Schedule 3: Timing of providers’ assessments User-to-user services likely to be accessed by children Section 12: Safety duties protecting children
This section sets out the duties on providers of user-to-user services with regard to content that is harmful to children but is not illegal. User-to-user services that are likely to be accessed by children (see section 37) must comply with these duties.
	Subsection (2) imposes a duty on service providers to take proportionate steps relating to the design and operation of the service:
To mitigate and manage the risk of harm to children in different age groups from risks identified in the most recent children’s risk assessment carried out under section 11.
To mitigate the impact of harm to children in different age groups from content that is harmful to children. This could include user support measures, such as signposting child users to sources of support if they have experienced harm on the service.
	Subsection (3) requires service providers to use proportionate systems and processes designed to prevent children of any age from accessing primary priority content (as set out in section 61) on their service. It also requires service providers to protect children in age groups which are judged to be at risk from other content that is harmful to children (either priority content as set out in section 62 or other content that satisfies the definition of content that is harmful to children in section 60(2)(c)) on their service.
	Subsection (4) requires user-to-user service providers to use age verification or age estimation (or both) to prevent children from encountering identified primary priority content that is harmful to children on their service. This duty applies unless the conditions under subsection (5) are met, which includes where the terms of service indicate that that kind of content is prohibited for all users. Where the requirement does apply, under subsection (6) the age verification or age estimation used must be highly effective at correctly determining whether or not a particular user is a child.
	The duties described in subsections (2) and (3) apply to all areas of the service, including the way the service is designed, operated and used, as well as to the content present on it. Subsection (7) clarifies that age verification or age estimation may be used to comply with duties under subsections (2) or (3), in circumstances where no duty to use age verification or age estimation applies.
	Subsection (8) lists areas within which the service provider may be required to use measures, if proportionate, to comply with the safety duties for protecting children. These areas include arrangements for compliance and risk management, service design, policies on access and use (e.g. preventing children from accessing specific content on the service), content moderation (e.g. content removal), user empowerment and support measures and staff policies.
	Subsection (9) requires providers to state in their terms of service how children are being prevented from encountering primary priority content and protected from encountering priority content on their service. It also requires providers to set out how children are protected from encountering other content that would satisfy the definition of content that is harmful to children in section 60. These terms must be applied consistently and must be clear and accessible (subsections (10) and (13)).
	Subsection (11) specifies that where a provider prevents access to part of, or the whole of the service for users under a particular age, it is required to set out in its terms of service the measures it uses to do so. It is also required to apply those provisions consistently.
	Subsection (12) specifies that information about any proactive technology the service provider will use to comply with its duties under subsections (2) and (3) must be included in the terms of service.
	Subsection (14) requires Category 1 services to summarise the findings from its most recent children’s risk assessment in its terms of service.