Children's online safety code of practice for search services
SUPERSEDED VERSION: This is the draft submitted to the Secretary of State on 24 April 2025, which has since been issued. For the current version of the Code of Practice, please see the Quick guide to Protection of Children Codes webpage on Ofcom's website.
Protection of Children Code of Practice for search services¶
Draft prepared under section 41 of the Online Safety Act 2023 and submitted to the Secretary of State in accordance with section 43(1) of that Act on 24 April 2025.¶
[Intentionally left blank]
Office of Communications¶
Draft Protection of Children Code of Practice for search services¶
Presented to Parliament pursuant to section 43(2) of the Online Safety Act¶
2023.
24 April 2025.¶
© Ofcom copyright 2025
Any enquiries regarding this publication should be sent to protectingchildren@ofcom.org.uk.
[ISBN]
Printed on paper containing 40% recycled fibre content minimum. Printed in the UK by HH Associates Ltd. on behalf of the Controller of His Majesty’s Stationery Office
Contents¶
1. Introduction ........................................................................................................................ 4 The Protection of Children Code of Practice for search services .................................................... 4 The recommended measures ......................................................................................................... 4 Data protection ............................................................................................................................... 5 2. Application and scope ......................................................................................................... 6 3. Index of recommended measures ...................................................................................... 8 4. Recommended measures ................................................................................................. 13 A. Governance and accountability................................................................................................. 13 B. [Not used] ................................................................................................................................. 17 C. Search moderation .................................................................................................................... 18 D. Reporting and complaints ......................................................................................................... 26 E. [Not used] ................................................................................................................................. 35 F. Settings, functionalities and user support ................................................................................. 36 G. Publicly available statements.................................................................................................... 39 5. Definitions and interpretation .......................................................................................... 41 Risks of harm ................................................................................................................................. 53 User numbers ................................................................................................................................ 53
Section 1 Introduction¶
The Protection of Children Code of Practice for search services¶
The recommended measures¶
1 So far as relating to content that is harmful to children.
Data protection¶
Section 2 Application and scope¶
2 So far as relating to content that is harmful to children.
possible for children in the United Kingdom to access a service, or a part of it, if age verification or age estimation is used on the service with the result that children in the United Kingdom are not normally able to access the service or that part of it);
b) so far as a safety duty protecting children relates to non-designated content that is harmful to children, the duty is to be taken to extend only to addressing risks of harm from the kinds of such content that have been identified in the children’s risk assessment (if any have been identified); and c) the duties set out in section 29(3) of the Act are to be taken to extend only to content that is harmful to children where the risk of harm is presented by the nature of the content (rather than the fact of its dissemination).
Section 3 Index of recommended measures¶
* So far as it relates to content that is harmful to children. † So far as relating to the complaints set out in section 32(4)(b)(ii) (so far as relating to content that is harmful to children) and (5).
Section 4 Recommended measures¶
A Governance and accountability¶
PCS A1 Annual review of risk management activities¶
Application¶
PCS A1.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is a large general search service.
Recommendation¶
PCS A1.2 The provider’s most senior governance body in relation to the service should carry out and record an annual review of risk management activities having to do with harm to children, including in relation to risk remaining after the implementation of appropriate Code of Practice measures. The review should include how developing risks are being monitored and managed.
PCS A2 Individual accountable for the safety duties protecting children and reporting and complaints duties¶
Application¶
PCS A2.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides.
Recommendation¶
PCS A2.2 The provider should name an individual accountable to the most senior governance body for compliance with the safety duties protecting children and the reporting and complaints duties.
PCS A2.3 Being accountable means being required to explain and justify actions or decisions regarding:
to the most senior governance body.
PCS A3 Written statements of responsibilities¶
Application¶
PCS A3.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both) of the following:
Recommendation¶
PCS A3.2 The provider should have written statements of responsibilities for senior managers who make decisions about the management of risks having to do with harm to children.
PCS A3.3 A statement of responsibilities is a document which clearly shows the responsibilities that the senior manager performs in relation to the management of risks having to do with harm to children and how they fit in with the provider’s overall governance and management arrangements in relation to the service.
PCS A4 Internal monitoring and assurance¶
Application¶
PCS A4.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is both a large service and multi-risk (children).
Recommendation¶
PCS A4.2 The provider should have an internal monitoring and assurance function to provide independent assurance that measures taken to mitigate and manage the risks of harm to children identified in the children’s risk assessment are effective on an ongoing basis. This function should report to, and its findings should be considered by, either:
PCS A4.3 This independent assurance may be provided by an existing internal audit function.
