Online Safety Act 2023

CHAPTER 3 U.K. Providers of search services: duties of care

Search services: which duties apply, and scope of duties U.K.

24 Providers of search services: duties of care U.K.

(1) Subsections (2) to (4) apply to determine which of the duties set out in this Chapter must be complied with by providers of regulated search services.

(2) All providers of regulated search services must comply with the following duties in relation to each such service which they provide—

(a) the duties about illegal content risk assessments set out in section 26,

(b) the duties about illegal content set out in section 27(2) to (8),

(c) the duty about content reporting set out in section 31,

(d) the duties about complaints procedures set out in section 32,

(e) the duties about freedom of expression and privacy set out in section 33, and

(f) the duties about record-keeping and review set out in section 34(2) to (6).

(3) Additional duties must be complied with by providers of particular kinds of regulated search services, as follows.

(4) All providers of regulated search services that are likely to be accessed by children must comply with the following duties in relation to each such service which they provide—

(a) the duties about children’s risk assessments set out in section 28, and

(b) the duties to protect children’s online safety set out in section 29(2) to (8).

(5) All providers of regulated search services that are Category 2A services must comply with the following duties in relation to each such service which they provide—

(a) the duty about illegal content risk assessments set out in section 27(9),

(b) the duty about children’s risk assessments set out in section 29(9), and

(c) the duty about record-keeping set out in section 34(9).

(6) For the meaning of “likely to be accessed by children”, see section 37.

(7) For the meaning of “Category 2A service”, see section 95 (register of categories of services).

Commencement Information

I1 S. 24 not in force at Royal Assent, see s. 240(1)

I2 S. 24 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)

25 Scope of duties of care U.K.

(1) A duty set out in this Chapter which must be complied with in relation to a search service extends only to—

(a) the search content of the service,

(b) the design, operation and use of the search engine in the United Kingdom, and

(c) in the case of a duty that is expressed to apply in relation to users of a service, the design, operation and use of the search engine as it affects United Kingdom users of the service.

(2) For the purposes of the application of this Chapter in relation to the search engine of a combined service (see section 7(6))—

(a) a duty set out in this Chapter which requires a matter to be included in a publicly available statement may be satisfied by including the matter in the terms of service;

(b) references in this Chapter (except in section 24) to a search service are to be read as references to the search engine;

(c) references in this Chapter (except in section 24) to the provider of a search service are to be read as references to the provider of the combined service.

Commencement Information

I3 S. 25 not in force at Royal Assent, see s. 240(1)

I4 S. 25 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)

Illegal content duties for search services U.K.

26 Illegal content risk assessment duties U.K.

(1) This section sets out the duties about risk assessments which apply in relation to all regulated search services.

(2) A duty to carry out a suitable and sufficient illegal content risk assessment at a time set out in, or as provided by, Schedule 3.

(3) A duty to take appropriate steps to keep an illegal content risk assessment up to date, including when OFCOM make any significant change to a risk profile that relates to services of the kind in question.

(4) Before making any significant change to any aspect of a service’s design or operation, a duty to carry out a further suitable and sufficient illegal content risk assessment relating to the impacts of that proposed change.

(5) An “illegal content risk assessment” of a service of a particular kind means an assessment of the following matters, taking into account the risk profile that relates to services of that kind—

(a) the level of risk of individuals who are users of the service encountering search content of the following kinds—

(i) each kind of priority illegal content (with each kind separately assessed), and

(ii) other illegal content,

taking into account (in particular) risks presented by algorithms used by the service, and the way that the service indexes, organises and presents search results;

(b) the level of risk of functionalities of the service facilitating individuals encountering search content that is illegal content, identifying and assessing those functionalities that present higher levels of risk;

(c) the nature, and severity, of the harm that might be suffered by individuals from the matters identified in accordance with paragraphs (a) and (b);

(d) how the design and operation of the service (including the business model, governance, use of proactive technology, measures to promote users’ media literacy and safe use of the service, and other systems and processes) may reduce or increase the risks identified.

(6) In this section references to risk profiles are to the risk profiles for the time being published under section 98 which relate to the risk of harm to individuals presented by illegal content.

