United KingdomOnline Safety Act 2023, illegal content risk assessment and safety duties of user-to-user services
Online Safety Act 2023, c. 50, ss. 9 and 10
In force since .
A notice and action rule binding private bodies.
- Enforcement body
- Office of Communications (Ofcom)
As of .
What it requires
- If you run a user-to-user service with links to the United Kingdom, carry out a suitable and sufficient illegal content risk assessment, keep it up to date, and carry out a further one before making any significant change to the service's design or operation, under Online Safety Act 2023 section 9.
- Use proportionate measures in the design and operation of the service to prevent users encountering priority illegal content and to mitigate the risk of the service being used to commit or facilitate a priority offence, under section 10(2).
- Operate proportionate systems and processes to minimise how long priority illegal content is present, and take illegal content down swiftly once you are alerted to it or otherwise become aware of it, under section 10(3).
- Say in your terms of service how individuals are protected from illegal content, and apply those terms consistently, under section 10(5) and (6).
If you get it wrong
Penalty structure
Online Safety Act 2023, Sch. 13 para. 4(1): the greater of 18 million pounds and 10 percent of the person's qualifying worldwide revenue for its most recent complete accounting period; 18 million pounds where the person has no accounting period (para. 4(2)).
- Rule
- Higher of
- As of
- Currency
- GBP
- Fixed cap
- 18,000,000
- Turnover percentage cap
- 10
What this law does
Part 3 of the Online Safety Act 2023 places duties on the provider of a regulated user-to-user service, and a service has links with the United Kingdom if it has a significant number of UK users, if UK users are one of its target markets, or if it can be used here and there is a material risk of significant harm to people here.
Section 9 requires a suitable and sufficient illegal content risk assessment, kept up to date and repeated before any significant change to the service's design or operation, covering among other things the risk of users encountering each kind of priority illegal content and the risk that the service's functionalities facilitate illegal content.
Section 10 requires proportionate measures to prevent users encountering priority illegal content and to mitigate the risk of the service being used to commit or facilitate a priority offence, proportionate systems and processes to minimise how long priority illegal content is present and to take illegal content down swiftly once the provider is alerted to it, and terms of service that say how users are protected from illegal content and are applied consistently.
Priority illegal content is terrorism content, child sexual exploitation and abuse content, and content amounting to an offence listed in Schedule 7, which includes sharing an intimate image without consent and, since , creating or requesting a purported intimate image of an adult.
For the intimate image offences a photograph or film includes an image made or altered by computer graphics or in any other way that appears to be one, so an AI-generated intimate image is within these duties. Sections 9 and 10 came into force on , and Schedule 3 required a service already operating to complete its first illegal content risk assessment within three months of Ofcom publishing its risk assessment guidance.
Ofcom enforces the duties and can impose a penalty of up to the greater of 18 million pounds and 10 percent of qualifying worldwide revenue. The 48-hour take-down duty for intimate image content that the Crime and Policing Act 2026 added to section 10 is held as its own entry.
When LexLint raises it
When your app profile says your app operates a social platform.