Search every question across sub-FAQs

A user-to-user classification turns on functionality, not branding. Ask whether content generated, uploaded, or shared by one user may be encountered by another. Public or group posts, user profiles, uploaded media, marketplace listings, in-game chat, collaborative spaces, and messaging can meet the test. The amount of user-generated content does not matter, and a Schedule 1 exemption must be tested separately.

For search, ask whether a person can search more than one website or database. General search and vertical search for products, jobs, travel, academic material, or another topic can qualify. A tool restricted to one website or one database does not meet the section 229 search-engine definition merely because it uses filters, recommendations, or sophisticated ranking.

If one product has both functions, apply the section 3 tie-breaker. Unless its only user-generated content falls within the specified exempt types, it is treated as user-to-user. If the same provider also operates a public search engine, it is a combined service and the search duties apply to that engine.

Identify the responsible provider by control, rather than assuming it is the brand owner, parent company, app-store operator, or company named in a customer contract. Section 226 generally identifies the user-to-user provider by control over who can use the relevant user-to-user elements. For search, it identifies the entity with control over the operations that accept search requests and generate responses.

UK establishment is not required. A significant UK user base or UK target market establishes links with the United Kingdom. A service accessible to individuals in the UK can also qualify where there are reasonable grounds to believe that its content or functionality creates a material risk of significant harm to individuals in the UK.

There is no general minimum revenue, employee, or user threshold for baseline Part 3 scope. Category thresholds determine additional duties for some services; they do not decide whether an otherwise regulated service has baseline duties.

Schedule 1 exemptions use specific statutory conditions. They include services whose only user-generated content is email, SMS or MMS, or one-to-one live aural communications; defined limited-functionality services; qualifying internal business services; specified public-body services; and qualifying education or childcare services. A broad product or sector label does not establish an exemption, and some exemptions operate at service-part level.

The limited-functionality exemption generally concerns comments or reviews on provider content, reactions to that content, and sharing those comments or reviews elsewhere. It does not exempt a service that also enables wider user interaction. The education and childcare exemption applies only to the providers and purposes described in Schedule 1, not every product sold to a school or used by a child.

Schedule 2 addresses certain services combining otherwise exempt user-to-user or search functions with provider pornographic content. Such a service may remain regulated under Part 5 even when the Part 3 user-to-user or search duties do not apply. Section 5 can also disapply the Act to a qualifying internal-business part of a Part 3 service or a specified part of a regulated search service without removing the whole service from scope.

Every regulated Part 3 service must complete an illegal-content risk assessment and maintain the applicable safety, reporting, complaints, freedom-of-expression, privacy, record-keeping, and review controls. The safety duties differ by service type: user-to-user services address user-generated content and use of the service to commit or facilitate priority offences, while search services address risks arising through search content and results.

The provider must also complete a children's access assessment. If the service or a relevant part is likely to be accessed by children, the children's risk-assessment and safety duties apply. Category status can add transparency, user-empowerment, fraudulent-advertising, and other duties, but it does not replace the baseline scope decision.

Section 77 requires Ofcom, once a year, to give every provider of a relevant service a transparency notice. A relevant service is a Category 1, Category 2A, or Category 2B service. The provider must produce and publish the report by the date and in the manner specified in the notice.

Ofcom published final transparency guidance in July 2025 and its categorised-services register in June 2026, updated in July. Ofcom's implementation roadmap says categorised services will publish their first transparency reports in 2027 and that a further timeline update will follow the register. Providers should use the actual notice as the controlling deadline rather than infer a date from an older roadmap.

Schedule 8 lists possible subjects. They include the incidence and dissemination of illegal content and content harmful to children; systems for risk assessment, reporting, complaints, moderation, user support, age assurance, and compliance; the use and effect of algorithms; cooperation with public authorities; staff and resourcing; and other listed safety and governance matters.

The notice determines which permitted matters apply to the service. Do not assume that every Schedule 8 item will be required, or substitute a voluntary environmental, social, and governance report. Where a requested figure cannot be measured directly, document the method, limitations, estimation, and quality checks rather than presenting an unsupported number as exact.

Treat the public report as a regulated output. Review it for consistency with risk assessments, terms, complaints data, published policies, prior submissions, and the actual service. Preserve approvals, the publication URL and time, the exact published file, accessibility checks, and evidence that it remained available as required.

If an error is found, assess materiality, notify the responsible legal and reporting owners, preserve the original, and follow the notice and Ofcom guidance for correction or communication. Do not overwrite the record without a dated explanation. A transparency report does not replace records that Ofcom may request under other powers.

For illegal content, user-to-user services need proportionate systems and processes designed to prevent users encountering priority illegal content, mitigate identified risks, minimise how long priority illegal content remains, and swiftly take down illegal content when the provider becomes aware of it. Search services must minimise the risk of users encountering priority illegal content and known illegal content in or via search results.

