Children's online safety code of practice for user-to-user services

Protection of Children Code of Practice for user-to-user services

Draft consolidated version incorporating amendments in relation to PCU C11 and C12 that Ofcom intends to submit to the Secretary of State in accordance with section 43(1) of the Online Safety Act.¶

[VERSION NOT IN FORCE: This version incorporates amendments that Ofcom intends to submit to the Secretary of State, but which are not in force. For the current version of the Codes of Practice, see here]

Contents¶

1. Introduction ........................................................................................................................ 4 The Protection of Children Code of Practice for user-to-user services .......................................... 4 The recommended measures ......................................................................................................... 4 Data protection ............................................................................................................................... 5 2. Application and scope ........................................................................................................ 6 3. Index of recommended measures ..................................................................................... 8 4. Recommended measures ................................................................................................. 18 A. Governance and accountability ................................................................................................ 18 B. Age assurance ........................................................................................................................... 22 C. Content moderation ................................................................................................................. 30 D. Reporting and complaints ........................................................................................................ 42 E. Recommender systems ............................................................................................................. 51 F. Settings, functionalities and user support ................................................................................ 56 G. Terms of service ...................................................................................................................... 62 H. [Not used] ................................................................................................................................. 64 I. [Not used] .................................................................................................................................. 65 J. User controls ............................................................................................................................. 66 5. Definitions and interpretation ......................................................................................... 72 Risks of harm................................................................................................................................. 89 User numbers ............................................................................................................................... 90 Highly effective age assurance ..................................................................................................... 90 Content prohibited on a service ................................................................................................... 91

Section 1 Introduction¶

The Protection of Children Code of Practice for user-to-user services¶

1.1 Under the Online Safety Act 2023 (the ‘Act’), Ofcom is required to prepare and issue Codes of Practice for providers of Part 3 services, describing measures recommended for the purpose of compliance with specified duties imposed on those providers by the Act.

1.2 This document contains the Code applying to providers of regulated user-to-user services (including providers of combined services, so far as the duties applicable to user-to-user services apply in relation to those services) for the purpose of compliance with the following duties: a) the safety duties protecting children set out in section 12(2) to (14) of the Act; b) the duty about content reporting set out in section 20 of the Act, so far as it relates to content that is harmful to children, present on a part of a service that it is possible for children to access; and c) the duties about complaints procedures set out in section 21 of the Act, so far as relating to the complaints set out in section 21(4)(b)(ii)1 and (5).

1.2 Recommended measures for search services are set out separately in the Protection of Children Code of Practice for search services.

1.3 Over time Ofcom will update the Codes to take account of technological developments, new evidence, and any other relevant matters.

The recommended measures¶

1.4 Section 4 of this document sets out the recommended measures and is divided into subsections by thematic area. The meaning of terms in bold and terms in bold and italics is explained in Section 5.

1.5 The Act provides that service providers which implement measures recommended to them in the Codes will be treated as complying with the relevant duty or duties to which those measures relate. The duties to which each measure relates are set out in the index of recommended measures at Section 3 of this document.

1.6 Where a service provider implements measures recommended to it in these Codes which include safeguards for the protection of freedom of expression and/or for the protection of the privacy of United Kingdom users, the Act provides that they will also be treated as complying with the duties set out in section 22(2) (in respect of freedom of expression) and section 22(3) (in respect of privacy).

1.7 Service providers may seek to comply with a relevant duty in another way by adopting what the Act refers to as alternative measures. In doing so, service providers would also need to

1 So far as relating to content that is harmful to children.

comply with the duty to have particular regard to the importance of protecting United Kingdom users' right to freedom of expression and the privacy of United Kingdom users.

1.8 Where they take alternative measures, service providers must also maintain a record of what they have done and how they consider that it meets the relevant duties, including how they have complied with the duty to have particular regard to the importance of protecting freedom of expression and privacy.