(7) See also—

(a) section 34(2) and (9) (records of risk assessments), and

(b) Schedule 3 (timing of providers’ assessments).

Commencement Information

I5 S. 26 not in force at Royal Assent, see s. 240(1)

I6 S. 26 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)

27 Safety duties about illegal content U.K.

(1) This section sets out the duties about illegal content which apply in relation to regulated search services (as indicated by the headings).

All services

(2) A duty, in relation to a service, to take or use proportionate measures relating to the design or operation of the service to effectively mitigate and manage the risks of harm to individuals, as identified in the most recent illegal content risk assessment of the service (see section 26(5)(c)).

(3) A duty to operate a service using proportionate systems and processes designed to minimise the risk of individuals encountering search content of the following kinds—

(a) priority illegal content;

(b) other illegal content that the provider knows about (having been alerted to it by another person or become aware of it in any other way).

(4) The duties set out in subsections (2) and (3) apply across all areas of a service, including the way the search engine is designed, operated and used as well as search content of the service, and (among other things) require the provider of a service to take or use measures in the following areas, if it is proportionate to do so—

(a) regulatory compliance and risk management arrangements,

(b) design of functionalities, algorithms and other features relating to the search engine,

(c) functionalities allowing users to control the content they encounter in search results,

(d) content prioritisation,

(e) user support measures, and

(f) staff policies and practices.

(5) A duty to include provisions in a publicly available statement specifying how individuals are to be protected from search content that is illegal content.

(6) A duty to apply the provisions of the statement referred to in subsection (5) consistently.

(7) A duty to include provisions in a publicly available statement giving information about any proactive technology used by a service for the purpose of compliance with a duty set out in subsection (2) or (3) (including the kind of technology, when it is used, and how it works).

(8) A duty to ensure that the provisions of the publicly available statement referred to in subsections (5) and (7) are clear and accessible.

Additional duty for Category 2A services

(9) A duty to summarise in a publicly available statement the findings of the most recent illegal content risk assessment of a service (including as to levels of risk and as to nature, and severity, of potential harm to individuals).

Interpretation

(10) In determining what is proportionate for the purposes of this section, the following factors, in particular, are relevant—

(a) all the findings of the most recent illegal content risk assessment (including as to levels of risk and as to nature, and severity, of potential harm to individuals), and

(b) the size and capacity of the provider of a service.

(11) In this section “illegal content risk assessment” has the meaning given by section 26.

(12) See also, in relation to duties set out in this section, section 33 (duties about freedom of expression and privacy).

Commencement Information

I7 S. 27 not in force at Royal Assent, see s. 240(1)

I8 S. 27 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)

Search services likely to be accessed by children U.K.

28 Children’s risk assessment duties U.K.

(1) This section sets out the duties about risk assessments which apply in relation to regulated search services that are likely to be accessed by children (in addition to the duties about risk assessments set out in section 26).

(2) A duty to carry out a suitable and sufficient children’s risk assessment at a time set out in, or as provided by, Schedule 3.

(3) A duty to take appropriate steps to keep a children’s risk assessment up to date, including when OFCOM make any significant change to a risk profile that relates to services of the kind in question.

(4) Before making any significant change to any aspect of a service’s design or operation, a duty to carry out a further suitable and sufficient children’s risk assessment relating to the impacts of that proposed change.

(5) A “children’s risk assessment” of a service of a particular kind means an assessment of the following matters, taking into account the risk profile that relates to services of that kind—

(a) the level of risk of children who are users of the service encountering search content of the following kinds—

(i) each kind of primary priority content that is harmful to children (with each kind separately assessed),

(ii) each kind of priority content that is harmful to children (with each kind separately assessed), and

(iii) non-designated content that is harmful to children,

giving separate consideration to children in different age groups, and taking into account (in particular) risks presented by algorithms used by the service and the way that the service indexes, organises and presents search results;

(b) the level of risk of children who are users of the service encountering search content that is harmful to children which particularly affects individuals with a certain characteristic or members of a certain group;

