UK Online Safety Act Content Moderation and Appeals
Content moderation and appeals under the UK Online Safety Act means deciding how a regulated service will find, assess, remove, restrict, report, and review harmful content, and how users can challenge or complain about those decisions.
The Act does not impose one universal appeal model. It requires service-specific reporting and complaints procedures tied to the applicable duties, with clear terms and records.
This page explains the Online Safety Act duties that sit behind moderation and review: service scope, illegal content and child-safety duties, , complaints procedures, record-keeping, and the Ofcom code of practice path. The Act requires specified complaint routes rather than one universal appeal for every moderation decision.
1
Section 1
What should teams decide about Content Moderation and Appeals under the UK Online Safety Act?
Start with the service type and duty. A regulated user-to-user service must use proportionate systems and processes designed to minimize the time is present, swiftly take down illegal content when the provider becomes aware of it, and effectively mitigate and manage the risk that the service is used to commit or facilitate priority offences. A regulated search service has a different duty focused on minimizing the risk that users encounter priority illegal search content and other illegal search content the provider is aware of.
Where children are likely to access the service, moderation and ranking controls must also support the children's safety duties. The provider should distinguish illegal content, primary priority content harmful to children, other content harmful to children, and content that only violates the service's terms; the decision ground changes the required action and complaint route.
Sections 20 and 31 require an easy-to-use content-reporting process. Sections 21 and 32 require an easy-to-use, transparent for specified complaints, including relevant complaints about content, failure to comply with duties, and certain actions taken against users or their content. The exact entitlement differs by service type, duty, complainant, and category.
A content report asks the provider to assess content or search content. A complaint can concern the provider's handling of that report, a failure to comply with a relevant duty, or an action taken against a user or content where the applicable section covers it. Route each intake by its statutory ground and service type; do not make a user guess between internal teams.
A complaint review should not assume the original moderation decision was correct. Give the reviewer the content, context, applicable law or policy ground, user submission, automated signals, prior action, and any child-safety or privacy issue needed to reach and explain the outcome. Record whether the service upheld, varied, or reversed the action and whether the case exposed a wider control failure.
Classify the decision ground and service part before choosing remove, de-index, restrict, demote, label, age-gate, preserve, or restore.
Route reports from users and other affected people to a team that can act within the risk-based response time.
Tell complainants which decisions or failures can be challenged, what information to provide, how the service reviews the matter, and how it communicates an outcome.
Record automated and human inputs, the policy version, decision, reviewer, timing, reasons, notice, and any reversal or remediation.
Escalate uncertain illegality, imminent harm, conflicting rights, law-enforcement requests, and systematic control failures.
Who should own Content Moderation and Appeals, and what evidence should prove the decision?
Trust and safety should own day-to-day decisions, product and engineering should own systems and process changes, and legal or specialist reviewers should handle uncertain illegality and rights conflicts. Privacy and child-safety owners should review workflows that use personal data or affect children.
Evidence should connect service risk assessments to moderation coverage, staffing, automated tools, response targets, quality checks, notices, complaints, reversals, recurring error analysis, terms enforcement, and code-of-practice mapping.
Set decision authority and escalation rules for illegal content, child harm, emergency risk, and policy-only violations.
Use samples and outcome data to test accuracy, timeliness, consistency, and whether users can find and use the reporting and complaints paths.
Record why the provider follows each relevant Ofcom code measure or how an alternative measure meets the underlying duty.
Feed complaint reversals, repeat reports, missed harms, and false positives back into risk assessments and control reviews.
Which edge cases should teams check before relying on a Content Moderation and Appeals decision?
The Act does not require every disputed decision to use the same review route. A report about illegal content, a complaint that the provider failed a safety duty, a challenge to removal under the terms, and a Category 1 complaint can have different statutory bases.
Removal is not the only relevant control, and removal alone may not satisfy a systems-and-processes duty. Risk can also arise from recommendation, search ranking, virality, default settings, user contact, or repeat offending.
Do not equate content that violates terms with illegal content; record the actual decision ground.
Do not promise a statutory appeal right broader than the applicable complaints duty, but give users an accessible route for every complaint the Act requires.
Check whether a search result should be de-indexed or ranked differently rather than applying a user-to-user takedown model.
Protect freedom of expression and privacy when designing safety systems, especially where automated moderation or identity and age data affect lawful users.
How should teams implement moderation and complaint reviews?
Build one decision record that follows a case from report or detection through classification, action, notice, complaint, independent review where assigned, outcome, and control feedback. Keep user-facing explanations consistent with the actual policy and service terms.
Measure both safety and error: harmful-content prevalence or reach, time to action, repeat exposure, reporting accessibility, complaint completion, reversals, inconsistent outcomes, and effects on privacy and lawful expression.
Publish clear terms and reporting and complaints routes for the regulated service.
Train reviewers on the Act's content categories, service policy, evidence standard, child-safety duties, and escalation rules.
Test automated tools and human decisions before and after material changes, and document known limitations.
Use recurring complaints and reversals to revise risk assessments, policy, tooling, staffing, and user notices.
Turn UK Online Safety Act Content Moderation and Appeals into assigned work
This UK Online Safety Act guide helps turn Content Moderation and Appeals into owners, evidence requests, review checkpoints, and reusable operating records in Sorena.
Official regulator position that services must meet both online-safety and data-protection responsibilities when safety measures process personal data.