCOM must send a copy of the report to the Secretary of State, and theSecretary of State must lay it before Parliament.

(6)

For further provision about the report under this section, see section 147.

(7)

Following the publication of the report, OFCOM may produce guidance about
the matters dealt with by the report for providers of regulated services andpersons carrying out independent research into online safety matters.

(8)

If OFCOM decide to produce such guidance, they must—(a) consult persons as mentioned in subsection (3),

25

30

35

40

Online Safety Bill
Part 7 — OFCOM's powers and duties in relation to regulated services
Chapter 7 — Committees, research and reports

(b)
(c)
(9)
147

129

publish the guidance (and any revised guidance), andinclude in each transparency report under section 145 an assessment of
the effectiveness of the guidance.

Subsection (8)(a) also applies if OFCOM decide to revise the guidance.
OFCOM’s reports

5(1)

OFCOM may from time to time produce and publish reports about online
safety matters.

(2)

In publishing a report mentioned in subsection (5), OFCOM must have regard
to the need to exclude from publication, so far as that is practicable, the matterswhich are confidential in accordance with subsections (3) and (4).

(3)

A matter is confidential under this subsection if—(a) it relates specifically to the affairs of a particular body, and(b) publication of that matter would or might, in OFCOM’s opinion,
seriously and prejudicially affect the interests of that body.

(4)

A matter is confidential under this subsection if—(a) it relates to the private affairs of an individual, and(b) publication of that matter would or might, in OFCOM’s opinion,
seriously and prejudicially affect the interests of that individual.

(5)

The reports referred to in subsection (2) are—(a) a report under section 116 (report in connection with notices to deal
with terrorism content and CSEA content),(b) a report under section 144 (report about news publisher content andjournalistic content),(c) a report under section 145 (transparency report),(d) a report under section 146 (report about researchers’ access to
information), and(e) a report produced under this section.

(6)

10

15

20

25

See also section 105(3) (restriction on publishing intelligence service
information).
PART 830

APPEALS AND SUPER-COMPLAINTSCHAPTER 1
APPEALS
148(1)

Appeals against OFCOM decisions relating to the register under section 86
This section applies to the following decisions of OFCOM—(a) a decision to include a regulated user-to-user service in the part of theregister referred to in section 86(2)(a) (Category 1 services);(b) a decision not to remove a regulated user-to-user service from that partof the register;

35

130

Online Safety Bill
Part 8 — Appeals and super-complaints
Chapter 1 — Appeals

(c)
(d)
(e)
(f)

a decision to include a regulated search service or a combined service
in the part of the register referred to in section 86(2)(b) (Category 2A
services);a decision not to remove a regulated search service or a combined
service from that part of the register;a decision to include a regulated user-to-user service in the part of theregister referred to in section 86(2)(c) (Category 2B services);a decision not to remove a regulated user-to-user service from that partof the register.

(2)

The provider of the service to which the decision relates may appeal to theUpper Tribunal against the decision.

(3)

Where an appeal is made under subsection (1)(a), (c) or (e), any special
requirements need not be complied with until the determination orwithdrawal of the appeal.

(4)“Special requirement” means—(a) in the case of an appeal against a decision mentioned in subsection(1)(a)—(i) any duty or requirement of this Act that applies in relation toCategory 1 services but not in relation to any other regulated
services, or(ii) any duty or requirement of this Act that applies in relation toCategory 1 services, Category 2A services and Category 2B
services but not in relation to any other regulated services;(b) in the case of an appeal against a decision mentioned in subsection(1)(c)—(i) any duty or requirement of this Act that applies in relation toCategory 2A services but not in relation to any other regulated
services, or(ii) any duty or requirement of this Act that applies in relation toCategory 1 services, Category 2A services and Category 2B
services but not in relation to any other regulated services;(c) in the case of an appeal against a decision mentioned in subsection(1)(e), any duty or requirement of this Act that applies in relation toCategory 1 services, Category 2A services and Category 2B services but
not in relation to any other regulated services.

(5)

The Upper Tribunal must decide the appeal by applying the same principles aswould be applied—(a) by the High Court on an application for judicial review, or(b) in Scotland, on an application to the supervisory jurisdiction of the
Court of Session.

(6)

On an appeal under this section, the Upper Tribunal may—(a) dismiss the appeal, or(b) quash the decision being challenged.

(7)

Where a decision is quashed, the Upper Tribunal must remit the decision to
OFCOM for reconsideration with such directions (if any) as the Tribunal
considers appropriate.

5

10

15

20

25

30

35

40

45

131

Online Safety Bill
Part 8 — Appeals and super-complaints
Chapter 1 — Appeals

149
(1)

Appeals against OFCOM notices
An appeal to the Upper Tribunal against OFCOM’s decision to give to aperson—(a) a notice under section 110(1) (notices to deal with terrorism content and
CSEA content),(b) a confirmation decision, or(c) a penalty notice,
may be brought by any person with a sufficient interest in the decision.

5(2)

An appeal under subsection (1) by a person other than the person given thenotice or decision in question may be brought only with the permission (orleave) of the Upper Tribunal.

10

(3)

The Upper Tribunal must decide the appeal by applying the same principles aswould be applied—(a) by the High Court on an application for judicial review, or(b) in Scotland, on an application to the supervisory jurisdiction of the
Court of Session.

(4)

On an appeal under this section, the Upper Tribunal may—(a) dismiss the appeal, or(b) quash the decision being challenged.

(5)

Where a decision is quashed, the Upper Tribunal must remit the decision to
OFCOM for reconsideration with such directions (if any) as the Tribunal
considers appropriate.

(6)

In this section “penalty notice” means a penalty notice under section 126, 127(5)or 128(6).
CHAPTER 2

15

20

25

SUPER-COMPLAINTS
150
(1)

(2)

Power to make super-complaints
An eligible entity may make a complaint to OFCOM that any feature of one ormore regulated services, or any conduct of one or more providers of suchservices, or any combination of such features and such conduct is, appears tobe, or presents a material risk of—(a) causing significant harm to users of the services or members of the
public, or a particular group of such users or members of the public;(b) significantly adversely affecting the right to freedom of expression
within the law of users of the services or members of the public, or of aparticular group of such users or members of the public; or(c) otherwise having a significant adverse impact on users of the services
or members of the public, or on a particular group of such users or
members of the public.
But a complaint under subsection (1) that relates to a single regulated service
or that relates to a single provider of one or more regulated services is only
admissible if OFCOM consider that—(a) the complaint is of particular importance, or

30

35

40

132

Online Safety Bill
Part 8 — Appeals and super-complaints
Chapter 2 — Super-complaints(b)

the complaint relates to the impacts on a particularly large number ofusers of the service or members of the public.

(3)

An entity is an “eligible entity” if the entity meets criteria specified inregulations made by the Secretary of State.

(4)

Regulations under subsection (3) must specify as one of the criteria that theentity must be a body representing the interests of users of regulated services,or members of the public, or a particular group of such users or members of the
public.

(5)

Before making regulations under subsection (3), the Secretary of State must
consult—(a) OFCOM, and(b) such other persons as the Secretary of State considers appropriate.

(6)

In this section—“conduct” includes acts and omissions;“users” means United Kingdom users (see section 199), except in
subsection (1)(a) where “users” means individuals in the United
Kingdom who are users of a service.

151

10

15

Procedure for super-complaints(1)

The Secretary of State must make regulations containing provision aboutprocedural matters relating to complaints under section 150.

(2)

Such regulations may, in particular, include provision about the following
matters—(a) notification to OFCOM of an intention to make a complaint under
section 150;(b) the form and manner of such a complaint, including requirements forsupporting evidence in relation to—(i) matters mentioned in subsections (1) and (2) of section 150, and(ii) criteria specified in regulations under subsection (3) of that
section;(c) steps that OFCOM must take in relation to such a complaint, including
requirements for publication of responses;(d) time limits for taking steps in relation to such a complaint (or provision
about how such time limits are to be determined) including time limits
in relation to the determination of—(i) whether a complaint is a complaint that is within section 150(1),(ii) where applicable, whether a complaint is admissible under
section 150(2), and(iii) whether an entity is an eligible entity (see section 150(3)).

(3)

5Before making regulations under subsection (1), the Secretary of State must
consult—(a) OFCOM, and(b) such other persons as the Secretary of State considers appropriate.

20

25

30

35

40

133

Online Safety Bill
Part 8 — Appeals and super-complaints
Chapter 2 — Super-complaints

152
(1)

(2)

OFCOM’s guidance about super-complaints
OFCOM must produce guidance about complaints under section 150, whichmust include guidance about—(a) the criteria specified in regulations under section 150(3),(b) procedural matters relating to such complaints, and(c) any other aspect of such complaints that OFCOM consider it
appropriate to include.

5

OFCOM must publish the guidance (and any revised or replacement
guidance).
PART 910SECRETARY OF STATE'S FUNCTIONS IN RELATION TO REGULATED SERVICES
Strategic priorities
153

Statement of strategic priorities(1)

The Secretary of State may designate a statement for the purposes of thissection if the requirements set out in section 154 (consultation andparliamentary procedure) are satisfied.

(2)

The statement is a statement prepared by the Secretary of State that sets out
strategic priorities of His Majesty’s Government in the United Kingdom
relating to online safety matters.

(3)

The statement may, among other things, set out particular outcomes identified
with a view to achieving the strategic priorities.

(4)

This section does not restrict the Secretary of State’s powers under any otherprovision of this Act or any other enactment.

(5)

A statement designated under subsection (1) must be published in suchmanner as the Secretary of State considers appropriate.

25

(6)

A statement designated under subsection (1) may be amended (including by
replacing the whole or a part of the statement with new material) by asubsequent statement designated under that subsection, and this section andsections 83 and 154 apply in relation to any such subsequent statement as they
apply in relation to the original statement.

30

(7)

Except as provided by subsection (8), no amendment may be made undersubsection (6) within the period of five years beginning with the day on whicha statement was most recently designated under subsection (1).

(8)

An earlier amendment may be made under subsection (6) if—(a) since that day—(i) a Parliamentary general election has taken place, or(ii) there has been a significant change in the policy of His Majesty’s
Government affecting online safety matters, or(b) the Secretary of State considers that the statement, or any part of it,
conflicts with any of OFCOM’s general duties (within the meaning ofsection 3 of the Communications Act).

15

20

35

40

134
154

Online Safety Bill
Part 9 — Secretary of State's functions in relation to regulated services

Consultation and parliamentary procedure(1)

This section sets out the requirements that must be satisfied in relation to astatement before the Secretary of State may designate it under section 153.

(2)

The Secretary of State must consult—(a) OFCOM, and(b) such other persons as the Secretary of State considers appropriate,
on a draft of the statement.

(3)

The Secretary of State must allow OFCOM a period of at least 40 days torespond to any consultation under subsection (2)(a).

(4)

After that period has ended the Secretary of State—(a) must make any changes to the draft that appear to the Secretary of State
to be necessary in view of responses to the consultation, and(b) must then lay the draft before Parliament.

(5)

The Secretary of State must then wait until the end of the 40-day period andmay not designate the statement if, within that period, either House of
Parliament resolves not to approve it.

(6)“The 40-day period” is the period of 40 days beginning with the day on which
the draft is laid before Parliament (or, if it is not laid before each House on thesame day, the later of the days on which it is laid).

(7)

In calculating the 40-day period, no account is to be taken of any period during
which Parliament is dissolved or prorogued or during which both Houses areadjourned for more than 4 days.

5

10

15

20

Directions to OFCOM
155

Directions about advisory committees(1)

The Secretary of State may give OFCOM a direction requiring OFCOM toestablish a committee to provide them with advice about online safety mattersof a kind specified in the direction.

(2)

The Secretary of State must consult OFCOM before giving or varying such a
direction.

(3)

A committee required to be established by a direction is to consist of thefollowing members, unless the direction specifies otherwise—(a) a chairman appointed by OFCOM, and(b) such number of other members appointed by OFCOM as OFCOM
consider appropriate.

30

(4)

A committee required to be established by a direction must, unless the
direction specifies otherwise, publish a report within the period of 18 months
after being established, and after that must publish periodic reports.

35

(5)

The Secretary of State may vary or revoke a direction given under this section.

25

Online Safety Bill
Part 9 — Secretary of State's functions in relation to regulated services

156
(1)

(2)

135

Directions in special circumstances
The Secretary of State may give a direction to OFCOM under subsection (2) or(3) if the Secretary of State has reasonable grounds for believing thatcircumstances exist that present a threat—(a) to the health or safety of the public, or(b) to national security.
A direction under this subsection is a direction requiring OFCOM, inexercising their media literacy functions, to give priority for a specified period
to specified objectives designed to address the threat presented by thecircumstances mentioned in subsection (1).

(3)

A direction under this subsection is a direction requiring OFCOM to give apublic statement notice to—(a) a specified provider of a regulated service, or(b) providers of regulated services generally.

(4)

A “public statement notice” is a notice requiring a provider of a regulated
service to make a publicly available statement, by a date specified in the notice,about steps the provider is taking in response to the threat presented by thecircumstances mentioned in subsection (1).

(5)

OFCOM may, by a public statement notice or a subsequent notice, require a
provider of a regulated service to provide OFCOM with such information as
they may require for the purpose of responding to that threat.

(6)

If a direction under subsection (2) or (3) is given on the ground mentioned insubsection (1)(a), the Secretary of State must publish the reasons for giving thedirection.

(7)

The Secretary of State may vary or revoke a direction given under subsection(2) or (3).

(8)

If the Secretary of State varies or revokes a direction given under subsection (3),
OFCOM may, in consequence, vary or revoke a public statement notice thatthey have given by virtue of the direction.

(9)

In subsection (2) “media literacy functions” means OFCOM’s functions under
section 11 of the Communications Act (duty to promote media literacy), so far
as functions under that section relate to regulated services.

(10)

In subsections (2) and (3) “specified” means specified in a direction under thissection.
Guidance

157
(1)

5

10

15

20

25

30

35

Secretary of State’s guidance
The Secretary of State may issue guidance to OFCOM about—(a) OFCOM’s exercise of their functions under this Act,(b) OFCOM’s exercise of their powers under section 1(3) of theCommunications Act (functions and general powers of OFCOM) to
carry out research in connection with online safety matters or toarrange for others to carry out research in connection with suchmatters, and

40

136

Online Safety Bill
Part 9 — Secretary of State's functions in relation to regulated services

(c)
(2)

OFCOM’s exercise of their functions under section 11 of theCommunications Act (media literacy) in relation to regulated services.

In the rest of this section, “the guidance” means any such guidance as ismentioned in subsection (1), except that it does not include guidance under
section 78 (guidance to OFCOM about fees).

(3)

The Secretary of State must consult OFCOM before issuing, revising or
replacing the guidance.

(4)

The guidance may not be revised or replaced more frequently than once every
three years unless—(a) the guidance needs to be corrected because of an amendment, repeal or
modification of any provision of this Act or of section 11 of theCommunications Act, or(b) the revision or replacement is by agreement between the Secretary ofState and OFCOM.

(5)

The guidance must be issued as one document.

(6)

The Secretary of State must lay the guidance (including revised or replacement
guidance) before Parliament.

(7)

The Secretary of State must publish the guidance (and any revised or
replacement guidance).

(8)

In exercising any functions to which the guidance relates, or deciding whether
to exercise them, OFCOM must have regard to the guidance for the time being
published under this section.

5

10

15

20

Annual report
158

Annual report on the Secretary of State’s functions
In section 390 of the Communications Act (annual report on the Secretary ofState’s functions), in subsection (2), after paragraph (e) insert—“(f) the Online Safety Act 2023.”

25

Review
159

Review(1)

The Secretary of State must review the operation of—(a) the regulatory framework provided for in this Act, and(b) section 11 of the Communications Act, to the extent that that section
relates to regulated services.

(2)

The review—(a) must not be carried out before the end of the period of two years
beginning with the day on which the last of the provisions of Part 3
comes into force, but(b) must be carried out before the end of the period of five years beginningwith that day.

(3)

The review must, in particular, consider how effective the regulatory
framework provided for in this Act is at—

30

35

40

Online Safety Bill
Part 9 — Secretary of State's functions in relation to regulated services

(a)

(b)

(4)

137

securing that regulated services are operated using systems andprocesses that, so far as relevant—(i) minimise the risk of harm to individuals in the United Kingdom
presented by content on regulated services,(ii) provide higher levels of protection for children than for adults,(iii) provide transparency and accountability to users in relation toactions taken to comply with duties set out in Chapter 2, 3, 4 or
5 of Part 3, Chapter 1 or 3 of Part 4, or Part 5,(iv) protect the right of users and (in the case of search services or
combined services) interested persons to freedom of expression
within the law, and(v) protect users from a breach of any statutory provision or rule oflaw concerning privacy that is relevant to the use or operationof a regulated service (including, but not limited to, any suchprovision or rule concerning the processing of personal data);
andensuring that regulation of services is proportionate, having regard to
the level of risk of harm presented by regulated services of different
kinds and to the size and capacity of providers.

The review must also, in particular, consider—(a) the effectiveness of—(i) the information gathering and information sharing powers
available to OFCOM, and(ii) the enforcement powers available to OFCOM; and(b) the extent to which OFCOM have had regard to the desirability ofencouraging innovation by providers of regulated services.

(5)

In carrying out the review, the Secretary of State must consult—(a) OFCOM, and(b) such other persons as the Secretary of State considers appropriate.

(6)

In carrying out the review, the Secretary of State must take into account any
report published by OFCOM under section 144 (reports about news publisher
content and journalistic content).

(7)

The Secretary of State must produce and publish a report on the outcome of thereview.

(8)

The report must be laid before Parliament.

(9)

In subsection (3) “content on regulated services” means—(a) regulated user-generated content present on regulated services,(b) search content of regulated services,(c) fraudulent advertisements present on regulated services, and(d) regulated provider pornographic content published or displayed on
regulated services.

(10)

In subsection (9)—“fraudulent advertisement” has the meaning given by section 33 or 34(depending on the kind of service in question);“regulated user-generated content” has the same meaning as in Part 3 (seesection 49);

5

10

15

20

25

30

35

40

45

138

Online Safety Bill
Part 9 — Secretary of State's functions in relation to regulated services“regulated provider pornographic content” and “published or displayed”
have the same meaning as in Part 5 (see section 70);
“search content” has the same meaning as in Part 3 (see section 51).
PART 10
COMMUNICATIONS OFFENCES

5

Harmful, false and threatening communications offences
160
(1)

(2)

False communications offence
A person commits an offence if—(a) the person sends a message (see section 163),(b) the message conveys information that the person knows to be false,(c) at the time of sending it, the person intended the message, or the
information in it, to cause non-trivial psychological or physical harm toa likely audience, and(d) the person has no reasonable excuse for sending the message.
For the purposes of this offence an individual is a “likely audience” of amessage if, at the time the message is sent, it is reasonably foreseeable that theindividual—(a) would encounter the message, or(b) in the online context, would encounter a subsequent message
forwarding or sharing the content of the message.

(3)

In a case where several or many individuals are a likely audience, it is notnecessary for the purposes of subsection (1)(c) that the person intended tocause harm to any one of them in particular (or to all of them).

(4)

See section 161 for exemptions from the offence under this section.

(5)

A person who commits an offence under this section is liable on summaryconviction to imprisonment for a term not exceeding the maximum term forsummary offences or a fine (or both).

(6)

In subsection (5) “the maximum term for summary offences” means—(a) if the offence is committed before the time when section 281(5) of the
Criminal Justice Act 2003 comes into force, 6 months;(b) if the offence is committed after that time, 51 weeks.

(7)

Proceedings for an offence under this section may be brought within the periodof 6 months beginning with the date on which evidence sufficient in theopinion of the prosecutor to justify the proceedings comes to the prosecutor’s
knowledge.

(8)

But such proceedings may not be brought by virtue of subsection (7) more than
3 years after the commission of the offence.

(9)

A certificate signed by the prosecutor as to the date on which the evidence inquestion came to the prosecutor’s knowledge is conclusive evidence of the dateon which it did so; and a certificate to that effect and purporting to be so signed
is to be treated as being so signed unless the contrary is proved.

10

15

20

25

30

35

40

Online Safety Bill
Part 10 — Communications offences

161

139

Exemptions from offence under section 160(1)

A recognised news publisher cannot commit an offence under section 160.

(2)

An offence under section 160 cannot be committed by the holder of a licence
under the Broadcasting Act 1990 or 1996 in connection with anything done
under the authority of the licence.

(3)

An offence under section 160 cannot be committed by the holder of a multiplex
licence in connection with anything done under the authority of the licence.

(4)

An offence under section 160 cannot be committed by the provider of an ondemand programme service in connection with anything done in the course ofproviding such a service.

(5)

162
(1)

(2)

5

10

An offence under section 160 cannot be committed in connection with theshowing of a film made for cinema to members of the public.
Threatening communications offence
A person commits an offence if—(a) the person sends a message (see section 163),(b) the message conveys a threat of death or serious harm, and(c) at the time of sending it, the person—(i) intended an individual encountering the message to fear thatthe threat would be carried out, or(ii) was reckless as to whether an individual encountering themessage would fear that the threat would be carried out.
“Serious harm” means—(a) serious injury amounting to grievous bodily harm within the meaningof the Offences against the Person Act 1861,(b) rape,(c) assault by penetration within the meaning of section 2 of the Sexual
Offences Act 2003, or(d) serious financial loss.

(3)

In proceedings for an offence under this section relating to a threat of serious
financial loss, it is a defence for the person to show that—(a) the threat was used to reinforce a reasonable demand, and(b) the person reasonably believed that the use of the threat was a propermeans of reinforcing the demand.

(4)

If evidence is adduced which is sufficient to raise an issue with respect to thedefence under subsection (3), the court must assume that the defence issatisfied unless the prosecution proves beyond reasonable doubt that it is not.

(5)

A person who commits an offence under this section is liable—(a) on summary conviction, to imprisonment for a term not exceeding thegeneral limit in a magistrates’ court or a fine (or both);(b) on conviction on indictment, to imprisonment for a term not exceeding
five years or a fine (or both).

15

20

25

30

35

40

140
163

Online Safety Bill
Part 10 — Communications offences

Interpretation of sections 160 to 162(1)This section applies for the purposes of sections 160 to 162, and references inthis section to an offence are to an offence under section 160 or 162.

(2)

A person “sends a message” if the person—(a) sends, transmits or publishes a communication (including an oral
communication) by electronic means, or(b) sends, or gives to an individual, a letter or a thing of any otherdescription,and references to a message are to be read accordingly.

(3)

A person also “sends a message” if the person—(a) causes a communication (including an oral communication) to be sent,
transmitted or published by electronic means, or(b) causes a letter or a thing of any other description to be—(i) sent, or(ii) given to an individual.

(4)

But a provider of an internet service by means of which a communication issent, transmitted or published is not to be regarded as a person who sends a
message.

(5)“Encounter”, in relation to a message, means read, view, hear or otherwise
experience the message.

(6)

It does not matter whether the content of a message is created by the person
who sends it (so for example, in the online context, an offence may becommitted by a person who forwards another person’s direct message orshares another person’s post).

(7)

In the application of sections 160 to 162 to the sending by electronic means of amessage consisting of or including a hyperlink to other content—(a) references to the message are to be read as including references tocontent accessed directly via the hyperlink, and(b) an individual who is a likely audience in relation to the hyperlink forthe purposes of section 160 is to be assumed to be a likely audience inrelation to the linked content.

(8)

In the application of sections 160 to 162 to the sending of an item on which datais stored electronically, references to the message are to be read as including
content accessed by means of the item to which the recipient is specificallydirected by the sender (and in this subsection “sending” includes “giving”, and“sender” is to be read accordingly).

(9)

In the online context, the date on which a person commits an offence in relation
to a message is the date on which the message is first sent by the person.

(10)“Recognised news publisher” has the meaning given by section 50.

(11)“Multiplex licence” means a licence under section 8 of the Wireless Telegraphy
Act 2006 which authorises the provision of a multiplex service within themeaning of section 42(6) of that Act.

(12)

“On-demand programme service” has the same meaning as in theCommunications Act (see section 368A of that Act), and a person is the“provider” of an on-demand programme service if the person has given

5

10

15

20

25

30

35

40

45

Online Safety Bill
Part 10 — Communications offences141

notification of the person’s intention to provide that service in accordance withsection 368BA of that Act.
164
(1)

(2)

(3)

Offences of sending or showing flashing images electronically
A person (A) commits an offence if—(a) A sends a communication by electronic means which consists of or
includes flashing images (see subsection (13)),(b) either condition 1 or condition 2 is met, and(c) A has no reasonable excuse for sending the communication.
Condition 1 is that—(a) at the time the communication is sent, it is reasonably foreseeable thatan individual with epilepsy would be among the individuals who
would view it, and(b) A sends the communication with the intention that such an individual
will suffer harm as a result of viewing the flashing images.
Condition 2 is that, when sending the communication—(a) A believes that an individual (B)—(i) whom A knows to be an individual with epilepsy, or(ii) whom A suspects to be an individual with epilepsy,
will, or might, view it, and(b) A intends that B will suffer harm as a result of viewing the flashing
images.

(4)

In subsections (2)(a) and (3)(a), references to viewing the communication are to
be read as including references to viewing a subsequent communication
forwarding or sharing the content of the communication.

(5)

The exemptions contained in section 161 apply to an offence under subsection(1) as they apply to an offence under section 160.

(6)

For the purposes of subsection (1), a provider of an internet service by meansof which a communication is sent is not to be regarded as a person who sends
a communication.

(7)

In the application of subsection (1) to a communication consisting of or
including a hyperlink to other content, references to the communication are to
be read as including references to content accessed directly via the hyperlink.

(8)

A person (A) commits an offence if—(a) A shows an individual (B) flashing images by means of an electronic
communications device,(b) when showing the images—(i) A knows that B is an individual with epilepsy, or(ii) A suspects that B is an individual with epilepsy,(c) when showing the images, A intends that B will suffer harm as a resultof viewing them, and(d) A has no reasonable excuse for showing the images.

(9)

An offence under subsection (1) or (8) cannot be committed by a healthcare
professional acting in that capacity.

(10)

A person who commits an offence under subsection (1) or (8) is liable—

5

10

15

20

25

30

35

40

142

Online Safety Bill
Part 10 — Communications offences

(a)
(b)
(c)

on summary conviction in England and Wales, to imprisonment for aterm not exceeding the general limit in a magistrates’ court or a fine (orboth);
on summary conviction in Northern Ireland, to imprisonment for aterm not exceeding six months or a fine not exceeding the statutory
maximum (or both);on conviction on indictment, to imprisonment for a term not exceeding
five years or a fine (or both).

(11)

It does not matter for the purposes of this section whether flashing images may
be viewed at once (for example, a GIF that plays automatically) or only aftersome action is performed (for example, pressing play).

(12)

In this section—(a) references to sending a communication include references to causing acommunication to be sent;(b) references to showing flashing images include references to causing
flashing images to be shown.

(13)

In this section—“electronic communications device” means equipment or a device that is
capable of transmitting images by electronic means;“flashing images” means images which carry a risk that an individualwith photosensitive epilepsy who viewed them would suffer a seizure
as a result;“harm” means—(a) a seizure, or(b) alarm or distress;“individual with epilepsy” includes, but is not limited to, an individualwith photosensitive epilepsy;“send” includes transmit and publish (and related expressions are to beread accordingly).

(14)

This section extends to England and Wales and Northern Ireland.

165

Extra-territorial application and jurisdiction(1)

Sections 160(1) and 162(1) apply to an act done outside the United Kingdom,but only if the act is done by a person within subsection (2).

(2)

A person is within this subsection if the person is—(a) an individual who is habitually resident in England and Wales, or(b) a body incorporated or constituted under the law of England andWales.

(3)

Section 164(1) applies to an act done outside the United Kingdom, but only if
the act is done by a person within subsection (4).

(4)

A person is within this subsection if the person is—(a) an individual who is habitually resident in England and Wales orNorthern Ireland, or(b) a body incorporated or constituted under the law of England and Walesor Northern Ireland.

5

10

15

20

25

30

35

40

Online Safety Bill
Part 10 — Communications offences

143

(5)

Proceedings for an offence committed under section 160 or 162 outside theUnited Kingdom may be taken, and the offence may for incidental purposes betreated as having been committed, at any place in England and Wales.

(6)

Proceedings for an offence committed under section 164(1) outside the United
Kingdom may be taken, and the offence may for incidental purposes be treatedas having been committed, at any place in England and Wales or Northern
Ireland.

(7)

This section extends to England and Wales and Northern Ireland.

166
(1)

(2)

(3)

5

Liability of corporate officers
If an offence under section 160, 162 or 164 is committed by a body corporate
and it is proved that the offence—(a) has been committed with the consent or connivance of an officer of the
body corporate, or(b) is attributable to any neglect on the part of an officer of the body
corporate,
the officer (as well as the body corporate) commits the offence and is liable tobe proceeded against and punished accordingly.
“Officer”, in relation to a body corporate, means—(a) a director, manager, associate, secretary or other similar officer, or(b) a person purporting to act in any such capacity.
In paragraph (a) “director”, in relation to a body corporate whose affairs aremanaged by its members, means a member of the body corporate.

10

15

20

This section extends to England and Wales and Northern Ireland.
Offence of sending etc photograph or film of genitals

167

Sending etc photograph or film of genitals

25

In the Sexual Offences Act 2003, after section 66 insert—“66A Sending etc photograph or film of genitals
(1)

(2)

(3)

A person (A) who intentionally sends or gives a photograph or film ofany person’s genitals to another person (B) commits an offence if—(a) A intends that B will see the genitals and be caused alarm,
distress or humiliation, or(b) A sends or gives such a photograph or film for the purpose ofobtaining sexual gratification and is reckless as to whether B
will be caused alarm, distress or humiliation.
References to sending or giving such a photograph or film to anotherperson include, in particular—(a) sending it to another person by any means, electronically orotherwise,(b) showing it to another person, and(c) placing it for a particular person to find.
“Photograph” includes the negative as well as the positive version.