PCS A5 Tracking evidence of new and increasing harm to children¶
Application¶
PCS A5.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both) of the following:
Recommendation¶
PCS A5.2 The provider should track evidence of new kinds of primary priority content or priority content, and unusual increases in particular kinds of content that is harmful to children or content that is harmful to children proxy, in search content that can be accessed by children. Relevant evidence may include, but is not limited to, that derived from:
PCS A5.3 The provider should ensure that any new kinds of primary priority content or priority content or unusual increases in particular kinds of content that is harmful to children or content that is harmful to children proxy are regularly reported through relevant governance channels to the most senior governance body.
PCS A5.4 To understand this, the provider should establish a baseline understanding of how frequently particular kinds of content that is harmful to children or content that is harmful to children proxy occur in search content that can be accessed by children to the extent possible based on its internal data and evidence. The provider should use this baseline to identify unusual increases in the relevant data.
PCS A6 Code of conduct regarding protection of children from harmful content¶
Application¶
PCS A6.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both) of the following:
Recommendation¶
PCS A6.2 The provider should have a code of conduct that sets standards and expectations for individuals working for the provider around protecting children in the United Kingdom from risks of harm to children.
PCS A7 Compliance training¶
Application¶
PCS A7.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both) of the following:
Recommendation¶
PCS A7.2 The provider should secure that individuals working for the provider who are involved in the design and operational management of the service are trained in the service’s approach to compliance with the safety duties protecting children and the reporting and complaints duties, sufficiently to give effect to them. This measure does not apply in relation to volunteers.
PCS A7.3 This does not affect Recommendation PCS C7 (provision of training and materials to individuals working in search moderation (non-volunteers)).
B [Not used]¶
[Intentionally left blank]
C Search moderation¶
PCS C1 Having a search moderation function designed to action content that is harmful to children¶
Application¶
PCS C1.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides.
Recommendation¶
PCS C1.2 The provider should, as part of its search moderation function, have systems and processes designed to review, assess and (where relevant) take appropriate moderation action in relation to search content that can be accessed by children the provider has reason to suspect may be relevant content that is harmful to children.
PCS C1.3 For the purpose of PCS C1.2, when the provider has reason to suspect that search content that can be accessed by children may be relevant primary priority content, the provider should either:
PCS C1.4 For the purpose of PCS C1.2, when the provider has reason to suspect that search content that can be accessed by children may be relevant priority content or relevant non-designated content, the provider should either:
moderation action for priority content and non-designated content, and the provider is satisfied that the type of relevant priority content or relevant non-designated content which it has reason to suspect exists is included within those kinds of content, decide whether to take (and, where relevant, take) appropriate moderation action for priority content and non-designated content in relation to the search content.
PCS C1.5 For the purpose of PCS C1.3, "appropriate moderation action for primary priority content" includes any action applied to the search content concerned that results, on child-accessible parts of the service, in:
unless the feasibility and relevance condition set out in PCS C1.8 is satisfied in which case "appropriate moderation action for primary priority content" includes any action that results in the search content concerned no longer appearing in search results presented to relevant users.
PCS C1.6 For the purpose of PCS C1.4,"appropriate moderation action for priority content and non-designated content” includes any action applied to the search content concerned that results, on child-accessible parts of the service, in:
unless the feasibility and relevance condition set out in PCS C1.8 is satisfied in which case "appropriate moderation action for priority content and non-designated content” includes any action that results in the search content concerned no longer appearing in search results presented to relevant users.
PCS C1.7 For the avoidance of doubt, PCS C1.5(a)(ii), PCS C1.5(b), PCS C1.6(a)(ii) and PCS C1.6(b) do not require relevant content that is harmful to children or content that is harmful to children proxy to appear lower than other search content in search results where this is not possible in response to a given search request because:
PCS C1.8 The feasibility and relevance condition is satisfied where:
PCS C1.9 For the purpose of PCS C1.5 and PCS C1.6, “relevant users” are United Kingdom users other than those United Kingdom users the provider has, on reasonable grounds, determined to be adults. For the purposes of this paragraph PCS C1.9, the fact that a user has self-declared their age (without more) is not be to regarded as giving a provider reasonable grounds to determine that a user is an adult.
