Schedule 4: Codes of practice under section 41: principles, objectives, content
Paragraph 1 requires OFCOM to consider how appropriate the provisions of codes of practice are for the different kinds of regulated user-to-user and search services and to the differing sizes and capacities of the providers of those services.
	Paragraph 2 sets out various principles OFCOM must have regard to when preparing or amending a code of practice.
	Paragraph 3 requires OFCOM to ensure that the measures set out in its codes of practice are compatible with the online safety objectives, which are set out at paragraph 4 for regulated user-to-user services and paragraph 5 for regulated search services.
	Paragraph 6 clarifies how the objectives for user-to-user services and search services apply to combined services.
	Paragraph 7 gives the Secretary of State power to make changes to the online safety objectives by regulations subject to the affirmative resolution procedure. Paragraph 8 obliges OFCOM to consider as soon as is reasonably practicable whether they should review and subsequently amend the codes of practice following changes to the online safety objectives.
	Paragraph 9 imposes obligations on OFCOM relating to the content of their codes of practice. These are that codes of practice for illegal content and children's online safety must include measures in the areas set out in those duties where this is proportionate to the type and size of service providers and to risk (sub-paragraph (5)). Sub-paragraphs (1) and (2) cover user-to-user services and (3) and (4) cover search services.
	Paragraph 10 requires OFCOM to design measures in the codes of practice in the light of the principles of the importance of protecting users’ rights to freedom of expression and privacy, and to incorporate safeguards for these rights where appropriate.
	Paragraph 11 provides that measures set out in a code of practice may only apply to services that are in the United Kingdom or affect users in the United Kingdom. This means that OFCOM could not set out measures in codes of practice that apply to services that do not operate in the United Kingdom or have United Kingdom users.
	Paragraph 12 sets out provisions which relate to OFCOM’s recommendation of age assurance in codes of practice for the purposes of Part 3 of the Act. It includes relevant principles that OFCOM must have regard to when recommending the use of age assurance, and makes clear that OFCOM must recommend highly effective age verification or age estimation in connection with the duty in section 12(3)(a) (preventing children from encountering primary priority content that is harmful to children). Amongst other matters, OFCOM must have regard to relevant standards set out in the latest version of the code of practice under section 123 of the Data Protection Act 2018 (Age Appropriate Design Code). The Information Commissioner's Office oversees the enforcement of data protection law in the UK and is responsible for the Age Appropriate Design Code.
	Paragraph 13 sets constraints on how OFCOM may recommend proactive technologies in the codes of practice relating to illegal content, child online safety and fraudulent advertising. OFCOM may only recommend proactive technologies in relation to the duties to tackle illegal content, content that is harmful to children and fraudulent advertising. Any such recommendation must be a proportionate response to the risk. Age assurance technologies are not covered by the principles which OFCOM must have regard to when recommending a proactive technology under the Act, because age assurance technologies are now covered by the principles introduced by paragraph 12. In relation to the accuracy and effectiveness of tools, OFCOM may refer to industry standards or set principles through the codes. A proactive technology measure may not be recommended to analyse user-generated content, or metadata relating to such content, which has been communicated privately.
	Paragraph 14 allows codes of practice to make provisions that are different for user-to-user and search services and to make different provisions for different kinds of service. It also allows OFCOM to differentiate between services and service providers as appropriate.
	Paragraph 15 provides that codes of practice can apply to service providers based outside of the United Kingdom.
	Paragraph 16 specifies that a code of practice for the purposes of this schedule means a code of practice about duties issued by OFCOM under section 41.