30

35

40

144

Online Safety Bill
Part 10 — Communications offences(4)“Film” means a moving image.

(5)

References to a photograph or film also include—(a) an image, whether made by computer graphics or in any otherway, which appears to be a photograph or film,(b) a copy of a photograph, film or image within paragraph (a), and(c) data stored by any means which is capable of conversion into a
photograph, film or image within paragraph (a).

(6)

A person who commits an offence under this section is liable—(a) on summary conviction, to imprisonment for a term notexceeding the general limit in a magistrates’ court or a fine (orboth);(b) on conviction on indictment, to imprisonment for a term notexceeding two years.”

5

10

Repeals and amendments in connection with offences
168

Repeals in connection with offences under sections 160 and 162(1)

Section 127(2)(a) and (b) of the Communications Act (false messages) is
repealed so far as it extends to England and Wales.

(2)

The following provisions of the Malicious Communications Act 1988 are
repealed—(a) section 1(1)(a)(ii),(b) section 1(1)(a)(iii), and(c) section 1(2).

169

15

20

Consequential amendments(1)Part 1 of Schedule 14 contains amendments consequential on sections 160, 162
and 164.

(2)Part 2 of Schedule 14 contains amendments consequential on section 167.

25

PART 11
SUPPLEMENTARY AND GENERAL
Providers' judgements about the status of content
170
(1)

(2)

Providers’ judgements about the status of content
This section sets out the approach to be taken where—(a) a system or process operated or used by a provider of a Part 3 service
for the purpose of compliance with relevant requirements, or(b) a risk assessment required to be carried out by Part 3,
involves a judgement by a provider about whether content is content of aparticular kind.
Such judgements are to be made on the basis of all relevant information that isreasonably available to a provider.

30

35

Online Safety Bill
Part 11 — Supplementary and general

(3)

(4)

145

In construing the reference to information that is reasonably available to a
provider, the following factors, in particular, are relevant—(a) the size and capacity of the provider, and(b) whether a judgement is made by human moderators, by means ofautomated systems or processes or by means of automated systems orprocesses together with human moderators.
Subsections (5) to (7) apply (as well as subsection (2)) in relation to judgements
by providers about whether content is—(a) illegal content, or illegal content of a particular kind, or(b) a fraudulent advertisement.

(5)

In making such judgements, the approach to be followed is whether a provider
has reasonable grounds to infer that content is content of the kind in question(and a provider must treat content as content of the kind in question if
reasonable grounds for that inference exist).

(6)

Reasonable grounds for that inference exist in relation to content and an
offence if, following the approach in subsection (2), a provider—(a) has reasonable grounds to infer that all elements necessary for thecommission of the offence, including mental elements, are present or
satisfied, and(b) does not have reasonable grounds to infer that a defence to the offence
may be successfully relied upon.

(7)

(8)

(9)

171

In the case of content generated by a bot or other automated tool, the tests
mentioned in subsection (6)(a) and (b) are to be applied in relation to the
conduct or mental state of a person who may be assumed to control the bot ortool (or, depending what a provider knows in a particular case, the actual
person who controls the bot or tool).
In considering a provider’s compliance with relevant requirements to which
this section is relevant, OFCOM may take into account whether providers’judgements follow the approaches set out in this section (including judgements
made by means of automated systems or processes, alone or together withhuman moderators).
In this section—“fraudulent advertisement” has the meaning given by section 33 or 34(depending on the kind of service in question);“illegal content” has the same meaning as in Part 3 (see section 53);
“relevant requirements” means—(a) duties and requirements under this Act, and(b) requirements of a notice given by OFCOM under this Act.

5

10

15

20

25

30

35

OFCOM’s guidance about illegal content judgements(1)

OFCOM must produce guidance for providers of Part 3 services about thematters dealt with in section 170 so far as relating to illegal content judgements.

(2)“Illegal content judgements” means judgements of a kind mentioned insubsection (4) of that section.

(3)

Before producing the guidance (including revised or replacement guidance),
OFCOM must consult such persons as they consider appropriate.

40

45

146
(4)

Online Safety Bill
Part 11 — Supplementary and general

OFCOM must publish the guidance (and any revised or replacement
guidance).
Liability of providers etc

172

Providers that are not legal persons(1)

In this section a “relevant entity” means an entity that—(a) is the provider of a regulated service, and(b) is not a legal person under the law under which it is formed.

(2)

If a penalty notice is given to a relevant entity (in the name of the entity), thepenalty must be paid out of the entity’s funds.

(3)

If a notice is given by OFCOM to a relevant entity (in the name of the entity)
under any provision of this Act, the notice continues to have effect despite achange in the membership of the entity.

(4)

If a penalty notice is given jointly to two or more officers or members of a
relevant entity, those individuals are jointly and severally liable to pay thepenalty under it.

(5)

In subsection (4) the reference to officers or members of a relevant entity
includes a reference to employees of such an entity or any other individuals
associated with such an entity.

(6)

In this section a “penalty notice” means—(a) a confirmation decision that imposes a penalty (see sections 120(5)(b)and 125),(b) a penalty notice under section 126,(c) a penalty notice under section 127(5), or(d) a penalty notice under section 128(6).

173Individuals providing regulated services: liability(1)This section applies in relation to two or more individuals who together are theprovider of a regulated service (see section 198(3), (5), (7), (9) and (11)).

(2)

Any duty or requirement imposed on such a provider under any of theprovisions specified in subsection (3), or any liability of such a provider to pay
a fee under section 75 or Schedule 10, is to be taken to be imposed on, or to bea liability of, all the individuals jointly and severally.

(3)

The provisions are—(a) Chapter 2 of Part 3 (providers of user-to-user services: duties of care);(b) Chapter 3 of Part 3 (providers of search services: duties of care);(c) Chapter 4 of Part 3 (children’s access assessments);(d) Chapter 5 of Part 3 (duties about fraudulent advertising);(e) Chapter 1 of Part 4 (user identity verification);(f) Chapter 2 of Part 4 (reporting CSEA content);(g) Chapter 3 of Part 4 (terms of service: transparency, accountability andfreedom of expression);(h) Chapter 4 of Part 4 (transparency reporting);(i) section 72 (provider pornographic content);

5

10

15

20

25

30

35

40

147

Online Safety Bill
Part 11 — Supplementary and general

(j)
(4)

section 74 (duty to notify OFCOM).

A notice in respect of a matter that may or must be given by OFCOM under any
provision of this Act may be given—(a) to only one of the individuals,(b) jointly to two or more of them, or(c) jointly to all of them,
but a separate notice may not be given to each of the individuals in respect ofthe matter.

(5)

If a penalty notice is given jointly to two or more individuals, those individuals
are jointly and severally liable to pay the penalty under it.

(6)

In subsection (5) a “penalty notice” means—(a) a confirmation decision that imposes a penalty (see sections 120(5)(b)and 125),(b) a penalty notice under section 126,(c) a penalty notice under section 127(5), or(d) a penalty notice under section 128(6).

174

(1)

(2)

10

15

Liability of parent entities etc
Schedule 15 contains provision about—(a) the giving of joint provisional notices of contravention to parent entities
etc,(b) the liability of parent entities for failures by subsidiary entities,(c) the liability of subsidiary entities for failures by parent entities,(d) the liability of fellow subsidiary entities for failures by subsidiary
entities, and(e) the liability of controlling individuals for failures by entities.

175

5

20

25

Former providers of regulated services
A power conferred by Chapter 6 of Part 7 (enforcement powers) to give a notice
to a provider of a regulated service is to be read as including power to give a
notice to a person who was, at the relevant time, a provider of such a service
but who has ceased to be a provider of such a service (and that Chapter and
Schedules 13 and 15 are to be read accordingly).
“The relevant time” means—(a) the time of the failure to which the notice relates, or(b) in the case of a notice which relates to the requirement in section 95(1)to co-operate with an investigation, the time of the failure or possible
failure to which the investigation relates.

30

35

Offences
176(1)

Information offences: supplementary
Proceedings against a person for an offence under section 98(1) or paragraph18(1)(b) of Schedule 12 may be brought only if—(a) OFCOM have given the person a provisional notice of contravention in
respect of the failure to comply with the requirements of an information

40

148

Online Safety Bill
Part 11 — Supplementary and general

(b)

(c)
(d)
(e)

notice or the requirements imposed by a person acting under Schedule
12 (as the case may be),
OFCOM have given the person a confirmation decision in respect ofthat failure imposing requirements of a kind described in section 121(1)and the time allowed for compliance with the decision has expired
without those requirements having been complied with,
OFCOM have not imposed a penalty on the person in respect of that
failure,a service restriction order under section 131 has not been made in
relation to a regulated service provided by the person in respect of that
failure, andan access restriction order under section 133 has not been made in
relation to a regulated service provided by the person in respect of that
failure.

(2)

Proceedings for an offence under section 99(2) (failure by named senior
manager to prevent offence under section 98(1)) may be brought only if theconditions in subsection (1) are met in respect of the offence under section
98(1).

(3)

Where a penalty is imposed on a person in respect of an act or omission
constituting an offence under section 62 or 98 or paragraph 18 of Schedule 12,
no proceedings may be brought against the person for that offence.

(4)

Where a penalty is imposed on an entity in respect of an act or omission
constituting an offence under section 98, no proceedings for an offence under
section 99 may be brought against an individual in respect of a failure toprevent that offence.

(5)

(6)

177

A penalty may not be imposed on a person in respect of an act or omission
constituting an offence under section 62 or 98 or paragraph 18 of Schedule 12if—(a) proceedings for the offence have been brought against the person but
have not been concluded, or(b) the person has been convicted of the offence.

Defences
Subsection (2) applies where a person relies on a defence under section 98 or 99.

(2)

If evidence is adduced which is sufficient to raise an issue with respect to thedefence, the court must assume that the defence is satisfied unless theprosecution proves beyond reasonable doubt that it is not.

(1)

10

15

20

25

30

In this section “penalty” means a penalty imposed by—(a) a confirmation decision (see sections 120(5)(b) and 125), or(b) a penalty notice under section 126.

(1)

178

5

Liability of corporate officers for offences
In this section a “relevant entity” means an entity that is—(a) the provider of a regulated service, and(b) a legal person under the law under which it is formed.

35

40

Online Safety Bill
Part 11 — Supplementary and general

(2)

(3)

(4)

(5)

179

149

If an offence is committed by a relevant entity and it is proved that theoffence—(a) has been committed with the consent or connivance of an officer of theentity, or(b) is attributable to any neglect on the part of an officer of the entity,
the officer (as well as the entity) commits the offence and (subject to section
176(1)) is liable to be proceeded against and punished accordingly.
In relation to an entity which is a body corporate, “officer” means—(a) a director, manager, associate, secretary or other similar officer, or(b) a person purporting to act in any such capacity.
In paragraph (a) “director”, in relation to a body corporate whose affairs aremanaged by its members, means a member of the body corporate.
In relation to a partnership which is not regarded as a body corporate under
the law under which it is formed, “officer” means—(a) a partner, or(b) a person purporting to act as a partner.
In this section—“body corporate” includes an entity incorporated outside the United
Kingdom;“offence” means an offence under this Act, except under Part 10.

5

10

15

20

Application of offences to providers that are not legal persons(1)

In this section a “relevant entity” means an entity that—(a) is the provider of a regulated service, and(b) is not a legal person under the law under which it is formed.

(2)

Proceedings for an offence alleged to have been committed by a relevant entity
must be brought against the entity in its own name (and not in that of any of its
officers or members).

(3)

For the purposes of such proceedings—(a) rules of court relating to the service of documents have effect as if theentity were a body corporate; and(b) the following provisions apply as they apply in relation to a body
corporate—(i) section 33 of the Criminal Justice Act 1925 and Schedule 3 to theMagistrates’ Courts Act 1980;(ii) section 18 of the Criminal Justice Act (Northern Ireland) 1945(c. 15 (N.I.)) and Article 166 of, and Schedule 4 to, theMagistrates’ Courts (Northern Ireland) Order 1981 (S.I. 1981/
1675 (N.I. 26)).

25

30

35

(4)

A fine imposed on a relevant entity on its conviction of an offence must be paidout of the entity’s funds.

40

(5)

If an offence is committed by a relevant entity and it is proved that theoffence—(a) has been committed with the consent or connivance of an officer of theentity, or(b) is attributable to any neglect on the part of an officer of the entity,

45

150

Online Safety Bill
Part 11 — Supplementary and general

the officer (as well as the entity) commits the offence and (subject to section
176(1)) is liable to be proceeded against and punished accordingly.
(6)

In relation to a partnership, “officer” means—(a) a partner, or(b) a person purporting to act as a partner.

(7)

In relation to a relevant entity other than a partnership, “officer” means—(a) an officer of the entity or a person concerned in the management orcontrol of the entity, or(b) a person purporting to act in such a capacity.

(8)

Subsection (2) is not to be read as prejudicing any liability of an officer undersubsection (5).

(9)

In this section “offence” means an offence under this Act, except under Part 10.

510Extra-territorial application
180

Extra-territorial application(1)

References in this Act to an internet service, a user-to-user service or a searchservice include such a service provided from outside the United Kingdom (aswell as such a service provided from within the United Kingdom).

(2)

The power to require the production of documents by an information noticeincludes power to require the production of documents held outside theUnited Kingdom.

(3)

The power conferred by section 96 includes power to require the attendance forinterview of an individual who is outside the United Kingdom.

(4)

Section 121(7) (requirements enforceable in civil proceedings against a person)
applies whether or not the person is in the United Kingdom.

181

Information offences: extra-territorial application and jurisdiction(1)

Sections 62, 98 and 101 apply to acts done by a person in the United Kingdom
or elsewhere (information offences).

(2)

Section 99 applies to acts done by an individual in the United Kingdom orelsewhere (offences by senior managers of providers of regulated services).

(3)

Sections 178(2) and 179(5), so far as relating to an offence under a section
specified in subsection (1) of this section, apply to acts done by an individualin the United Kingdom or elsewhere (liability of directors etc of providers of
regulated services).

(4)

In the case of an offence under section 62, 98, 99 or 101 which is committed
outside the United Kingdom—(a) proceedings for the offence may be taken at any place in the United
Kingdom, and(b) the offence may for all incidental purposes be treated as having beencommitted at any such place.

(5)

In the application of subsection (4) to Scotland, any such proceedings against aperson may be taken—

15

20

25

30

35

40

151

Online Safety Bill
Part 11 — Supplementary and general

(a)
(b)
(6)

in any sheriff court district in which the person is apprehended or is incustody, orin such sheriff court district as the Lord Advocate may determine.

In this section—“act” includes a failure to act;“sheriff court district” is to be construed in accordance with the Criminal
Procedure (Scotland) Act 1995 (see section 307(1) of that Act).

5

Payment of sums into Consolidated Fund
182

Payment of sums into the Consolidated Fund

(1)

Section 400 of the Communications Act (destination of penalties etc) is
amended as follows.

(2)

In subsection (1), after paragraph (i) insert—“(j) an amount paid to OFCOM in respect of a penalty imposed bythem under Chapter 6 of Part 7 of the Online Safety Act 2023;(k) an amount paid to OFCOM in respect of an additional fee
charged under Schedule 10 to the Online Safety Act 2023.”(3)

In subsection (2), after “applies” insert “(except an amount mentioned insubsection (1)(j) or (k))”.

(4)

After subsection (3) insert—
“(3A)

(5)

Where OFCOM receive an amount mentioned in subsection (1)(j) or (k),it must be paid into the Consolidated Fund of the United Kingdom.”

10

15

20

In the heading, omit “licence”.
Publication by OFCOM

183

Publication by OFCOM
Anything required by this Act to be published by OFCOM must be publishedin such manner as OFCOM consider appropriate for bringing it to the attentionof the persons who, in their opinion, are likely to be affected by it.

25

Service of notices
184

Service of notices(1)

This section applies in relation to a notice that may or must be given by
OFCOM to a person under any provision of this Act.

(2)

OFCOM may give a notice to a person by—(a) delivering it by hand to the person,(b) leaving it at the person’s proper address,(c) sending it by post to the person at that address, or(d) sending it by email to the person’s email address.

(3)

A notice to a body corporate may be given to any officer of that body.

30

35

152

Online Safety Bill
Part 11 — Supplementary and general(4)

A notice to a partnership may be given to any partner or to a person who has
the control or management of the partnership business.

(5)

A notice to an entity that is not a legal person under the law under which it isformed (other than a partnership) may be given to any member of thegoverning body of the entity.

(6)

(7)

(8)

(9)

(10)

In the case of a notice given to a person who is a provider of a regulated service,
the person’s proper address for the purposes of paragraphs (b) and (c) ofsubsection (2), and section 7 of the Interpretation Act 1978 in its application to
those paragraphs, is any address (within or outside the United Kingdom) at
which OFCOM believe, on reasonable grounds, that the notice will come to theattention of the person or (where the person is an entity) any director or otherofficer of that entity.
In the case of a notice given to a person other than a provider of a regulated
service, a person’s proper address for the purposes of paragraphs (b) and (c) ofsubsection (2), and section 7 of the Interpretation Act 1978 in its application to
those paragraphs, is—(a) in the case of an entity, the address of the entity’s registered or principal
office;(b) in any other case, the person’s last known address.
In the case of an entity registered or carrying on business outside the United
Kingdom, or with offices outside the United Kingdom, the reference insubsection (7) to its principal office includes its principal office in the United
Kingdom or, if the entity has no office in the United Kingdom, any place in the
United Kingdom at which OFCOM believe, on reasonable grounds, that thenotice will come to the attention of any director or other officer of that entity.
In the case of a notice given to an individual under section 96 (interviews), thereference in subsection (7) to the person’s last known address is to theindividual’s home address or, if the individual is currently connected with aprovider of a regulated service, the address of the provider’s registered orprincipal office.
For the purposes of subsection (2)(d), a person’s email address is—(a) any email address published for the time being by that person as anaddress for contacting that person, or(b) if there is no such published address, any email address by means ofwhich OFCOM believe, on reasonable grounds, that the notice will
come to the attention of that person or (where that person is an entity)
any director or other officer of that entity.

(11)

A notice sent by email is treated as given 48 hours after it was sent, unless thecontrary is proved.

(12)

In this section—“director” includes any person occupying the position of a director, bywhatever name called;“officer”, in relation to an entity, includes a director, a manager, a partner,
an associate, a secretary or, where the affairs of the entity are managed
by its members, a member.

5

10

15

20

25

30

35

40

45

153

Online Safety Bill
Part 11 — Supplementary and general

Repeals and amendments
185

Amendments of Part 4B of the Communications Act
Schedule 16 contains amendments of Part 4B of the Communications Act.

186

Repeal of Part 4B of the Communications Act(1)

In the Communications Act, omit Part 4B (video-sharing platform services).

(2)

In the Audiovisual Media Services Regulations 2020 (S.I. 2020/1062), omit Part
4 (which inserts Part 4B into the Communications Act).

(3)

In this Act, omit—(a) section 185, and(b) Schedule 16.

(4)

187
(1)

10

In the Audiovisual Media Services (Amendment) (EU Exit) Regulations 2020
(S.I. 2020/1536), omit regulation 4.
Repeal of Part 4B of the Communications Act: transitional provision etc
Schedule 17 contains transitional, transitory and saving provision—(a) about the application of this Act and Part 4B of the Communications
Act during a period before the repeal of Part 4B of the Communications
Act (or, in the case of Part 3 of Schedule 17, in respect of charging years
as mentioned in that Part);(b) in connection with the repeal of Part 4B of the Communications Act.

(2)

The Secretary of State may by regulations make transitional, transitory or
saving provision of the kind mentioned in subsection (1)(a) and (b).

(3)

Regulations under subsection (2) may amend or repeal—(a) Part 3 of Schedule 3;(b) Schedule 17.

(4)

Regulations under subsection (2) may, in particular, make provision about—(a) the application of Schedule 17 in relation to a service if the transitional
period in relation to that service ends on a date before the date when
section 186 comes into force;(b) the application of Part 3 of Schedule 17, including further provision
about the calculation of a provider’s non-Part 4B qualifying worldwide
revenue for the purposes of paragraph 19 of that Schedule;(c) the application of Schedule 10 (recovery of OFCOM’s initial costs), andin particular how fees chargeable under that Schedule may be
calculated, in respect of charging years to which Part 3 of Schedule 17
relates.

188

5

Repeals: Digital Economy Act 2017

(1)

The Digital Economy Act 2017 is amended as follows.

(2)

Omit—
(a) Part 3 (online pornography), and

15

20

25

30

35

154

Online Safety Bill
Part 11 — Supplementary and general

(b)
(3)

189

section 119(10) (power to extend that Part to the Channel Islands or theIsle of Man).

Omit section 103 (code of practice for providers of online social media
platforms).
Offence under the Obscene Publications Act 1959: OFCOM defence(1)

Section 2 of the Obscene Publications Act 1959 (prohibition of publication of
obscene matter) is amended in accordance with subsections (2) and (3).

(2)

After subsection (5) insert—
“(5A)

(3)

190

A person shall not be convicted of an offence against this section of the
publication of an obscene article if the person proves that—(a) at the time of the offence charged, the person was a member of
OFCOM, employed or engaged by OFCOM, or assisting
OFCOM in the exercise of any of their online safety functions(within the meaning of section 206 of the Online Safety Act2023), and(b) the person published the article for the purposes of OFCOM’s
exercise of any of those functions.”

In subsection (7)—(a) the words after “In this section” become paragraph (a), and(b) at the end of that paragraph, insert “;(b) “OFCOM” means the Office of Communications.”

5

10

15

20

Offences regarding indecent photographs of children: OFCOM defence
England and Wales(1)

Section 1B of the Protection of Children Act 1978 (defence to offence relating toindecent photographs of children) is amended in accordance with subsections(2) and (3).

(2)

In subsection (1)—(a) for “he”, in each place, substitute “the defendant”;(b) for “him”, in each place, substitute “the defendant”;(c) omit “or” at the end of paragraph (b);(d) at the end of paragraph (c) insert “, or(d) the defendant—(i) was at the time of the offence charged a memberof OFCOM, employed or engaged by OFCOM,
or assisting OFCOM in the exercise of any of
their online safety functions (within the meaningof section 206 of the Online Safety Act 2023), and(ii) made the photograph or pseudo-photograph forthe purposes of OFCOM’s exercise of any of
those functions.”(3)

After subsection (2) insert—“(3)

In this section “OFCOM” means the Office of Communications.”

25

30

35

40

155

Online Safety Bill
Part 11 — Supplementary and general

Scotland(4)

Section 52 of the Civic Government (Scotland) Act 1982 (indecent photographsof children) is amended in accordance with subsections (5) and (6).

(5)

After subsection (4) insert—
“(4A)

(6)

Where a person is charged with an offence under subsection (1)(a) ofmaking an indecent photograph or pseudo-photograph of a child, it
shall be a defence for the person to prove that—(a) at the time of the offence charged, the person was a member of
OFCOM, employed or engaged by OFCOM, or assisting
OFCOM in the exercise of any of their online safety functions(within the meaning of section 206 of the Online Safety Act2023), and(b) the person made the photograph or pseudo-photograph for the
purposes of OFCOM’s exercise of any of those functions.”

In subsection (8), after paragraph (d) insert—“(e) “OFCOM” means the Office of Communications.”

5

10

15

Northern Ireland
(7)

(8)

(9)

Article 3A of the Protection of Children (Northern Ireland) Order 1978 (S.I.
1978/1047 (N.I. 17)) (defence to offence relating to indecent photographs ofchildren) is amended in accordance with subsections (8) and (9).
In paragraph (1)—(a) for “he”, in each place, substitute “the defendant”;(b) for “him”, in each place, substitute “the defendant”;(c) omit “or” at the end of sub-paragraph (b);(d) at the end of sub-paragraph (c) insert “, or(d) the defendant—(i) was at the time of the offence charged a memberof OFCOM, employed or engaged by OFCOM,
or assisting OFCOM in the exercise of any of
their online safety functions (within the meaningof section 206 of the Online Safety Act 2023), and(ii) made the photograph or pseudo-photograph forthe purposes of OFCOM’s exercise of any of
those functions.”
After paragraph (2) insert—
“(3)

20

25

30

35

In this Article “OFCOM” means the Office of Communications.”
Powers to amend Act

191
(1)

Powers to amend section 35
The Secretary of State may by regulations amend section 35 (fraud etc
offences).
But the power to add an offence to that section is limited by subsections (2) and
(3).

40

156
(2)

(3)

(4)

Online Safety Bill
Part 11 — Supplementary and general

An offence may be added to section 35 only if the Secretary of State considers
it appropriate to do so because of—(a) the prevalence on Category 1 services of content (other than regulateduser-generated content) consisting of paid-for advertisements thatamount to that offence, or the prevalence in or via search results ofCategory 2A services of paid-for advertisements that amount to that
offence,(b) the risk of harm to individuals in the United Kingdom presented bysuch advertisements, and(c) the severity of that harm.
An offence may not be added to section 35 if—(a) the offence concerns—(i) the infringement of intellectual property rights,(ii) the safety or quality of goods (as opposed to what kind of goods
they are), or(iii) the performance of a service by a person not qualified toperform it; or(b) it is an offence under the Consumer Protection from Unfair Trading
Regulations 2008 (S.I. 2008/1277).
In this section—(a) “regulated user-generated content” has the same meaning as in Part 3(see section 49);(b) the words “in or via search results” are to be construed in accordancewith section 34;(c) references to advertisements that amount to an offence are to beconstrued in accordance with section 53 (see subsections (3), (11) and(12) of that section).

192

Powers to amend or repeal provisions relating to exempt content or services(1)

The Secretary of State may by regulations—(a) amend section 49(5), or(b) repeal section 49(2)(d) and (5), and make a consequential amendment
of sections 2(6), 4(2)(a) and 49(2)(f),
if the Secretary of State considers that it is appropriate to do so because of therisk of harm to individuals in the United Kingdom presented by one-to-one
live aural communications.

(2)

Subject to subsection (3), the Secretary of State may by regulations amend
section 49(2)(e), (6) or (7) if the Secretary of State considers that it is appropriate
to do so because of the risk of harm to individuals in the United Kingdom
presented by comments and reviews on provider content.

(3)

Regulations under subsection (2) may not have the effect that comments andreviews on provider content present on a service of which the provider is arecognised news publisher become regulated user-generated content within
the meaning of Part 3.

(4)

The Secretary of State may by regulations amend Part 1 of Schedule 1 toprovide for a further description of user-to-user service or search service to be
exempt, if the Secretary of State considers that the risk of harm to individuals
in the United Kingdom presented by a service of that description is low.

5

10

15

20

25

30

35

40

45

Online Safety Bill
Part 11 — Supplementary and general

157

(5)

Regulations under subsection (4) may amend sections 2, 4 and 49 and Schedule
2 in connection with the amendment of Part 1 of Schedule 1.

(6)

The Secretary of State may by regulations amend Schedule 9 to provide for afurther description of internet service to be included, if the Secretary of State
considers that the risk of harm to children in the United Kingdom presented byregulated provider pornographic content published or displayed on a serviceof that description is low.

(7)

If the condition in subsection (8) is met, the Secretary of State may by
regulations amend or repeal either of the following—(a) paragraph 3 of Schedule 1 (services offering only one-to-one live aural
communications);(b) any provision of that Schedule added in exercise of the power
conferred by subsection (4).

(8)

The condition is that the Secretary of State considers that it is appropriate toamend or repeal the provision in question (as the case may be) because of therisk of harm to individuals in the United Kingdom presented by a service of thedescription in question.

(9)

Subject to subsection (10), the Secretary of State may by regulations amend
paragraph 4 of Schedule 1 (limited functionality services) if the Secretary ofState considers that it is appropriate because of the risk of harm to individuals
in the United Kingdom presented by a service described in that paragraph.

5

10

15

20

(10)

Regulations under subsection (9) may not have the effect that a service
described in paragraph 4 of Schedule 1 of which the provider is a recognised
news publisher is no longer exempt under that paragraph.

(11)

Regulations under subsection (7) may amend or repeal a provision of Schedule
2 in connection with the amendment or repeal of a provision of Part 1 of
Schedule 1.

(12)

Regulations under subsection (7)(b) may amend or repeal a provision ofsections 2, 4 and 49 in connection with the amendment or repeal of a provisionof Part 1 of Schedule 1.

30

The Secretary of State may by regulations amend or repeal any provision of
Schedule 9 added in exercise of the power conferred by subsection (6), if theSecretary of State considers that it is appropriate to do so because of the risk ofharm to children in the United Kingdom presented by regulated provider
pornographic content published or displayed on a service of that description.

35

(13)

(14)

193

In this section—“comments and reviews on provider content” and “one-to-one live aural
communications” have the meaning given by section 49;“recognised news publisher” has the meaning given by section 50;“regulated provider pornographic content” and “published or displayed”
have the same meaning as in Part 5 (see section 70).

25

40Powers to amend Part 2 of Schedule 1
England(1)

The Secretary of State may by regulations amend the part of the list in Part 2 of
Schedule 1 which relates to England—

45

158

Online Safety Bill
Part 11 — Supplementary and general

(a)
(b)

(c)

(2)

if there has been an amendment or repeal of legislation, or of aprovision of legislation, by reference to which a description of
education or childcare is framed;to add a further description of education or childcare, if the Secretary ofState considers that it is appropriate to do so because of the applicationof enactments other than this Act, or guidance or requirements(however referred to) produced under enactments other than this Act,to persons providing education or childcare of that description;
to omit a description of education or childcare, if the Secretary of State
considers that it is appropriate to do so because of the risk of harm toindividuals in England presented by services provided by persons
providing education or childcare of that description which areprovided for the purposes of such education or childcare (other than aservice described in paragraph 7 of Schedule 1).