(c) the extent to which the design of the service, in particular its functionalities, affects the level of risk of harm that might be suffered by children, identifying and assessing those functionalities that present higher levels of risk, including a functionality that makes suggestions relating to users’ search requests (predictive search functionality);

(d) the different ways in which the service is used, including functionalities or other features of the service that affect how much children use the service, and the impact of such use on the level of risk of harm that might be suffered by children;

(e) the nature, and severity, of the harm that might be suffered by children from the matters identified in accordance with paragraphs (a) to (d), giving separate consideration to children in different age groups;

(f) how the design and operation of the service (including the business model, governance, use of proactive technology, measures to promote users’ media literacy and safe use of the service, and other systems and processes) may reduce or increase the risks identified.

(6) In this section references to risk profiles are to the risk profiles for the time being published under section 98 which relate to the risk of harm to children presented by content that is harmful to children.

(7) See also—

(a) section 34(2) and (9) (records of risk assessments), and

(b) Schedule 3 (timing of providers’ assessments).

Commencement Information

I9 S. 28 not in force at Royal Assent, see s. 240(1)

I10 S. 28 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)

29 Safety duties protecting children U.K.

(1) This section sets out the duties to protect children’s online safety which apply in relation to regulated search services that are likely to be accessed by children (as indicated by the headings).

All services

(2) A duty, in relation to a service, to take or use proportionate measures relating to the design or operation of the service to effectively—

(a) mitigate and manage the risks of harm to children in different age groups, as identified in the most recent children’s risk assessment of the service (see section 28(5)(e)), and

(b) mitigate the impact of harm to children in different age groups presented by search content that is harmful to children.

(3) A duty to operate a service using proportionate systems and processes designed to—

(a) minimise the risk of children of any age encountering search content that is primary priority content that is harmful to children;

(b) minimise the risk of children in age groups judged to be at risk of harm from other content that is harmful to children (or from a particular kind of such content) encountering search content of that kind.

(4) The duties set out in subsections (2) and (3) apply across all areas of a service, including the way the search engine is designed, operated and used as well as search content of the service, and (among other things) require the provider of a service to take or use measures in the following areas, if it is proportionate to do so—

(a) regulatory compliance and risk management arrangements,

(b) design of functionalities, algorithms and other features relating to the search engine,

(c) functionalities allowing for control over content that is encountered in search results, especially by children,

(d) content prioritisation,

(e) user support measures, and

(f) staff policies and practices.

(5) A duty to include provisions in a publicly available statement specifying how children are to be protected from search content of the following kinds—

(a) primary priority content that is harmful to children (with each kind of primary priority content separately covered),

(b) priority content that is harmful to children (with each kind of priority content separately covered), and

(c) non-designated content that is harmful to children.

(6) A duty to apply the provisions of the statement referred to in subsection (5) consistently.

(7) A duty to include provisions in a publicly available statement giving information about any proactive technology used by a service for the purpose of compliance with a duty set out in subsection (2) or (3) (including the kind of technology, when it is used, and how it works).

(8) A duty to ensure that the provisions of the publicly available statement referred to in subsections (5) and (7) are clear and accessible.

Additional duty for Category 2A services

(9) A duty to summarise in a publicly available statement the findings of the most recent children’s risk assessment of a service (including as to levels of risk and as to nature, and severity, of potential harm to children).

Commencement Information

I11 S. 29 not in force at Royal Assent, see s. 240(1)

I12 S. 29 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)

30 Safety duties protecting children: interpretation U.K.

(1) In determining what is proportionate for the purposes of section 29, the following factors, in particular, are relevant—

(a) all the findings of the most recent children’s risk assessment (including as to levels of risk and as to nature, and severity, of potential harm to children), and

(b) the size and capacity of the provider of a service.

(2) So far as a duty set out in section 29 relates to non-designated content that is harmful to children, the duty is to be taken to extend only to addressing risks of harm from the kinds of such content that have been identified in the most recent children’s risk assessment (if any have been identified).

