Follow us

The application of the OSA is broad and captures a wide range of online platforms and services. Initial analysis prepared by Ofcom estimates that more than 100,000 online services could be subject to the new rules, many of which will be subject to the UK regulator's jurisdiction for the first time. Those organisations in-scope range from some of the largest and most established technology companies in the world to small and micro services, as well as new entrants to the market.

Online service providers of all shapes and sizes will need to carefully consider whether their services fall within the scope of the OSA and, if so, to what extent further measures are required in respect of those services (or part of those services) to ensure full compliance with the corresponding safety duties that apply.

We answer your questions around the scope of the OSA and provide a more detailed overview of the types of online services that might be caught by the new regulatory regime.

Am I caught by the OSA?

The OSA imposes legal duties on providers of the following three categories of online service:

  • user-to-user services, which enable the sharing of user generated content; 
  • search services, which enable users to search online databases or websites; and 
  • pornography sites, which publish or display pornographic content (meaning pornographic content published by the provider of the service). 

The OSA will cover all three categories of service identified above that have "links with the UK", unless the service as a whole (or the relevant part) is subject to an exemption. 

Services providing two or more of these three individual categories of service will be subject to each of the corresponding legal requirements.

Click on the drop down headings below for further information.

Section 3 of the OSA defines a user-to-user service as an internet service through which users can generate, upload or share content with other users of that service. The scope of this definition is broad (noting that a service may still be a user-to-user service even if only a proportion of that service allows for such user-generated content to be uploaded or shared).  

Ofcom has provided a non-exhaustive overview of the types of services that are in-scope, as set out below (noting that these types of services are not fixed groupings and an online service may combine features from several of the types set out here):

Section 3 of the OSA defines a search service as an internet service that is, or includes, a search engine. A search engine is a service or functionality that enables a person to search multiple websites and/or databases. A search engine would not therefore include a service or functionality which only allows a person to search just one website or database – for example, a website that has an internal search functionality that does not generate results from external sources. 

Ofcom has identified two main types of search service: 

  • General search services: Which allow users to search content from across the web. Examples of general search services include Google, Microsoft Bing and Yahoo! 
  • Vertical search services: Which allow users to search for specific products or services offered by different providers, such as flights, hotels or financial products. Examples of vertical search services include Skyscanner, and MoneySuperMarket. 

Pornographic services are internet services on which pornographic content (defined under Section 79 of the OSA as regulated provider pornographic content) is published or displayed. Note that internet services that publish or display such content would fall within this category, regardless of whether the purpose of that particular service was to disseminate pornographic content. 

Ofcom has detailed examples of different types of pornographic services, including: 

  • Tube sites: Which support the uploading of pre-recorded images or videos, which may be professionally produced or user generated. An example of a tube site is Pornhub.
  • Cam sites: Which provide livestreamed content to users and may enable interaction between performers and viewers. An example of a cam site is OnlyFans. 
  • Aggregators: Which gather and aggregate links to content from other pornographic services, rather than publishing its own or user-generated content. An example of an aggregator in this context is 

Note that video-sharing platforms are currently regulated by Ofcom under the Video Sharing Platform Regime (VSP Regime), which came into force in November 2020. All services currently in scope of the VSP Regime will eventually fall within the scope of the OSA (following a transitional period – which started on 10 January 2024 – and subsequent repeal of the VSP Regime by the UK Government).

Am I out of scope of the OSA?

Schedule 1 and Schedule 9 of the OSA set out limited exemptions from the duties imposed on the three categories of online service referred to in question 1 above. Schedule 1 details the exemptions for user-to-user services and search services and Schedule 9 details the internet services not subject to duties relating to regulated provider pornographic content.

These Schedules are drafted relatively narrowly, meaning that businesses will need to carefully review and determine whether or not their services fall within the scope of an exemption. It is also worth noting that the Secretary of State has the power to amend or remove categories of exempt service from theses Schedules if it considers that there is an increased risk of harm from particular types of service, so businesses will need to be alive to any changes made here.  

Click on the drop down headings below for further information.

The following exemptions apply to user-to-user services. 

  • Direct communications exemption: User-to-user services where the only user-generated content on the service is direct forms of communication (such as SMS and MMS messages, email or one-to-one live aural communication (for example, a real time unrecorded call made between users)) are exempt from regulation.
  • Limited user functionality exemption: User-to-user services with limited functionalities, such as only being able to post comments or reviews relating to provider content or only being able to express a view of such comments by means of applying an emoji or a "like" or "dislike" symbol are exempt from regulation. 

See Schedule 1 of the OSA for the full list of exemptions.  

The following exemptions apply to user-to-user services, search services and services that publish or display provider pornographic content:

  • Internal business exemption: Internal business services which are only available to a closed group of people for the purpose of operating the service (such as business intranets, collaboration tools and database management systems) are exempt from regulation.
  • Public body exemption: Services provided by public bodies in the exercise of their public functions are exempt from regulation.
  • Education/childcare provider exemption: Services provided by education or childcare providers in the provision of education or childcare services are exempt from regulation. 

See Schedule 1 and Schedule 9 respectively for the full list of exemptions.  

Ofcom has emphasised that, where a particular category of service is covered by an exemption, it would still need to comply with other relevant duties if it provides services that fall within other categories of regulated service – for example, a user-to-user service that has limited functionalities might be covered by the limited user functionality exemption, but if that service also publishes and displays pornographic content then it would also need to comply with the corresponding duties in respect of that content (as described above). 

Can I still be caught if I am based outside the UK?

The scope of the OSA is not only broad in terms of the types of services that it covers but also in terms of its geographic reach – it is designed to capture any online service that has a "link to the UK", regardless of where in the world the service is based.

Click on the drop down heading below for further information.

A "link to the UK" will be established if any one of the following criteria is satisfied:

1. The service has a significant number of UK users

This will require an element of judgement by the online service operator given that the OSA does not define what is meant by a 'significant number'. However, Ofcom has suggested that: 

  • a bot (or other automated tool) will be regarded as a user for the purposes of considering the 'UK link test' if its functions interact with user-generated content and it is not controlled by the provider of the service; and
  • certain users may be excluded where they are acting in the course of the provider's business – for example, employees of that provider.

2. The service has UK users as one of its (or sole) target markets

This could be determined by a number of factors, including in the way the online service promotes or collects revenue from that service. 

3. The service poses a material risk of harm to UK users

Even if the above criteria has not been met, an online service will still have links with the UK if the service is capable of being used in the UK by individuals and there are reasonable grounds to believe that the user-generated content on that service presents a material risk of significant harm to individuals in the UK. 

Use our interactive flow chart below to check your answers.

Online safety series

Essential information to navigate the complexities of online safety regulations

Key contacts

Claire Wiseman photo

Claire Wiseman

Professional Support Lawyer, London

Claire Wiseman
James Balfour photo

James Balfour

Senior Associate, London

James Balfour
Elizabeth Walter photo

Elizabeth Walter

Associate, London

Elizabeth Walter

Stay in the know

We’ll send you the latest insights and briefings tailored to your needs

Technology, Media and Entertainment, and Telecommunications Technology, Media and Telecommunications Claire Wiseman James Balfour Elizabeth Walter