In subsection (1)(b), “enactment” includes an enactment contained insubordinate legislation (within the meaning of the Interpretation Act 1978).

5

10

15

Scotland(3)(4)

The Scottish Ministers may by regulations amend the part of the list in Part 2of Schedule 1 which relates to Scotland—(a) if there has been an amendment or repeal of legislation, or of aprovision of legislation, by reference to which a description of
education or childcare is framed;(b) to add a further description of education or childcare, if the Scottish
Ministers consider that it is appropriate to do so because of theapplication of enactments other than this Act, or guidance or
requirements (however referred to) produced under enactments otherthan this Act, to persons providing education or childcare of that
description;(c) to omit a description of education or childcare, if the Scottish Ministers
consider that it is appropriate to do so because of the risk of harm toindividuals in Scotland presented by services provided by persons
providing education or childcare of that description which areprovided for the purposes of such education or childcare (other than aservice described in paragraph 7 of Schedule 1).
In subsection (3)(b), “enactment” includes an enactment contained in, or in an
instrument made under, an Act of the Scottish Parliament.

20

25

30

35

Wales
(5)

The Welsh Ministers may by regulations made by statutory instrument amend
the part of the list in Part 2 of Schedule 1 which relates to Wales—(a) if there has been an amendment or repeal of legislation, or of aprovision of legislation, by reference to which a description of
education or childcare is framed;(b) to add a further description of education or childcare, if the Welsh
Ministers consider that it is appropriate to do so because of theapplication of enactments other than this Act, or guidance or
requirements (however referred to) produced under enactments otherthan this Act, to persons providing education or childcare of that
description;(c) to omit a description of education or childcare, if the Welsh Ministers
consider that it is appropriate to do so because of the risk of harm to

40

45

50

Online Safety Bill
Part 11 — Supplementary and general

159

individuals in Wales presented by services provided by persons
providing education or childcare of that description which areprovided for the purposes of such education or childcare (other than aservice described in paragraph 7 of Schedule 1).
(6)

In subsection (5)(b), “enactment” includes an enactment contained in, or in an
instrument made under, a Measure or Act of Senedd Cymru.

5Northern Ireland
(7)

(8)

(9)

The relevant Department may by regulations amend the part of the list in Part
2 of Schedule 1 which relates to Northern Ireland—(a) if there has been an amendment or repeal of legislation, or of aprovision of legislation, by reference to which a description of
education or childcare is framed;(b) to add a further description of education or childcare, if the relevant
Department considers that it is appropriate to do so because of theapplication of enactments other than this Act, or guidance or
requirements (however referred to) produced under enactments otherthan this Act, to persons providing education or childcare of that
description;(c) to omit a description of education or childcare, if the relevant
Department considers that it is appropriate to do so because of the riskof harm to individuals in Northern Ireland presented by services
provided by persons providing education or childcare of that
description which are provided for the purposes of such education or
childcare (other than a service described in paragraph 7 of Schedule 1).
In subsection (7), “the relevant Department” means—(a) where the amendment relates to childcare, primary education orsecondary education, the Department of Education in Northern
Ireland;(b) where the amendment relates to further education or higher education,
the Department for the Economy in Northern Ireland with theconcurrence of the Department of Agriculture, Environment and Rural
Affairs in Northern Ireland, or the Department of Agriculture,
Environment and Rural Affairs in Northern Ireland with theconcurrence of the Department for the Economy in Northern Ireland;(c) where the amendment relates to education in agriculture and related
subjects, the Department of Agriculture, Environment and Rural
Affairs in Northern Ireland.

15

20

25

30

35

In subsection (7)(b), “enactment” includes an enactment contained in, or in an
instrument made under, Northern Ireland legislation.
Interpretation

(10)

10

In this section, the following terms have the same meaning as in Schedule 1—“childcare”;“education”;“education in agriculture and related subjects”;“further education”;“higher education”;“primary education”;“secondary education”.

40

45

160
194

Online Safety Bill
Part 11 — Supplementary and general

Powers to amend Schedules 5, 6 and 7(1)

The Secretary of State may by regulations amend—(a) Schedule 5 (terrorism offences);(b) Part 1 of Schedule 6 (child sexual exploitation and abuse offences).

(2)

The Scottish Ministers may by regulations amend Part 2 of Schedule 6.

(3)

The Secretary of State may by regulations amend Schedule 7 (priority
offences).
But an offence may be added to that Schedule only on the grounds insubsection (4) or (5), and subsection (6) limits the power to add an offence.

(4)

The first ground for adding an offence to Schedule 7 is that the Secretary ofState considers it appropriate to do so because of—(a) the prevalence on regulated user-to-user services of regulated usergenerated content that amounts to that offence, or the prevalence on
regulated search services and combined services of search content thatamounts to that offence,(b) the risk of harm to individuals in the United Kingdom presented byregulated user-generated content or search content that amounts to that
offence, and(c) the severity of that harm.

10

The second ground for adding an offence to Schedule 7 is that the Secretary ofState considers it appropriate to do so because of—(a) the prevalence of the use of regulated user-to-user services for thecommission or facilitation of that offence,(b) the risk of harm to individuals in the United Kingdom presented by theuse of such services for the commission or facilitation of that offence,and(c) the severity of that harm.

20

(5)

(6)

(7)

(8)

An offence may not be added to Schedule 7 if—(a) the offence concerns—(i) the infringement of intellectual property rights,(ii) the safety or quality of goods (as opposed to what kind of goods
they are), or(iii) the performance of a service by a person not qualified toperform it; or(b) it is an offence under the Consumer Protection from Unfair Trading
Regulations 2008 (S.I. 2008/1277).
The Secretary of State must consult the Scottish Ministers before making
regulations under subsection (3) which—(a) add an offence that extends only to Scotland, or(b) amend or remove an entry specifying an offence that extends only to
Scotland.
The Secretary of State must consult the Department of Justice in Northern
Ireland before making regulations under subsection (3) which—(a) add an offence that extends only to Northern Ireland, or(b) amend or remove an entry specifying an offence that extends only to
Northern Ireland.

5

15

25

30

35

40

45

161

Online Safety Bill
Part 11 — Supplementary and general(9)

In this section—(a) “regulated user-generated content” has the same meaning as in Part 3(see section 49);(b) “search content” has the same meaning as in Part 3 (see section 51);(c) references to content that amounts to an offence are to be construed inaccordance with section 53 (see subsections (3), (11) and (12) of that
section).

5

Regulations
195

Power to make consequential provision(1)

The Secretary of State may by regulations make provision that is consequential
on this Act or regulations under this Act.

(2)

The regulations may—(a) amend or repeal provision made by the Communications Act;(b) amend or revoke provision made under that Act.

(3)

The regulations may make transitional, transitory or saving provision.

196
(1)

(2)

Regulations under this Act may make different provision for different
purposes and may, in particular—(a) make different provision with regard to—(i) user-to-user services,(ii) search services, and(iii) internet services, other than regulated user-to-user services orregulated search services, that are within section 71(2);(b) make different provision with regard to user-to-user services ofdifferent kinds;(c) make different provision with regard to search services of different
kinds;(d) make different provision with regard to different kinds of services
mentioned in paragraph (a)(iii);(e) make different provision with regard to different kinds of internet
services within section 71(2).
A power to make regulations under this Act includes power to makesupplementary, incidental, transitional, transitory or saving provision.
This subsection does not apply to regulations under section 195 (consequential
provision).
Any power of the Secretary of State under this Act to make regulations is
exercisable by statutory instrument.

(4)This section does not apply to regulations under section 211 (commencement
and transitional provision).

(1)

15

Regulations: general

(3)

197

10

Parliamentary procedure for regulations
A statutory instrument containing (whether alone or with other provision)—

20

25

30

35

40

162

Online Safety Bill
Part 11 — Supplementary and general

(a)
(b)
(c)
(d)
(e)
(f)
(g)
(h)
(i)

regulations under section 68(12),regulations under section 103(2),regulations under section 150(3),regulations under section 187(2),regulations under section 191(1),regulations under section 192(1), (2), (4), (6), (7), (9) or (13),regulations under section 193(1),regulations under section 194(1) or (3),regulations under section 195 that amend or repeal provision made by
the Communications Act,(j) regulations under paragraph 7 of Schedule 4,(k) regulations under paragraph 34 of Schedule 8, or(k) regulations under paragraph 7 of Schedule 10,
may not be made unless a draft of the instrument has been laid before, andapproved by a resolution of, each House of Parliament.
(2)

A statutory instrument containing regulations under section 54(2) or (3) may
not be made unless a draft of the instrument has been laid before, andapproved by a resolution of, each House of Parliament.

(3)

But a statutory instrument mentioned in subsection (2) may be made without
a draft of the instrument being laid before, and approved by a resolution of,each House of Parliament if it contains a declaration that the Secretary of Stateis of the opinion that, because of urgency, it is necessary to make theregulations without a draft being so laid and approved.

(4)

After an instrument is made in accordance with subsection (3), it must be laid
before Parliament.

(5)

Regulations contained in an instrument made in accordance with subsection(3) cease to have effect at the end of the period of 28 days beginning with the
day on which the instrument is made unless, during that period, theinstrument is approved by a resolution of each House of Parliament.

(6)

In calculating the period of 28 days, no account is to be taken of any whole days
that fall within a period during which—(a) Parliament is dissolved or prorogued, or(b) either House of Parliament is adjourned for more than 4 days.

(7)

If regulations cease to have effect as a result of subsection (5), that does not—(a) affect the validity of anything previously done under or by virtue of theregulations, or(b) prevent the making of new regulations.

(8)

A statutory instrument containing—(a) regulations under section 60(1),(b) regulations under section 74(3)(b),(c) regulations under section 151(1),(d) regulations under section 195 that do not amend or repeal provision
made by the Communications Act,(e) regulations under paragraph 7(1) of Schedule 3, or(f) regulations under paragraph 1(1), (2) or (3) of Schedule 11,
is subject to annulment in pursuance of a resolution of either House of
Parliament.

5

10

15

20

25

30

35

40

45

163

Online Safety Bill
Part 11 — Supplementary and general(9)

Regulations made by the Scottish Ministers under—(a) section 193(3), and(b) section 194(2),are subject to the affirmative procedure (see section 29 of the Interpretation andLegislative Reform (Scotland) Act 2010 (asp 10)).

(10)

A statutory instrument containing regulations under section 193(5) may not bemade by the Welsh Ministers unless a draft of the instrument has been laid
before and approved by a resolution of Senedd Cymru.

(11)

The power of the relevant Department to make regulations under section
193(7) is exercisable by statutory rule for the purposes of the Statutory Rules(Northern Ireland) Order 1979 (S.I. 1979/1573 (N.I. 12)).

(12)Regulations may not be made by the relevant Department under section 193(7)unless a draft of the regulations has been laid before and approved by aresolution of the Northern Ireland Assembly.

(13)

In subsections (11) and (12), “the relevant Department” has the same meaning
as in section 193(7) (see subsection (8) of that section).

5

10

15

PART 12INTERPRETATION AND FINAL PROVISIONSInterpretation
198(1)“Provider” of internet service

20

This section applies to determine who is the “provider” of an internet service
for the purposes of this Act.
User-to-user services (other than combined services)(2)

The provider of a user-to-user service is to be treated as being the entity thathas control over who can use the user-to-user part of the service (and that
entity alone).

(3)

If no entity has control over who can use the user-to-user part of a user-to-userservice, but an individual or individuals have control over who can use thatpart, the provider of the service is to be treated as being that individual or thoseindividuals.

25

30

Search services(4)

The provider of a search service is to be treated as being the entity that hascontrol over the operations of the search engine (and that entity alone).

(5)

If no entity has control over the operations of the search engine, but anindividual or individuals have control over those operations, the provider ofthe search service is to be treated as being that individual or those individuals.

35

Combined services(6)

The provider of a combined service is to be treated as being the entity that hascontrol over both—(a) who can use the user-to-user part of the service, and

40

164

Online Safety Bill
Part 12 — Interpretation and final provisions(b) the operations of the search engine,(and that entity alone).
(7)

If no entity has control over the matters mentioned in paragraphs (a) and (b) ofsubsection (6), but an individual or individuals have control over both thosematters, the provider of the combined service is to be treated as being that
individual or those individuals.

5Internet services other than user-to-user services or search services
(8)

(9)

The provider of an internet service, other than a user-to-user service or a searchservice, is to be treated as being the entity that has control over which content
is published or displayed on the service.

10

If no entity has control over which content is published or displayed on suchan internet service, but an individual or individuals have control over which
content is published or displayed, the provider of the service is to be treated as
being that individual or those individuals.
Machine-generated services(10)

The provider of an internet service that is generated by a machine is to betreated as being the entity that controls the machine (and that entity alone).

(11)

If no entity controls the machine, but an individual or individuals control it, theprovider of the internet service is to be treated as being that individual or thoseindividuals.

15

20

Interpretation(12)

A person who provides an access facility in relation to a user-to-user service,
within the meaning of section 133, is not to be regarded as a person who has
control over who can use the user-to-user part of the service for the purposesof this section.

(13)

In this section “operations of the search engine” means operations which—(a) enable users of a search service or a combined service to make searchrequests, and(b) generate responses to those requests.

(14)

In this section “published or displayed” is to be construed in accordance withsection 70(5).

199“User”, “United Kingdom user” and “interested person”(1)

For the purposes of this Act a user is a “United Kingdom user” of a service if—(a) where the user is an individual, the individual is in the United
Kingdom;(b) where the user is an entity, the entity is incorporated or formed under
the law of any part of the United Kingdom.

(2)

For the purposes of references in this Act to a user of a service it does not matter
whether a person is registered to use a service.

(3)

References in this Act to a user of a service do not include references to any of
the following when acting in the course of the provider’s business—

25

30

35

40

Online Safety Bill
Part 12 — Interpretation and final provisions

(a)
(b)
(c)
(d)
(4)

165

where the provider of the service is an individual or individuals, that
individual or those individuals;
where the provider is an entity, officers of the entity;
persons who work for the provider (including as employees orvolunteers);
any other person providing a business service to the provider such as acontractor, consultant or auditor.

In subsection (3) “acting in the course of the provider’s business” means (as thecase may be)—(a) acting in the course of the provider’s business of providing the service,or(b) acting in the course of a business, trade, profession or other concern—(i) carried on (whether or not for profit) by the provider of theservice, and(ii) for the purposes of which the service is provided.

(5)

In subsections (1) to (4) “service” (except in the term “business service”) meansinternet service, user-to-user service or search service.

(6)

In subsection (3) “officer” includes a director, manager, partner, associate,secretary or other similar officer.

(7)

In this Act “interested person”, in relation to a search service or a combined
service, means a person that is responsible for a website or database capable ofbeing searched by the search engine, provided that—(a) in the case of an individual, the individual is in the United Kingdom;(b) in the case of an entity, the entity is incorporated or formed under thelaw of any part of the United Kingdom.

200

In this Act “internet service” means a service that is made available by meansof the internet.

(2)

For the purposes of subsection (1) a service is “made available by means of theinternet” even where it is made available by means of a combination of—(a) the internet, and(b) an electronic communications service.

(3)“Electronic communications service” has the same meaning as in theCommunications Act (see section 32(2) of that Act).

(1)

(2)

10

15

20

25

“Internet service”

(1)

201

5

“Search engine”
In this Act “search engine”—(a) includes a service or functionality which enables a person to searchsome websites or databases (as well as a service or functionality whichenables a person to search (in principle) all websites or databases);(b) does not include a service which enables a person to search just one
website or database.
For the purposes of this Act, a search engine is not to be taken to be “included”
in an internet service or a user-to-user service if the search engine is controlled
by a person who does not control other parts of the service.

30

35

40

166
202
(1)

(2)

Online Safety Bill
Part 12 — Interpretation and final provisions“Proactive technology”
In this Act “proactive technology” means—(a) content moderation technology,(b) user profiling technology, or(c) behaviour identification technology,
but this is subject to subsections (3) and (7).
“Content moderation technology” means technology, such as algorithms,
keyword matching, image matching or image classification, which—(a) analyses relevant content to assess whether it is illegal content orcontent that is harmful to children, or(b) analyses content to assess whether it is a fraudulent advertisement.

(3)

But content moderation technology is not to be regarded as proactive
technology if it is used in response to a report from a user or other person about
particular content.

(4)“User profiling technology” means technology which analyses (any or all of)—(a) relevant content,(b) user data, or(c) metadata relating to relevant content or user data,
for the purposes of building a profile of a user to assess characteristics such as
age.

(5)

(6)

Technology which—(a) analyses data specifically provided by a user for the purposes of theprovider assessing or establishing the user’s age in order to decide
whether to allow the user to access a service (or part of a service) or
particular content, and(b) does not analyse any other data or content,
is not to be regarded as user profiling technology.
“Behaviour identification technology” means technology which analyses (anyor all of)—(a) relevant content,(b) user data, or(c) metadata relating to relevant content or user data,to assess a user’s online behaviour or patterns of online behaviour (forexample, to assess whether a user may be involved in, or be the victim of,illegal activity).

(7)

But behaviour identification technology is not to be regarded as proactive
technology if it is used in response to concerns identified by another person or
an automated tool about a particular user.

(8)“Relevant content” means—(a) in relation to a user-to-user service, content that is user-generated
content in relation to the service;(b) in relation to a search service, the content of websites and databases
capable of being searched by the search engine.

(9)“User data” means—(a) data provided by users, including personal data (for example, data
provided when a user sets up an account), and

5

10

15

20

25

30

35

40

45

Online Safety Bill
Part 12 — Interpretation and final provisions

(b)

167

data created, compiled or obtained by providers of Part 3 services andrelating to users (for example, data relating to when or where users
access a service or how they use it).

(10)

References in this Act to proactive technology include content moderation
technology, user profiling technology or behaviour identification technology
which utilises artificial intelligence or machine learning.

(11)

Accredited technology that may be required to be used in relation to thedetection of terrorism content or CSEA content (or both) by a notice under
section 110(1) is an example of content moderation technology.

(12)

The reference in subsection (8)(b) to a search service includes a reference to thesearch engine of a combined service.

(13)

In this section—“accredited” technology has the same meaning as in Chapter 5 of Part 7(see section 113(12));“content that is harmful to children” has the same meaning as in Part 3(see section 54);
“fraudulent advertisement” has the meaning given by section 33 or 34(depending on the kind of service in question);“illegal content”, “terrorism content” and “CSEA content” have the same
meaning as in Part 3 (see section 53);
“user-generated content” has the meaning given by section 49 (seesubsections (3) and (4) of that section).

203
(1)

(2)

(3)

5

10

15

20

Content communicated “publicly” or “privately”
This section specifies factors which OFCOM must, in particular, consider when
deciding whether content is communicated “publicly” or “privately” by meansof a user-to-user service for the purposes of—(a) section 110 (notice to deal with terrorism content),(b) section 124 (requirement to use proactive technology), or(c) paragraph 12(4) of Schedule 4 (recommendation of proactive
technology in codes of practice).
The factors are—(a) the number of individuals in the United Kingdom who are able toaccess the content by means of the service;(b) any restrictions on who may access the content by means of the service(for example, a requirement for approval or permission from a user, or
the provider, of the service);(c) the ease with which the content may be forwarded to or shared withusers of the service other than those who originally encounter it.
The following factors do not count as restrictions on access—(a) a requirement to log in to or register with a service (or part of a service);(b) a requirement to make a payment or take out a subscription in order toaccess a service (or part of a service) or to access particular content;(c) inability to access a service (or part of a service) or to access particular
content except by using particular technology or a particular kind of
device (as long as that technology or device is generally available to the
public).

25

30

35

40

45

168
204
(1)

(2)

(3)

(4)

205

Online Safety Bill
Part 12 — Interpretation and final provisions“Functionality”
In this Act “functionality”, in relation to a user-to-user service, includes any
feature that enables interactions of any description between users of the service
by means of the service, and includes any feature enabling a user to do
anything listed in subsection (2).
The things are—(a) creating a user profile, including an anonymous or pseudonymous
profile;(b) searching within the service for user-generated content or other usersof the service;(c) forwarding content to, or sharing content with, other users of theservice;(d) sharing content on other internet services;(e) sending direct messages to or speaking to other users of the service, orinteracting with them in another way (for example by playing a game);(f) expressing a view on content, including, for example, by—(i) applying a “like” or “dislike” button or other button of thatnature,(ii) applying an emoji or symbol of any kind,(iii) engaging in yes/no voting, or(iv) rating or scoring content in any way (including giving star or
numerical ratings);(g) sharing current or historic location information with other users of theservice, recording a user’s movements, or identifying which other usersof the service are nearby;(h) following or subscribing to particular kinds of content or particularusers of the service;(i) creating lists, collections, archives or directories of content or users of
the service;(j) tagging or labelling content present on the service;(k) uploading content relating to goods or services;(l) applying or changing settings on the service which affect thepresentation of user-generated content on the service;(m) accessing other internet services through content present on the service(for example through hyperlinks).
In this Act “functionality”, in relation to a search service, includes (inparticular)—(a) a feature that enables users to search websites or databases;(b) a feature that makes suggestions relating to users’ search requests(predictive search functionality).

5

10

15

20

25

30

35

40

In this section “user-generated content” has the meaning given by section 49(see subsections (3) and (4) of that section).
“Harm” etc(1)This section applies for the purposes of this Act, apart from Part 10(communications offences).

(2)“Harm” means physical or psychological harm.

45

Online Safety Bill
Part 12 — Interpretation and final provisions

(3)

(4)

169

References to harm presented by content, and any other references to harm in
relation to content, include references to harm arising or that may arise fromany one or combination of the following—(a) the nature of the content;(b) the fact of its dissemination;(c) the manner of its dissemination (for example, content repeatedly sent
to an individual by one person or by different people).
References to harm presented by content, and any other references to harm in
relation to content, include references to harm arising or that may arise in thefollowing circumstances—(a) where, as a result of the content, individuals act in a way that results inharm to themselves or that increases the likelihood of harm tothemselves;(b) where, as a result of the content, individuals do or say something toanother individual that results in harm to that other individual or that
increases the likelihood of such harm (including, but not limited to,where individuals act in such a way as a result of content that is related
to that other individual’s characteristics or membership of a group).

(5)

References to a risk of harm, or to potential harm, are to be read in the same
way as references to harm.

(6)

In contexts where harm (or a risk of harm or potential harm) relates to children,
subsections (3) and (4) are to be read as if they referred to children instead ofindividuals.

206
(1)

(2)

5

10

15

20

“Online safety functions” and “online safety matters”
In this Act references to OFCOM’s “online safety functions”—(a) are references to—(i) the functions that OFCOM have under this Act,(ii) the functions that OFCOM have under the provisions of theCommunications Act listed in subsection (2), so far as thosefunctions relate to regulated services or Part 3 services (as thecase may be), and(iii) the functions that OFCOM have under section 3 of theCommunications Act (general duties), so far as duties underthat section relate to a function which is an online safetyfunction by reason of sub-paragraph (i) or (ii);(b) include references to OFCOM’s power to do anything appearing tothem to be incidental or conducive to the carrying out of any of theirfunctions within paragraph (a)(i) or (ii) (see section 1(3) of theCommunications Act).

25

These are the provisions of the Communications Act referred to in subsection(1)(a)(ii)—(a) section 6 (duties to review regulatory burdens);(b) section 7 (duty to carry out impact assessments);(c) section 8 (duty to publish and meet promptness standards);(d) section 11 (duty to promote media literacy);(e) sections 12 and 13 (Content Board);(f) section 14(6)(a) (research about media literacy);

40

30

35

45

170

Online Safety Bill
Part 12 — Interpretation and final provisions

(g)
(h)
(i)
(j)
(k)
(l)
(3)

207
(1)

section 14(6B) (research about users’ experience of regulated services);
section 16 (consumer consultation);section 20 (advisory committees for different parts of the United
Kingdom);
section 21 (advisory committee on elderly and disabled persons);
section 22 (representation on international and other bodies);
section 26 (publication of information and advice for consumers etc).

5

In this Act “online safety matters” means the matters to which OFCOM’s
online safety functions relate.
Interpretation: generalIn this Act—
“adult” means a person aged 18 or over;“age assurance” means measures designed to estimate or verify the age or
age-range of users of a service;“audit notice” means a notice given under paragraph 4 of Schedule 12;“capacity”: any reference to the capacity of a provider of a regulated
service is to—(a) the financial resources of the provider, and(b) the level of technical expertise which is available to theprovider, or which it is reasonable to expect would be available
to the provider given its size and financial resources;“child” means a person under the age of 18;“the Communications Act” means the Communications Act 2003;“confirmation decision” means a notice given under section 120;“content” means anything communicated by means of an internet service,
whether publicly or privately, including written material or messages,
oral communications, photographs, videos, visual images, music anddata of any description;“the Convention” has the meaning given by section 21(1) of the Human
Rights Act 1998;“country” includes territory;“document” means anything in which information (in whatever form) isrecorded;“encounter”, in relation to content, means read, view, hear or otherwise
experience content;“entity” means a body or association of persons or an organisation,
regardless of whether the body, association or organisation is—(a) formed under the law of any part of the United Kingdom or ofa country outside the United Kingdom, or(b) a legal person under the law under which it is formed;“identifying content” means content the function of which is to identify auser of an internet service (for example, a user name or profile picture);“information notice” means a notice given under section 91(1);“measure”: any reference to a measure includes a reference to any systemor process relevant to the operation of an internet service or any step or
action which may be taken by a provider of an internet service tocomply with duties or requirements under this Act;“notice” means notice in writing;

10

15

20

25

30

35

40

45

Online Safety Bill
Part 12 — Interpretation and final provisions

171“notify” means notify in writing, and “notification” is to be construed
accordingly;“OFCOM” means the Office of Communications;“paid-for advertisement”: an advertisement is a “paid-for advertisement”
in relation to an internet service if—(a) the provider of the service receives any consideration(monetary or non-monetary) for the advertisement (whether
directly from the advertiser or indirectly from another person),and(b) the placement of the advertisement is determined by systems orprocesses that are agreed between the parties entering into thecontract relating to the advertisement;“person” includes (in addition to an individual and a body of persons
corporate or unincorporate) any organisation or association of persons;“personal data” has the meaning given by section 3(2) of the Data
Protection Act 2018;“processing” has the meaning given by section 3(4) of the Data Protection
Act 2018;“provisional notice of contravention” means a notice given under section
118;“publicly available” means available to members of the public in the
United Kingdom;“systems and/or processes”: any reference to systems and/or processes is
to human or automated systems and/or processes, and accordingly
includes technologies;“taking down” (content): any reference to taking down content is to any
action that results in content being removed from a user-to-user service
or being permanently hidden so users of the service cannot encounterit (and related expressions are to be read accordingly);“terms of service”, in relation to a user-to-user service, means all
documents (whatever they are called) comprising the contract for useof the service (or of part of it) by United Kingdom users;“user-to-user part”, in relation to a user-to-user service, means the part ofthe service on which content that is user-generated content in relation
to the service is present.
(2)

The definitions of “encounter” and “person” in subsection (1) do not apply forthe purposes of Part 10 (for the definition of “encounter” in that Part, seesection 163(5)).

(3)

References in this Act to a kind of user-to-user service or search service (or Part
3 service) include references to user-to-user services or search services grouped
together for the purposes of a risk profile prepared by OFCOM under section
89 (and references to different kinds of user-to-user services or search services(or Part 3 services) are to be read accordingly).

(4)

References in this Act to content (or content of a particular description) present
or prevalent on a user-to-user service (or on a part of it), or to the presence,incidence or prevalence of content (or content of a particular description) on auser-to-user service (or on a part of it), do not include, in the case of a user-touser service that includes a search engine—(a) search content, or(b) any other content that, following a search request, may be encounteredas a result of subsequent interactions with internet services.

5

10

15

20

25

30

35

40

45

50

172

Online Safety Bill
Part 12 — Interpretation and final provisions

In this subsection “search content” and “search request” have the same
meaning as in Part 3 (see section 51).
(5)

For the purposes of this Act—(a) any reference to the use of or access to a service, or to content present,
published or displayed on a service, is to be taken to include use of oraccess to the service or content on registering or on the making of apayment or on subscription;(b) any reference to content that is made available or that may be accessed,
encountered or shared, is to be taken to include content that is madeavailable or that may be accessed, encountered or shared for a limited
period of time only;
and references to restrictions on access to a service or to content are to be readaccordingly.

(6)

For the purposes of this Act, content that is user-generated content in relation
to an internet service does not cease to be such content in relation to the service
when published or displayed on the service by means of software or an
automated tool or algorithm applied by the provider of the service or applied
by a person acting on behalf of that provider.

(7)

Nothing in this Act (other than section 188) affects any prohibition or
restriction in relation to pornographic content (within the meaning of section
70(2)), or powers in relation to such content, under another enactment or ruleof law.

(8)

In this section, “user-generated content” has the meaning given by section 49(see subsections (3) and (4) of that section).

208

5

10

15

20

25

Index of defined terms
The following table sets out terms defined or explained for this Act or for a Partof this Act.

