A service can fall within Part 3 if users can encounter content generated, uploaded, or shared by other users, or if it provides a search engine across more than one website or database.
The provider must then check UK links, Schedule 1 and Schedule 2, disapplied service parts, and who controls the relevant functionality. Company location and service size do not decide scope by themselves.
Structured answer sets in this page tree.
Cited legal and guidance references.
Use four tests in order. First, decide whether the product contains a , a , or both. Second, identify the entity that controls access to the user-to-user functionality or controls search operations. Third, decide whether the service has . Fourth, test the specific and Schedule 2 exemptions and any disapplied parts. A regulated service then has baseline illegal-content, reporting, complaints, record-keeping, and assessment duties; child-access and category status can add further duties.
A user-to-user classification turns on functionality, not the product label. Ask whether content generated, uploaded, or shared by one user may be encountered by another. Comments, public or group posts, user profiles, user-uploaded media, marketplace listings, in-game chat, collaborative spaces, and some messaging functions can meet the test. The exemptions still need separate analysis.
For search, ask whether a person can search more than one website or database. A general search engine and a vertical search engine for products, jobs, travel, academic material, or another topic can qualify. A search tool restricted to one website or database does not meet section 229 merely because it has filters or sophisticated ranking.
If the service has both functions, apply the section 3 tie-breaker. Unless the only user content is within the specified exempt types, it is treated as a ; if the same provider also operates a public search engine, it is a and search duties apply to that engine.
The responsible entity is not necessarily the brand owner, app-store operator, parent company, or company named in a customer contract. Section 226 generally identifies the user-to-user provider by control over who can use the relevant user-to-user elements. For search, the provider is the entity with control over the operations that accept requests and generate results.
After identifying the provider, apply section 4. UK establishment is not required. A significant UK user base or a UK target market is enough. A service accessible in the UK can also qualify where there are reasonable grounds to believe its user-generated content or search content creates a material risk of significant harm to people in the UK.
The Act does not set a general minimum revenue, employee, or user threshold for baseline Part 3 scope. Category thresholds decide additional duties; they do not decide whether an otherwise regulated service has the baseline duties.
exemptions are specific, not broad sector labels. They cover services whose only user-generated content is email, SMS or MMS, or one-to-one live aural communications; defined limited-functionality services; qualifying internal business services; specified public-body services; and qualifying education or childcare services. Each exemption has conditions, and some operate at service-part level.
The limited-functionality exemption generally concerns comments or reviews on provider content and sharing those comments or reviews elsewhere. It does not exempt a service that also enables wider user interaction. The education and childcare exemption applies only to the providers and purposes described in , not every product sold to a school or used by a child.
Schedule 2 deals with certain services that combine otherwise exempt user-to-user or search functions with provider pornographic content. Those services may remain regulated under Part 5 even when the Part 3 user-to-user or search duties do not apply. Section 5 can also disapply the Act to defined low-risk parts without taking the whole service out of scope.
Every regulated must complete an illegal-content risk assessment and maintain the required reporting, complaints, freedom-of-expression, privacy, record-keeping, and review controls. The safety duties differ: user-to-user services address user-generated content and the use of the service to commit or facilitate priority offences, while search services address risks arising through search content and results.
The provider must also complete a . If the service or a relevant part is likely to be accessed by children, children's risk-assessment and safety duties apply. Category status can add transparency, user-empowerment, fraudulent-advertising, and other duties, but it does not replace the baseline classification.
Not necessarily. A significant number of UK users is only one route to . A UK target market is another. A service accessible in the UK can also qualify where there are reasonable grounds to believe its user-generated content or search content creates a material risk of significant harm to people in the UK.
Not if it searches only one website or one database. Section 229 requires search across some or all websites or databases and expressly excludes a service or functionality limited to one website or database. A vertical search engine covering multiple sources can qualify even if it covers only one topic.
No. exempts services whose only user-generated content is email, SMS or MMS, or one-to-one live aural communications, subject to the schedule's conditions and exceptions. A wider service with posts, group communications, profiles, uploads, comments, or other user interaction needs a function-by-function analysis.
Capture the functionality, provider entity, UK links, exemptions, service-part boundaries, evidence, owner, and review trigger.
Turn the feature inventory, provider-control map, UK-links evidence, and exemptions into an owned assessment.
Check a classification, provider, UK-links, exemption, or combined-service question against cited material.
Work through the service map, entity controls, exemptions, open questions, evidence, and next duties.