Operates a social platform, in the United Kingdom

Defamation Act 2013, s. 5 · Read the law's page

• Rely on section 5 as the operator of a website when an action for defamation is brought over a statement someone else posted on it; the Act extends to England and Wales only.
• To rely on the defence, be able to show that you were not the operator who posted the statement.
• Respond to every notice of complaint as the Defamation (Operators of Websites) Regulations 2013 require: the defence is defeated if the claimant shows that it was not possible to identify the poster, that the claimant gave you a notice of complaint in relation to the statement, and that you failed to respond to it in accordance with the Regulations.
• Do not act with malice in relation to the posting of a statement, because the defence is defeated if the claimant shows that you did. Moderating the statements others post does not by itself defeat it.
• Recognise a notice of complaint by its contents: it must specify the complainant's name and email address, set out the statement and explain why it is defamatory of the complainant, specify where on the website the statement was posted, set out the meaning the complainant attributes to it, set out the aspects the complainant believes are factually inaccurate or opinions not supported by fact, confirm that the complainant does not have sufficient information about the poster to bring proceedings, and confirm whether the complainant consents to your providing the poster with the complainant's name and email address.
• If a notice complains that a statement on your website is defamatory of the complainant but lacks some of that information, still treat it as a notice of complaint. Within 48 hours of receiving it, notify the complainant in writing that it does not comply with section 5(6)(a) to (c) of the Act and regulation 2, and what those requirements are.
• If you have a means of contacting the poster, meaning one that includes private electronic communication such as email or private messaging, send the poster within 48 hours of receiving the notice of complaint a copy of it, altered to conceal the complainant's name and address if the complainant has not consented to your providing them. In the same communication, notify the poster in writing that the statement may be removed from the locations specified in the notice unless the poster responds in writing by the deadline you state, which must be the 5th day after the day you send the notification, and that the poster's name and address will not be released to the complainant unless the poster consents or a court orders you to.
• Treat the poster's response as complete only if it says whether the poster wants the statement removed from the locations specified in the notice and, where the poster does not, gives the poster's full name, the postal address at which the poster resides or carries on business, and whether the poster consents to your providing those details to the complainant.
• If you have no means of contacting the poster, remove the statement from the locations specified in the notice of complaint within 48 hours of receiving the notice.
• Within 48 hours of receiving a notice of complaint, send the complainant a written acknowledgement stating, where you contacted the poster, that you have acted in accordance with paragraph 2 of the Schedule and, where you removed the statement because you have no means of contacting the poster, that it has been removed. This step does not apply where the repeated-posting rule below applies.
• If the poster does not respond by the deadline, remove the statement within 48 hours of the end of the period and notify the complainant in writing that it has been removed. If the poster responds without the required information, do the same within 48 hours of receiving the response; a name or postal address that a reasonable website operator would consider obviously false counts as missing.
• If the poster responds in time and wishes the statement removed, remove it within 48 hours of receiving the response and notify the complainant in writing that it has been removed.
• If the poster responds in time and does not wish the statement removed, tell the complainant in writing within 48 hours of receiving the response that the poster does not wish it removed and that it has not been removed. Give the complainant the poster's name or address in writing if the poster consented, and otherwise notify the complainant in writing that the poster did not consent.
• Where the same complainant has sent you notices of complaint on two or more previous occasions about a statement conveying the same or substantially the same imputation, posted on the same website by the same person, each time removed under the Schedule, and says so when sending a further notice, remove the statement within 48 hours of receiving that notice without following the steps above.
• Treat a statement as removed within the time allowed if another person removed it from the location before that time elapsed.

Consumer Rights Act 2015, c. 15, s. 46 · Read the law's page

• This binds a trader that supplies digital content to a consumer under a contract; a trader acts for purposes relating to its trade, business, craft or profession, and a consumer is an individual acting wholly or mainly outside them (sections 2(2), 2(3) and 46(1)).
• If your digital content damages the consumer's device or other digital content, and the damage would not have occurred had you exercised reasonable care and skill, repair the damage within a reasonable time and without significant inconvenience to the consumer, bearing the necessary costs, or compensate the consumer with an appropriate payment (section 46(1) to (3)).
• Pay any compensation without undue delay and within 14 days of agreeing that the consumer is entitled to it, and charge the consumer no fee for the payment (section 46(5) and (6)).

The Network and Information Systems Regulations 2018, SI 2018/506, reg. 12(1) and (2) · Read the law's page

• Applies to a relevant digital service provider: a provider of an online marketplace, an online search engine or a cloud computing service in the United Kingdom whose head office is in the United Kingdom or which has nominated a representative established there, and which is not a micro or small enterprise (regulation 1).
• Identify and take appropriate and proportionate measures to manage the risks posed to the security of the network and information systems on which you rely to provide the service in the United Kingdom (regulation 12(1)).
• Ensure, having regard to the state of the art, a level of security of network and information systems appropriate to the risk posed, and prevent and minimise the impact of incidents with a view to ensuring the continuity of the service (regulation 12(2)(a) and (b)).
• Take into account the security of systems and facilities, incident handling, business continuity management, monitoring, auditing and testing, and compliance with international standards (regulation 12(2)(c)).