Term

Provision

adult

section 207

age assurance

section 207

audit noticesection 207

capacity (of a provider)section 207

Category 1 service

section 86(10)(a)Category 2A service

section 86(10)(b)Category 2B service

section 86(10)(c)charging year (in Part 6)

section 81

childsection 207

children’s access assessment (in Part 3)

section 30

30

35

173

Online Safety Bill
Part 12 — Interpretation and final provisions

Term

Provision

combined service

section 3(7)the Communications Act

section 207

confirmation decisionsection 207

content

section 207

content that is harmful to children (in Part 3)

section 54

the Convention

section 207

country

section 207

CSEA content (in Part 3)

section 53

document

section 207

encounter (content) (except in Part 10)

section 207

entitysection 207functionality

section 204

harm (except in Part 10)

section 205

identifying content

section 207

illegal content (in Part 3)

section 53

information noticesection 207

initial charging year (in Part 6)

section 81

interested person

section 199

internet service

section 200 (see also
section 180(1))

journalistic content (in Part 3)

section 15

likely to be accessed by children (in Part 3)

section 32

measuresection 207

news publisher content (in Part 3)

section 49(8) to (10)non-designated content that is harmful tochildren (in Part 3)

section 54

noticesection 207

notify, notification

section 207

OFCOM

section 207

online safety functions

section 206

online safety matterssection 206

5

10

15

20

25

30

174

Online Safety Bill
Part 12 — Interpretation and final provisions

Term

Provision

paid-for advertisement

section 207

Part 3 service

section 3(3)person (except in Part 10)

section 207

personal data

section 207

pornographic content (in Part 5)

section 70

primary priority content that is harmful tochildren (in Part 3)

section 54

priority content that is harmful to children(in Part 3)

section 54

priority illegal content (in Part 3)

section 53

priority offence (in Part 3)

section 53

proactive technology

section 202

processing (of data)

section 207

providersection 198

provider pornographic content (in Part 5)

section 70

provisional notice of contravention

section 207

publicly available

section 207

publicly/privately(incommunication of content)

relationtosection 203

published or displayed (in relation topornographic content) (in Part 5)

section 70

recognised news publisher (in Part 3)

section 50

regulated provider pornographic content (inPart 5)section 70

regulated search service

section 3(2)regulated service

section 3(4)regulated user-generated content (in Part 3)

section 49

regulated user-to-user service

section 3(2)restricting users’ access to content (in Part 3)

section 52

searchsection 51

search content

section 51

search engine

section 201

5

10

15

20

25

30

175

Online Safety Bill
Part 12 — Interpretation and final provisions

Term

Provision

search request

section 51

search results

section 51

search service

section 2 (see also
section 180(1))

systems and/or processes

section 207

taking down (content)

section 207

terms of service

section 207

terrorism content (in Part 3)

section 53

United Kingdom user

section 199

user

section 199

user-generated content (in Part 3)

section 49(3) and (4)user-to-user part (of a service)section 207

user-to-user service

section 2 (see also
section 180(1))

5

10

15

Final provisions
209

Financial provisions
There is to be paid out of money provided by Parliament—(a) any expenditure incurred under or by virtue of this Act by the Secretaryof State, and(b) any increase attributable to this Act in the sums payable under any
other Act out of money so provided.

210

20

Extent(1)

Except as provided by subsections (2) to (7), this Act extends to England andWales, Scotland and Northern Ireland.

(2)

In Part 10 (communications offences)—(a) sections 160 to 166 extend to England and Wales only;(b) section 168(1) extends to England and Wales only.

(3)

Section 168(2) extends to England and Wales and Northern Ireland.

(4)

The following provisions extend to England and Wales only—(a) section 167;(b) section 189;(c) section 190(1) to (3).

(5)

Section 190(4) to (6) extends to Scotland only.

(6)

Section 190(7) to (9) extends to Northern Ireland only.

25

30

35

176

Online Safety Bill
Part 12 — Interpretation and final provisions(7)

An amendment or repeal made by Schedule 14 has the same extent within the
United Kingdom as the provision amended or repealed.

(8)

The power conferred by section 411(6) of the Communications Act may be
exercised so as to extend to any of the Channel Islands or the Isle of Man therepeal of provisions of section 127 of that Act made by section 168(1).

(9)

The power conferred by section 338 of the Criminal Justice Act 2003 may be
exercised so as to extend to any of the Channel Islands or the Isle of Man theamendment of provisions of that Act made by paragraph 7 of Schedule 14.

(10)

The power conferred by section 60(6) of the Modern Slavery Act 2015 may be
exercised so as to extend to any of the Channel Islands or the Isle of Man theamendment of Schedule 4 to that Act made by paragraph 9 of Schedule 14.

(11)

The power conferred by section 415(1) of the Sentencing Act 2020 may be
exercised so as to extend to any of the Channel Islands or the Isle of Man theamendment of Schedule 18 to that Act made by paragraph 10 of Schedule 14.

211

Commencement and transitional provision(1)

The following provisions come into force on the day on which this Act ispassed—(a) Part 1;(b) sections 2 and 3 and Schedules 1 and 2;(c) Chapter 1 of Part 3;(d) sections 49 to 51;(e) section 53 and Schedules 5, 6 and 7;(f) sections 54 and 55;(g) section 70;(h) section 71(4);(i) section 180(1);(j) section 188;(k) sections 193 to 197;(l) this Part.

(2)

The other provisions of this Act come into force on such day as the Secretary ofState may by regulations appoint.

(3)

The power to make regulations under subsection (2) includes power to appoint
different days for different purposes.

(4)

Regulations under subsection (2) may not bring section 186 into force before
the end of the period of six months beginning with the date specified inregulations under paragraph 7(1) of Schedule 3.

(5)

The Secretary of State may by regulations make transitional, transitory or
saving provision in connection with the coming into force of any provision ofthis Act.

(6)

The power to make regulations under subsection (5) includes power to makedifferent provision for different purposes.

(7)

Regulations under this section are to be made by statutory instrument.

5

10

15

20

25

30

35

40

Online Safety Bill
Part 12 — Interpretation and final provisions

212

Short title
This Act may be cited as the Online Safety Act 2023.

177

178

Online Safety Bill
Schedule 1 — Exempt user-to-user and search services

SCHEDULESSCHEDULE 1

Sections 2 and 3

EXEMPT USER-TO-USER AND SEARCH SERVICESPART 1DESCRIPTIONS OF SERVICES WHICH ARE EXEMPT

5

Email services
1

A user-to-user service is exempt if emails are the only user-generated
content (other than identifying content) enabled by the service.

SMS and MMS services
2(1) A user-to-user service is exempt if SMS messages are the only usergenerated content (other than identifying content) enabled by the service.

10(2) A user-to-user service is exempt if MMS messages are the only usergenerated content (other than identifying content) enabled by the service.
(3) A user-to-user service is exempt if SMS messages and MMS messages are theonly user-generated content (other than identifying content) enabled by theservice.

15(4) “SMS message” and “MMS message” have the meaning given by section
49(12).
Services offering only one-to-one live aural communications
3(1) A user-to-user service is exempt if one-to-one live aural communications are
the only user-generated content (other than identifying content) enabled by
the service.

20(2) “One-to-one live aural communications” has the meaning given by section
49(5).
Limited functionality services
4(1) A user-to-user service is exempt if the functionalities of the service arelimited, such that users are able to communicate by means of the service
only in the following ways—(a) posting comments or reviews relating to provider content;(b) sharing such comments or reviews on a different internet service;(c) expressing a view on such comments or reviews, or on provider
content, by means of—25

30

Online Safety Bill
Schedule 1 — Exempt user-to-user and search services
Part 1 — Descriptions of services which are exempt

179

(i)

(d)

applying a “like” or “dislike” button or other button of thatnature,(ii) applying an emoji or symbol of any kind,(iii) engaging in yes/no voting, or(iv) rating or scoring the content (or the comments or reviews) inany way (including giving star or numerical ratings);
producing or displaying identifying content in connection with anyof the activities described in paragraphs (a) to (c).

(2) In sub-paragraph (1), “provider content” means content published on aservice by the provider of the service or by a person acting on behalf of theprovider (including where the publication of the content is effected orcontrolled by means of software or an automated tool or algorithm appliedby the provider or by a person acting on behalf of the provider).
(3) For the purposes of this paragraph, content that is user-generated content inrelation to a service is not to be regarded as provider content in relation tothat service.

5

10

15

Services which enable combinations of user-generated content
5

A user-to-user service is exempt if the only user-generated content enabledby the service is content of the following kinds—(a) content mentioned in paragraph 1, 2 or 3 and related identifying
content;(b) content arising in connection with any of the activities described inparagraph 4(1).

20

Exception to exemptions in paragraphs 1 to 5
6

But a a user-to-user service described in any of paragraphs 1 to 5 is notexempt if—(a) regulated provider pornographic content is published or displayedon the service, and(b) the service has links with the United Kingdom within the meaning ofsection 71(4).

2530Internal business services (entire user-to-user service or search service)7(1) A user-to-user service or a search service is exempt if the conditions in subparagraph (2) are met in relation to the service.
(2) The conditions are—(a) the user-to-user service or search service is an internal resource ortool for a business, or for more than one business carried on by thesame person,(b) the person carrying on the business (or businesses) (“P”) is theprovider of the user-to-user service or search service, and(c) the user-to-user service or search service is available only to a closed
group of people comprising some or all of the following—(i) where P is an individual or individuals, that individual or
those individuals,(ii) where P is an entity, officers of P,

35

40

180

Online Safety Bill
Schedule 1 — Exempt user-to-user and search services
Part 1 — Descriptions of services which are exempt

(iii)
(iv)

persons who work for P (including as employees orvolunteers) for the purposes of any activities of the business(or any of the businesses) in question, andany other persons authorised by a person within subparagraph (i), (ii) or (iii) to use the service for the purposes ofany activities of the business (or any of the businesses) inquestion (for example, a contractor, consultant or auditor, orin the case of an educational institution, pupils or students).

(3) In this paragraph—“business” includes trade, profession, educational institution or otherconcern (whether or not carried on for profit);“officer” includes a director, manager, partner, associate, secretary,
governor, trustee or other similar officer.

510Internal business services (part of user-to-user service or search service)8(1) A user-to-user service is exempt if—(a) the conditions in paragraph 7(2) are met in relation to a part of theservice,(b) no user-generated content is enabled by the rest of the service, and(c) no regulated provider pornographic content is published ordisplayed on the rest of the service.
(2) A user-to-user service is also exempt if—(a) the conditions in paragraph 7(2) are met in relation to a part of theservice,(b) the only user-generated content enabled by the rest of the service is—(i) content mentioned in paragraph 1, 2 or 3 and related
identifying content, or(ii) content arising in connection with any of the activities
described in paragraph 4(1), and(c) no regulated provider pornographic content is published ordisplayed on the rest of the service.
(3) A search service is exempt if—(a) the conditions in paragraph 7(2) are met in relation to a part of theservice that is a search engine,(b) the service does not include a public search engine, and(c) no regulated provider pornographic content is published ordisplayed on the rest of the service.
(4) In this paragraph—“public search engine” means a search engine other than one in relation
to which the conditions in paragraph 7(2) are met;“the rest of the service” means all parts of the user-to-user service or
search service other than the part in relation to which the conditions
in paragraph 7(2) are met.

15

20

25

30

35

40

Services provided by public bodies
9(1) A user-to-user service or a search service is exempt if—(a) both of the following conditions are met in relation to the service—45

Online Safety Bill
Schedule 1 — Exempt user-to-user and search services
Part 1 — Descriptions of services which are exempt

181

(i)

(b)
(c)
(d)

the provider of the service is a public authority within themeaning of section 6 of the Human Rights Act 1998, and(ii) the service is provided in the exercise of public functions
only,
the provider of the service is Parliament, either House of Parliament,
the Scottish Parliament, Senedd Cymru, the Northern Ireland
Assembly or a person acting on behalf of any of those institutions,the provider of the service is a foreign sovereign power, orboth of the following conditions are met in relation to the service—(i) the provider of the service is an entity formed under the lawof a country outside the United Kingdom, which exercises
functions of a public nature, and(ii) the service is provided in the exercise of such functions only.

(2) But a user-to-user service or a search service is not exempt under thisparagraph if—(a) the provider of the service is a person providing education or
childcare, and(b) the service is provided for the purposes of that education or
childcare.
See paragraph 10 for an exemption for services provided by persons
providing education or childcare of particular descriptions.

5

10

15

20

(3) This paragraph is without prejudice to the fact that this Act does not apply
in relation to a user-to-user or search service provided by the Crown.
(4) In this paragraph, “public function” means a function that is a function of apublic nature for the purposes of the Human Rights Act 1998.

25

Services provided by persons providing education or childcare
10(1) A user-to-user service or a search service is exempt if—(a) the provider of the service is—(i) the person with legal responsibility for education or childcareof a description listed in Part 2 of this Schedule (“theresponsible person”), or where the responsible person is abody, a member of that body, or(ii) a person who is employed or engaged to provide educationor childcare of a description listed in Part 2 of this Schedule,
and who is subject to safeguarding duties which relate to theprovision of that education or childcare, and(b) the service is provided for the purposes of that education or
childcare.
(2) In sub-paragraph (1)(a)(ii), “safeguarding duties” means duties or
requirements which are related to the safeguarding of children arising underenactments other than this Act, under guidance or requirements (howeverreferred to) produced under enactments other than this Act, or as a result ofcontractual arrangements made by the responsible person.
(3) For the purposes of this paragraph, the person with legal responsibility foreducation or childcare of a particular description is the person with legal
responsibility for its day-to-day provision (for example, the person withlegal responsibility for a particular school), rather than any other person
who has a duty to ensure that, in general, education or childcare of that

30

35

40

45

182

Online Safety Bill
Schedule 1 — Exempt user-to-user and search services
Part 1 — Descriptions of services which are exempt

description (or education or childcare which includes education or childcareof that description) is provided.
Interpretation
11

In Part 1 of this Schedule—“enactment” includes—(a) an enactment contained in subordinate legislation (within themeaning of the Interpretation Act 1978),(b) an enactment contained in, or in an instrument made under,an Act of the Scottish Parliament,(c) an enactment contained in, or in an instrument made under,a Measure or Act of Senedd Cymru, and(d) an enactment contained in, or in an instrument made under,
Northern Ireland legislation;“regulated provider pornographic content” and “published ordisplayed” have the same meaning as in Part 5 (see section 70);
“user-generated content” has the meaning given by section 49 (seesubsections (3) and (4) of that section).

5

10

15

PART 2PARAGRAPH 10 EXEMPTION: DESCRIPTIONS OF EDUCATION AND CHILDCARE
England20

12

Early years childminding by an early years childminder registered under
Chapter 2 of Part 3 of the Childcare Act 2006.

13

Early years provision by a person registered under Chapter 2 of Part 3 of that
Act.

14

Later years childminding by a later years childminder registered under
Chapter 3 of Part 3 of that Act.

15

Later years provision by a person registered under Chapter 3 of Part 3 of that
Act.

16

Education or childcare in a maintained nursery school within the meaningof section 22 of the School Standards and Framework Act 1998.

17

Education or childcare in—(a) an Academy school, within the meaning of section 1A of the
Academies Act 2010;(b) an alternate provision Academy, within the meaning of section 1C ofthat Act;(c) a maintained school, within the meaning of the School Standards andFramework Act 1998 (see section 20(7) of that Act);(d) a non-maintained special school, being a school that is approved
under section 342 of the Education Act 1996;(e) an independent educational institution registered on the register
maintained under section 95 of the Education and Skills Act 2008;(f) a pupil referral unit, within the meaning of section 19 of the
Education Act 1996.

25

30

35

40

Online Safety Bill
Schedule 1 — Exempt user-to-user and search services
Part 2 — Paragraph 10 exemption: descriptions of education and childcare

18

183

Education in—(a) an institution in England within the further education sector, within
the meaning of the Further and Higher Education Act 1992 (seesection 91(3) of that Act);(b) a 16 to 19 Academy, within the meaning of section 1B of the
Academies Act 2010;(c) a special post-16 institution, within the meaning of Part 3 of theChildren and Families Act 2014 (see section 83(2) of that Act).

5

19

Education provided by an independent training provider.

20

Further education for persons under 19 provided by a local authority in
England.

21

In paragraphs 12 to 15, “early years childminding”, “early years provision”,“later years childminding” and “later years provision” have the same
meaning as in Part 3 of the Childcare Act 2006 (see section 98 of that Act).

22

In paragraph 19, “independent training provider” means a provider—(a) that is a provider of post-16 education or training carried on, or
partly carried on, in England—(i) to which Chapter 3 of Part 8 of the Education and Inspections
Act 2006 (inspection of further education and training etc)
applies, and(ii) which is funded, wholly or partly, by the Secretary of State, alocal authority in England or a combined authority, but(b) that is not—(i) an employer who only provides such education or training to
its employees,(ii) a 16 to 19 Academy (within the meaning of section 1B of the
Academies Act 2010),(iii) a school,(iv) a local authority in England,(v) an institution within the further education sector (within themeaning given by section 91(3) of the Further and Higher
Education Act 1992), or(vi) a higher education provider (within the meaning given by
section 83(1) of the Higher Education and Research Act 2017).

15

23

In paragraphs 20 and 22, “local authority in England” has the same meaning
as in the Education Act 1996 (see sections 579(1) and 581 of that Act).

35

24

In paragraph 22—“combined authority” means a combined authority established under
section 103 of the Local Democracy, Economic Development andConstruction Act 2009;“school” has the meaning given by section 4(1) of the Education Act
1996.

10

20

25

30

40

Scotland25

Early learning and childcare, within the meaning of Part 6 of the Children
and Young People (Scotland) Act 2014 (asp 8) (see section 46 of that Act).

45

184

Online Safety Bill
Schedule 1 — Exempt user-to-user and search services
Part 2 — Paragraph 10 exemption: descriptions of education and childcare

26Child minding, within the meaning of Part 5 of the Public Services Reform(Scotland) Act 2010 (asp 8) (see paragraph 12 of Schedule 12 to that Act).

27

Day care of children, within the meaning of Part 5 of that Act (see paragraph
13 of Schedule 12 to that Act).

28

Primary education, secondary education or childcare in—(a) a school, or(b) a hostel used mainly by pupils attending a school;
and in this paragraph “school” has the same meaning as in the Education(Scotland) Act 1980 (see section 135(1) of that Act).

529

Further education provided by a body listed under the heading “Institutions
formerly eligible for funding by the Scottish Further Education Funding
Council” or under the heading “Other institutions” in Schedule 2 to the
Further and Higher Education (Scotland) Act 2005 (asp 6).

1030Further education provided by a college of further education which is
assigned to a regional strategic body by an order made under section 7C(1)of that Act.

15

Wales
31

Child minding by a person who is registered as a child minder under Part 2of the Children and Families (Wales) Measure 2010 (nawm 1).

32

Day care for children by a person who is registered to provide day care forchildren under Part 2 of that Measure.

33

Primary education, secondary education or childcare in a school in Wales,
within the meaning of the Education Act 1996 as it applies in relation to
Wales (see section 4 of that Act).

34

Education provided in accordance with section 19A of the Education Act
1996.

35

Further education in an institution in Wales within the further education
sector, within the meaning of the Further and Higher Education Act 1992
(see section 91(3) of that Act).

36

Any other post-16 education or training in Wales, the facilities for which are
secured under section 31(1)(a) or (b) or 32(1)(a) or (b) of the Learning andSkills Act 2000, that is funded by the Welsh Ministers or a local authority inWales (within the meaning of section 579(1) of the Education Act 1996), butthat is not provided by—(a) an institution in Wales within the higher education sector, within themeaning of the Further and Higher Education Act 1992 (see section
91(5) of that Act), or(b) a person who is a provider of such post-16 education or training only
by reason of providing such education or training to the person’s
employees.

37

In paragraphs 31 and 32, “child minding” and “day care for children” havethe same meaning as in Part 2 of the Children and Families (Wales) Measure2010 (see section 19 of that Measure).

20

25

30

35

40

Online Safety Bill
Schedule 1 — Exempt user-to-user and search services
Part 2 — Paragraph 10 exemption: descriptions of education and childcare

185

Northern Ireland
38

Childcare by persons who act as child minders or provide day care forchildren within the meaning of the Children (Northern Ireland) Order 1995
(S.I. 1995/755 (N.I. 2)), and who are registered under Article 118 of that
Order.

39

Pre-school education, within the meaning of Part 5 of the Education(Northern Ireland) Order 1998 (S.I. 1998/1759 (N.I. 13)) (see Article 17(8) ofthat Order).

40

Education in a nursery school, within the meaning of the Education andLibraries (Northern Ireland) Order 1986 (S.I. 1986/594 (N.I. 3)) (see Article
2(2) of that Order).

41

Education or childcare in a school, within the meaning of the Education andLibraries (Northern Ireland) Order 1986 (see Article 2(2) of that Order).

42

Education which is suitable education otherwise than at school provided inaccordance with Article 86 of the Education (Northern Ireland) Order 1998.

43

Education in an institution of further education, within the meaning of the
Further Education (Northern Ireland) Order 1997 (S.I. 1997/1772 (N.I. 15))
(see Article 2(2) of that Order).

44

Education in agriculture and related subjects.
PART 3

5

10

15

20

INTERPRETATION
45

The following definitions apply for the purposes of this Schedule.

46“Childcare”—(a) in relation to provision in England, has same meaning as in theChildcare Act 2006 (see section 18 of that Act);(b) in relation to provision in Scotland, means early learning andchildcare within the meaning of Part 6 of the Children and Young
People (Scotland) Act 2014 (see section 46 of that Act), and any formof care provided outside school hours or during school holidays tochildren who are in attendance at an educational establishment (andin this paragraph, “educational establishment” has the same
meaning as in the Education (Scotland) Act 1980 (see section 135(1)of that Act));(c) in relation to provision in Wales, means anything that amounts tochild minding or day care for children for the purposes of Part 2 of
the Children and Families (Wales) Measure 2010 (see section 19(2) to(4) of that Measure), and any form of care provided by a schooloutside school hours or during school holidays (and in thisparagraph “school” has the same meaning as in the Education Act
1996 as it applies in relation to Wales (see section 4 of that Act));(d) in relation to provision in Northern Ireland, means anything thatamounts to child minding or day care for the purposes of Part 11 of
the Children (Northern Ireland) Order 1995, and any form of careprovided by a school outside school hours or during school holidays(and in this paragraph “school” has the same meaning as in the

25

30

35

40

45

186

Online Safety Bill
Schedule 1 — Exempt user-to-user and search services
Part 3 — Interpretation

Education and Libraries (Northern Ireland) Order (see Article 2(2) ofthat Order)).
47

48

49

50

51

“Education”—(a) in relation to provision in England, Wales and Scotland, means
primary education, secondary education, further education or
higher education;(b) in relation to provision in Northern Ireland, means primaryeducation, secondary education, further education, higher education
or education in agriculture and related subjects.
“Education in agriculture and related subjects”, in relation to provision in
Northern Ireland, means education consisting of instruction in agriculture
and related subjects provided by the Department of Agriculture,
Environment and Rural Affairs in Northern Ireland under section 5(2)(a) of
the Agriculture Act (Northern Ireland) 1949 (c. 2 (N.I.)), but not where theinstruction is provided only to the Department’s employees.
“Further education”—(a) in relation to provision in England and Wales, has the same meaning
as in the Education Act 1996 (see section 2 of that Act);(b) in relation to provision in Scotland, has the same meaning as in Part
1 of the Further and Higher Education (Scotland) Act 1992 (seesections 1(3) and 6 of that Act);(c) in relation to provision in Northern Ireland, has the same meaning as
in the Further Education (Northern Ireland) Order 1997 (see Article
3 of that Order).
“Higher education”—(a) in relation to provision in England and Wales, has the same meaning
as in the Education Act 1996 (see section 579(1) of that Act);(b) in relation to provision in Scotland, has the same meaning as in Part
2 of the Further and Higher Education (Scotland) Act 1992 (seesection 38 of that Act);(c) in relation to provision in Northern Ireland, means—(i) “higher education” within the meaning of the Further
Education (Northern Ireland) Order 1997 (see Article 2(2) ofthat Order), and(ii) any other education provided by a higher education
institution within the meaning of the Education and Libraries(Northern Ireland) Order 1993 (S.I. 1993/2810 (N.I. 12)) (seeArticle 30 of that Order).
“Primary education” and “secondary education”—(a) in relation to provision in England and Wales, have the same
meaning as in the Education Act 1996 (see section 2 of that Act);(b) in relation to provision in Scotland, have the same meaning as in the
Education (Scotland) Act 1980 (see section 135(2) of that Act);(c) in relation to provision in Northern Ireland, have the same meaning
as in the Education and Libraries (Northern Ireland) Order 1986 (seeArticle 2(2) of that Order).

5

10

15

20

25

30

35

40

45

Online Safety Bill
187
Schedule 2 — User-to-user services and search services that include regulated provider pornographic content

SCHEDULE 2

Section 3

USER-TO-USER SERVICES AND SEARCH SERVICES THAT INCLUDE REGULATED PROVIDERPORNOGRAPHIC CONTENT

1

2

A user-to-user service described in any of paragraphs 1 to 5 of Schedule 1—(a) on which regulated provider pornographic content is published ordisplayed, and(b) that has links with the United Kingdom.
(1) A user-to-user service within sub-paragraph (2) or (3).
(2) A user-to-user service is within this sub-paragraph if—(a) the internal business service conditions are met in relation to a partof the service,(b) no user-generated content is enabled by the rest of the service,(c) regulated provider pornographic content is published or displayedon the rest of the service, and(d) the service has links with the United Kingdom.
(3) A user-to-user service is within this sub-paragraph if—(a) the internal business service conditions are met in relation to a partof the service,(b) the only user-generated content enabled by the rest of the service is—(i) content mentioned in paragraph 1, 2 or 3 of Schedule 1 andrelated identifying content, or(ii) content arising in connection with any of the activities
described in paragraph 4(1) of Schedule 1,(c) regulated provider pornographic content is published or displayedon the rest of the service, and(d) the service has links with the United Kingdom.

3

5

10

15

20

25

(1) A search service within sub-paragraph (2).
(2) A search service is within this sub-paragraph if—(a) the internal business service conditions are met in relation to a partof the service that is a search engine,(b) the service does not include a public search engine,(c) regulated provider pornographic content is published or displayedon the rest of the service, and(d) the service has links with the United Kingdom.

4

For the purposes of this Schedule, a service “has links with the United
Kingdom” if it has links with the United Kingdom within the meaning ofsection 71(4).

5

In this Schedule—“the internal business service conditions” means the conditions inparagraph 7(2) of Schedule 1;“public search engine” means a search engine other than one in relation
to which the internal business service conditions are met;
“regulated provider pornographic content” and “published ordisplayed” have the same meaning as in Part 5 (see section 70);

30

35

40

188

Online Safety Bill
Schedule 2 — User-to-user services and search services that include regulated provider pornographic content“the rest of the service” means any part of the user-to-user service or
search service other than the part in relation to which the internalbusiness service conditions are met;“user-generated content” has the meaning given by section 49 (seesubsections (3) and (4) of that section).

SCHEDULE 3

5

Sections 8, 10, 22, 24 and 31

TIMING OF PROVIDERS’ ASSESSMENTS
PART 1
TIMING OF ILLEGAL CONTENT RISK ASSESSMENTS AND CHILDREN’S ACCESS ASSESSMENTS
Part 3 services already in operation at the outset of the regime provided for by this Act110(1) This paragraph applies in relation to a Part 3 service which is in operation
immediately before the day on which the first illegal content risk assessment
guidance is published.
(2) The first illegal content risk assessment of the service must be completed
within the period of three months beginning with the day on which that
guidance is published.

15(3) The first CAA of the service must be completed within the period of threemonths beginning with the day on which the first CAA guidance ispublished.
New Part 3 services which start up, and existing services which become Part 3 services,
between publication of the first illegal content risk assessment guidance and the first CAA
guidance2(1) In this paragraph “the first day”, in relation to a Part 3 service, means—(a) the first day on which the service is a Part 3 service (being a newservice), or(b) the first day on which the service becomes a Part 3 service (having
previously not been a Part 3 service).
(2) Sub-paragraphs (3) and (4) apply if, on the first day, illegal content risk
assessment guidance is available but the first CAA guidance has not yet
been published.

20

25

30

(3) The first illegal content risk assessment of the service must be completed
within the period of three months beginning with the first day.
(4) The first CAA of the service must be completed within the period of threemonths beginning with the day on which the first CAA guidance ispublished.
New Part 3 services which start up when illegal content risk assessment guidance and CAA
guidance are both available
3(1) In this paragraph “the first day”, in relation to a Part 3 service, means the firstday on which the service is a Part 3 service (being a new service).

35

Online Safety Bill
Schedule 3 — Timing of providers’ assessments
Part 1 — Timing of illegal content risk assessments and children’s access assessments

189(2) If, on the first day, illegal content risk assessment guidance and CAA
guidance are both available, both of the following must be completed within
the period of three months beginning with that day—(a) the first illegal content risk assessment of the service, and(b) the first CAA of the service.

5

Existing services which become Part 3 services when illegal content risk assessment guidance
and CAA guidance are both available
4(1) In this paragraph “the first day”, in relation to a Part 3 service, means the firstday on which the service becomes, or again becomes, a Part 3 service(following a period during which the service was not a Part 3 service).

10(2) If, on the first day, illegal content risk assessment guidance and CAA
guidance are both available, both of the following must be completed within
the period of three months beginning with that day—(a) an illegal content risk assessment of the service, and(b) a CAA of the service.

15

PART 2TIMING OF CHILDREN’S RISK ASSESSMENTS
5(1) In this paragraph “the relevant day”, in relation to a Part 3 service, means—(a) the first day on which the service is treated as likely to be accessed bychildren, or(b) the first day on which the service is again treated as likely to beaccessed by children (following a period during which the service
was not so treated).
(2) If, on the relevant day, children’s risk assessment guidance is available, achildren’s risk assessment of the service must be completed within the
period of three months beginning with that day.
(3) Sub-paragraph (4) applies if—(a) on the relevant day, the first children’s risk assessment guidance has
not yet been published, and(b) immediately before the publication of that guidance, the service isstill treated as likely to be accessed by children.