(3) The reference in section 29(3)(b) to children in age groups judged to be at risk of harm from content that is harmful to children is a reference to children in age groups judged to be at risk of such harm as assessed by the provider of a service in the most recent children’s risk assessment of the service.

(4) The duties set out in section 29(3) are to be taken to extend only to content that is harmful to children where the risk of harm is presented by the nature of the content (rather than the fact of its dissemination).

(5) The duties set out in section 29 extend only to such parts of a service as it is possible for children to access.

(6) For the purposes of subsection (5), a provider is only entitled to conclude that it is not possible for children to access a service, or a part of it, if age verification or age estimation is used on the service with the result that children are not normally able to access the service or that part of it.

(7) In section 29 and this section “children’s risk assessment” has the meaning given by section 28.

(8) See also, in relation to duties set out in section 29, section 33 (duties about freedom of expression and privacy).

Commencement Information

I13 S. 30 not in force at Royal Assent, see s. 240(1)

I14 S. 30 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)

Duties about content reporting and complaints procedures U.K.

31 Duty about content reporting U.K.

(1) This section sets out the duty about content reporting which applies in relation to all regulated search services.

(2) A duty to operate a service using systems and processes that allow users and affected persons to easily report search content which they consider to be content of a kind specified below (with the duty extending to content that is harmful to children depending on the kind of service, as indicated by the headings).

All services

(3) Illegal content.

Services likely to be accessed by children

(4) Content that is harmful to children.

Interpretation

(5) In this section “affected person” means a person, other than a user of the service in question, who is in the United Kingdom and who is—

(a) the subject of the content,

(b) a member of a class or group of people with a certain characteristic targeted by the content,

(c) a parent of, or other adult with responsibility for, a child who is a user of the service or is the subject of the content, or

(d) an adult providing assistance in using the service to another adult who requires such assistance, where that other adult is a user of the service or is the subject of the content.

(6) See also, in relation to the duty set out in this section, section 33 (duties about freedom of expression and privacy).

Commencement Information

I15 S. 31 not in force at Royal Assent, see s. 240(1)

I16 S. 31 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)

32 Duties about complaints procedures U.K.

(1) This section sets out the duties about complaints procedures which apply in relation to all regulated search services.

(2) A duty to operate a complaints procedure in relation to a service that—

(a) allows for relevant kinds of complaint to be made (as set out under the headings below),

(b) provides for appropriate action to be taken by the provider of the service in response to complaints of a relevant kind, and

(c) is easy to access, easy to use (including by children) and transparent.

(3) A duty to make the policies and processes that govern the handling and resolution of complaints of a relevant kind publicly available and easily accessible (including to children).

All services

(4) The following kinds of complaint are relevant for all services—

(a) complaints by users and affected persons about search content which they consider to be illegal content;

(b) complaints by users and affected persons if they consider that the provider is not complying with a duty set out in—

(i) section 27 (illegal content),

(ii) section 31 (content reporting), or

(iii) section 33 (freedom of expression and privacy);

(c) complaints by an interested person if the provider of a search service takes or uses measures in order to comply with a duty set out in section 27 that result in content relating to that interested person no longer appearing in search results or being given a lower priority in search results;

(d) complaints by an interested person if—

(i) the use of proactive technology on a search service results in content relating to that interested person no longer appearing in search results or being given a lower priority in search results, and

(ii) the interested person considers that the proactive technology has been used in a way not contemplated by, or in breach of, the provider’s policies on its use (for example, by affecting content not of a kind specified in those policies as a kind of content in relation to which the technology would operate).

Services likely to be accessed by children

(5) The following kinds of complaint are relevant for services that are likely to be accessed by children—

(a) complaints by users and affected persons about search content which they consider to be content that is harmful to children;

(b) complaints by users and affected persons if they consider that the provider is not complying with a duty set out in section 29 (children’s online safety);

(c) complaints by an interested person if the provider of a search service takes or uses measures in order to comply with a duty set out in section 29 that result in content relating to that interested person no longer appearing in search results or being given a lower priority in search results;

(d) complaints by a user who is unable to access content because measures used to comply with a duty set out in section 29(2) or (3) have resulted in an incorrect assessment of the user’s age.

