The UK Online Safety Act
Who is caught by the OSA?

Section 3 of the OSA defines a user-to-user service as an internet service through which users can generate, upload or share content with other users of that service. The scope of this definition is broad (noting that a service may still be a user-to-user service even if only a proportion of that service allows for such user-generated content to be uploaded or shared).  

Ofcom has provided a non-exhaustive overview of the types of services that are in-scope, as set out below (noting that these types of services are not fixed groupings and an online service may combine features from several of the types set out here):

Section 3 of the OSA defines a search service as an internet service that is, or includes, a search engine. A search engine is a service or functionality that enables a person to search multiple websites and/or databases. A search engine would not therefore include a service or functionality which only allows a person to search just one website or database – for example, a website that has an internal search functionality that does not generate results from external sources. 

Ofcom has identified two main types of search service: 

• General search services: Which allow users to search content from across the web. Examples of general search services include Google, Microsoft Bing and Yahoo! 
• Vertical search services: Which allow users to search for specific products or services offered by different providers, such as flights, hotels or financial products. Examples of vertical search services include Skyscanner, Hotels.com and MoneySuperMarket. 

Pornographic services are internet services on which pornographic content (defined under Section 79 of the OSA as regulated provider pornographic content) is published or displayed. Note that internet services that publish or display such content would fall within this category, regardless of whether the purpose of that particular service was to disseminate pornographic content. 

Ofcom has detailed examples of different types of pornographic services, including: 

• Tube sites: Which support the uploading of pre-recorded images or videos, which may be professionally produced or user generated. An example of a tube site is Pornhub.
• Cam sites: Which provide livestreamed content to users and may enable interaction between performers and viewers. An example of a cam site is OnlyFans. 
• Aggregators: Which gather and aggregate links to content from other pornographic services, rather than publishing its own or user-generated content. An example of an aggregator in this context is lxxx.com. 

Note that video-sharing platforms are currently regulated by Ofcom under the Video Sharing Platform Regime (VSP Regime), which came into force in November 2020. All services currently in scope of the VSP Regime will eventually fall within the scope of the OSA (following a transitional period – which started on 10 January 2024 – and subsequent repeal of the VSP Regime by the UK Government).

The following exemptions apply to user-to-user services. 

• Direct communications exemption: User-to-user services where the only user-generated content on the service is direct forms of communication (such as SMS and MMS messages, email or one-to-one live aural communication (for example, a real time unrecorded call made between users)) are exempt from regulation.
• Limited user functionality exemption: User-to-user services with limited functionalities, such as only being able to post comments or reviews relating to provider content or only being able to express a view of such comments by means of applying an emoji or a "like" or "dislike" symbol are exempt from regulation. 

See Schedule 1 of the OSA for the full list of exemptions.  

The following exemptions apply to user-to-user services, search services and services that publish or display provider pornographic content:

• Internal business exemption: Internal business services which are only available to a closed group of people for the purpose of operating the service (such as business intranets, collaboration tools and database management systems) are exempt from regulation.
• Public body exemption: Services provided by public bodies in the exercise of their public functions are exempt from regulation.
• Education/childcare provider exemption: Services provided by education or childcare providers in the provision of education or childcare services are exempt from regulation. 

See Schedule 1 and Schedule 9 respectively for the full list of exemptions.  

Ofcom has emphasised that, where a particular category of service is covered by an exemption, it would still need to comply with other relevant duties if it provides services that fall within other categories of regulated service – for example, a user-to-user service that has limited functionalities might be covered by the limited user functionality exemption, but if that service also publishes and displays pornographic content then it would also need to comply with the corresponding duties in respect of that content (as described above). 

A "link to the UK" will be established if any one of the following criteria is satisfied:

1. The service has a significant number of UK users

This will require an element of judgement by the online service operator given that the OSA does not define what is meant by a 'significant number'. However, Ofcom has suggested that: 

• a bot (or other automated tool) will be regarded as a user for the purposes of considering the 'UK link test' if its functions interact with user-generated content and it is not controlled by the provider of the service; and
• certain users may be excluded where they are acting in the course of the provider's business – for example, employees of that provider.

2. The service has UK users as one of its (or sole) target markets

This could be determined by a number of factors, including in the way the online service promotes or collects revenue from that service. 

3. The service poses a material risk of harm to UK users

Even if the above criteria has not been met, an online service will still have links with the UK if the service is capable of being used in the UK by individuals and there are reasonable grounds to believe that the user-generated content on that service presents a material risk of significant harm to individuals in the UK. 

Use our interactive flow chart below to check your answers.