UK Online Safety Act Applicability Test

A user-to-user service is an internet service through which content generated, uploaded, or shared by one user may be encountered by another user. A search service is an internet service that is, or includes, a search engine. Apply these definitions to actual functions such as posts, comments, reviews, file sharing, group spaces, marketplaces, messaging, and public search rather than relying on the product label.

The service must also have links with the United Kingdom. Section 4 provides three routes: a significant number of UK users; the United Kingdom as a target market; or UK access combined with reasonable grounds to believe that user-generated or search content presents a material risk of significant harm to individuals in the United Kingdom. A provider can be in scope even when it is established outside the United Kingdom.

Finally, apply the Schedule 1 exemptions, the Schedule 2 exclusion for specified user-to-user or search services that include regulated provider pornographic content, and any function-specific disapplication. Schedule 1 descriptions include certain email, SMS or MMS, one-to-one live aural communication, limited-functionality, internal business, public-body, and education or childcare services, but each exemption has conditions and some have exceptions. Record the exact paragraph and facts instead of treating a product name or sector as automatically exempt.

Part 5 uses a separate test for a service that publishes or displays provider pornographic content and has UK links. Do not force that service into the Part 3 user-to-user or search analysis when the relevant content is published by the provider.

Record one of four outcomes for each assessed function: Part 3 regulated user-to-user service, Part 3 regulated search service, exempt, excluded or disapplied Part 3 functionality, or outside Part 3 because a required element is absent. Assess provider pornographic content separately under Part 5. A single product can produce more than one outcome.

For example, a marketplace may have regulated user reviews and messages, an exempt internal staff area, and a provider-operated product search that does not meet the public search-service definition. A foreign discussion forum can still be in scope through UK users or a UK target market. These are examples only; the service facts and statutory conditions control.

A product owner should supply the functional facts; legal or regulatory counsel should review the statutory classification; data and commercial owners should support the UK-link analysis. The provider remains responsible for the service-level conclusion.

The scope record should identify the service, provider entity, functions assessed, users who can create and encounter content, search sources, UK links, each Schedule 1 exemption and Schedule 2 exclusion considered, the conclusion for each service part, and the facts that would trigger reassessment.

Scope can attach to only part of a product. Internal search over one provider's own content is not automatically a regulated public search engine, while user comments or reviews may create user-to-user functionality even when the main product is publishing or commerce.

Do not use company size, revenue, or formal categorisation as the basic applicability test. Small services can be in Part 3 scope, and the core illegal-content and children-access assessment duties apply before the Category 1, 2A, or 2B analysis.

Write the result as a service-scope memo, not a single yes-or-no field. It should show the analysis for each service part and explain why each Schedule 1 exemption and Schedule 2 exclusion does or does not apply.

If Part 3 applies, the immediate next steps are an illegal-content risk assessment and record, the related safety and reporting controls, and a children's access assessment. If Part 5 applies, run the provider-pornography age-assurance analysis separately.