PCS C1.10 In designing the systems and processes referred to in PCS C1.2 and in particular the aspects of those systems and processes relating to what appropriate moderation action (if any, as relevant) to take (including the extent to which search content is given a lower priority in the overall ranking of search results presented to United Kingdom users), the provider should have regard to the following:
PCS C1.11 If the service has an existing functionality which allows moderation actions to be applied by default for users of the service, the provider may use this functionality to implement the appropriate moderation actions in accordance with PCS C1.3 and PCS C1.4, including where that default setting may be changed by users.
Safeguards for freedom of expression¶
PCS C1.12 The following measures are safeguards to protect United Kingdom users’ and interested persons’ rights to freedom of expression and the privacy of United Kingdom users:
PCS C2 Filtering out primary priority content for child users¶
Application¶
PCS C2.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is a large general search service.
Recommendation¶
PCS C2.2 The provider should ensure that, on child-accessible parts of the service, search content that is relevant primary priority content or primary priority content proxy of which the provider is aware, by reason of following the processes set out in Recommendation PCS C1, does not appear in the search results of any users the provider has determined are child users using any existing means to determine the age or age range of a particular user.
PCS C2.3 The provider should take steps to ensure that any functionality which allows moderation actions to be applied by default for users of the service, to achieve the outcome set out in PCS C2.2, cannot be switched off by users the provider has determined are child users using any existing means to determine the age or age range of a particular user.
Safeguards for freedom of expression¶
PCS C2.4 The following measures are safeguards to protect United Kingdom users’ and interested persons’ rights to freedom of expression and the privacy of United Kingdom users:
PCS C3 Setting internal content policies¶
Application¶
PCS C3.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both) of the following:
Recommendation¶
PCS C3.2 The provider should set and record (but need not publish) internal content policies setting out rules, standards and guidelines around:
PCS C3.3 The policies should be drafted in such a way that appropriate moderation action is taken in accordance with Recommendation PCS C1 (having a search moderation function designed to action content that is harmful to children) and where applicable, that the outcome set out in Recommendation PCS C2 (filtering out primary priority content for child users) is ensured.
PCS C3.4 The provider should:
PCS C4 Performance targets¶
Application¶
PCS C4.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both) of the following:
Recommendation¶
PCS C4.2 For the purposes of PCS C4.3 and PCS C4.4, search content is “actioned” when:
(as applicable) in respect of the search content.
PCS C4.3 The provider should set and record performance targets for its search moderation function, covering at least:
PCS C4.4 In setting its targets, the provider should balance the need to ensure search content that is relevant content that is harmful to children is actioned swiftly against the importance of making accurate moderation decisions.
PCS C4.5 The provider should effectively measure and monitor its performance against its performance targets.
PCS C5 Prioritisation¶
Application¶
PCS C5.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both) of the following:
Recommendation¶
PCS C5.2 The provider should prepare and apply a policy in respect of the prioritisation of search content for review. In setting the policy, the provider should have regard to at least the following:
PCS C6 Resourcing¶
Application¶
PCS C6.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both) of the following:
Recommendation¶
PCS C6.2 The provider should resource its search moderation function so as to give effect to its internal content policies and performance targets having regard to at least:
PCS C7 Provision of training and materials to individuals working in search moderation (non-volunteers)¶
Application¶
PCS C7.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both) of the following:
Recommendation¶
PCS C7.2 The provider should ensure individuals working in search moderation receive training and materials that enable them to fulfil their role in moderating search content that can be accessed by children including in relation to Recommendations PCS C1 and PCS C12 (where relevant), and the internal content policies set in accordance with Recommendation PCS C3. This measure does not apply in relation to volunteers.
PCS C7.3 The provider should ensure that in doing so:
D Reporting and complaints¶
PCS D1 Enabling complaints¶
Application¶
PCS D1.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides.
Recommendation¶
PCS D1.2 The provider should have systems and processes which enable prospective complainants to make each type of relevant complaint in a way which will secure that the provider will take appropriate action in relation to them.
PCS D2 Having easy to find, easy to access and easy to use complaints systems and processes¶
Application¶
PCS D2.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides.
