UK Online Safety Act Categorisation

Category 1 has two routes. A regulated user-to-user service qualifies if its user-to-user part exceeds 34 million average monthly active UK users and uses a content recommender system, or exceeds 7 million and both uses a recommender and lets users forward or share regulated user-generated content with other users of the service.

Category 2A covers a regulated search service or a combined service whose search engine exceeds 7 million average monthly active UK users. The threshold excludes a search engine that only searches selected websites or databases on a specific topic, theme, or genre and is facilitated by a relevant arrangement; both parts of that exception must be satisfied.

Category 2B covers a regulated user-to-user service exceeding 3 million average monthly active UK users where direct messages cannot be encountered by other users unless the sender or recipient takes further action. The design of the messaging function, not its marketing name, controls.

For all three categories, calculate the mean number of active UK users per month over the six months ending with the month before the assessment starts. Use the shorter operating period if the service has operated for less than six months. A number equal to the threshold does not meet wording that requires the number to exceed it.

The first register shows why the service boundary matters. ChatGPT Search is Category 2A, but Ofcom states that this does not categorise unrelated chatbot content that is not search content. Facebook appears through different regulated parts, and services such as WhatsApp appear in Category 1 while many marketplaces and messaging services appear in Category 2B. These entries illustrate Ofcom's decisions; they do not classify another service by analogy.

A data owner should maintain the monthly active UK user calculation. Engineering and product owners should attest to the relevant functionality, and the regulatory owner should map Ofcom's decision to the correct service part and additional duties.

Preserve the six-month data extract, metric definition, service-boundary rationale, functionality specifications and user journeys, internal threshold conclusion, register entry, Ofcom information requests, and any representations made during assessment.

One product can appear in more than one category because the category attaches to a regulated service part. Formal Category 2A status for a public search engine does not extend the Category 2A duties to unrelated chatbot, publishing, or user-to-user functions unless those functions fall within the categorised search service.

The emerging Category 1 list is not the Category 1 register. It uses the Act's 75% user-number conditions and specified functionality to flag services that may soon meet a Category 1 threshold. The current user-number markers are 25.5 million, or 5.25 million where the recommender and forward-or-share conditions also apply; listed services do not acquire the additional Category 1 duties.

Once Ofcom places a service on the register, map the statutory additional duties to the registered part and current commencement position. Category 1 includes duties concerning user empowerment, identity verification, democratic-importance content, news publisher content, journalistic content, terms, complaints, and freedom-of-expression and privacy assessments.

Category 1 and 2A services have fraudulent-advertising duties and duties to provide specified risk-assessment records to Ofcom. Category 1, 2A, and 2B services can also have transparency-reporting and fee obligations. Check the current Ofcom notices, codes, and commencement position for each deliverable rather than assuming one common deadline.