Questions and answers

A Part 3 user-to-user service is an internet service through which content generated, uploaded, or shared by one user may be encountered by another user. A Part 3 search service is an internet service that is, or includes, a search engine. A combined service can contain both parts, and each part may have different duties.

Part 5 separately covers an internet service on which the provider publishes or displays regulated provider pornographic content. A service may therefore be outside the Part 3 user-to-user and search definitions but still have Part 5 duties.

The provider's location is not decisive. A service has UK links if it has a significant number of UK users, targets the UK market, or is capable of UK use and there are reasonable grounds to believe that UK users face a material risk of significant harm from content on or accessible through it.

Schedule 1 exempts specified services or parts of services, including email, SMS and MMS, one-to-one live aural communications, limited functionality, certain internal business services, and services provided by public bodies or qualifying education and childcare providers. Each exemption has conditions. An exempt function does not automatically exempt the rest of a combined product.

Comments and reviews on provider content can fall within the limited-functionality exemption only if the statutory conditions are met. File storage, group messaging, forums, dating, gaming, social media, and content-sharing features can be user-to-user services even when interaction is not the product's main purpose. Apply the definitions to the actual journey rather than the marketing label.

For the limited-functionality exemption, users must be able to communicate only through comments or reviews on provider content, sharing those comments or reviews on another service, reactions such as likes, emojis, votes or ratings, and identifying content connected with those activities. User-generated content is not provider content for this test. Schedule 1 paragraph 6 also removes the paragraphs 1–5 exemptions where regulated provider pornographic content is published or displayed and the section 80(4) UK-links test is met.

The scope record should be short enough to review but detailed enough to reproduce the decision. Include a service map, the relevant statutory definition, UK-links evidence, every exemption considered, the provider entity, and the product owner. State any assumptions and the event that will trigger reassessment.

Scope is only the gateway. If a Part 3 service is regulated, the provider must address illegal-content duties and complete a children's access assessment. Categorisation, transparency reporting, and some additional duties are later questions; a service can be regulated without appearing on Ofcom's categorised-services register.

Age assurance, content moderation, recommender controls, profiling, identity signals, user reports, and child-safety analytics can process personal data while also serving an Online Safety Act duty. The service must meet the applicable safety outcome and comply with UK GDPR principles, lawful-basis rules, transparency, rights, security, accountability, and retention requirements.

The Children's Code applies to relevant information-society services likely to be accessed by children and explains how UK data-protection law applies in that context. Its scope test and the Online Safety Act children's access assessment come from different legislation. Record both conclusions rather than treating one as a substitute for the other.

Start with the exact legal outcomes rather than assuming one regulator requires maximum data collection. Define the safety risk, the required effectiveness level, and the minimum personal data needed to achieve it. Compare feasible methods, including their accuracy, bias, circumvention, security, retention, and effects on rights.

For age assurance, Ofcom and the ICO say all methods process personal data, self-declaration alone is ineffective, and data may be processed where the method is necessary, proportionate to the risk, and compliant with data-protection law. The joint statement does not create an exemption from either regime.

Keep separate but linked records: the service-scope decision, risk assessments, code or guidance mapping, data protection impact assessment, lawful-basis analysis, privacy notices, legitimate-interests assessment where relevant, vendor terms, security review, retention schedule, test results, complaints, and change approvals.

Record how errors affect people. False adult classifications can expose children to harm; false child classifications can deny adults access or subject them to different processing. Test affected groups, monitor outcomes, and review both the safety and privacy records after material changes or incidents.

Ofcom can use statutory information notices to obtain information needed for its online-safety functions. It can open an investigation where it suspects non-compliance. Its enforcement guidance describes a process that may lead to a provisional notice of contravention, an opportunity for written and oral representations, and then a confirmation decision, a further provisional notice, settlement, or closure.

A confirmation decision can record a contravention, require steps to remedy it or comply with the obligation, and impose a financial penalty. Ofcom may also impose daily penalties in circumstances allowed by the Act. The specific process and available outcome depend on the requirement being enforced.

For many enforceable requirements, the maximum financial penalty is the greater of GBP18 million or 10% of qualifying worldwide revenue. Schedule 13 contains the penalty framework, including how qualifying worldwide revenue is determined. The actual amount depends on the legal power, facts, seriousness, and Ofcom's penalty guidance.

In serious cases and subject to the statutory conditions, Ofcom can apply to the court for service-restriction or access-restriction orders directed at ancillary services or access facilities. These are court orders, not an automatic result of an investigation. Criminal offences also exist for specified information failures and related conduct; individual and senior-manager exposure depends on the exact offence and facts.

Enforcement readiness is the ability to reproduce a compliance decision and answer a regulator accurately. Keep current scope analyses, risk assessments, code mappings or alternative-measure rationales, child-access and age-assurance records, terms, complaints evidence, transparency data definitions, governance approvals, incidents, tests, and change logs.

Ofcom does not resolve individual users' complaints or direct a service to remove or reinstate specific content. It can use complaints and other intelligence to identify systemic compliance issues. A provider therefore needs an internal complaints process that works and an evidence trail showing whether recurring failures were fed back into risk assessments and controls.

Stage one asks whether children can normally access the service or a particular part of it. A provider can conclude they cannot only where highly effective age assurance and access controls prevent users who have not been identified as adults from entering. Self-declared age, an age statement in terms, or a weak gate does not support that conclusion.

If children can access the service, stage two asks whether the child user condition is met: there is a significant number of child users, or the service is of a kind likely to attract a significant number of children. Assess actual and foreseeable use, not only the intended audience. A conclusion can differ between distinct parts of one service.

The initial deadline for services already in scope was 16 April 2025. A user-to-user or search service that later comes into scope must complete the assessment within three months of the first day it becomes available to UK users.

If the provider concludes that the service is not likely to be accessed by children, it must repeat the assessment within 12 months, and sooner where the Act or Ofcom guidance requires. Reassess before or after relevant changes as required, including changes to design, operation, target market, age controls, or evidence of child use.

The provider must complete a suitable and sufficient children's risk assessment for the affected service or part and comply with the applicable child-safety, record-keeping, and review duties. For existing services, the first children's risk assessment deadline was 24 July 2025 and child-protection measures applied from 25 July 2025.

A negative access conclusion does not remove the baseline illegal-content duties. It also does not settle whether the Children's Code applies, because the data-protection and Online Safety Act tests have different legal sources and should be assessed separately.