Recommendation¶
PCS D2.2 The systems and processes referred to in PCS D1.2 should be operated to ensure that:
PCS D2.3 In designing the systems and processes referred to in PCS D1.2, including its reporting tool or function, the provider should consider the accessibility needs of its United Kingdom user base having regard to:
PCS D2.4 For the purposes of PCS D2.3(c), the systems and processes referred to in PCS D1.2 should be designed for the purpose of ensuring usability for those dependent on assistive technologies, including:
PCS D3 [Not used]¶
PCS D4 Appropriate action – sending indicative timeframes¶
Application¶
PCS D4.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both) of the following:
Recommendation¶
PCS D4.2 The provider should acknowledge receipt of each relevant complaint and provide the complainant with an indicative timeframe for deciding the complaint.
PCS D4.3 PCS D4.2 does not apply if:
PCS D5 Appropriate action – sending further information about how the complaint will be handled¶
Application¶
PCS D5.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both) of the following:
Recommendation¶
PCS D5.2 In the acknowledgment of receipt of each relevant complaint, referred to in Recommendation PCS D4, the provider should set out:
PCS D6 Opt-out from communications following a complaint¶
Application¶
PCS D6.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both) of the following:
Recommendation¶
PCS D6.2 The provider should enable the complainant to opt out of receiving any non-ephemeral communications in relation to a relevant complaint.
PCS D7 Appropriate action for relevant complaints about content considered harmful to children¶
Application¶
PCS D7.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides.
Recommendation¶
PCS D7.2 When the provider receives a relevant complaint about search content that can be accessed by children which may be content that is harmful to children:
PCS D7.3 PCS D7.2 does not apply to a complaint identified as manifestly unfounded in accordance with PCS D14.2.
PCS D8 Appropriate action for content appeals – determination (services that are large general search services or multi-risk)¶
Application¶
PCS D8.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both) of the following:
Recommendation¶
PCS D8.2 The provider should determine relevant complaints which are content appeals.
PCS D8.3 The provider should, as a minimum, monitor its performance against performance targets relating to the following:
and should resource itself so as to give effect to those targets.
PCS D8.4 The provider should have regard to the following matters in determining what priority to give to review of a relevant complaint which is a content appeal:
and, if so, any information available about the accuracy of the content identification technology at identifying similar types of content that is harmful to children; and
PCS D9 Appropriate action for content appeals – determination (services that are neither large general search services nor multi-risk)¶
Application¶
PCS D9.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is neither a large general search service nor multi-risk (children).
Recommendation¶
PCS D9.2 The provider should determine relevant complaints which are content appeals promptly.
PCS D10 Appropriate action for content appeals – action following determination¶
Application¶
PCS D10.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides.
Recommendation¶
PCS D10.2 If, in relation to a relevant complaint that is a content appeal, the provider reverses a decision that search content was content that is harmful to children, the provider should:
content to be given a lower priority in the overall ranking of search results or not appear in search results again.
PCS D11 Appropriate action for age assessment appeals (services that are large general search services or multi-risk)¶
Application¶
PCS D11.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both) of the following:
Recommendation¶
PCS D11.2 The provider should have regard to the following matters in determining what priority to give to consideration of an age assessment appeal:
PCS D11.3 The provider should, as a minimum, monitor its performance against performance targets relating to the following:
and should resource itself so as to give effect to those targets.
PCS D11.4 If the provider determines that the user’s age was incorrectly assessed, the provider should take any necessary steps to enable the user to access content to which access was restricted as a result of that incorrect assessment (so far as appropriate and possible for the purpose of restoring the position to what it would have been had the assessment been correct).
PCS D11.5 The provider should monitor trends in age assessment appeals to help improve any age assurance process used on the service.
PCS D12 Appropriate action for age assessment appeals (services that are neither large general search services nor multi-risk)¶
Application¶
PCS D12.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is neither a large general search service nor multi-risk (children).
Recommendation¶
PCS D12.2 The provider should determine age assessment appeals promptly.
PCS D12.3 If the provider determines that the user’s age was incorrectly assessed, the provider should take any necessary steps to enable the user to access content to which access was restricted as a result of that incorrect assessment (so far as appropriate and possible for the purpose of restoring the position to what it would have been had the assessment been correct)..
PCS D12.4 The provider should monitor trends in age assessment appeals to help improve any age assurance process used on the service.
PCS D13 Appropriate action for complaints about non-compliance with certain duties¶
Application¶
PCS D13.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides.
Recommendation¶
PCS D13.2 This Recommendation PCS D13 applies to relevant complaints that the provider is not complying with:
PCS D13.3 The provider should nominate a responsible individual or a team to ensure that such complaints are directed to an appropriate individual or team to be processed.