20

25

30

(4) The first children’s risk assessment of the service must be completed within
the period of three months beginning with the day on which the firstchildren’s risk assessment guidance is published.
PART 335

PRE-EXISTING PART 4B SERVICES
Interpretation of this Part
6(1) In this Part, “pre-existing Part 4B service” means—(a) an internet service which—(i) is a video-sharing platform service by reason of theconditions in section 368S(1) and (2) of the Communications
Act being met in relation to the service as a whole, and

40

190

Online Safety Bill
Schedule 3 — Timing of providers’ assessments
Part 3 — Pre-existing Part 4B services

(ii)

(b)

was being provided immediately before Schedule 17 (videosharing platform services: transitional provision etc) comes
into force; ora dissociable section of an internet service, where that dissociablesection—(i) is a video-sharing platform service by reason of theconditions in section 368S(1)(a) and (2) of theCommunications Act being met in relation to that dissociablesection, and(ii) was being provided immediately before Schedule 17 comes
into force.

510(2) In sub-paragraph (1), any reference to a service provided before Schedule 17comes into force includes a reference to a service provided in breach of therequirement in section 368V of the Communications Act.
7(1) In this Part, “assessment start day”, in relation to a pre-existing Part 4B
service, means—(a) the date specified in regulations made by the Secretary of State forthe purposes of this Part of this Schedule, or(b) if the pre-existing Part 4B service ceases to be a video-sharing
platform service before the date specified in the regulations, the datewhen that service ceases to be a video-sharing platform service.
(2) But in respect of any period during which this Schedule is fully in force andno regulations under sub-paragraph (1) have yet been made, the definitionin sub-paragraph (1) has effect as if—(a) for paragraph (a) there were substituted “the date when section 186
comes into force”, and(b) in paragraph (b), for “specified in the regulations” there were
substituted “when section 186 comes into force”.

8

In this Part “video-sharing platform service” has the same meaning as in Part
4B of the Communications Act (see section 368S of that Act).

9

Any reference in this Part to the effect of Part 1 or 2 of this Schedule is areference to the effect that Part 1 or 2 would have if this Part weredisregarded.

15

20

25

30

PRE-EXISTING PART 4B SERVICES WHICH ARE REGULATED USER-TO-USER SERVICES
Application of paragraphs 11 and 12
1035(1) This paragraph and paragraphs 11 and 12 apply in relation to a pre-existing
Part 4B service which—(a) is within the definition in paragraph (a) of paragraph 6(1), and(b) is also a regulated user-to-user service.
(2) If the effect of Part 1 of this Schedule is that the period within which the firstillegal content risk assessment or CAA of the service must be completed
begins on a day before the assessment start day, the time for carrying outthat assessment is extended as set out in paragraph 11 or 12.
(3) But paragraphs 11 and 12 do not apply if the service ceases to be a regulateduser-to-user service on the assessment start day.

40

45

Online Safety Bill
Schedule 3 — Timing of providers’ assessments
Part 3 — Pre-existing Part 4B services

191

Illegal content risk assessments and children’s access assessments
11(1) Sub-paragraphs (2) and (3) apply in relation to the service if, on theassessment start day, illegal content risk assessment guidance is available
but the first CAA guidance has not yet been published.
(2) The first illegal content risk assessment of the service must be completed
within the period of three months beginning with the assessment start day.

5(3) The first CAA of the service must be completed within the period of threemonths beginning with the day on which the first CAA guidance ispublished.
12

If, on the assessment start day, illegal content risk assessment guidance and
CAA guidance are both available, both of the following must be completed
within the period of three months beginning with that day—(a) the first illegal content risk assessment of the service, and(b) the first CAA of the service.

10

REGULATED USER-TO-USER SERVICES WHICH INCLUDE A PRE-EXISTING PART 4B SERVICE

15Application of paragraphs 14 to 17
13(1) Paragraphs 14 to 17 make provision about the timing of assessments in thecase of a regulated user-to-user service which includes a pre-existing Part 4B
service within the definition in paragraph (b) of paragraph 6(1).
(2) In sub-paragraph (3) and paragraphs 14 to 17—(a) “the regulated service” means the regulated user-to-user service, and(b) “the Part 4B part” means the pre-existing Part 4B service which isincluded in the regulated service.
(3) If the effect of Part 1 of this Schedule is that the period within which the firstillegal content risk assessment or CAA of the regulated service must becompleted begins on a day before the assessment start day—(a) the time for carrying out the assessment in question in relation to thePart 4B part is extended as set out in paragraph 14 or 15 (whichever
applies),(b) Part 1 applies as set out in paragraph 16, and(c) paragraph 5 applies as set out in paragraph 17.

20

25

30

(4) But paragraphs 14 to 17 do not apply if the service ceases to be a regulateduser-to-user service on the assessment start day.
Illegal content risk assessments and children’s access assessments of Part 4B part14(1) Sub-paragraphs (2) and (3) apply in relation to the Part 4B part if, on theassessment start day, illegal content risk assessment guidance is available
but the first CAA guidance has not yet been published.
(2) The first illegal content risk assessment of the Part 4B part must becompleted within the period of three months beginning with the assessment
start day.

35

40

192

Online Safety Bill
Schedule 3 — Timing of providers’ assessments
Part 3 — Pre-existing Part 4B services(3) The first CAA of the Part 4B part must be completed within the period of
three months beginning with the day on which the first CAA guidance ispublished.
15

If, on the assessment start day, illegal content risk assessment guidance and
CAA guidance are both available, both of the following must be completed
within the period of three months beginning with that day—(a) an illegal content risk assessment of the Part 4B part, and(b) a CAA of the Part 4B part.

5

Application of Part 1
16(1) This paragraph applies in relation to an illegal content risk assessment or a
CAA of the regulated service if an assessment of that kind is due to be
carried out in relation to the Part 4B part of the service in accordance withparagraph 14 or 15.
References in the rest of this paragraph to an illegal content risk assessment
or a CAA are to an assessment of that kind to which this paragraph applies.
(2) For the purposes of this paragraph—(a) the regulated service is “type 1” if it would still be a regulated userto-user service even if the Part 4B part were to be assumed not to bepart of the service;(b) the regulated service is “type 2” if it would be a regulated searchservice if the Part 4B part were to be assumed not to be part of theservice;(c) the regulated service is “type 3” if it does not fall within paragraph(a) or (b).
(3) If the regulated service is type 1, an illegal content risk assessment or a CAA
is to be treated as being due at the time provided for by Part 1 only in relation
to the rest of the service.

10

15

20

25

(4) In sub-paragraph (3) “the rest of the service” means any user-to-user part of
the regulated service other than the Part 4B part.
(5) If the regulated service is type 2—(a) an illegal content risk assessment is not required to be carried out at
the time provided for by Part 1, but that is not to be taken to prevent
an illegal content risk assessment as defined by section 22 from being
due in relation to the search engine of the service at the time
provided for by Part 1;(b) a CAA is to be treated as being due at the time provided for by Part
1 only in relation to the search engine of the service.

3035(6) If the regulated service is type 3, no illegal content risk assessment or CAA
is required to be carried out at the time provided for by Part 1.
Application of paragraph 5
17(1) This paragraph sets out how paragraph 5 (children’s risk assessments) is to
apply if a CAA is required to be carried out in accordance with—(a) paragraph 14 or 15 (CAA of Part 4B part of a service),(b) paragraph 16(3) (CAA of the rest of a service), or(c) paragraph 16(5)(b) (CAA of search engine of a service).

40

45

193

Online Safety Bill
Schedule 3 — Timing of providers’ assessments
Part 3 — Pre-existing Part 4B services(2) The definition of “the relevant day” is to operate by reference to the CAA
that was (or was required to be) carried out, and accordingly, references tothe day on which the service is to be treated as likely to be accessed bychildren are to be read as references to the day on which the Part 4B part ofthe service, the rest of the service or the search engine of the service (as thecase may be) is to be treated as likely to be accessed by children.

5(3) References to a children’s risk assessment of the service are to a children’srisk assessment of the Part 4B part of the service, the rest of the service or the
search engine of the service (as the case may be).
PART 4

10

INTERPRETATION, AND EXTENSION OF THREE-MONTH PERIODSInterpretation of this Schedule18

In this Schedule—“CAA” means a children’s access assessment (see section 30);“CAA guidance” means OFCOM’s guidance under section 47(2)(b)(guidance about children’s access assessments);“children’s risk assessment guidance” means OFCOM’s guidance
under section 90(3).

19For the meaning of “likely to be accessed by children”, see section 32.

20

In relation to regulated user-to-user services (or in the case of combined
services, the user-to-user part of such services)—(a) references to an illegal content risk assessment are to an illegal
content risk assessment as defined by section 8;(b) references to illegal content risk assessment guidance are to
OFCOM’s guidance under section 90(1).

21

22

23

In relation to regulated search services and the search engine of combined
services—(a) references to an illegal content risk assessment are to an illegal
content risk assessment as defined by section 22;(b) references to illegal content risk assessment guidance are to
OFCOM’s guidance under section 90(2).
In relation to regulated user-to-user services (or in the case of combined
services, the user-to-user part of such services)—(a) references to a children’s risk assessment are to a children’s risk
assessment as defined by section 10;(b) references to children’s risk assessment guidance are to be read asreferences to guidance about such children’s risk assessments.
In relation to regulated search services and the search engine of combined
services—(a) references to a children’s risk assessment are to a children’s risk
assessment as defined by section 24;(b) references to children’s risk assessment guidance are to be read asreferences to guidance about such children’s risk assessments.

15

20

25

30

35

40

194

Online Safety Bill
Schedule 3 — Timing of providers’ assessments
Part 4 — Interpretation, and extension of three-month periods

24

For the purposes of this Schedule, guidance of a particular kind is available
at a particular time if at that time there is in existence published guidance ofthat kind.

Extension of three-month periods
25(1) This paragraph applies in relation to a time-limit of three months imposedby any provision of this Schedule for completing a CAA or a particular kindof risk assessment.
(2) Extra time may be allowed—(a) by agreement between OFCOM and the provider of a particular Part
3 service, or(b) in accordance with a notice published by OFCOM specifying alonger period for CAAs or risk assessments of that kind (as the casemay be) which relate to Part 3 services of a particular kind or size.

SCHEDULE 4

5

10

Section 37

CODES OF PRACTICE UNDER SECTION 36: PRINCIPLES, OBJECTIVES, CONTENT

15

General principles
1

2

In preparing a draft of a code of practice or amendments of a code ofpractice, OFCOM must—(a) consider the appropriateness of provisions of the code of practice todifferent kinds and sizes of Part 3 services and to providers ofdiffering sizes and capacities, and(b) have regard to the principles mentioned in paragraph 2.
The principles are as follows—(a) providers of Part 3 services must be able to understand which
provisions of the code of practice apply in relation to a particularservice they provide;(b) the measures described in the code of practice must be sufficiently
clear, and at a sufficiently detailed level, that providers understandwhat those measures entail in practice;(c) the measures described in the code of practice must be proportionate
and technically feasible: measures that are proportionate or
technically feasible for providers of a certain size or capacity, or forservices of a certain kind or size, may not be proportionate or
technically feasible for providers of a different size or capacity or forservices of a different kind or size;(d) the measures described in the code of practice that apply in relation
to Part 3 services of various kinds and sizes must be proportionate to
OFCOM’s assessment (under section 89) of the risk of harmpresented by services of that kind or size.

Online safety objectives
3

OFCOM must ensure that measures described in codes of practice arecompatible with pursuit of the online safety objectives.

20

25

30

35

40

Online Safety Bill
Schedule 4 — Codes of practice under section 36: principles, objectives, content

4

5

195

The online safety objectives for regulated user-to-user services are as
follows—(a) a service should be designed and operated in such a way that—(i) the systems and processes for regulatory compliance and risk
management are effective and proportionate to the kind andsize of service,(ii) the systems and processes are appropriate to deal with thenumber of users of the service and its user base,(iii) United Kingdom users (including children) are made awareof, and can understand, the terms of service,(iv) there are adequate systems and processes to support United
Kingdom users,(v) (in the case of a Category 1 service) users are offered options
to increase their control over the content they encounter andthe users they interact with,(vi) the service provides a higher standard of protection forchildren than for adults,(vii) the different needs of children at different ages are taken into
account,(viii) there are adequate controls over access to the service by
adults, and(ix) there are adequate controls over access to, and use of, theservice by children, taking into account use of the service by,
and impact on, children in different age groups;(b) a service should be designed and operated so as to protect
individuals in the United Kingdom who are users of the service fromharm, including with regard to—(i) algorithms used by the service,(ii) functionalities of the service, and(iii) other features relating to the operation of the service.
The online safety objectives for regulated search services are as follows—(a) a service should be designed and operated in such a way that—(i) the systems and processes for regulatory compliance and risk
management are effective and proportionate to the kind andsize of service,(ii) the systems and processes are appropriate to deal with thenumber of users of the service and its user base,(iii) United Kingdom users (including children) are made awareof, and can understand, the publicly available statement
referred to in sections 23 and 25,(iv) there are adequate systems and processes to support United
Kingdom users,(v) the service provides a higher standard of protection forchildren than for adults, and(vi) the different needs of children at different ages are taken into
account;(b) a service should be assessed to understand its use by, and impact on,
children in different age groups;(c) a search engine should be designed and operated so as to protect
individuals in the United Kingdom who are users of the service fromharm, including with regard to—

5

10

15

20

25

30

35

40

45

50

196

Online Safety Bill
Schedule 4 — Codes of practice under section 36: principles, objectives, content

(i)
(ii)
(iii)
6

algorithms used by the search engine,functionalities relating to searches (such as a predictive
search functionality), andthe indexing, organisation and presentation of search results.

In the case of a combined service—(a) the online safety objectives set out in paragraph 4 do not apply in
relation to the search engine;(b) the online safety objectives set out in paragraph 5 apply in relation to
the search engine, and accordingly references in that paragraph to asearch service are to be read as references to the search engine;(c) the reference in paragraph 5(a)(iii) to a publicly available statement
includes a reference to provisions of the terms of service which relate
to the search engine.

7

The Secretary of State may by regulations amend paragraph 4 or 5 so as tovary the online safety objectives for regulated user-to-user services orregulated search services, and such regulations may make consequential
amendments of paragraph 6.

8

If regulations are made amending the online safety objectives, OFCOM
must, as soon as reasonably practicable after the regulations come into force,
consider whether a review of the codes of practice published under section
41 is required and, if OFCOM consider that it is required, carry out a review
to assess whether any amendments are needed to reflect the revised
objectives.

5

10

15

20

Content of codes of practice9(1) Codes of practice that describe measures recommended for the purpose ofcompliance with a duty set out in section 9(2) or (3) (illegal content) must
include measures in each of the areas of a service listed in section 9(4).
(2) Codes of practice that describe measures recommended for the purpose ofcompliance with a duty set out in section 11(2) or (3) (children’s online
safety) must include measures in each of the areas of a service listed in
section 11(5).

2530(3) Codes of practice that describe measures recommended for the purpose ofcompliance with a duty set out in section 23(2) or (3) (illegal content) must
include measures in each of the areas of a service listed in section 23(4).
(4) Codes of practice that describe measures recommended for the purpose ofcompliance with a duty set out in section 25(2) or (3) (children’s online
safety) must include measures in each of the areas of a service listed in
section 25(4).
(5) Sub-paragraphs (1) to (4) apply to the extent that inclusion of the measuresin question is consistent with paragraph 1(a) and the principles mentioned
in paragraph 2(c) and (d).
10(1) Measures described in a code of practice which are recommended for the
purpose of compliance with any of the relevant duties must be designed in
the light of the principles mentioned in sub-paragraph (2) and (whereappropriate) incorporate safeguards for the protection of the matters
mentioned in those principles.

35

40

45

Online Safety Bill
Schedule 4 — Codes of practice under section 36: principles, objectives, content

197(2) The principles are—(a) the importance of protecting the right of users and (in the case of
search services or combined services) interested persons to freedomof expression within the law, and(b) the importance of protecting the privacy of users.

5(3) In sub-paragraph (2)(b) the reference to protecting the privacy of users is toprotecting users from a breach of any statutory provision or rule of law
concerning privacy that is relevant to the use or operation of a user-to-userservice or a search service (including, but not limited to, any such provisionor rule concerning the processing of personal data).

10(4) In this paragraph “the relevant duties” means the duties set out in—(a) sections 9 and 23 (illegal content),(b) sections 11 and 25 (children’s online safety),(c) section 12 (user empowerment),(d) section 13 (content of democratic importance),(e) section 15 (journalistic content),(f) sections 16 and 26 (content reporting),(g) sections 17 and 27 (complaints procedures), and(h) sections 33 and 34 (fraudulent advertising).
11

Measures described in a code of practice may relate only to the design or
operation of a Part 3 service—(a) in the United Kingdom, or(b) as it affects United Kingdom users of the service.

15

20

Content of codes of practice: proactive technology
12(1) If OFCOM consider it appropriate to do so, and in accordance with theprinciples to which they must have regard (see paragraphs 1 and 2 and, inparticular, 10(2)), they may include in a code of practice a measuredescribing the use of a kind of technology.
(2) But there are constraints, set out in the rest of this paragraph, on OFCOM’s
power to include in a code of practice a measure describing the use ofproactive technology as a way (or one of the ways) of complying with a duty
set out in this Act (a “proactive technology measure”).
(3) A proactive technology measure may be recommended only for the purposeof compliance with any of the duties set out in—(a) section 9(2) or (3) (illegal content),(b) section 11(2) or (3) (children’s online safety),(c) section 23(2) or (3) (illegal content),(d) section 25(2) or (3) (children’s online safety), or(e) section 33(1) or 34(1) (fraudulent advertising).
(4) A proactive technology measure may relate to the use of a kind oftechnology on or in relation to any Part 3 service or any part of such a
service, but if the technology operates (or may operate) by analysing usergenerated content or metadata relating to such content, the measure may notrecommend the use of the technology to analyse user-generated content
communicated privately, or metadata relating to user-generated content
communicated privately.

25

30

35

40

45

198

Online Safety Bill
Schedule 4 — Codes of practice under section 36: principles, objectives, content(5) A proactive technology measure may be included in a code of practice inrelation to Part 3 services of a particular kind or size only if OFCOM aresatisfied that use of the technology in question by such services would be
proportionate to the risk of harm that the measure is designed to safeguard
against (taking into account, in particular, the risk profile for the time being
published by OFCOM under section 89 relating to such services).
(6) In deciding whether to include a proactive technology measure in a code ofpractice, OFCOM must have regard to the degree of accuracy, effectivenessand lack of bias achieved by the technology in question, and may—(a) refer in the code of practice to existing industry or technicalstandards for the technology (where they exist);(b) set out principles in the code of practice designed to ensure that thetechnology or its use is (so far as possible) accurate, effective and freeof bias.
General
13

14

5

10

15
A code of practice may make different provision for different purposes andmay, in particular—(a) make different provision with regard to—(i) user-to-user services, and(ii) search services;(b) make different provision with regard to user-to-user services ofdifferent kinds or search services of different kinds; and(c) otherwise differentiate between Part 3 services, and between
providers of such services, in such manner as OFCOM consider
appropriate.

20

25

A code of practice may apply in relation to a person who provides a Part 3
service from outside the United Kingdom.

Interpretation
15

In this Schedule—“code of practice” means a code of practice under section 36;“search results” has the meaning given by section 51(3);“user-generated content” has the meaning given by section 49 (seesubsections (3) and (4) of that section).

SCHEDULE 5

Section 53

TERRORISM OFFENCES
1

30

An offence under any of the following provisions of the Terrorism Act
2000—(a) section 11 (membership of a proscribed organisation);(b) section 12(1) (inviting support for a proscribed organisation);(c) section 12(1A) (expressing an opinion or belief supportive of aproscribed organisation);35

40

Online Safety Bill
Schedule 5 — Terrorism offences

(d)
(e)
(f)
(g)
(h)
(i)
(j)
(k)
(l)
(m)
(n)
(o)
(p)

199

section 12(2) (arranging a meeting supportive of a proscribedorganisation);section 13(1A) (publishing image of uniform of proscribedorganisation);section 15 (terrorist fund-raising);
section 16(1) (use of money or property for terrorist purposes);section 16(2) (possession of money or property for terrorist
purposes);section 17 (involvement in terrorist funding arrangements);
section 18 (laundering of terrorist property);
section 54(1) (providing weapons training);
section 54(3) (inviting another to receive weapons training);
section 56 (directing a terrorist organisation);section 58 (collection of information likely to be of use to a terrorist);section 58A (publishing information about members of the armed
forces etc);
sections 59 to 61 (inciting terrorism outside the United Kingdom).

2

An offence under section 113 of the Anti-terrorism, Crime and Security Act
2001 (use of noxious substances or things).

3

An offence under any of the following provisions of the Terrorism Act
2006—(a) section 1 (encouragement of terrorism);(b) section 2 (dissemination of terrorist publications);(c) section 5 (preparation of terrorist acts);(d) section 6 (training for terrorism);(e) section 11 (terrorist threats relating to radioactive devices etc).

5

10

15

20

25

Inchoate offences
4(1) An offence of attempting or conspiring to commit an offence specified in thisSchedule.
(2) An offence under Part 2 of the Serious Crime Act 2007 (encouraging or
assisting) in relation to an offence specified in this Schedule, or (in Scotland)
inciting a person to commit such an offence.
(3) An offence of aiding, abetting, counselling or procuring the commission of
an offence specified in this Schedule, or (in Scotland) being involved art andpart in the commission of such an offence.

30

35

200

Online Safety Bill
Schedule 6 — Child sexual exploitation and abuse offences
Part 1 — England and Wales, and Northern Ireland

SCHEDULE 6

Section 53

CHILD SEXUAL EXPLOITATION AND ABUSE OFFENCES
PART 1
ENGLAND AND WALES, AND NORTHERN IRELAND
1

An offence under section 2 of the Obscene Publications Act 1959 relating to
an obscene article tending to deprave and corrupt others by encouraging
them to commit an offence specified in paragraph 2, 4, 5, 7 or 8.

2

An offence under section 1 of the Protection of Children Act 1978 (indecent
photographs of children).

3

An offence under Article 3 of the Protection of Children (Northern Ireland)
Order 1978 (S.I. 1978/1047 (N.I. 17)) (indecent photographs of children).

4

An offence under section 160 of the Criminal Justice Act 1988 (possession ofindecent photograph of a child).

5

An offence under any of the following provisions of the Sexual Offences Act
2003—(a) section 8 (causing or inciting a child under 13 to engage in sexual
activity);(b) section 10 (causing or inciting a child to engage in sexual activity);(c) section 11 (engaging in sexual activity in the presence of a child);(d) section 12 (causing a child to watch a sexual act);(e) section 13 (child sex offences committed by children or young
persons);(f) section 14 (arranging or facilitating commission of a child sex
offence);(g) section 15 (meeting a child following sexual grooming etc);(h) section 15A (sexual communication with a child);(i) section 47 (paying for sexual services of a child);(j) section 48 (causing or inciting sexual exploitation of a child);(k) section 49 (controlling a child in relation to sexual exploitation);(l) section 50 (arranging or facilitating sexual exploitation of a child).

6

An offence under any of the following provisions of the Sexual Offences(Northern Ireland) Order 2008 (S.I. 2008/1769 (N.I. 2))—(a) Article 15 (causing or inciting a child under 13 to engage in sexual
activity);(b) Article 17 (causing or inciting a child to engage in sexual activity);(c) Article 18 (engaging in sexual activity in the presence of a child);(d) Article 19 (causing a child to watch a sexual act);(e) Article 20 (sexual offences against children committed by children or
young persons);(f) Article 21 (arranging or facilitating commission of a sex offence
against a child);(g) Article 22 (meeting a child following sexual grooming etc);(h) Article 22A (sexual communication with a child);(i) Article 37 (paying for sexual services of a child);

5

10

15

20

25

30

35

40

Online Safety Bill
Schedule 6 — Child sexual exploitation and abuse offences
Part 1 — England and Wales, and Northern Ireland

(j)
(k)
(l)

201

Article 38 (causing or inciting child prostitution or pornography);
Article 39 (controlling a child prostitute or a child involved in
pornography);
Article 40 (arranging or facilitating child prostitution or
pornography).

7

An offence under section 62 of the Coroners and Justice Act 2009 (possessionof prohibited image of a child).

8

An offence under section 69 of the Serious Crime Act 2015 (possession of
paedophile manual).

Inchoate offences
9

5

10

(1) An offence of attempting or conspiring to commit an offence specified in thisPart.
(2) An offence under Part 2 of the Serious Crime Act 2007 (encouraging or
assisting) in relation to an offence specified in this Part.
(3) An offence of aiding, abetting, counselling or procuring the commission of
an offence specified in this Part.

15

PART 2SCOTLAND
10

An offence under either of the following provisions of the Civic Government(Scotland) Act 1982—(a) section 52 (indecent photographs etc of children);(b) section 52A (possession of indecent photographs of children).

11

An offence under any of the following provisions of the Protection ofChildren and Prevention of Sexual Offences (Scotland) Act 2005—(a) section 1 (meeting a child following certain preliminary contact);(b) section 9 (paying for sexual services of a child);(c) section 10 (causing or inciting provision by child of sexual services orchild pornography);(d) section 11 (controlling a child providing sexual services or involvedin pornography);(e) section 12 (arranging or facilitating provision by child of sexual
services or child pornography).

12

An offence under any of the following provisions of the Sexual Offences(Scotland) Act 2009—(a) section 21 (causing a young child to participate in a sexual activity);(b) section 23 (causing a young child to look at a sexual image);(c) section 24 (communicating indecently with a young child etc);(d) section 31 (causing an older child to participate in a sexual activity);(e) section 33 (causing an older child to look at a sexual image);(f) section 34 (communicating indecently with an older child etc);(g) section 54 (incitement to commit certain sexual acts outside
Scotland).

20

25

30

35

40

202

Online Safety Bill
Schedule 6 — Child sexual exploitation and abuse offences
Part 2 — Scotland

Inchoate offences
13(1) An offence of attempting or conspiring to commit an offence specified in thisPart.
(2) An offence of inciting a person to commit an offence specified in this Part.
(3) An offence of aiding, abetting, counselling or procuring the commission of
an offence specified in this Part, or being involved art and part in thecommission of such an offence.

SCHEDULE 7

5

Section 53

PRIORITY OFFENCES
Assisting suicide1

An offence under section 2 of the Suicide Act 1961 (assisting suicide etc).

2

An offence under section 13 of the Criminal Justice Act (Northern Ireland)
1966 (c. 20 (N.I.)) (assisting suicide etc).

10

Threats to kill3

An offence under section 16 of the Offences against the Person Act 1861
(threats to kill).

15

Public order offences, harassment, stalking and fear or provocation of violence
4

5

An offence under any of the following provisions of the Public Order Act
1986—(a) section 4 (fear or provocation of violence);(b) section 4A (intentional harassment, alarm or distress);(c) section 5 (harassment, alarm or distress);
An offence under any of the following provisions of the Public Order Act
1986—(a) section 18 (use of words or behaviour or display of written material);(b) section 19 (publishing or distributing written material);(c) section 21 (distributing, showing or playing a recording);(d) section 29B (use of words or behaviour or display of writtenmaterial);(e) section 29C (publishing or distributing written material);(f) section 29E (distributing, showing or playing a recording).

6

An offence under section 50A of the Criminal Law (Consolidation)(Scotland) Act 1995 (racially-aggravated harassment).

7

An offence under any of the following provisions of the Protection from
Harassment Act 1997—(a) section 2 (harassment);(b) section 2A (stalking);(c) section 4 (putting people in fear of violence);

20

25

30

35

Online Safety Bill
Schedule 7 — Priority offences

(d)
8

9

10

203

section 4A (stalking involving fear of violence or serious alarm or
distress).

An offence under any of the following provisions of the Protection from
Harassment (Northern Ireland) Order 1997 (S.I. 1997/1180 (N.I. 9))—(a) Article 4 (harassment);(b) Article 6 (putting people in fear of violence).
An offence under any of the following provisions of the Crime and Disorder
Act 1998—(a) section 31 (racially or religiously aggravated public order offences);(b) section 32 (racially or religiously aggravated harassment etc).

12

An offence under any of the following provisions of the Misuse of Drugs Act
1971—(a) section 4(3) (unlawful supply, or offer to supply, of controlled
drugs);(b) section 9A (prohibition of supply etc of articles for administering or
preparing controlled drugs);(c) section 19 (inciting any other offence under that Act).

15

20

An offence under section 5 of the Psychoactive Substances Act 2016
(supplying, or offering to supply, a psychoactive substance).

Firearms and other weapons
13

An offence under section 1(1) or (2) of the Restriction of Offensive Weapons
Act 1959 (sale etc of flick knife etc).

14

An offence under any of the following provisions of the Firearms Act 1968—(a) section 1(1) (purchase etc of firearms or ammunition withoutcertificate);(b) section 2(1) (purchase etc of shot gun without certificate);(c) section 3(1) (dealing etc in firearms or ammunition by way of tradeor business without being registered);(d) section 3(2) (sale etc of firearms or ammunition to person other thanregistered dealer);(e) section 5(1), (1A) or (2A) (purchase, sale etc of prohibited weapons);(f) section 21(5) (sale etc of firearms or ammunition to persons
previously convicted of crime);(g) section 22(1) (purchase etc of firearms or ammunition by person
under 18);(h) section 24 (supplying firearms to minors);(i) section 24A (supplying imitation firearms to minors).

15

10

An offence under any of the following provisions of the Criminal Justice andLicensing (Scotland) Act 2010 (asp 13)—(a) section 38 (threatening or abusive behaviour);(b) section 39 (stalking).

Drugs and psychoactive substances
115

An offence under any of the following provisions of the Crossbows Act
1987—

25

30

35

40

204

Online Safety Bill
Schedule 7 — Priority offences

(a)
(b)
16

17

section 1 (sale and letting on hire of crossbow);
section 2 (purchase and hiring of crossbow).

