UK Online Safety Act Moderation and Appeals

A regulated user-to-user service must let users and affected persons report illegal content. If the service is likely to be accessed by children, it must also enable reports of content harmful to children on parts children can access. Section 21 then requires complaints routes for the content and system failures specified for that service, including complaints that the provider did not act on illegal content or that its reporting or complaints process does not operate as required.

The user-to-user complaints duty also covers specified actions taken by the provider against content or a user, such as removal or access restriction, suspension or banning, or restrictions on use. The exact route depends on which statutory duty caused the action. Additional complaint types apply where Category 1 duties or other Part 3 duties apply.

Search services have parallel reporting and complaints duties in sections 31 and 32. Their process must account for people affected by indexed content even if they never used the search service.

The baseline Act speaks mainly in terms of reports, complaints, and appropriate action, not a universal appeal right with a fixed deadline. A provider can use an internal appeal as its method for handling a complaint about removal, restriction, suspension, or another moderation decision, but the process still has to cover every statutory complaint type that applies.

Some additional duties are more specific. Category 1 protections for news publisher and journalistic content include dedicated procedures and, in defined circumstances, notification and an opportunity to make representations before action is taken. Those provisions should not be copied into a baseline process and described as applying to every service or every item of content.

Ofcom does not decide individual user complaints and cannot order a service to remove or reinstate particular content through its ordinary complaints portal. Individuals should first use the service's own process; information later sent to Ofcom can inform regulatory monitoring.

For a judgement that content is illegal, section 192 requires the provider to use all relevant information reasonably available. The provider should infer that content is illegal only where there are reasonable grounds to infer the elements of a relevant offence and no reasonable grounds to infer a defence. The rule applies to human and automated judgements, although the information reasonably available can differ.

Content moderation must also match the most recent risk assessment and the systems described in the provider's terms or public statement. Sections 22 and 33 require particular regard to users' legal rights to freedom of expression and privacy when the provider decides on and implements safety measures.

Data protection still applies when moderation uses personal data, profiling, age assurance, or automated tools. Ofcom and the ICO state that online safety and data protection are compatible but must be considered together; neither regime displaces the other.

Assign one operational owner for reporting and complaints, but keep product, trust and safety, legal, privacy, accessibility, and engineering responsibilities explicit. Test the public path without a logged-in account, with assistive technology, and with a child-appropriate journey where children can use it.

Measure whether the process produces timely and appropriate action for the assessed risk. The Act does not supply one universal turnaround time, so internal targets should be justified by harm severity, evidence needs, legal uncertainty, and the measures in the applicable Ofcom code.