Services likely to be accessed by children have additional duties for content harmful to children. The exact moderation design depends on the service, assessed risks, applicable duties, and Ofcom codes. Measures can include detection, triage, human review, removal, visibility reduction, recommendation controls, account action, user support, and escalation, but each measure must be justified and tested in context.

A content-reporting mechanism lets users and other eligible people notify the provider about content of a kind covered by the Act. A complaints procedure covers specified complaints about content, the provider's compliance, and certain provider decisions. For user-to-user services, sections 20 and 21 govern these duties; sections 31 and 32 cover search services.

The complaints procedure must allow relevant complaints, provide for appropriate action when a complaint is upheld, be easy to access and use, including by children, and be transparent. Appropriate action depends on the case. It may include removing illegal content, correcting a restriction, reinstating content removed in error, or changing an account decision. The Act does not require every complaint to produce the user's preferred result.

User-to-user terms must explain how users are protected from illegal content and set out the complaints policies and procedures required by the Act. Search services must make the corresponding illegal-content statement and complaints information public. Providers must apply stated provisions consistently.

Useful evidence includes moderation guidance, training, quality sampling, model and rule versions, error analysis, response times, reversals, repeat reports, systemic issues, staffing and language coverage, vendor oversight, child accessibility, and remediation. Metrics need stable definitions and should distinguish reports, pieces of content, decisions, accounts, complaints, and successful complaints.

Category 1 applies where a regulated user-to-user service exceeds 34 million average monthly active UK users and uses a content recommender system, or exceeds 7 million average monthly active UK users and has both a content recommender system and functionality for users to forward or share regulated user-generated content with other users.

Category 2A applies where a regulated search service, or the search engine of a combined service, exceeds 7 million average monthly active UK users and is not the specified type of vertical search engine limited to selected sites or databases under a relevant arrangement.

Category 2B applies where a regulated user-to-user service exceeds 3 million average monthly active UK users and provides qualifying direct messaging designed so messages cannot be encountered by other users unless the sender or recipient takes further action.

An internal threshold calculation is a monitoring decision, not the formal categorisation result. Ofcom assesses services, gives affected providers an opportunity to make representations, and publishes the register required by section 95. The register was published on 10 July 2026.

A service can appear in more than one category, and only the relevant part may be categorised. Ofcom's register, for example, explains that category treatment of a search function within a combined service does not automatically extend to non-search chatbot or feed functionality.

All three categories are subject to transparency reporting after an Ofcom notice. Category 1 services also face additional user-empowerment, content, terms, and fraudulent-advertising duties; Category 2A services have additional search and fraudulent-advertising duties; Category 2B services have additional transparency obligations. The exact commencement and applicable notice must be checked for each duty.

Category 1 and Category 2A providers must also publish specified risk-assessment findings and provide Ofcom with assessment records as required. Categorisation does not replace the baseline illegal-content, children's access, child-safety, complaints, record-keeping, or enforcement duties.

Ofcom may include a requirement in an information notice for an entity to name one individual who meets the section 103 senior-manager test and can reasonably be expected to ensure compliance. The notice must also require the entity to inform the individual and explain the consequences of non-compliance. Naming happens in the entity's response; assigning an executive internally before a notice arrives is useful preparation but is not the statutory trigger.

Section 110 covers failure to prevent specified entity offences under section 109. These include failing to comply with the notice; knowingly or recklessly providing information that is false in a material particular; intentionally supplying encrypted information in a form that prevents Ofcom from understanding it; intentionally suppressing, destroying, or altering required information or documents; and intentional deletion or alteration of information that a data-preservation notice requires the entity to retain for an official investigation into a child's death. The precise intent and other elements in section 109 must be proved for the relevant route.

The entity must commit the underlying offence and the named individual must have failed to take all reasonable steps to prevent it. Section 110 therefore addresses information governance and evidence handling. A failure to meet an unrelated safety duty does not by itself establish the offence.

Section 110 contains specific defences. For the failure-to-comply route, it is a defence that the person held the relevant senior-manager role for such a short time after the notice was given that they could not reasonably have been expected to prevent the entity's offence. For the false-information, encryption, destruction, alteration, and data-preservation routes, it is a defence that the person was not a section 103 senior manager when the relevant act occurred. For every section 110 route, lack of knowledge that the person had been named is a defence.

Section 201 addresses the burden once sufficient evidence raises one of these statutory defences: the court must assume the defence is satisfied unless the prosecution proves otherwise beyond reasonable doubt. Whether a defence succeeds depends on the evidence and should be assessed by qualified counsel.

Section 202 is separate. If an entity commits an offence and it was committed with a corporate officer's consent or connivance, or was attributable to the officer's neglect, the officer also commits the offence. This route does not depend on an Ofcom requirement to name a senior manager.