An offence under any of the following provisions of the Criminal Justice Act
1988—(a) section 141(1) or (4) (sale etc of offensive weapons);(b) section 141A (sale of knives etc to persons under 18).
An offence under any of the following provisions of the Criminal Justice(Northern Ireland) Order 1996 (S.I. 1996/3160 (N.I. 24))—(a) Article 53 (sale etc of knives);(b) Article 54 (sale of knives etc to minors).

18

An offence under any of the following provisions of the Knives Act 1997—(a) section 1 (unlawful marketing of knives);(b) section 2 (publication of material in connection with marketing ofknives).

19

An offence under any of the following provisions of the Firearms (Northern
Ireland) Order 2004 (S.I. 2004/702 (N.I. 3))—(a) Article 24 (sale etc of firearms or ammunition without certificate);(b) Article 37(1) (sale etc of firearms or ammunition to person withoutcertificate etc);(c) Article 45(1) and (2) (purchase, sale etc of prohibited weapons);(d) Article 63(8) (sale etc of firearms or ammunition to people who havebeen in prison etc);(e) Article 66A (supplying imitation firearms to minors).

20

An offence under section 36(1)(c) or (d) of the Violent Crime Reduction Act
2006 (sale etc of realistic imitation firearms).

21

An offence under any of the following provisions of the Air Weapons andLicensing (Scotland) Act 2015 (asp 10)—(a) section 2 (requirement for air weapon certificate);(b) section 24 (restrictions on sale etc of air weapons).

Assisting illegal immigration
22

5

10

15

20

25

30

An offence under section 25 of the Immigration Act 1971 (assisting unlawful
immigration etc).

Sexual exploitation
23

An offence under any of the following provisions of the Sexual Offences Act
2003—(a) section 52 (causing or inciting prostitution for gain);(b) section 53 (controlling prostitution for gain).

24

An offence under any of the following provisions of the Sexual Offences(Northern Ireland) Order 2008 (S.I. 2008/1769 (N.I. 2))—(a) Article 62 (causing or inciting prostitution for gain);(b) Article 63 (controlling prostitution for gain).

35

40

Online Safety Bill
Schedule 7 — Priority offences

205

Sexual images
25

An offence under section 63 of the Criminal Justice and Immigration Act
2008 (possession of extreme pornographic images).

26

An offence under section 33 of the Criminal Justice and Courts Act 2015
(disclosing, or threatening to disclose, private sexual photographs and films
with intent to cause distress).

27

An offence under section 2 of the Abusive Behaviour and Sexual Harm
(Scotland) Act 2016 (asp 22) (disclosing, or threatening to disclose, an
intimate photograph or film).

Proceeds of crime28

An offence under any of the following provisions of the Proceeds of Crime
Act 2002—(a) section 327 (concealing etc criminal property);(b) section 328 (arrangements facilitating acquisition etc of criminal
property);(c) section 329 (acquisition, use and possession of criminal property).

5

10

15

Fraud
29

30

An offence under any of the following provisions of the Fraud Act 2006—(a) section 2 (fraud by false representation);(b) section 4 (fraud by abuse of position);(c) section 7 (making or supplying articles for use in frauds);(d) section 9 (participating in fraudulent business carried on by sole
trader etc).
An offence under section 49(3) of the Criminal Justice and Licensing(Scotland) Act 2010 (articles for use in fraud).

20

25

Financial services
31

32

An offence under any of the following provisions of the Financial Services
and Markets Act 2000—(a) section 23 (contravention of prohibition on carrying on regulated
activity unless authorised or exempt);(b) section 24 (false claims to be authorised or exempt);(c) section 25 (contravention of restrictions on financial promotion).
An offence under any of the following provisions of the Financial Services
Act 2012—(a) section 89 (misleading statements);(b) section 90 (misleading impressions).

Inchoate offences
33(1) An offence of attempting or conspiring to commit an offence specified in thisSchedule.

30

35

206

Online Safety Bill
Schedule 7 — Priority offences(2) An offence under Part 2 of the Serious Crime Act 2007 (encouraging or
assisting) in relation to an offence specified in this Schedule, or (in Scotland)
inciting a person to commit such an offence.
(3) An offence of aiding, abetting, counselling or procuring the commission of
an offence specified in this Schedule, or (in Scotland) being involved art andpart in the commission of such an offence.

SCHEDULE 8

5

Section 68

TRANSPARENCY REPORTS BY PROVIDERS OF CATEGORY 1 SERVICES, CATEGORY 2A SERVICES
AND CATEGORY 2B SERVICESPART 1

10

MATTERS ABOUT WHICH INFORMATION MAY BE REQUIRED: USER-TO-USER PART OF SERVICE
1

The incidence of illegal content, content that is harmful to children andrelevant content on a service.

2

The dissemination of illegal content, content that is harmful to children andrelevant content by means of a service.

3

The number of users who are assumed to have encountered illegal content,
content that is harmful to children or relevant content by means of theservice.

4

The application of the terms of service.

5

The systems and processes for users to report content which they consider
to be illegal content, content that is harmful to children or relevant content.

6

The systems and processes that a provider operates to deal with illegal
content, content that is harmful to children and relevant content, including
systems and processes for identifying such content and taking it down.

7

Functionalities designed to help users manage risks relating to content thatis harmful to children and relevant content.

8

Features, including functionalities, that a provider considers may contributeto risks of harm to individuals using the service, and measures taken or inuse by the provider to mitigate and manage those risks.

9

Measures taken or in use by a provider to comply with any duty set out in
Chapter 2 or 4 of Part 3 or section 33 (including in particular measures thatare described in a code of practice under section 36).

10

Measures taken or in use by a provider to comply with the duty set out insection 57(1) (user identity verification).

11

Arrangements that a provider has in place for the reporting (in the United
Kingdom or elsewhere) of content relating to child sexual exploitation andabuse, and measures taken or in use by a provider to comply with arequirement under section 59.

12

Measures taken or in use by a provider to comply with any duty set out insection 64 or 65 (terms of service).

15

20

25

30

35

40

Online Safety Bill
207
Schedule 8 — Transparency reports by providers of Category 1 services, Category 2A services and Category 2B
services
Part 1 — Matters about which information may be required: user-to-user part of service

13

14

The systems and processes by which a provider assesses the risk of harm toindividuals from the presence of illegal content or content that is harmful tochildren—(a) when the service is initially being designed or developed,(b) when any further development or update to the service is being
considered, and(c) while the service is in operation.
The systems and processes that a provider operates—(a) to direct users of the service to information about how they canprotect themselves from harm in relation to illegal content andcontent that is harmful to children, and(b) to counteract or provide support to users of the service in relation toillegal content and content that is harmful to children present on theservice.

15

Co-operation by a provider with government, regulatory or other public
sector bodies in the United Kingdom, in particular those involved in theenforcement of the criminal law.

16

Measures taken or in use by a provider to provide for a higher standard ofprotection for children than for adults.

17

Measures taken or in use by a provider to improve the media literacy ofusers, and an evaluation of the effectiveness of such measures.

18

Any other measures taken or in use by a provider which relate to online
safety matters.

5

10

15

20

PART 2
MATTERS ABOUT WHICH INFORMATION MAY BE REQUIRED: SEARCH ENGINE19

The incidence of illegal search content and search content that is harmful tochildren on a service.

20

The number of users who are assumed to have encountered illegal searchcontent or search content that is harmful to children.

21

The application of the statements of policies and procedures mentioned in
sections 23(5) and 25(5).

22The systems and processes for users to report search content which they
consider to be illegal content or content that is harmful to children, or othercontent which they consider breaches any statements of policies andprocedures which have been made publicly available by the provider of aservice.

23

24

The systems and processes that a provider operates to deal with illegal
search content and search content that is harmful to children, including
systems and processes for identifying such content and minimising the riskof those kinds of content being encountered by means of the service.
Functionalities designed to help users manage risks relating to searchcontent that is harmful to children.

25

30

35

40

208

Online Safety Bill
Schedule 8 — Transparency reports by providers of Category 1 services, Category 2A services and Category 2B
services
Part 2 — Matters about which information may be required: search engine

25

Measures taken or in use by a provider to comply with any duty set out in
Chapter 3 or 4 of Part 3 or section 34 (including in particular measures thatare described in a code of practice under section 36).

26

Arrangements that a provider has in place for the reporting (in the United
Kingdom or elsewhere) of content relating to child sexual exploitation andabuse, and measures taken or in use by a provider to comply with arequirement under section 59.

27

The systems and processes by which a provider assesses the risk of harm toindividuals from illegal search content or search content that is harmful tochildren—(a) when the service is initially being designed or developed,(b) when any further development or update to the service is being
considered, and(c) while the service is in operation.

28

The systems and processes that a provider operates—(a) to direct users of the service to information about how they canprotect themselves from harm in relation to illegal content andcontent that is harmful to children, and(b) to counteract or provide support to users of the service in relation toillegal search content and search content that is harmful to children.

29

Co-operation by a provider with government, regulatory or other public
sector bodies in the United Kingdom, in particular those involved in theenforcement of the criminal law.

30

Measures taken or in use by a provider to provide a higher standard ofprotection for children than for adults.

31

Measures taken or in use by a provider to improve the media literacy ofusers, and an evaluation of the effectiveness of such measures.

32

Any other measures taken or in use by a provider which relate to online
safety matters.
PART 3

5

10

15

20

25

30

FURTHER PROVISION AND INTERPRETATION
33

34

When determining which information to require in a notice under section
68(1) in relation to a particular service, OFCOM must take into account—(a) the kind of service it is;(b) the functionalities of the service;(c) the number of users of the service;(d) the capacity of the provider;(e) the duties set out in Chapter 2 or 3 of Part 3 or Chapters 1 to 3 of Part
4 that apply in relation to the service;(f) the proportion of users of the service who are children.
The Secretary of State may by regulations—(a) amend Part 1 or Part 2 of this Schedule so as to add further mattersabout which information may be required, or to vary or omit mattersabout which information may be required, and(b) amend paragraph 33 in connection with any such amendment.

35

40

45

Online Safety Bill
209
Schedule 8 — Transparency reports by providers of Category 1 services, Category 2A services and Category 2B
services
Part 3 — Further provision and interpretation

35

The Secretary of State must consult OFCOM before making regulations
under paragraph 34.

36

In the application of Part 2 of this Schedule to a combined service, references
to statements of policies and procedures include references to provisions of
the terms of service which relate to the search engine.

37(1) For the purposes of this Schedule, content of a particular kind is “relevant
content” if—(a) a term of service, other than a term of service within sub-paragraph(2), states that a provider may or will take down content of that kindfrom the service or restrict users’ access to content of that kind, and(b) it is regulated user-generated content.
(2) The terms of service within this sub-paragraph are as follows—(a) terms of service which make provision of the kind mentioned in
section 9(5) (protecting individuals from illegal content) or 11(6)(protecting children from content that is harmful to children);(b) terms of service which deal with the treatment of consumer content.

5

10

15

(3) References in this Schedule to relevant content are to content that is relevant
content in relation to the service in question.
38

In this Schedule—“consumer content” has the same meaning as in Chapter 3 of Part 4 (seesection 67(3));“content that is harmful to children” has the same meaning as in Part 3(see section 54);
“illegal content” has the same meaning as in Part 3 (see section 53);
“illegal search content” means search content that is illegal content;“regulated user-generated content” has the same meaning as in Part 3(see section 49), and references to such content are to content that isregulated user-generated content in relation to the service inquestion;“search content” has the same meaning as in Part 3 (see section 51);
“users” means United Kingdom users (see section 199), except inparagraphs 14(a) and 28(a) where “users” means individuals in the
United Kingdom who are users of a service.

SCHEDULE 9

20

25

30

Section 71

CERTAIN INTERNET SERVICES NOT SUBJECT TO DUTIES RELATING TO REGULATED PROVIDER

35

PORNOGRAPHIC CONTENT

Internal business services (entire internet service)1(1) An internet service, other than a user-to-user service or a search service, in
relation to which the conditions in sub-paragraph (2) are met.
(2) The conditions are—(a) the internet service is an internal resource or tool for a business, orfor more than one business carried on by the same person,

40

210

Online Safety Bill
Schedule 9 — Certain internet services not subject to duties relating to regulated provider pornographic content

(b)
(c)

the person carrying on the business (or businesses) (“P”) is theprovider of the internet service, andthe internet service is available only to a closed group of people
comprising some or all of the following—(i) where P is an individual or individuals, that individual or
those individuals,(ii) where P is an entity, officers of P,(iii) persons who work for P (including as employees orvolunteers) for the purposes of any activities of the business(or any of the businesses) in question, and(iv) any other persons authorised by a person within subparagraph (i), (ii) or (iii) to use the service for the purposes ofany activities of the business (or any of the businesses) inquestion (for example, a contractor, consultant or auditor, orin the case of an educational institution, pupils or students).

(3) In this paragraph—“business” includes trade, profession, educational institution or otherconcern (whether or not carried on for profit);“officer” includes a director, manager, partner, associate, secretary,
governor, trustee or other similar officer.

5

10

15

20

Internal business services (part of internet service)2(1) An internet service, other than a user-to-user service or a search service,
within sub-paragraph (2).
(2) An internet service is within this sub-paragraph if—(a) the conditions in paragraph 1(2) are met in relation to a part of theservice, and(b) no regulated provider pornographic content is published ordisplayed on the rest of the service.
(3) In sub-paragraph (2)(b), “the rest of the service” means all parts of theinternet service other than the part in relation to which the conditions inparagraph 1(2) are met.

25

30Services provided by public bodies
3(1) An internet service, other than a user-to-user service or a search service,
which is provided by a public body.
(2) An internet service is “provided by a public body” if—(a) both of the following conditions are met in relation to the service—(i) the provider of the service is a public authority within themeaning of section 6 of the Human Rights Act 1998, and(ii) the service is provided in the exercise of public functions
only,(b) the provider of the service is Parliament, either House of Parliament,
the Scottish Parliament, Senedd Cymru, the Northern Ireland
Assembly or a person acting on behalf of any of those institutions,(c) the provider of the service is a foreign sovereign power, or(d) both of the following conditions are met in relation to the service—

35

40

45

Online Safety Bill
211
Schedule 9 — Certain internet services not subject to duties relating to regulated provider pornographic content

(i)
(ii)

the provider of the service is an entity formed under the lawof a country outside the United Kingdom, which exercises
functions of a public nature, andthe service is provided in the exercise of such functions only.

(3) But an internet service is not within this paragraph if—(a) the provider of the service is a person providing education or
childcare, and(b) the service is provided for the purposes of that education or
childcare.
See paragraph 4.

510(4) This paragraph is without prejudice to the fact that this Act does not apply
in relation to an internet service provided by the Crown.
(5) In this paragraph, “public function” means a function that is a function of apublic nature for the purposes of the Human Rights Act 1998.
Services provided by persons providing education or childcare
4(1) An internet service, other than a user-to-user service or a search service—(a) of which the provider is—(i) the person with legal responsibility for education or childcareof a description listed in Part 2 of Schedule 1 (“the responsible
person”), or where the responsible person is a body, amember of that body, or(ii) a person who is employed or engaged to provide educationor childcare of a description listed in Part 2 of Schedule 1, and
who is subject to safeguarding duties which relate to theprovision of that education or childcare, and(b) which is provided for the purposes of that education or childcare.
(2) In sub-paragraph (1)(a)(ii), “safeguarding duties” means duties or
requirements which are related to the safeguarding of children arising underenactments other than this Act, under guidance or requirements (howeverreferred to) produced under enactments other than this Act, or as a result ofcontractual arrangements made by the responsible person.
(3) For the purposes of this paragraph, the person with legal responsibility foreducation or childcare of a particular description is the person with legal
responsibility for its day-to-day provision (for example, the person withlegal responsibility for a particular school), rather than any other person
who has a duty to ensure that, in general, education or childcare of that
description (or education or childcare which includes education or childcareof that description) is provided.

15

20

25

30

35

On-demand programme services (entire internet service)5(1) An internet service that is an on-demand programme service.
(2) In this paragraph and paragraph 6, “on-demand programme service” has
the same meaning as in the Communications Act (see section 368A of that
Act).

40

212

Online Safety Bill
Schedule 9 — Certain internet services not subject to duties relating to regulated provider pornographic content

On-demand programme services (part of internet service)6(1) An internet service within sub-paragraph (2).
(2) An internet service is within this sub-paragraph if—(a) part of the service is an on-demand programme service, and(b) no regulated provider pornographic content is published ordisplayed on the rest of the service.

5(3) In sub-paragraph (2)(b), “the rest of the service” means all parts of theinternet service other than the part which is an on-demand programme
service.
Interpretation
7

10

In this Schedule—“education” and “childcare” have the same meaning as in Schedule 1(see Part 3 of that Schedule);“enactment” includes—(a) an enactment contained in subordinate legislation (within themeaning of the Interpretation Act 1978),(b) an enactment contained in, or in an instrument made under,an Act of the Scottish Parliament,(c) an enactment contained in, or in an instrument made under,a Measure or Act of Senedd Cymru, and(d) an enactment contained in, or in an instrument made under,
Northern Ireland legislation;“regulated provider pornographic content” and “published ordisplayed” have the same meaning as in Part 5 (see section 70).

SCHEDULE 10

15

20

Section 80

25(1) This Schedule concerns the recovery by OFCOM of an amount equal to theaggregate of the amounts of WTA receipts which, in accordance with section
401(1) of the Communications Act and OFCOM’s statement under that
section, are retained by OFCOM for the purpose of meeting their initialcosts.

30

RECOVERY OF OFCOM’S INITIAL COSTS
Recovery of initial costs
1(2) OFCOM must seek to recover the amount described in sub-paragraph (1)(“the total amount of OFCOM’s initial costs”) by charging providers of
regulated services fees under this Schedule (“additional fees”).
(3) In this Schedule—“initial costs” means the costs incurred by OFCOM before the day on
which section 79 comes into force on preparations for the exercise of
their online safety functions;“WTA receipts” means the amounts described in section 401(1)(a) of theCommunications Act which are paid to OFCOM (certain receipts
under the Wireless Telegraphy Act 2006).

35

40

Online Safety Bill
Schedule 10 — Recovery of OFCOM’s initial costs

213

Recovery of initial costs: first phase2(1) The first phase of OFCOM’s recovery of their initial costs is to take placeover a period of several charging years to be specified in regulations underparagraph 7 (“specified charging years”).
(2) Over that period OFCOM must, in aggregate, charge providers of regulated
services additional fees of an amount equal to the total amount of OFCOM’s
initial costs.

5(3) OFCOM may not charge providers additional fees in respect of any charging
year which falls before the first specified charging year.
(4) OFCOM may require a provider to pay an additional fee in respect of acharging year only if the provider is required to pay a fee in respect of thatyear under section 75 (and references in this Schedule to charging providers
are to be read accordingly).
(5) The amount of an additional fee payable by a provider is to be calculated inaccordance with regulations under paragraph 7.

1015Further recovery of initial costs
3(1) The second phase of OFCOM’s recovery of their initial costs begins after theend of the last of the specified charging years.
(2) As soon as reasonably practicable after the end of the last of the specified
charging years, OFCOM must publish a statement specifying—(a) the amount which is at that time the recoverable amount (seeparagraph 6), and(b) the amounts of the variables involved in the calculation of therecoverable amount.

20(3) OFCOM’s statement must also specify the amount which is equal to that
portion of the recoverable amount which is not likely to be paid or
recovered.
The amount so specified is referred to in sub-paragraphs (4) and (5) as “theoutstanding amount”.

25(4) Unless a determination is made as mentioned in sub-paragraph (5), OFCOM
must, in aggregate, charge providers of regulated services additional fees ofan amount equal to the outstanding amount.

30(5) The Secretary of State may, as soon as reasonably practicable after the
publication of OFCOM’s statement, make a determination specifying anamount by which the outstanding amount is to be reduced, and in that case
OFCOM must, in aggregate, charge providers of regulated services
additional fees of an amount equal to the difference between the outstanding
amount and the amount specified in the determination.
(6) Additional fees mentioned in sub-paragraph (4) or (5) must be charged in
respect of the charging year immediately following the last of the specified
charging years (“year 1”).
(7) The process set out in sub-paragraphs (2) to (6) is to be repeated in successive
charging years, applying those sub-paragraphs as if—

35

40

214

Online Safety Bill
Schedule 10 — Recovery of OFCOM’s initial costs

(a)
(b)

in sub-paragraph (2), the reference to the end of the last of thespecified charging years were to the end of year 1 (and so on forsuccessive charging years);in sub-paragraph (6), the reference to year 1 were to the charging
year immediately following year 1 (and so on for successive charging
years).

5(8) Any determination by the Secretary of State under this paragraph must be
published in such manner as the Secretary of State considers appropriate.
(9) Sub-paragraphs (4) and (5) of paragraph 2 apply to the charging ofadditional fees under this paragraph as they apply to the charging ofadditional fees under that paragraph.

10(10) The process set out in this paragraph comes to an end in accordance withparagraph 4.
End of the recovery process
4(1) The process set out in paragraph 3 comes to an end if a statement by OFCOM
under that paragraph records that—(a) the recoverable amount is nil, or(b) all of the recoverable amount is likely to be paid or recovered.
(2) Or the Secretary of State may bring that process to an end by making adetermination that OFCOM are not to embark on another round of charging
providers of regulated services additional fees.

1520(3) The earliest time when such a determination may be made is after the
publication of OFCOM’s first statement under paragraph 3.
(4) A determination under sub-paragraph (2)—(a) must be made as soon as reasonably practicable after the publicationof a statement by OFCOM under paragraph 3;(b) must be published in such manner as the Secretary of State considers
appropriate.
(5) A determination under sub-paragraph (2) does not affect OFCOM’s
power—(a) to bring proceedings for the recovery of the whole or part of anadditional fee for which a provider became liable at any time before
the determination was made, or(b) to act in accordance with the procedure set out in section 128 inrelation to such a liability.

25

30

35

Providers for part of a year only
5(1) For the purposes of this Schedule, the “provider” of a regulated service, in
relation to a charging year, includes a person who is the provider of theservice for part of the year.
(2) Where a person is the provider of a regulated service for part of a charging
year only, OFCOM may refund all or part of an additional fee paid to
OFCOM under paragraph 2 or 3 by that provider in respect of that year.

40Online Safety Bill
Schedule 10 — Recovery of OFCOM’s initial costs

215

Calculation of the recoverable amount6

For the purposes of a statement by OFCOM under paragraph 3, the“recoverable amount” is given by the formula—C – F – R – D

where—C is the total amount of OFCOM’s initial costs,
F is the aggregate amount of the additional fees received by OFCOM at
the time of the statement in question,
R is the aggregate amount of the additional fees received by OFCOM
that at the time of the statement in question have been, or are due tobe, refunded (see paragraph 5(2)), andD is the amount specified in a determination made by the Secretary ofState under paragraph 3 (see paragraph 3(5)) at a time before thestatement in question or, where more than one such determination
has been made, the sum of the amounts specified in thosedeterminations.
If no such determination has been made before the statement inquestion, D = 0.

5

10

15

Regulations about recovery of initial costs
7(1) The Secretary of State must make regulations making such provision as the
Secretary of State considers appropriate in connection with the recovery by
OFCOM of their initial costs.

20(2) The regulations must include provision as set out in sub-paragraphs (3), (4)and (6).
(3) The regulations must specify the total amount of OFCOM’s initial costs.

25(4) For the purposes of paragraph 2, the regulations must specify—(a) the charging years in respect of which additional fees are to be
charged, and(b) the proportion of the total amount of initial costs which OFCOM
must seek to recover in each of the specified charging years.

30(5) The following rules apply to provision made in accordance with subparagraph (4)(a)—(a) the initial charging year may not be specified;(b) only consecutive charging years may be specified;(c) at least three charging years must be specified;(d) no more than five charging years may be specified.
(6) The regulations must specify the computation model that OFCOM must use
to calculate fees payable by individual providers of regulated services underparagraphs 2 and 3 (and that computation model may be different fordifferent charging years).

3540(7) The regulations may make provision about what OFCOM may or must do if
the operation of this Schedule results in them recovering more than the total
amount of their initial costs.
(8) The regulations may amend this Schedule or provide for its application withmodifications in particular cases.

45

216

Online Safety Bill
Schedule 10 — Recovery of OFCOM’s initial costs(9) Before making regulations under this paragraph, the Secretary of State must
consult—(a) OFCOM,(b) providers of regulated user-to-user services,(c) providers of regulated search services,(d) providers of internet services within section 71(2), and(e) such other persons as the Secretary of State considers appropriate.

5Interpretation
8

In this Schedule—“additional fees” means fees chargeable under this Schedule in respectof the recovery of OFCOM’s initial costs;“charging year” has the meaning given by section 81;“initial charging year” has the meaning given by section 81;“initial costs” has the meaning given by paragraph 1(3), and the “total
amount” of initial costs means the amount described in paragraph1(1);“recoverable amount” has the meaning given by paragraph 6;“specified charging year” means a charging year specified inregulations under paragraph 7 for the purposes of paragraph 2.

SCHEDULE 11

Section 85

10

15

20

CATEGORIES OF REGULATED USER-TO-USER SERVICES AND REGULATED SEARCH SERVICES:REGULATIONSRegulations specifying threshold conditions for categories of Part 3 services
1(1) The Secretary of State must make regulations specifying conditions(“Category 1 threshold conditions”) for the user-to-user part of regulateduser-to-user services relating to each of the following—(a) number of users of the user-to-user part of the service,(b) functionalities of that part of the service, and(c) any other characteristics of that part of the service or factors relating
to that part of the service that the Secretary of State considers
relevant.
(2) The Secretary of State must make regulations specifying conditions(“Category 2A threshold conditions”) for the search engine of regulated
search services and combined services relating to each of the following—(a) number of users of the search engine, and(b) any other characteristics of the search engine or factors relating to thesearch engine that the Secretary of State considers relevant.
(3) The Secretary of State must make regulations specifying conditions(“Category 2B threshold conditions”) for the user-to-user part of regulateduser-to-user services relating to each of the following—(a) number of users of the user-to-user part of the service,(b) functionalities of that part of the service, and

25

30

35

40

Online Safety Bill
Schedule 11 — Categories of regulated user-to-user services and regulated search services: regulations

(c)

217

any other characteristics of that part of the service or factors relating
to that part of the service that the Secretary of State considers
relevant.

(4) Regulations under this paragraph must specify the way or ways in which
the relevant threshold conditions may be met, and that may be by meetingthe conditions in any specified combination, subject to the rule that—(a) in relation to the Category 1 threshold conditions and the Category
2B threshold conditions, at least one specified condition about
number of users and at least one specified condition about
functionality must be met, and(b) in relation to the Category 2A threshold conditions, at least one
specified condition about number of users must be met.
(5) In making regulations under sub-paragraph (1), the Secretary of State musttake into account the likely impact of the number of users of the user-to-userpart of the service, and its functionalities, on how easily, quickly and widely
regulated user-generated content is disseminated by means of the service.

5

10

15

(6) In making regulations under sub-paragraph (2), the Secretary of State musttake into account the likely impact of the number of users of the searchengine on the level of risk of harm to individuals from search content that isillegal content or search content that is harmful to children.

20(7) In making regulations under sub-paragraph (3), the Secretary of State musttake into account the likely impact of the number of users of the user-to-userpart of the service, and its functionalities, on the level of risk of harm toindividuals from illegal content and content that is harmful to children
disseminated by means of the service.

25(8) In this paragraph “specified” means specified in the regulations.
Procedure for first regulations under paragraph 1
2(1) This paragraph describes the procedure that must be followed in relation to
the making of the first regulations under each of sub-paragraphs (1), (2) and(3) of paragraph 1.
(2) In the case of regulations under paragraph 1(1), within the period of six
months beginning with the day on which this Act is passed, OFCOM mustcarry out research into—(a) how easily, quickly and widely regulated user-generated content isdisseminated by means of regulated user-to-user services,(b) the number of users and functionalities of the user-to-user part ofsuch services, and(c) such other characteristics of that part of such services or factors
relating to that part of such services as OFCOM consider to be
relevant to specifying the Category 1 threshold conditions.
(3) In the case of regulations under paragraph 1(2), within the period of six
months beginning with the day on which this Act is passed, OFCOM mustcarry out research into the following aspects of the search engine ofregulated search services and combined services—(a) the prevalence of search content that is illegal content and searchcontent that is harmful to children,(b) the number of users of the search engine, and

30

35

40

45

218

Online Safety Bill
Schedule 11 — Categories of regulated user-to-user services and regulated search services: regulations(c)such other characteristics or factors as OFCOM consider to be
relevant to specifying the Category 2A threshold conditions.

(4) In the case of regulations under paragraph 1(3), within the period of six
months beginning with the day on which this Act is passed, OFCOM mustcarry out research into—(a) the dissemination of illegal content and content that is harmful tochildren by means of regulated user-to-user services,(b) the number of users and functionalities of the user-to-user part ofsuch services, and(c) such other characteristics of that part of such services or factors
relating to that part of such services as OFCOM consider to be
relevant to specifying the Category 2B threshold conditions.
(5) OFCOM must provide the Secretary of State with advice based on the
research under sub-paragraph (2), (3) or (4) (as the case may be) as to theprovision which OFCOM consider it is appropriate for the regulations inquestion to make.
(6) Such advice may include advice that the regulations should include anothercharacteristic or factor in addition to number of users and (in the case ofregulations under paragraph 1(1) or (3)) functionalities, and what that othercharacteristic or factor should be.

