Policy background The Online Safety Act
The legislation imposes legal requirements on:
Providers of internet services which allow users to encounter content generated, uploaded or shared by other users, i.e. user-generated content ("user-to-user services");
Providers of search engines which enable users to search multiple websites and databases ("search services"); and
Providers of internet services on which provider pornographic content is published or displayed.
	The legislation requires providers of regulated user-to-user and search services to:
Assess the risks of harm to those users present on the service;
Take steps to mitigate and manage the risks of harm to individuals arising from illegal content and activity, and (for services likely to be accessed by children) content and activity that is harmful to children. Providers will also need to assess the risk of their services being used for the commission or facilitation of a priority offence and to design and operate their services to mitigate this risk;
Put in place systems and processes which allow users and affected persons to report specified types of content and activity to the service provider;
Establish a transparent and easy to use complaints procedure which allows for complaints of specified types to be made;
Have particular regard to the importance of protecting users’ legal rights to freedom of expression and protecting users from a breach of a legal right to privacy when implementing safety policies and procedures; and
Put in place systems and processes designed to ensure that detected but unreported CSEA content is reported to the NCA.
	Those user-to-user services which meet the Category 1 threshold conditions, specified by the Secretary of State, are subject to additional legal requirements, including to:
Improve transparency and accountability and protect free speech. Those user-to-user services which meet the Category 1 threshold conditions must have systems and processes to ensure they only remove or restrict access to content, or ban or suspend users, where allowed by their terms of service, or where they otherwise have a legal obligation to do so.
Carry out an assessment of the impact that safety policies and procedures will have on users’ legal rights to freedom of expression, including on access to and treatment of news publisher and journalistic content, and users’ privacy, and demonstrate the steps they have taken to mitigate any impact;
Specify in a public statement the steps taken to protect users’ legal rights to freedom of expression and users’ privacy;
Put in place systems and processes designed to ensure that the importance of the free expression of content of democratic importance is taken into account when making decisions about how to treat such content;
Put in place systems and processes designed to ensure that the importance of the free expression of journalistic content is taken into account when making decisions about how to treat such content.
Notify and offer a right of appeal to a recognised news publisher before removing or moderating its content, or taking action against its account;
Put in place a dedicated and expedited complaints procedure that ensures that the decisions of the service provider to take action against a user because of a particular piece of journalistic content can be challenged;
Offer optional user verification and user empowerment tools to adults on their sites; and proactively ask their registered adult users at the first possible opportunity how they would like the user empowerment content tools to be applied; and
Put in place proportionate systems and processes to prevent the risk of users encountering fraudulent adverts.
	Those search services which meet the Category 2A threshold conditions are under a duty to produce annual transparency reports and to put in place proportionate systems and processes to prevent the risk of users encountering fraudulent adverts.
	Category 1, 2A, and 2B Services are also under duties to set out their policies on disclosing information to the parents of deceased child users, provide details about this in the terms of service or a publicly available statement, and operate a complaints procedure in relation to these duties.
	The Act confers new powers on OFCOM establishing them as the online safety regulator. OFCOM is responsible for enforcing the legal requirements imposed on service providers. The Act gives OFCOM the power to compel in-scope providers to provide information and to require an individual from an in-scope provider to attend an interview; powers of entry and inspection; and the power to require a service provider to undertake, and pay for, a report from a skilled person. OFCOM may also require information, or produce a report, in relation to the death of a child and share this information with a coroner.
	The Act confers new powers on OFCOM to require regulated user-to-user and search services to use accredited technology to deal with CSEA and terrorism content, or make best endeavours to develop or source technology to deal with CSEA content, where necessary and proportionate.
	The new powers conferred on OFCOM also include the power to give enforcement notifications (which may set out the steps required to remedy a contravention) and the power to impose financial penalties of up to £18 million or 10% of qualifying worldwide revenue, whichever is greater. OFCOM can also, in certain circumstances, apply to the Courts for an order imposing business disruption measures on a provider.
	The Act requires OFCOM to produce codes of practice for service providers, setting out the recommended steps that providers can take in order to comply with the legal requirements described above. A provider may take different measures to those recommended in the codes of practice. A provider will be treated as having complied with the relevant legal obligation if the provider takes the steps recommended in the relevant code of practice for complying with that obligation.
	The Act also requires providers of internet services which make pornographic material available by way of the service (as opposed to enabling users to generate or share such content) to use age verification or age estimation (or both), to ensure that children are not normally able to encounter that pornographic content.
	The Act creates a false communications offence and a threatening communications offence. It also amends the existing communications offences in the Malicious Communications Act 1988, Malicious Communications (Northern Ireland) Order 1988, and Section 127 of the Communications Act 2003 to reflect this. It also creates a new "cyberflashing" offence, an offence of sending or showing flashing images electronically to people with epilepsy, and an offence of encouraging or assisting serious self-harm. It also inserts new intimate image abuse offences to the Sexual Offences Act 2003.