UK Online Safety Act User-to-user And Search Services

Start by deciding whether the service is in scope and which illegal-content, children-safety, age-assurance, user-empowerment, transparency, complaints, risk-assessment, or Ofcom-facing compliance requirement is triggered. The answer should be specific enough to show the service type, the relevant duty, and the evidence that supports the decision.

Keep the Online Safety Act source, service-scope decision, user-to-user/search feature map, risk assessment, code-of-practice mapping, age-assurance evidence, and Ofcom-facing record together. The Act applies to search services and services that allow users to post content online or interact with each other, while Schedule 1 lists exemptions such as email, SMS, and certain limited-functionality, education, childcare, and public-body services.

Ownership should sit with the team that can change service design, moderation, recommender systems, age assurance, reporting, complaints, terms, or transparency data, with legal and trust-safety review.

Evidence should show service categorisation, illegal-content risk assessment, children access assessment, children risk assessment, mitigation controls, age-assurance decisions, terms/complaints records, and Ofcom reporting readiness. For scope decisions, the evidence should also show why the service is or is not an exempt service and whether it has links to the UK.

Most Online Safety Act mistakes happen at the boundary between user-to-user, search, pornography, category, child-access, illegal-content, and transparency duties.

Use this section before launching a user feature, recommender change, moderation change, age-assurance flow, complaint process, or transparency-reporting process. Check whether the service is exempt, whether it has UK links, and whether children are likely to access it.

Use an Online Safety Act workflow that captures service scope, user groups, risk assessment, code mapping, child-access status, mitigation owner, evidence, and Ofcom escalation path.

The output should be a service-scope memo, risk assessment, children access assessment, mitigation plan, age-assurance decision, complaint workflow, or transparency-report evidence pack. For this topic, the practical starting point is to classify the service correctly first, then map the duties that follow from that classification.