5

10

15

20

(7) As soon as reasonably practicable after OFCOM provide advice asmentioned in sub-paragraph (5)—(a) OFCOM must publish the advice, and(b) the Secretary of State must make the regulations.
(8) If the regulations include provision which differs in any material respectfrom provision advised by OFCOM, the Secretary of State must publish astatement which explains why the Secretary of State has departed from that
advice.
(9) A statement mentioned in sub-paragraph (8) must be published—(a) no later than the time at which the regulations to which the statement
relates are made, and(b) in such manner as the Secretary of State considers appropriate forbringing it to the attention of persons who may be affected by it.
(10) The Secretary of State may give OFCOM extra time to carry out theirresearch in the case of regulations under paragraph 1(2) or (3), but OFCOM
must carry out such research within the period of 18 months beginning withthe day on which this Act is passed.
(11) The Secretary of State may not make regulations under paragraph 1 until
OFCOM have carried out research and provided advice to the Secretary ofState as required by this paragraph.

25

30

35

40

Procedure for amending or replacing regulations under paragraph 1
3(1) Regulations in force under paragraph 1(1) may not be amended or replacedby further regulations under that provision except following further
research carried out by OFCOM into the matters mentioned in paragraph
2(2).

45

Online Safety Bill
Schedule 11 — Categories of regulated user-to-user services and regulated search services: regulations

219(2) Regulations in force under paragraph 1(2) may not be amended or replacedby further regulations under that provision except following further
research carried out by OFCOM into the matters mentioned in paragraph2(3).
(3) Regulations in force under paragraph 1(3) may not be amended or replacedby further regulations under that provision except following further
research carried out by OFCOM into the matters mentioned in paragraph
2(4).
(4) The further research in question—(a) may be initiated by OFCOM or carried out in response to a requestfrom the Secretary of State, and(b) may be in as much depth as OFCOM consider appropriate.

510(5) A request from the Secretary of State to OFCOM to carry out further researchmust indicate why the Secretary of State considers that to be necessary.
(6) Where such research is carried out, OFCOM must provide the Secretary ofState with advice as to whether, in OFCOM’s opinion—(a) it is appropriate to make changes to the regulations in question,
specifying the changes that OFCOM recommend, or(b) it is not appropriate to make any changes to the regulations inquestion.

1520(7) OFCOM must publish such advice as soon as reasonably practicable after
providing it to the Secretary of State.
(8) Where, following such advice, regulations are amended or replaced byfurther regulations under the provision in question (“new regulations”)—(a) if the new regulations include provision which differs in any
material respect from provision advised by OFCOM, the Secretary ofState must publish a statement explaining the departures from that
advice;(b) if OFCOM’s advice was as mentioned in sub-paragraph (6)(b), theSecretary of State must publish a statement explaining the reasonsfor the new regulations.
(9) Where OFCOM’s advice is as mentioned in sub-paragraph (6)(a) and theSecretary of State does not make new regulations, the Secretary of State
must, as soon as reasonably practicable, publish a statement explaining thatdecision.

25

30

35

(10) A statement mentioned in sub-paragraph (8) must be published no later
than the time at which the regulations to which the statement relates aremade.
(11) A statement mentioned in sub-paragraph (8) or (9) must be published insuch manner as the Secretary of State considers appropriate for bringing itto the attention of persons who may be affected by it.
(12) Sub-paragraphs (1) to (3) do not apply to regulations made only for the
purpose of correcting existing regulations under paragraph 1.

40

220

Online Safety Bill
Schedule 11 — Categories of regulated user-to-user services and regulated search services: regulations

Publication of OFCOM’s advice under paragraphs 2 and 3
4(1) In arranging for the publication of advice under paragraph 2(7)(a) or 3(7),OFCOM must have regard to the need to exclude from publication, so far asthat is practicable, matters which are confidential in accordance with subparagraphs (2) and (3).

5(2) A matter is confidential under this sub-paragraph if—(a) it relates specifically to the affairs of a particular body, and(b) publication of that matter would or might, in OFCOM’s opinion,
seriously and prejudicially affect the interests of that body.
(3) A matter is confidential under this sub-paragraph if—(a) it relates to the private affairs of an individual, and(b) publication of that matter would or might, in OFCOM’s opinion,
seriously and prejudicially affect the interests of that individual.

10Interpretation
5

References in this Schedule to the number of users of a user-to-user part of aservice or a search engine are to the number of United Kingdom users ofsuch a part or search engine.

6

In this Schedule the “characteristics” of a user-to-user part of a service or asearch engine include its user base, business model, governance and othersystems and processes.

7

In this Schedule—“content that is harmful to children” has the same meaning as in Part 3(see section 54);
“illegal content” has the same meaning as in Part 3 (see section 53);
“regulated user-generated content” has the same meaning as in Part 3(see section 49);
“search content” has the same meaning as in Part 3 (see section 51).

SCHEDULE 12

15

20

25

Section 97

OFCOM’S POWERS OF ENTRY, INSPECTION AND AUDIT
Authorised persons
130(1) OFCOM may authorise persons to—(a) exercise powers of entry and inspection under paragraph 2;(b) carry out audits in accordance with notices under paragraph 4;(c) apply for a warrant to be issued under paragraph 5, and execute sucha warrant that has been issued.

35(2) “Authorised person” means—(a) in paragraph 2, a person authorised for the purposes mentioned in
sub-paragraph (1)(a);(b) in paragraph 4, a person authorised for the purposes mentioned in
sub-paragraph (1)(b);40

Online Safety Bill
Schedule 12 — OFCOM’s powers of entry, inspection and audit

(c)

221

in other paragraphs of this Schedule, a person authorised for the
purposes mentioned in sub-paragraph (1)(c).

(3) An authorisation under this paragraph must be in writing.
Power of entry and inspection without a warrant
2(1) The powers conferred by this paragraph may be exercised in relation topremises only if OFCOM—(a) believe that the premises are being used by the provider of aregulated service in connection with the provision of a regulated
service, and(b) have given the occupier of the premises seven days’ notice that they
propose to exercise the powers.

510(2) The powers conferred by this paragraph must be exercised at a reasonablehour.
(3) Before exercising a power of entry under this paragraph, an authorised
person must, if requested to do so by a person on the premises—(a) produce evidence of the authorised person’s identity, and(b) outline the purpose for which the power is exercised.
(4) An authorised person may—(a) enter the premises,(b) inspect the premises,(c) observe the carrying on of the regulated service at the premises,(d) inspect any document or equipment found on the premises,(e) require any person on the premises to provide any information, or
produce any document in the person’s possession or control, that theauthorised person considers is relevant to the provision of theregulated service, and(f) require any person on the premises to provide an explanation of any
document or to state where it may be found.
(5) An authorised person may take copies of any document found or produced
under sub-paragraph (4).

15

20

25

30

(6) An authorised person may exercise powers conferred by this paragraph inrelation to information or a document only if the information or document
is required in connection with the exercise by OFCOM of their functions
under this Act.
Notice requiring information or documents at inspection
335(1) This paragraph applies where OFCOM intend to exercise the powers
conferred by paragraph 2 to enter and inspect premises.
(2) OFCOM may give the occupier of the premises a notice requiring relevant
information to be provided, or relevant documents to be produced, during
the inspection.
(3) Any such notice must be given at least seven days in advance of the
proposed inspection date.

40

222

Online Safety Bill
Schedule 12 — OFCOM’s powers of entry, inspection and audit(4) For the purposes of this paragraph, information or documents are “relevant”
if they are required in connection with the exercise by OFCOM of theirfunctions under this Act.
(5) A notice under this paragraph must—(a) specify or describe the information to be provided, or the documents
to be produced, during the inspection, and(b) contain information about the consequences of not complying with
the notice.

5

Audit
4

(1) OFCOM may give the provider of a regulated service a notice (an “audit
notice”) requiring the provider to permit OFCOM to carry out an audit—(a) to assess whether the provider has complied or is complying with
enforceable requirements that apply in respect of the service, or(b) to assess—(i) the nature and level of risk of the provider failing to comply
with an enforceable requirement that applies in respect of theservice, and(ii) ways to mitigate such a risk.
(2) An audit notice may require the provider to take any of the following actions
for a purpose mentioned in sub-paragraph (1)—(a) to permit an authorised person to enter and inspect specified
premises;(b) to permit an authorised person to observe the carrying on of theregulated service at the premises;(c) to direct an authorised person to documents on the premises that areof a specified description;(d) to assist an authorised person to view information of a specified
description that is capable of being viewed using equipment or a
device on the premises;(e) to comply with a request from an authorised person for a copy (insuch form as may be requested) of the documents or information towhich the person is directed or which the person is assisted to view;(f) to permit an authorised person to inspect the documents,
information or equipment to which the person is directed or which
the person is assisted to view;(g) to provide an authorised person with an explanation of such
documents or information;(h) to make available for interview by the authorised person a specified
number of people of a specified description who are involved in theprovision of the regulated service (not exceeding the number who
are willing to be interviewed).
(3) An audit notice—(a) must be given at least 28 days in advance of the start of the audit, and(b) must specify the time or times at which, or period or periods within
which, each requirement imposed by the notice must be complied
with.
(4) An audit notice may not require a provider to permit an authorised person
to enter domestic premises.

10

15

20

25

30

35

40

45

Online Safety Bill
Schedule 12 — OFCOM’s powers of entry, inspection and audit

223(5) An audit notice may not require a provider to do anything that would resultin the disclosure of information or documents in respect of which a claim tolegal professional privilege, or (in Scotland) to confidentiality ofcommunications, could be maintained in legal proceedings.
(6) An audit notice must contain information about the consequences of notcomplying with the requirements which it imposes.

5(7) An audit notice may by further notice—(a) be revoked by OFCOM;(b) be varied by OFCOM so as to make it less onerous.
(8) OFCOM may require a provider to pay some or all of the reasonable costs ofan audit carried out in accordance with an audit notice.

10(9) If OFCOM require a provider to pay an amount as mentioned in subparagraph (8), paragraph 6 of Schedule 13 applies in relation to the amountas it applies in relation to a penalty within the meaning of that Schedule.
(10) In this paragraph “specified” means specified in an audit notice.

15

Conditions for issue of a warrant
5(1) A justice of the peace or (in Northern Ireland) a lay magistrate may issue awarrant in relation to premises specified in an application only if satisfied onsworn information in writing given by an authorised person that—(a) the premises are being used by the provider of a regulated service inconnection with the provision of a regulated service;(b) there are reasonable grounds to suspect that—(i) the provider is failing to comply, or has failed to comply,
with an enforceable requirement that applies in respect ofthat service, and(ii) there is information or equipment on the premises, or there
are documents on the premises, relevant to OFCOM’s
investigation into that failure (or possible failure); and(c) any of the conditions in sub-paragraph (2) are met.
(2) The conditions are that, in relation to the premises specified in theapplication for a warrant—(a) OFCOM have previously given notice to enter the premises, as
required in relation to entry without a warrant under paragraph 2,
but a person authorised by OFCOM to exercise powers under thatparagraph was denied access,(b) a requirement imposed by a person acting in the exercise of powers
conferred by paragraph 2 has not been complied with,(c) a requirement of a notice under paragraph 3 has not been complied
with,(d) a requirement of a notice under paragraph 4 (audit notice) has notbeen complied with,(e) giving notice to enter the premises would defeat the object of entry,or(f) OFCOM require access to the premises urgently.

20

25

30

35

40

224

Online Safety Bill
Schedule 12 — OFCOM’s powers of entry, inspection and audit

Evidence of authority
6(1) Before exercising a power of entry under a warrant, an authorised person
must—(a) produce a copy of the warrant,(b) supply the occupier (if present), or any other person appearing to theauthorised person to be in charge of the premises, with a copy of thewarrant, and(c) if requested to do so—(i) produce evidence of the authorised person’s identity, and(ii) outline the purpose for which the power is exercised.

510(2) If neither the occupier nor any other person appearing to the authorised
person to be in charge of the premises is present, the authorised person mustleave a copy of the warrant in a prominent place on the premises.
Powers exercisable by warrant
7

An authorised person executing a warrant may do any of the following forthe purposes of OFCOM’s investigation into whether there is, or has been, afailure referred to in paragraph 5(1)(b)(i)—(a) enter the premises specified in the warrant;(b) search the premises;(c) inspect any documents or equipment found on the premises, or any
information capable of being viewed using equipment or a device on
the premises;(d) require any person on the premises to provide information,
including requiring an explanation of any document found on thepremises or any information capable of being viewed using
equipment or a device on the premises;(e) require any person on the premises to produce any document in the
person’s possession or control;(f) take copies of any document found on the premises or produced in
response to a requirement under paragraph (e);(g) require information which is stored in electronic form and may beaccessed from the premises to be produced in a form in which it canbe taken away and in which it is visible and legible (or from which it
can readily be produced in a visible and legible form);(h) operate any equipment found on the premises for the purposes of
producing such information in such a form;(i) require any person on the premises to give the authorised person any
assistance that the authorised person may reasonably require(including for the purposes of paragraphs (g) and (h));(j) take copies of anything produced in accordance with paragraph (g);(k) seize any document found on the premises or produced in response
to a requirement under paragraph (e), or anything produced inaccordance with paragraph (g), or any equipment found on thepremises;(l) open any container found on the premises;(m) take a photograph or video recording of anything found on thepremises.

15

20

25

30

35

40

45

Online Safety Bill
Schedule 12 — OFCOM’s powers of entry, inspection and audit

225

Powers of seizure: supplementary
8(1) This paragraph applies where the person executing a warrant seizes adocument or other thing.
(2) The person must, on request—(a) give a receipt for it, and(b) (in the case of a document) give an occupier of the premises a copyof it.

5(3) Sub-paragraph (2)(b) does not apply if the person executing the warrant
considers that providing a copy would result in undue delay.
(4) Anything seized may be retained for so long as is necessary in all thecircumstances.

10

Further provision about executing warrants
9

Entry and search under a warrant must be at a reasonable hour, unless it
appears to the person executing it that the purpose of a search would be
frustrated or seriously prejudiced by entry at a reasonable hour.

10

Entry and search under a warrant must be within the period of one monthstarting with the date of its issue.

11

An authorised person executing a warrant may take such other persons andsuch equipment and materials onto the premises as appear to that person to
be necessary.

12

A person taken on to the premises under paragraph 11 may exercise any
power conferred on an authorised person by paragraph 7 if the person is in
the company and under the supervision of an authorised person executing
a warrant.

13

An authorised person may use reasonable force, if necessary, for the
purpose of exercising a power under a warrant.

14

A warrant authorises entry on one occasion only, unless it specifies that it
authorises multiple entries.

15

If the premises are unoccupied or the occupier is temporarily absent, anauthorised person executing a warrant must leave the premises as
effectively secured against trespassers as that person found them.

15

20

25

30

Return of warrants
16(1) Where a warrant is executed—(a) it must be returned to the appropriate person (see sub-paragraph (3))
after being executed, and(b) the person by whom it is executed must write on the warrant astatement of the powers that have been exercised under the warrant.

35(2) Where a warrant is not executed, it must be returned to the appropriate
person within the time authorised for its execution.
(3) The appropriate person is—

40

226

Online Safety Bill
Schedule 12 — OFCOM’s powers of entry, inspection and audit

(a)
(b)
(c)

in the case of a warrant issued in England and Wales, the designatedofficer for the local justice area in which the justice of the peace wasacting when issuing the warrant;
in the case of a warrant issued in Scotland, the clerk of the justice ofthe peace court;in the case of a warrant issued in Northern Ireland, the clerk of petty
sessions.

(4) The appropriate person must retain a search warrant returned under subparagraph (1) or (2) until the end of the period of 12 months starting with thedate of its return.

510(5) If during that period the occupier of premises to which the warrant relates
asks to inspect it, the occupier must be allowed to do so.
Restrictions on powers
17(1) This paragraph applies in relation to—(a) powers conferred by paragraph 2 (entry and inspection without
warrant), and(b) powers exercisable under a warrant.

15(2) Those powers are not exercisable in respect of domestic premises.
(3) Those powers are not exercisable in relation to information or documents in
respect of which a claim to legal professional privilege, or (in Scotland) to
confidentiality of communications, could be maintained in legal
proceedings.

20

Offences
18(1) A person commits an offence if—(a) the person intentionally obstructs a person acting under thisSchedule;(b) the person fails, without reasonable excuse, to comply with any
requirement imposed by a person acting under this Schedule;(c) in response to a requirement imposed by a person acting under thisSchedule, the person provides information that is false in a material
respect, knowing that it is false in a material respect or being recklessas to whether it is false in a material respect.
(2) A person who commits an offence under this paragraph is liable—(a) on summary conviction in England and Wales, to imprisonment fora term not exceeding the general limit in a magistrates’ court or a fine(or both);(b) on summary conviction in Scotland, to imprisonment for a term notexceeding 12 months or a fine not exceeding the statutory maximum(or both);(c) on summary conviction in Northern Ireland, to imprisonment for aterm not exceeding 6 months or a fine not exceeding the statutory
maximum (or both);(d) on conviction on indictment, to imprisonment for a term notexceeding two years or a fine (or both).

25

30

35

40

Online Safety Bill
Schedule 12 — OFCOM’s powers of entry, inspection and audit

227

Interpretation
19

20

21

In this Schedule—“domestic premises” means premises, or a part of premises, used as adwelling;“premises” means premises in the United Kingdom.
References in this Schedule to a person “acting under this Schedule” are to aperson acting—(a) in the exercise of powers conferred by paragraph 2 (entry andinspection without warrant), or(b) in the execution of a warrant,
and the reference in paragraph 18(1)(a) also includes a person carrying out
an audit in accordance with an audit notice.
In this Schedule “enforceable requirement” has the same meaning as in
Chapter 6 of Part 7 (see section 119), except that—(a) it does not include—(i) a requirement under (or a requirement of a notice under)
section 94 (reports by skilled persons),(ii) a requirement of a notice under section 96 (interviews), or(iii) a requirement imposed by a person acting under thisSchedule;(b) it includes a requirement imposed by a notice under section 110(1)(notices to deal with terrorism content and CSEA content).

22

In paragraphs 6 to 17 and 20 “warrant” means a warrant issued underparagraph 5.

23

In the application of paragraph 5(1) to Scotland, the reference to sworn
information in writing has effect as a reference to evidence on oath.

24

In the application of paragraph 5(1) to Northern Ireland, the reference tosworn information in writing has effect as a reference to a complaint on oath.

SCHEDULE 13

5

10

15

20

25

Section 130

PENALTIES IMPOSED BY OFCOM UNDER CHAPTER 6 OF PART 730

Meaning of “penalty” in this Schedule1

Except as otherwise indicated, references in this Schedule to a “penalty” areto any of the following—(a) a penalty imposed by a confirmation decision (see sections 120(5)(b)and 125), whether that is—(i) a penalty of a single amount, or(ii) a penalty calculated by reference to a daily rate;(b) a penalty imposed by a penalty notice under section 126;(c) a penalty imposed by a penalty notice under section 127(5);(d) a penalty imposed by a penalty notice under section 128(6).

35

40

228

Online Safety Bill
Schedule 13 — Penalties imposed by OFCOM under Chapter 6 of Part 7

Amount of penalties: principles
2(1) In determining the amount of a penalty to be imposed on a person, OFCOM
must, in particular, take into account—(a) any representations made, and evidence provided, by the person,
and(b) the effects of the failure (or failures) in respect of which the penalty
is imposed.
(2) In the case of a penalty imposed by a confirmation decision, OFCOM mustalso take into account any representations made, and evidence provided, by
any other person to whom the earlier provisional notice of contravention
relating to the same matter was given.
(3) OFCOM must also take into account—(a) in the case of a penalty imposed by a confirmation decision, any
steps taken by the person towards—(i) complying with any duty or requirement specified in theprovisional notice of contravention given to the person, or(ii) remedying the failure to comply with any such duty or
requirement;(b) in the case of a penalty imposed by a penalty notice under section
126, any steps taken by the person towards—(i) complying with any duty or requirement specified in theconfirmation decision given to the person, or(ii) remedying the failure to comply with any such duty or
requirement;(c) in the case of a penalty imposed by a penalty notice under section
127(5), any steps taken by the person towards complying with thenotice under section 110(1);(d) in the case of a penalty imposed by a penalty notice under section
128(6), any steps taken by the person towards paying any amount of
the fee due to OFCOM.

5

10

15

20

25

30

(4) A penalty must be of an amount that OFCOM consider to be—(a) appropriate, and(b) proportionate to the failure (or failures) in respect of which it is
imposed.
(5) See also section 392 of the Communications Act (which requires OFCOM toproduce guidelines about their determination of the amount of penalties
that they impose).

35

Limitation to type and amount of penalties previously proposed
3(1) A confirmation decision or penalty notice may not impose a penalty of adifferent kind, of a greater amount or (in the case of a penalty calculated byreference to a daily rate) payable over a longer period than that proposed in
the earlier notice in relation to the same matter.
(2) Sub-paragraph (1) applies in a case where a provisional notice ofcontravention and confirmation decision in relation to the same matter areboth given jointly (in accordance with Schedule 15) to the same entities, butdoes not otherwise apply in relation to a penalty for which two or more
entities are jointly and severally liable.

40

45

Online Safety Bill
Schedule 13 — Penalties imposed by OFCOM under Chapter 6 of Part 7229(3) In this paragraph “penalty notice” means a penalty notice under section 126,
127(5) or 128(6).
Maximum amount of penalties
4(1) Where a penalty is imposed on a person in respect of a regulated service
provided by that person, the maximum amount of the penalty for which theperson is liable is whichever is the greater of—(a) £18 million, and(b) 10% of the person’s qualifying worldwide revenue for the person’s
most recent complete accounting period (subject to sub-paragraph
(5)).

5

10

(2) But if the person does not have an accounting period, the maximum amountof the penalty for which the person is liable is £18 million.
(3) The maximum amount of a penalty for which a person not within subparagraph (1) is liable is £18 million.
(4) If the person’s first accounting period has not yet ended, sub-paragraph(1)(b) is to be read as referring to 10% of the amount that OFCOM estimate
to be the person’s likely qualifying worldwide revenue for that period.
(5) If the duration of the accounting period by reference to which an amount ofqualifying worldwide revenue is calculated is less than a year, the amountmentioned in sub-paragraph (1)(b) is to be proportionately increased.
If the duration of that accounting period is more than a year, that amount is
to be proportionately reduced.
(6) The amount of a person’s qualifying worldwide revenue for an accounting
period is, in the event of a disagreement between the person and OFCOM,
the amount determined by OFCOM.

15

20

25

(7) In the case of a confirmation decision that imposes a penalty of a single
amount and a penalty calculated by reference to a daily rate, references in
sub-paragraphs (1) to (3) to the maximum amount for which a person isliable are to the maximum amount of both those penalties taken together.
(8) In this paragraph “accounting period”, in relation to a person, means aperiod in respect of which accounts are prepared in relation to that person
or, where that person is an individual, in respect of that individual’sbusiness of providing a regulated service.
(9) In this paragraph and in paragraph 5, “qualifying worldwide revenue” has
the meaning given to it in a statement produced and published by OFCOM
under section 76 (see subsection (2) of that section).

30

35

Maximum amount of penalties: group of entities
5(1) This paragraph contains modifications of paragraph 4 in a case where, in
accordance with Schedule 15, two or more entities are jointly and severally
liable for a penalty.
(2) Sub-paragraphs (3) to (5) of this paragraph apply instead of paragraph 4(1)to (4).
(3) The maximum amount of the penalty for which the entities are liable iswhichever is the greater of—

40

230

Online Safety Bill
Schedule 13 — Penalties imposed by OFCOM under Chapter 6 of Part 7

(a)
(b)

£18 million, and
10% of the qualifying worldwide revenue of the group of entities thatconsists of—(i) the entity that is the provider of the regulated service towhich the decision or notice in question relates (“entity E”),
and(ii) every other entity which (at the time the decision or notice isgiven) is a group undertaking in relation to entity E.

(4) In sub-paragraph (3)(b), the reference to the qualifying worldwide revenueof a group of entities is to—(a) the amount of the group’s qualifying worldwide revenue for themost recent complete accounting period of the entities liable for the
penalty, or(b) if the first accounting period of the entities liable for the penalty has
not yet ended, the amount that OFCOM estimate to be the group’s
likely qualifying worldwide revenue for that period.
(5) In a case where the accounting periods of the entities liable for the penalty
are different—(a) the reference in sub-paragraph (4)(a) to the accounting period of theentities is to be read as a reference to the accounting period of any ofthe entities (at OFCOM’s discretion), and(b) sub-paragraph (4)(b) is to apply as if—(i) for “the first accounting period of the entities” there were
substituted “the first accounting period of all of the entities”,
and(ii) for “that period” there were substituted “the accounting
period of any of the entities (at OFCOM’s discretion)”.

5

10

15

20

25

(6) Sub-paragraphs (5), (6) and (7) of paragraph 4 are to be read with thenecessary modifications in their application for the purposes of thisparagraph.

30(7) In this paragraph—“accounting period”, in relation to an entity, means a period in respectof which accounts are prepared in relation to that entity;“group undertaking” has the meaning given by section 1161(5) of theCompanies Act 2006.

35(8) For the purposes of this paragraph, sections 1161(5) and 1162 of, andSchedule 7 to, the Companies Act 2006—(a) are to apply in relation to an entity which is not an undertaking (asdefined in section 1161(1) of that Act) as they apply in relation to anundertaking, and(b) are to be read with any necessary modifications if applied to anentity formed under the law of a country outside the United
Kingdom.

40

Recovery of penalties
6(1) In England and Wales, a penalty is recoverable—(a) if the county court so orders, as if it were payable under an order ofthat court;

45

231

Online Safety Bill
Schedule 13 — Penalties imposed by OFCOM under Chapter 6 of Part 7(b)if the High Court so orders, as if it were payable under an order ofthat court.

(2) In Scotland, a penalty may be enforced in the same manner as an extract
registered decree arbitral bearing a warrant for execution issued by thesheriff court of any sheriffdom in Scotland.

5(3) In Northern Ireland, a penalty is recoverable—(a) if a county court so orders, as if it were payable under an order of thatcourt;(b) if the High Court so orders, as if it were payable under an order ofthat court.

10

SCHEDULE 14

Section 169

AMENDMENTS CONSEQUENTIAL ON OFFENCES IN PART 10 OF THIS ACTPART 1AMENDMENTS CONSEQUENTIAL ON OFFENCES IN SECTIONS 160, 162 AND 164
Football Spectators Act 1989
1

15

In Schedule 1 to the Football Spectators Act 1989 (football banning orders:
relevant offences), after paragraph 1(y) insert—“(z) any offence under section 160 (false communications) or
162 (threatening communications) of the Online Safety Act
2023—(i) which does not fall within paragraph (d), (e), (m),(n), (r) or (s),(ii) as respects which the court has stated that theoffence is aggravated by hostility of any of thetypes mentioned in section 66(1) of the Sentencing
Code (racial hostility etc), and(iii) as respects which the court makes a declarationthat the offence related to a football match, to a
football organisation or to a person whom theaccused knew or believed to have a prescribed
connection with a football organisation.”

20

25

30

Sexual Offences Act 2003
2

In Schedule 5 to the Sexual Offences Act 2003 (cases where sexual harm
prevention orders may be made), after paragraph 63C insert—“63D

An offence under section 160 of the Online Safety Act 2023
(false communications).

63E

An offence under section 162 of that Act (threatening
communications).”

35

232

Online Safety Bill
Schedule 14 — Amendments consequential on offences in Part 10 of this Act
Part 1 — Amendments consequential on offences in sections 160, 162 and 164

Regulatory Enforcement and Sanctions Act 2008
3

In Schedule 3 to the Regulatory Enforcement and Sanctions Act 2008
(relevant enactments for the purposes of relevant functions to which Parts 1
and 2 of that Act apply), at the appropriate place insert—“Online Safety Act 2023, sections 160 and 162”.

5

Elections Act 2022
4

In Schedule 9 to the Elections Act 2022 (offences for purposes of Part 5), inPart 2, after paragraph 52 insert—“Online Safety Act 2023
52A

An offence under any of the following provisions of theOnline Safety Act 2023—(a) section 160 (false communications);(b) section 162 (threatening communications);(c) section 164 (sending flashing images).”
PART 2

10

15

AMENDMENTS CONSEQUENTIAL ON OFFENCE IN SECTION 167
Children and Young Persons Act 1933
5

In Schedule 1 to the Children and Young Persons Act 1933 (offences againstchildren and young persons with respect to which special provisions of Act
apply), in the entry relating to the Sexual Offences Act 2003, after “66” insert“, 66A”.

20

Sexual Offences Act 2003
6(1) The Sexual Offences Act 2003 is amended as follows.
(2) In section 136A(3A) (specified child sex offences), in paragraph (c), after “66”insert “, 66A”.

25(3) In Schedule 3 (sexual offences for purposes of Part 2), after paragraph 33
insert—“33A

An offence under section 66A of this Act (sending etc photographor film of genitals) if—(a) where the offender was under 18, the offender is or has
been sentenced in respect of the offence to imprisonment
for a term of at least 12 months;(b) in any other case—(i) the victim was under 18, or(ii) the offender, in respect of the offence or finding, isor has been—(a) sentenced to a term of imprisonment,(b) detained in a hospital, or(c) made the subject of a community sentenceof at least 12 months.”

30

35

40

Online Safety Bill
Schedule 14 — Amendments consequential on offences in Part 10 of this Act
Part 2 — Amendments consequential on offence in section 167

233

Criminal Justice Act 2003
7(1) The Criminal Justice Act 2003 is amended as follows.
(2) In Part 2 of Schedule 15 (specified sexual offences for purposes of section325), after paragraph 149 insert—“149A

An offence under section 66A of that Act (sending etc photographor film of genitals).”5(3) In Schedule 34A (child sex offences for purposes of section 327A), in
paragraph 10, after “66” insert “, 66A”.
Anti-social Behaviour, Crime and Policing Act 20148

In section 116 of the Anti-social Behaviour, Crime and Policing Act 2014
(information about guests at hotels believed to be used for child sexual
exploitation), in subsection (8)(c), in the entry that relates to exposure andvoyeurism offences in the Sexual Offences Act 2003, after “66” insert “, 66A”.