The Network and Information Systems Regulations 2018, SI 2018/506, reg. 12(3) to (7) · Read the law's page

• Applies to the relevant digital service providers described in the security duties of regulation 12(1) and (2): a provider of an online marketplace, an online search engine or a cloud computing service in the United Kingdom that is not a micro or small enterprise.
• Notify the Information Commission in writing about any incident having a substantial impact on the provision of any of those services (regulation 12(3)); this applies only if you have access to information that lets you assess whether the impact is substantial (regulation 12(4)).
• Make the notification without undue delay and in any event no later than 72 hours after you are first aware that the incident has occurred (regulation 12(6)(a)).
• State your name and the digital services you provide, the time and duration of the incident, its nature and impact, any cross-border impact, and any other helpful information (regulation 12(5)).
• In judging whether the impact is substantial, take into account the number of users affected, the duration of the incident, the geographical area affected, the extent of the disruption to the service and the extent of the impact on economic and societal activities (regulation 12(7)(a)).

Online Safety Act 2023, c. 50

• If you run a user-to-user service with links to the United Kingdom, assess the risk of illegal content, use proportionate measures to prevent users encountering priority illegal content, and take illegal content down swiftly once alerted to it.
• Do not share, or threaten to share, an intimate photograph or film of a person without their consent, including an AI-generated one.
• Take down reported intimate image content, including an AI-generated intimate image, no later than 48 hours after a report by the person it shows or someone acting on their behalf.
• Carry out a further illegal content risk assessment before making any significant change to the service's design or operation.

Online Safety Act 2023, c. 50, ss. 11-12 (Part 3) · Read the law's page

• Applies to regulated user-to-user services likely to be accessed by children in the UK; Category 1 (large) platforms carry additional duties.
• Carry out a children's risk assessment.
• Use proportionate measures, including age verification or age estimation where appropriate, to prevent children encountering primary priority content harmful to children, such as pornography, self harm, suicide and eating disorder content.
• Do not rely on a photo upload age check that lacks liveness detection: Ofcom found one that children could circumvent to be in breach of section 12.

Online Safety Act 2023, c. 50, ss. 9 and 10 · Read the law's page

• If you run a user-to-user service with links to the United Kingdom, carry out a suitable and sufficient illegal content risk assessment, keep it up to date, and carry out a further one before making any significant change to the service's design or operation, under Online Safety Act 2023 section 9.
• Use proportionate measures in the design and operation of the service to prevent users encountering priority illegal content and to mitigate the risk of the service being used to commit or facilitate a priority offence, under section 10(2).
• Operate proportionate systems and processes to minimise how long priority illegal content is present, and take illegal content down swiftly once you are alerted to it or otherwise become aware of it, under section 10(3).
• Say in your terms of service how individuals are protected from illegal content, and apply those terms consistently, under section 10(5) and (6).

Protection of Children Codes of Practice (illegal content and user-to-user/search services), Ofcom, April to July 2025 · Read the law's page

• Applies to user-to-user services and search services likely to be accessed by children in the UK; these Codes set out the measures Ofcom expects, and following them treats you as compliant with the children's safety duties.
• Have completed your children's risk assessment by 24 July 2025.
• Have risk mitigation measures in place from 25 July 2025, including age assurance, safer default settings and algorithms, and content moderation.

Online Safety Act 2023, c. 50, ss. 10(3A)-(3B) and 20A, inserted by the Crime and Policing Act 2026, c. 20, s. 100 · Read the law's page

• If you run a user-to-user service with links to the United Kingdom, let users and affected persons easily report content as intimate image content, under Online Safety Act 2023 section 20A.
• Take down content reported to you as intimate image content by the person it shows or someone acting for them, and any content you identify as the same or substantially the same, as soon as reasonably practicable and no later than 48 hours after the report, unless you consider the content is not intimate image content or the reporter is neither the subject nor acting for them, under section 10(3A) and (3B).
• Say in your terms of service how you handle intimate image content reports and the 48-hour take-down, under section 10(5)(b).

Regulations to be made under Online Safety Act 2023 s. 214A, as inserted by the Children's Wellbeing and Schools Act 2026 · Read the law's page

• This is a proposed measure: the government announced the ban on 15 June 2026 and the regulations have not been made; what follows is what it would require if made in this form.
• Applies to user-to-user social media platforms that allow content posting and use algorithmic recommendation feeds (the announcement named Snapchat, TikTok, YouTube, Instagram, Facebook and X); messaging services are excluded, with narrow exemptions for education, e-commerce and music streaming services.
• Keep users under 16 off a covered platform.
• Timing as announced: regulations expected to be laid before Parliament by the end of 2026 and protections in force in spring 2027; Ofcom is to complete a study of highly effective age assurance for under-16s in autumn 2026.