Interpretation

(6) In this section—

• “affected person” has the meaning given by section 31;

• “interested person” has the meaning given by section 227(7).

(7) See also, in relation to duties set out in this section, section 33 (duties about freedom of expression and privacy).

Commencement Information

I17 S. 32 not in force at Royal Assent, see s. 240(1)

I18 S. 32 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)

Cross-cutting duties U.K.

33 Duties about freedom of expression and privacy U.K.

(1) This section sets out the duties about freedom of expression and privacy which apply in relation to all regulated search services.

(2) When deciding on, and implementing, safety measures and policies, a duty to have particular regard to the importance of protecting the rights of users and interested persons to freedom of expression within the law.

(3) When deciding on, and implementing, safety measures and policies, a duty to have particular regard to the importance of protecting users from a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of a search service (including, but not limited to, any such provision or rule concerning the processing of personal data).

(4) In this section—

• “interested person” has the meaning given by section 227(7);

• “safety measures and policies” means measures and policies designed to secure compliance with any of the duties set out in—

  (a)

  section 27 (illegal content),

  (b)

  section 29 (children’s online safety),

  (c)

  section 31 (content reporting), or

  (d)

  section 32 (complaints procedures).

Commencement Information

I19 S. 33 not in force at Royal Assent, see s. 240(1)

I20 S. 33 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)

34 Record-keeping and review duties U.K.

(1) This section sets out the record-keeping and review duties which apply in relation to regulated search services (as indicated by the headings).

All services

(2) A duty to make and keep a written record, in an easily understandable form, of all aspects of every risk assessment under section 26 or 28, including details about how the assessment was carried out and its findings.

(3) A duty to make and keep a written record of any measures taken or in use to comply with a relevant duty which—

(a) are described in a code of practice and recommended for the purpose of compliance with the duty in question, and

(b) apply in relation to the provider and the service in question.

In this section such measures are referred to as “applicable measures in a code of practice”.

(4) If alternative measures have been taken or are in use to comply with a relevant duty, a duty to make and keep a written record containing the following information—

(a) the applicable measures in a code of practice that have not been taken or are not in use,

(b) the alternative measures that have been taken or are in use,

(c) how those alternative measures amount to compliance with the duty in question, and

(d) how the provider has complied with section 49(5) (freedom of expression and privacy).

(5) If alternative measures have been taken or are in use to comply with a duty set out in section 27(2) or (3) or 29(2) or (3), the record required under subsection (4) of this section must also indicate whether such measures have been taken or are in use in every area listed in subsection (4) of those sections in relation to which there are applicable measures in a code of practice.

(6) A duty to review compliance with the relevant duties in relation to a service—

(a) regularly, and

(b) as soon as reasonably practicable after making any significant change to any aspect of the design or operation of the service.

(7) OFCOM may provide that particular descriptions of providers of search services are exempt from any or all of the duties set out in this section, and may revoke such an exemption.

(8) OFCOM must publish details of any exemption or revocation under subsection (7), including reasons for the revocation of an exemption.

Additional duty for Category 2A services

(9) As soon as reasonably practicable after making a record of a risk assessment as required by subsection (2), or revising such a record, a duty to supply OFCOM with a copy of the record (in full).

Interpretation

(10) In this section—

• “alternative measures” means measures other than measures which are (in relation to the provider and the service in question) applicable measures in a code of practice;

• “code of practice” means a code of practice published under section 46;

• “relevant duties” means the duties set out in—

  (a)

  section 27 (illegal content),

  (b)

  section 29 (children’s online safety),

  (c)

  section 31 (content reporting), and

  (d)

  section 32 (complaints procedures),

and for the purposes of subsection (6), also includes the duties set out in section 75 (deceased child users).

Commencement Information

I21 S. 34 not in force at Royal Assent, see s. 240(1)

I22 S. 34(1)-(9) in force at 10.1.2024 by S.I. 2023/1420, reg. 2(j)

I23 S. 34(10) in force at 10.1.2024 for specified purposes by S.I. 2023/1420, reg. 2(j)