PCS D13.4 Relevant complaints should be handled:
PCS D13.5 PCS D13.3 and PCS D13.4 do not apply in relation to complaints identified as manifestly unfounded in accordance with PCS D14.2.
PCS D14 Exception: manifestly unfounded complaints¶
Application¶
PCS D14.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides.
Recommendation¶
PCS D14.2 When the provider receives a relevant complaint that is not a content appeal or an age assessment appeal, it may disregard the complaint only if:
PCS D14.3 In designing a policy for the purposes of PCS D14.2(a), the provider should have regard to:
PCS D14.4 The provider should, at minimum, carry out an annual review of the policy to ensure it is not incorrectly identifying relevant complaints as manifestly unfounded.
PCS D14.5 If the policy is incorrectly identifying relevant complaints as manifestly unfounded, the provider should make changes to it with a view to ensuring its accuracy.
PCS D14.6 The provider should keep a record of its review process and any changes it has made.
E [Not used]¶
[Intentionally left blank]
F Settings, functionalities and user support¶
PCS F1 Reporting and removal of predictive search suggestions¶
Application¶
PCS F1.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is a large general search service and where a child-accessible part of the service uses a predictive search functionality.
Recommendation¶
PCS F1.2 The provider should offer United Kingdom users a means to easily report predictive search suggestions which they consider direct users towards primary priority content or priority content.
PCS F1.3 Where a report is received, the provider should:
PCS F2 [Not used]¶
PCS F3 Providing suicide, self-harm and eating disorder crisis prevention information¶
Application¶
PCS F3.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is a large general search service.
Recommendation¶
PCS F3.2 The provider should use systems and processes to detect, and provide crisis prevention information in response to, search requests made by United Kingdom users on child-accessible parts of the service that contain:
PCS F3.3 The crisis prevention information should:
PCS F3.4 Before including the information set out in PCS F3.3(c)(i) or (ii) in crisis prevention information, the provider should have regard to any terms published by the relevant organisation relating to the use of its helpline or information and support (as the case may be), including as to obtaining its consent.
PCS F4 Providing age-appropriate user support materials for children¶
Application¶
PCS F4.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is multi-risk (children).
Recommendation¶
PCS F4.2 The provider should make publicly available (including to United Kingdom users who are not registered to use the service and persons in the United Kingdom who are not users of the service) materials which explain:
PCS F4.3 Where a child-accessible part of the service uses a predictive search functionality, the provider should also make publicly available (including to persons in the United Kingdom who are not users of the service) materials which explain how to report predictive search suggestions (where the service includes this feature, and see Recommendation PCS F1.
PCS F4.4 The materials should in each case include:
PCS F4.5 The section of the materials aimed at children should be clear, comprehensible and easy for a child user to understand.
PCS F4.6 The materials should not include any material which would be content that is harmful to children if it were search content of the service.
PCS F4.7 If it is possible to register to use the service, the provider should ensure that the materials are provided to United Kingdom users during the registration process.
PCS F4.8 The provider should ensure that the materials appear in search results in response to search requests relating to them made by United Kingdom users using the service’s search engine.
PCS F4.9 If the service includes a functionality which enables users to search for material relating to the service, the provider should also ensure that the materials are provided in response to search requests made by United Kingdom users using that functionality.
G Publicly available statements¶
PCS G1 Publicly available statements: substance (all services)¶
Application¶
PCS G1.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides.
Recommendation¶
PCS G1.2 The provider should include the following in the publicly available statement:
PCS G2 Publicly available statements: substance (Category 2A services)¶
Application¶
PCS G2.1 This measure applies to a provider in respect of each Category 2A service that is likely to be accessed by children it provides.
Recommendation¶
PCS G2.2 The provider should summarise the findings of its children’s risk assessment (including as to levels of risk and as to the nature, and severity, of potential harm to children) in the publicly available statement.
PCS G3 Publicly available statements: clarity and accessibility¶
Application¶
PCS G3.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides.
Recommendation¶
PCS G3.2 The provider should ensure that the provisions included in the publicly available statement in accordance with Recommendation PCS G1 are:
Section 5 Definitions and interpretation¶
Table A - Definitions of terms in bold used in this Code¶
Table B - Terms used in this Code that have the meaning given in the Act¶
Risks of harm¶
Risk of harm¶
Multi-risk (children)¶
User numbers¶
Classification: CONFIDENTIAL [Intentionally left blank]
Classification: CONFIDENTIAL