UK Online Safety Act User-to-user and Search Services

A user-to-user classification turns on functionality, not branding. Ask whether content generated, uploaded, or shared by one user may be encountered by another. Public or group posts, user profiles, uploaded media, marketplace listings, in-game chat, collaborative spaces, and messaging can meet the test. The amount of user-generated content does not matter, and a Schedule 1 exemption must be tested separately.

For search, ask whether a person can search more than one website or database. General search and vertical search for products, jobs, travel, academic material, or another topic can qualify. A tool restricted to one website or one database does not meet the section 229 search-engine definition merely because it uses filters, recommendations, or sophisticated ranking.

If one product has both functions, apply the section 3 tie-breaker. Unless its only user-generated content falls within the specified exempt types, it is treated as user-to-user. If the same provider also operates a public search engine, it is a combined service and the search duties apply to that engine.

Identify the responsible provider by control, rather than assuming it is the brand owner, parent company, app-store operator, or company named in a customer contract. Section 226 generally identifies the user-to-user provider by control over who can use the relevant user-to-user elements. For search, it identifies the entity with control over the operations that accept search requests and generate responses.

UK establishment is not required. A significant UK user base or UK target market establishes links with the United Kingdom. A service accessible to individuals in the UK can also qualify where there are reasonable grounds to believe that its content or functionality creates a material risk of significant harm to individuals in the UK.

There is no general minimum revenue, employee, or user threshold for baseline Part 3 scope. Category thresholds determine additional duties for some services; they do not decide whether an otherwise regulated service has baseline duties.

Schedule 1 exemptions use specific statutory conditions. They include services whose only user-generated content is email, SMS or MMS, or one-to-one live aural communications; defined limited-functionality services; qualifying internal business services; specified public-body services; and qualifying education or childcare services. A broad product or sector label does not establish an exemption, and some exemptions operate at service-part level.

The limited-functionality exemption generally concerns comments or reviews on provider content, reactions to that content, and sharing those comments or reviews elsewhere. It does not exempt a service that also enables wider user interaction. The education and childcare exemption applies only to the providers and purposes described in Schedule 1, not every product sold to a school or used by a child.

Schedule 2 addresses certain services combining otherwise exempt user-to-user or search functions with provider pornographic content. Such a service may remain regulated under Part 5 even when the Part 3 user-to-user or search duties do not apply. Section 5 can also disapply the Act to a qualifying internal-business part of a Part 3 service or a specified part of a regulated search service without removing the whole service from scope.

Every regulated Part 3 service must complete an illegal-content risk assessment and maintain the applicable safety, reporting, complaints, freedom-of-expression, privacy, record-keeping, and review controls. The safety duties differ by service type: user-to-user services address user-generated content and use of the service to commit or facilitate priority offences, while search services address risks arising through search content and results.

The provider must also complete a children's access assessment. If the service or a relevant part is likely to be accessed by children, the children's risk-assessment and safety duties apply. Category status can add transparency, user-empowerment, fraudulent-advertising, and other duties, but it does not replace the baseline scope decision.