10

Modern Slavery Act 20159

In Schedule 4 to the Modern Slavery Act 2015 (offences to which defence insection 45 does not apply), in paragraph 33 (offences under Sexual Offences
Act 2003), after the entry for section 66 insert—“section 66A (sending etc photograph or film of genitals)”.

15

Sentencing Act 2020
10

In Part 2 of Schedule 18 to the Sentencing Act 2020 (specified sexual offences
for purposes of section 306), in paragraph 38 (offences under Sexual
Offences Act 2003), after sub-paragraph (ax) insert—“(axa) section 66A (sending etc photograph or film of genitals);”.

20

Elections Act 2022
11

In Schedule 9 to the Elections Act 2022 (offences for purposes of Part 5), afterparagraph 47(f) insert—“(g) section 66A (sending etc photograph or film of
genitals).”

SCHEDULE 15

25

Section 174

LIABILITY OF PARENT ENTITIES ETC

30

Joint provisional notices of contravention
1(1) This paragraph applies if—(a) OFCOM are satisfied that there are grounds to give an entity (“E”) a
provisional notice of contravention relating to a regulated service,and(b) E is the provider of that service.

35

234

Online Safety Bill
Schedule 15 — Liability of parent entities etc(2) If there is an entity which is a parent undertaking in relation to E, theprovisional notice of contravention may be given—(a) to E alone, or(b) jointly to E and to an entity which is a parent undertaking in relation
to E.

5

(3) If there is an entity which is a subsidiary undertaking in relation to E, theprovisional notice of contravention may be given—(a) to E alone, or(b) jointly to E and to an entity which is a subsidiary undertaking in
relation to E.

10(4) If E is a subsidiary undertaking and there is an entity which is a fellow
subsidiary undertaking in relation to E, the provisional notice ofcontravention may be given—(a) to E alone, or(b) jointly to E and to an entity which is a fellow subsidiary undertaking
in relation to E.

15(5) If an individual or individuals control E (see paragraph 5(4)), the provisional
notice of contravention may be given—(a) to E alone, or(b) jointly to E and to the individual or individuals who control E.

20(6) If a provisional notice of contravention is given jointly as mentioned in subparagraph (2)(b), (3)(b), (4)(b) or (5)(b), section 118(8) is to be read, in its
application for the purposes of this paragraph, as if it included a reference torepresentations about whether joint and several liability would beappropriate.

25

Liability of parent entities for failures by subsidiary entities
2(1) This paragraph applies if—(a) OFCOM are satisfied that there are grounds to give an entity (“E”) a
relevant decision or notice relating to a regulated service,(b) E is the provider of that service, and(c) there is an entity which is a parent undertaking in relation to E (a“parent entity”).
(2) The relevant decision or notice may be given—(a) to E alone, or(b) (subject to sub-paragraph (4)) jointly to E and to a parent entity.
(3) But before giving a penalty notice to a parent entity, or giving a confirmation
decision to a parent entity which was not previously given a provisional
notice of contravention relating to the same matter, OFCOM must give that
entity an opportunity to make representations to OFCOM about—(a) the matters contained in the decision or notice, and(b) whether joint and several liability would be appropriate.
(4) OFCOM may not give a relevant decision or notice to a parent entity (“P”)
if—(a) P meets the condition in section 1162(2)(a) of the Companies Act inrelation to E, and

30

35

40

45

Online Safety Bill
Schedule 15 — Liability of parent entities etc

(b)

235

P makes representations (under section 118(8) as applied byparagraph 1(6), or under sub-paragraph (3)) which satisfy OFCOM
that P does not meet any condition in section 1162(2)(b), (c) or (d) or(4) of the Companies Act in relation to E.

(5) If a relevant decision or notice is given to entities jointly as mentioned in subparagraph (2)(b), those entities are jointly and severally liable to comply
with the requirements, or (as the case may be) pay the penalty, imposed by
the decision or notice.
(6) See also paragraph 5 of Schedule 13 (maximum amount of penalties: groupof entities).

510Liability of subsidiary entities for failures by parent entities
3(1) This paragraph applies if—(a) OFCOM are satisfied that there are grounds to give an entity (“E”) a
relevant decision or notice relating to a regulated service,(b) E is the provider of that service, and(c) there is an entity which is a subsidiary undertaking in relation to E (a“subsidiary entity”).
(2) The relevant decision or notice may be given—(a) to E alone, or(b) jointly to E and to a subsidiary entity.
(3) But—(a) before giving a penalty notice to a subsidiary entity, or giving a
confirmation decision to a subsidiary entity which was notpreviously given a provisional notice of contravention relating to thesame matter, OFCOM must give that entity an opportunity to makerepresentations to OFCOM about—(i) the matters contained in the decision or notice, and(ii) whether joint and several liability would be appropriate; and(b) a relevant decision or notice may be given to a subsidiary entity only
if that entity’s acts or omissions contributed to the failure in respectof which the decision or notice is given.
(4) If a relevant decision or notice is given to entities jointly as mentioned in subparagraph (2)(b), those entities are jointly and severally liable to comply
with the requirements, or (as the case may be) pay the penalty, imposed by
the decision or notice.

15

20

25

30

35

(5) See also paragraph 5 of Schedule 13 (maximum amount of penalties: groupof entities).
Liability of fellow subsidiary entities for failures by subsidiary entities
4(1) This paragraph applies if—(a) OFCOM are satisfied that there are grounds to give an entity (“E”) a
relevant decision or notice relating to a regulated service,(b) E is the provider of that service,(c) E is a subsidiary undertaking, and(d) there is an entity which is a fellow subsidiary undertaking in relation
to E (a “fellow subsidiary entity”).

40

45

236

Online Safety Bill
Schedule 15 — Liability of parent entities etc(2) The relevant decision or notice may be given—(a) to E alone, or(b) jointly to E and to a fellow subsidiary entity.
(3) But—(a) before giving a penalty notice to a fellow subsidiary entity, or giving
a confirmation decision to a fellow subsidiary entity which was notpreviously given a provisional notice of contravention relating to thesame matter, OFCOM must give that entity an opportunity to makerepresentations to OFCOM about—(i) the matters contained in the decision or notice, and(ii) whether joint and several liability would be appropriate; and(b) a relevant decision or notice may be given to a fellow subsidiary
entity only if that entity’s acts or omissions contributed to the failure
in respect of which the decision or notice is given.
(4) If a relevant decision or notice is given to entities jointly as mentioned in subparagraph (2)(b), those entities are jointly and severally liable to comply
with the requirements, or (as the case may be) pay the penalty, imposed by
the decision or notice.
(5) See also paragraph 5 of Schedule 13 (maximum amount of penalties: groupof entities).

5

10

15

20

Liability of controlling individuals for failures by entities
5(1) This paragraph applies if—(a) OFCOM are satisfied that there are grounds to give an entity (“E”) a
relevant decision or notice relating to a regulated service,(b) E is the provider of that service, and(c) an individual or individuals control E.
(2) The relevant decision or notice may be given—(a) to E alone, or(b) (subject to sub-paragraph (5)) jointly to E and to the individual orindividuals who control E.
(3) But before giving a penalty notice to an individual, or giving a confirmation
decision to an individual who was not previously given a provisional noticeof contravention relating to the same matter, OFCOM must give that
individual an opportunity to make representations to OFCOM about—(a) the matters contained in the decision or notice, and(b) whether joint and several liability would be appropriate.
(4) An individual or individuals are to be taken to “control” E if that individualor those individuals would, if they were an undertaking, be a parent
undertaking in relation to E within the meaning of section 1162 of theCompanies Act by reason of meeting the condition in subsection (2)(a), (b),(c) or (d) or (4)(a) of that section.
(5) OFCOM may not give a relevant decision or notice to an individual orindividuals (“P”) if—(a) the condition by reason of which P controls E is the condition insection 1162(2)(a) of the Companies Act, and

25

30

35

40

45

Online Safety Bill
Schedule 15 — Liability of parent entities etc

(b)

237

P makes representations (under section 118(8) as applied byparagraph 1(6), or under sub-paragraph (3)) which satisfy OFCOM
that P does not control E by reason of any condition in section
1162(2)(b), (c) or (d) or (4) of the Companies Act.

(6) If a relevant decision or notice is given jointly to E and to an individual orindividuals as mentioned in sub-paragraph (2)(b), that entity and that
individual or those individuals are jointly and severally liable to comply
with the requirements, or (as the case may be) pay the penalty, imposed by
the decision or notice.
OFCOM’s guidance
6

10

OFCOM’s guidance under section 138 must include information about thefactors that OFCOM would consider it appropriate to take into accountwhen considering whether to give a decision or notice jointly as mentioned
in this Schedule.

Interpretation
7

5

In this Schedule—“the Companies Act” means the Companies Act 2006;“fellow subsidiary undertaking” has the meaning given by section
1161(4) of the Companies Act;
“parent undertaking” and “subsidiary undertaking” are to be read in
accordance with section 1162 of the Companies Act;
“penalty notice” means a penalty notice under section 126, 127(5) or128(6);“relevant decision or notice” means—(a) a confirmation decision that includes requirements of a kinddescribed in section 121(1) or imposes a penalty as mentioned
in section 125 (or both), or(b) a penalty notice.

8

In its application for the purposes of this Schedule, paragraph 4 of Schedule
7 to the Companies Act is to be read as if the reference to operating andfinancial policies were to policies relating to compliance with the regulatory
requirements imposed by this Act.

9

For the purposes of this Schedule, sections 1161(4) and 1162 of, and Schedule
7 to, the Companies Act—(a) are to apply in relation to an entity which is not an undertaking (asdefined in section 1161(1) of that Act) as they apply in relation to anundertaking, and(b) are to be read with any necessary modifications if applied to anentity formed under the law of a country outside the United
Kingdom.

15

20

25

30

35

40

238

Online Safety Bill
Schedule 16 — Amendments of Part 4B of the Communications Act

SCHEDULE 16

Section 185

AMENDMENTS OF PART 4B OF THE COMMUNICATIONS ACT
1Part 4B of the Communications Act (video-sharing platform services) is
amended in accordance with this Schedule.

2

In section 368U (maintenance of list of providers)—(a) omit subsection (2);(b) for subsection (3) substitute—“(3)

5

OFCOM must publish the up to date list on a publicly
accessible part of their website.”3

In section 368V(4) (meaning of “significant differences”), for the words from“the determination of jurisdiction” to the end substitute “whether or not theperson has the required connection with the United Kingdom under section
368S(2)(d)”.

4

In section 368Y(2)(d) (information to be provided by providers of videosharing platform services), for the words from “under the jurisdiction” to theend substitute “subject to regulation under this Part in respect of the videosharing platform service that P provides”.

5

In section 368Z1(3) (duty to take appropriate measures), for the words from“of the description” to the end substitute “to monitor the information which
they transmit or store, or actively to seek to discover facts or circumstancesindicating illegal activity”.

6

In section 368Z10(3)(a) (power to demand information), for the words from“falls under” to the end substitute “has the required connection with theUnited Kingdom under section 368S(2)(d)”.

7

For section 368Z12 (co-operation with member States and the European
Commission) substitute—

10

15

20

25

“368Z12Co-operation with EEA States
OFCOM may co-operate with EEA states which are subject to the Audiovisual
Media Services Directive, and with the national regulatory
authorities of such EEA states, for the following purposes—(a) facilitating the carrying out by OFCOM of any of theirfunctions under this Part; or(b) facilitating the carrying out by the national regulatory
authorities of the EEA states of any of their functions inrelation to video-sharing platform services under that
Directive as it has effect in EU law as amended from time totime.”

30

35

Online Safety Bill
Schedule 17 — Video-sharing platform services: transitional provision etc
Part 1 — Interpretation

SCHEDULE 17

239

Section 187

VIDEO-SHARING PLATFORM SERVICES: TRANSITIONAL PROVISION ETCPART 1
INTERPRETATION
1(1) In this Schedule, “pre-existing Part 4B service” means—(a) an internet service which—(i) is a video-sharing platform service by reason of theconditions in section 368S(1) and (2) of the Communications
Act being met in relation to the service as a whole, and(ii) was being provided immediately before this Schedule comes
into force; or(b) a dissociable section of an internet service, where that dissociablesection—(i) is a video-sharing platform service by reason of theconditions in section 368S(1)(a) and (2) of theCommunications Act being met in relation to that dissociablesection, and(ii) was being provided immediately before this Schedule comes
into force.
(2) In sub-paragraph (1), any reference to a service provided before thisSchedule comes into force includes a reference to a service provided inbreach of the requirement in section 368V of the Communications Act.

2

In this Schedule—“the relevant day”, in relation to a pre-existing Part 4B service or to aservice which includes a pre-existing Part 4B service, means—(a) the date when section 186 comes into force (repeal of Part 4Bof the Communications Act), or(b) if the pre-existing Part 4B service ceases to be a video-sharing
platform service before the date mentioned in paragraph (a),the date when that service ceases to be a video-sharing
platform service;“safety duties” means the duties mentioned in section 6(2), (4) and (5),except the duties set out in—(a) section 8 (illegal content risk assessments),(b) section 10 (children’s risk assessments), and(c) section 19(2) (records of risk assessments);“the transitional period”, in relation to a pre-existing Part 4B service or
to a service which includes a pre-existing Part 4B service, means theperiod—(a) beginning with the date when this Schedule comes into force,and(b) ending with the relevant day;“video-sharing platform service” has the same meaning as in Part 4B of
the Communications Act (see section 368S of that Act).

5

10

15

20

25

30

35

40

240

Online Safety Bill
Schedule 17 — Video-sharing platform services: transitional provision etc
Part 2 — During the transitional period

PART 2
DURING THE TRANSITIONAL PERIOD
Pre-existing Part 4B services which are regulated user-to-user services
3(1) This paragraph applies in relation to a pre-existing Part 4B service which—(a) is within the definition in paragraph (a) of paragraph 1(1), and(b) is also a regulated user-to-user service.

5(2) Both this Act and Part 4B of the Communications Act apply in relation to thepre-existing Part 4B service during the transitional period.
(3) But that is subject to—(a) sub-paragraph (4),(b) sub-paragraph (5), and(c) paragraph 4.
(4) The following duties and requirements under this Act do not apply during
the transitional period in relation to the pre-existing Part 4B service—(a) the safety duties;(b) the duties set out in section 33 (fraudulent advertising);(c) the duties set out in section 57 (user identity verification);(d) the requirements under section 59(1) and (2) (reporting CSEA
content to the NCA);(e) the duties set out in sections 64 and 65 (terms of service);(f) the duty on OFCOM to give a notice under section 68(1) requiring
information in a transparency report;(g) the requirements to produce transparency reports under section
68(3) and (4).
(5) OFCOM’s powers under Schedule 12 to this Act (powers of entry, inspection
and audit) do not apply during the transitional period in relation to the preexisting Part 4B service.

10

15

20

25

(6) In sub-paragraph (2) the reference to this Act does not include a reference toPart 6 (fees); for the application of Part 6, see Part 3 of this Schedule.
Regulated user-to-user services that include regulated provider pornographic content
430(1) The duties set out in section 72 of this Act do not apply during thetransitional period in relation to any regulated provider pornographic
content published or displayed on a pre-existing Part 4B service.
(2) In the case of a regulated user-to-user service which includes a pre-existing
Part 4B service within the definition in paragraph (b) of paragraph 1(1),nothing in sub-paragraph (1) is to be taken to prevent the duties set out insection 72 from applying during the transitional period in relation to any
regulated provider pornographic content published or displayed on any
other part of the service.
(3) In this paragraph “regulated provider pornographic content” and“published or displayed” have the same meaning as in Part 5 of this Act (seesection 70).

35

40

Online Safety Bill
Schedule 17 — Video-sharing platform services: transitional provision etc
Part 2 — During the transitional period

241

Pre-existing Part 4B services which form part of regulated user-to-user services
5(1) During the transitional period, Part 4B of the Communications Act applies
in relation to a pre-existing Part 4B service within the definition inparagraph (b) of paragraph 1(1).
(2) Sub-paragraph (3), and paragraphs 6 to 8, apply in relation to a regulateduser-to-user service which includes a pre-existing Part 4B service within thedefinition in paragraph (b) of paragraph 1(1).
(3) During the transitional period, this Act applies in relation to the regulateduser-to-user service with the modifications set out in paragraph 6, 7, or 8
(whichever applies).

510(4) In paragraphs 6 to 8 the dissociable section of the service which is the preexisting Part 4B service is referred to as “the Part 4B part”.
(5) In sub-paragraph (3) the reference to this Act does not include a reference toPart 6 (fees); for the application of Part 6, see Part 3 of this Schedule.
Regulated user-to-user services with a Part 4B part and another user-to-user part
6

15(1) This paragraph applies in relation to a regulated user-to-user service
described in paragraph 5(2) if the service would still be a regulated user-touser service even if the Part 4B part were to be assumed not to be part of theservice.
(2) During the transitional period—(a) any duty or requirement mentioned in paragraph 3(4) which applies
in relation to the regulated service is to be treated as applying only in
relation to the rest of the service;(b) the powers mentioned in paragraph 3(5) are to be treated as applying
only in relation to the rest of the service.

2025(3) In this paragraph “the rest of the service” means any user-to-user part of theregulated service other than the Part 4B part.
Regulated user-to-user services with a Part 4B part and a search engine
7(1) This paragraph applies in relation to a regulated user-to-user service
described in paragraph 5(2) if the service would be a regulated searchservice if the Part 4B part were to be assumed not to be part of the service.
(2) During the transitional period, no duty or requirement mentioned inparagraph 3(4) applies in relation to the Part 4B part of the service (but thatis not to be taken to prevent any other duty or requirement under this Act
from applying in relation to the search engine of the service during thetransitional period).
(3) During the transitional period, the powers mentioned in paragraph 3(5) areto be treated as applying only in relation to the search engine of the service.

30

35

242

Online Safety Bill
Schedule 17 — Video-sharing platform services: transitional provision etc
Part 2 — During the transitional period

Regulated user-to-user services with a Part 4B part but no other user-to-user part or searchengine8(1) This paragraph applies in relation to a regulated user-to-user service
described in paragraph 5(2) if the service does not fall within paragraph 6 or
7.

5(2) The duties, requirements and powers mentioned in paragraph 3(4) and (5)do not apply in relation to the regulated service during the transitional
period.
Risk assessments and children’s access assessments of pre-existing Part 4B services or ofservices which include a pre-existing Part 4B service
9

See Part 3 of Schedule 3 for provision about—(a) the timing of risk assessments and children’s access assessments ofpre-existing Part 4B services, and(b) modifications of Parts 1 and 2 of that Schedule in connection withrisk assessments and children’s access assessments of services which
include a pre-existing Part 4B service within the definition inparagraph (b) of paragraph 1(1).

1015Operation of section 368U of the Communications Act
10

During the transitional period, section 368U of the Communications Act has
effect as a requirement to establish and maintain an up to date list of persons
providing a video-sharing platform service to which Part 4B applies.

20

Video-sharing platform services which start up, or start up again, during the transitional
period11

Part 4B of the Communications Act does not apply in relation to a videosharing platform service which is first provided on or after the date when
this Schedule comes into force.

12(1) Sub-paragraph (2) applies in relation to a pre-existing Part 4B service if—(a) the service ceases to be a video-sharing platform service on a datewithin the transitional period, and(b) the service begins again to be a video-sharing platform service onsome later date within the transitional period.

2530(2) Part 4B of the Communications Act does not start applying again in relation
to the service on the date mentioned in sub-paragraph (1)(b).
13

Paragraphs 11 and 12 apply regardless of whether, or when, a provider of aservice has notified the appropriate regulatory authority in accordance withsection 368V of the Communications Act.

35

Online Safety Bill
Schedule 17 — Video-sharing platform services: transitional provision etc
Part 3 — Application of Part 6 of this Act: fees

243

PART 3
APPLICATION OF PART 6 OF THIS ACT: FEES
Introduction
14

This Part makes provision about the application of the following provisionsof this Act in relation to a person who is the provider of a relevant regulated
service—(a) section 74 (duty to notify OFCOM in relation to the charging of fees);(b) section 75 (payment of fees);(c) Schedule 10 (additional fees).

15

In this Part “relevant regulated service” means—(a) a regulated user-to-user service which is a pre-existing Part 4B
service within the definition in paragraph (a) of paragraph 1(1), or(b) a regulated user-to-user service which includes a pre-existing Part 4B
service within the definition in paragraph (b) of paragraph 1(1).

Application of section 74
16

10

15

(1) Sub-paragraph (2) applies in relation to a person who is the provider of a
relevant regulated service, whether or not the person is the provider of any
other regulated service.
(2) Section 74, which makes provision about the notification of OFCOM in
relation to a charging year, applies to the provider in relation to every
charging year, regardless of whether any part, or all, of a charging year falls
within the transitional period.

175(1) This paragraph applies in relation to a person who is the provider of a
relevant regulated service, unless the person is an exempt provider (seeparagraph 24).
(2) Sub-paragraph (3) applies in relation to the provider if—(a) the provider is required by section 74 to give details to OFCOM of
the provider’s qualifying worldwide revenue for the qualifying
period that relates to a charging year,(b) the provider gives such details in relation to that charging year at atime within the transitional period, and(c) no regulations under section 211(2) have been made before that time
specifying that section 186 is to come into force on or before the firstday of that charging year.
(3) The provider’s notification under section 74 about qualifying worldwide
revenue must include a breakdown indicating the amounts which are
wholly referable to a relevant Part 4B service (if any).

20

25

30

35

Application of section 75: transitional charging year18

If a person who is the provider of a relevant regulated service is an exempt
provider, section 75 and Schedule 10 do not apply in relation to the provider
in respect of a transitional charging year (see paragraph 23).

40

244

Online Safety Bill
Schedule 17 — Video-sharing platform services: transitional provision etc
Part 3 — Application of Part 6 of this Act: fees

19(1) If a person who is the provider of a relevant regulated service is not an
exempt provider, section 75 and Schedule 10 apply in relation to theprovider in respect of a transitional charging year.
(2) But sub-paragraphs (3) and (4) apply in relation to the provider in respect ofa transitional charging year if the provider’s notification under section 74 in
relation to that charging year has included details of amounts whollyreferable to a relevant Part 4B service (as mentioned in paragraph 17(3)).
(3) For the purposes of the computation of the provider’s fee under section 75
in respect of the transitional charging year, references in that section to theprovider’s qualifying worldwide revenue are to be taken to be references tothe provider’s non-Part 4B qualifying worldwide revenue.
(4) OFCOM may not require the provider to pay a fee under section 75 inrespect of the transitional charging year if the provider’s non-Part 4B
qualifying worldwide revenue for the qualifying period that relates to thatcharging year is less than the threshold figure that has effect for thatcharging year.
(5) The amount of a provider’s “non-Part 4B qualifying worldwide revenue” isthe amount that would be the provider’s qualifying worldwide revenue (seesection 76) if all amounts wholly referable to a relevant Part 4B service wereleft out of account.

5

10

15

20

Application of section 75: non-transitional charging year20(1) Sub-paragraph (2) applies in relation to a person who is the provider of a
relevant regulated service, whether or not the person is the provider of any
other regulated service.
(2) Section 75 and Schedule 10 apply without modification in relation to theprovider in respect of a non-transitional charging year (even if thenotification date in relation to such a charging year fell within thetransitional period).

25

Amounts wholly referable to relevant Part 4B service
21(1) For the purposes of this Part, OFCOM may produce a statement giving
information about the circumstances in which amounts do, or do not, countas being wholly referable to a relevant Part 4B service.

30(2) If OFCOM produce such a statement, they must publish it (and any revisedor replacement statement).
Interpretation of this Part
22

In this Part—“non-transitional charging year” means a charging year which is not atransitional charging year;“notification date”, in relation to a charging year, means the latest dateby which a notification under section 74 relating to that charging
year is required to be given (see section 74(5));“relevant Part 4B service” means—(a) a regulated user-to-user service described in paragraph 15(a),
or

35

40

Online Safety Bill
Schedule 17 — Video-sharing platform services: transitional provision etc
Part 3 — Application of Part 6 of this Act: fees

(b)
23

24

245

a pre-existing Part 4B service included in a regulated user-touser service described in paragraph 15(b).

For the purposes of this Part a charging year is a “transitional charging year”
if—(a) the notification date in relation to that charging year fell within thetransitional period, and(b) no regulations under section 211(2) were made before thenotification date specifying that section 186 was to come into force onor before the first day of that charging year.
(1) In this Part “exempt provider” means a person within sub-paragraph (2) or(3).
(2) A person is within this sub-paragraph if the person is the provider of only
one regulated service, and that service is—(a) a regulated user-to-user service which is a pre-existing Part 4B
service within the definition in paragraph (a) of paragraph 1(1), or(b) a regulated user-to-user service which—(i) includes a pre-existing Part 4B service within the definition inparagraph (b) of paragraph 1(1), and(ii) does not fall within paragraph 6 or 7.
(3) A person is within this sub-paragraph if the person is the provider of morethan one regulated service, if each regulated service is of a kind described in
sub-paragraph (2).

25

In this Part the following terms have the same meaning as in Part 6 of thisAct—“charging year”;“qualifying period”;“threshold figure”.

5

10

15

20

25

PART 4
AFTER THE END OF THE TRANSITIONAL PERIODInterpretation of this Part
26

27

In this Part of this Schedule—(a) “the repeal time” means the time when section 186 of this Act comes
into force (repeal of Part 4B of the Communications Act);(b) (except in paragraph (a)) references to sections are to sections of theCommunications Act.

30

35

For the purposes of this Part an investigation relating to a person begins
when OFCOM notify the person to that effect.

OFCOM as appropriate regulatory authority
28

The repeal of section 368T does not affect OFCOM’s powers to act after the
repeal time as the appropriate regulatory authority under Part 4B of theCommunications Act as it has effect by virtue of this Part of this Schedule.

40

246

Online Safety Bill
Schedule 17 — Video-sharing platform services: transitional provision etc
Part 4 — After the end of the transitional period

Duties of service providers to co-operate with investigations
29

The repeal of section 368Y(3)(c) (duty to co-operate) does not affect theapplication of that provision after the repeal time in relation to—(a) an investigation as mentioned in section 368Z10(3)(f) begun before
that time, or(b) any demand for information for the purpose mentioned in section
368Z10(3)(i) resulting from such an investigation.

5

Demands for information, and enforcement of such demands
30(1) The repeal of sections 368Y(3)(b) and 368Z10 (demands for information)
does not affect the application of those provisions after the repeal time in acase in which—(a) OFCOM require information after the repeal time for the purposes ofan investigation as mentioned in section 368Z10(3)(f), and(b) the investigation was begun before that time.
(2) The repeal of sections 368Z2, 368Z4 and 368Z10 does not affect theapplication of those sections after the repeal time in connection with—(a) a failure to comply with a requirement under section 368Z10
imposed before that time, or(b) a failure to comply with a requirement imposed after that time under
section 368Z10 as it has effect in a case mentioned in sub-paragraph(1).
(3) In this paragraph—(a) “the purposes of an investigation” include the purposes of any
enforcement action or proceedings resulting from an investigation;(b) references to sections 368Z2 and 368Z4 include references to thosesections as modified by section 368Z10.

10

15

20

25

Enforcement notifications, financial penalties etc
31(1) The repeal of sections 368W and 368Z4 (enforcement of section 368V) does
not affect the application of those sections after the repeal time in a case inwhich OFCOM—(a) made a determination as mentioned in section 368W(1) before thattime, or(b) began, before that time, to investigate whether they may havegrounds to make such a determination.
(2) The repeal of sections 368Z2 and 368Z4 (enforcement of sections 368Y and
368Z1(6) and (7)) does not affect the application of those sections after the
repeal time in a case in which OFCOM—(a) made a determination as mentioned in section 368Z2(1) before thattime, or(b) began, before that time, to investigate whether they may havegrounds to make such a determination.
(3) The repeal of sections 368Z3 and 368Z4 (enforcement of sections 368Z1(1)and (2)) does not affect the application of those sections after the repeal timein a case in which OFCOM—

30

35

40

Online Safety Bill
Schedule 17 — Video-sharing platform services: transitional provision etc
Part 4 — After the end of the transitional period

(a)
(b)

247

made a determination as mentioned in section 368Z3(1) before thattime, orbegan, before that time, to investigate whether they may havegrounds to make such a determination.

Suspension or restriction of service for contraventions or failures32(1) The repeal of section 368Z5 (suspension or restriction of service forcontraventions or failures) does not affect the application of that section after
the repeal time in a case in which OFCOM—(a) made a determination as mentioned in section 368W(1), 368Z2(1) or
368Z3(1) before that time, or(b) made such a determination after that time following an investigation
begun before that time.
(2) The repeal of section 368Z5 does not affect the application of that section (asmodified by section 368Z10) after the repeal time in a case in which—(a) OFCOM are satisfied that a person failed to comply with arequirement under section 368Z10 imposed before that time, or(b) OFCOM are satisfied that a person failed to comply with arequirement imposed after that time under section 368Z10 as it has
effect in a case mentioned in paragraph 30(1).
(3) The repeal of sections 368Z7 (directions under sections 368Z5 and 368Z6)
and 368Z8 (offence relating to such directions) does not affect the applicationof those sections after the repeal time in connection with a direction given
under section 368Z5 as it has effect by virtue of this paragraph.

5

10

15

20

Online Safety BillA

BILL
To make provision for and in connection with the regulation by OFCOM of certain
internet services; for and in connection with communications offences; and forconnected purposes.

Brought from the Commons on 18th January 2023.

Ordered to be Printed, 18th January 2023.

© Parliamentary copyright House of Lords and House of Commons 2023
This publication may be reproduced under the terms of the Open Parliament Licence, which is published atwww.parliament.uk/site-information/copyright
PUBLISHED BY AUTHORITY OF THE HOUSE OF LORDS

HL Bill 87(Rev)58/3