Data protection¶

1.9 Implementing the recommended measures set out in this Code will inevitably involve the processing of personal data. The Information Commissioner’s Office (‘the ICO’) is the statutory regulator for data protection law and has made clear that it expects service providers to comply fully with data protection law when taking measures for the purpose of complying with their online safety duties under the Act.

1.10 The ICO has set out that it expects service providers to take a ‘data protection by design and by default’ approach when implementing online safety systems and processes. It advises service providers to familiarise themselves with the data protection legislation, the ICO’s Children’s code and relevant ICO guidance, including the updated opinion published by the ICO in January 2024 setting out the Commissioner’s expectations for age assurance under the Children’s code, to understand how to comply with the data protection regime.

Section 2 Application and scope¶

2.1 This Code of Practice applies to a provider in respect of the regulated user-to-user service that it provides.

2.2 If a person is the provider of more than one regulated user-to-user service, this Code has effect in relation to each such service (so far as applicable).

2.3 This Code applies regardless of whether or not the provider of the service is inside the United Kingdom.

2.4 The services in respect of which each recommended measure in this Code applies are specified in the “application” section of each measure. An overview can be found in the index of recommended measures in Section 3 of this document.

2.5 Section 5 of this document includes provision about a service’s risk and size. The subsection headed ‘Risks of harm’ (which begins at paragraph 5.3) sets out when a service is at low, medium or high risk of harm arising from a specific kind of content that is harmful to children, and includes a definition of ‘multi-risk (children)’.

2.6 The subsection headed ‘User numbers’ (which begins at paragraph 5.6) explains when a service is to be treated as having more than a particular number of monthly active United Kingdom users for those measures which apply in relation to services of a certain size, and how to calculate the number of monthly active United Kingdom users. The definition of ‘large service’ is included in the definitions section in Section 5 of this document.

2.7 The subsection headed ‘Highly effective age assurance’ (which begins at paragraph 5.10) sets out the criteria that an age assurance process must fulfil in order to be considered “highly effective”.

2.8 The subsection headed ‘Content prohibited on a service’ (which begins at paragraph 5.16) sets out when a kind of content that is harmful to children is to be taken as prohibited on a service or allowed on a service.

2.9 The measures in this Code of Practice are recommended for the purpose of compliance with the safety duties protecting children and the reporting and complaints duties and their scope and application should be construed accordingly. In particular, the recommended measures should be construed in light of sections 8 and 13 of the Act.

2.10 Section 8 provides that: a) the duties set out in Chapter 2 of Part 3 of the Act which must be complied with in relation to a user-to-user service that includes regulated provider pornographic content do not extend to—

i the regulated provider pornographic content, or

ii the design, operation or use of the service so far as relating to that content;

b) the duties set out in Chapter 2 of Part 3 of the Act which must be complied with in relation to a combined service do not extend to:

i the search content of the service,

ii any other content that, following a search request, may be encountered as a result of subsequent interactions with internet services, or

iii anything relating to the design, operation or use of the search engine; and

c) the duties set out in Chapter 2 of Part 3 of the Act which must be complied with in relation to a user-to-user service extend only to:

i the design, operation and use of the service in the United Kingdom, and

ii in the case of a duty that is expressed to apply in relation to users of a service, the design, operation and use of the service as it affects United Kingdom users of the service.

2.11 Section 13 provides that: a) the safety duties protecting children extend only to such parts of a service as it is possible for children to access (and a provider is only entitled to conclude that it is not possible for children in the United Kingdom to access a service, or a part of it, if age verification or age estimation is used on the service with the result that children in the United Kingdom are not normally able to access the service or that part of it); b) so far as a safety duty protecting children relates to non-designated content that is harmful to children, the duty is to be taken to extend only to addressing risks of harm from the kinds of such content that have been identified in the children’s risk assessment (if any have been identified); and c) the duties set out in sections 12(3) and (9) of the Act are to be taken to extend only to content that is harmful to children where the risk of harm is presented by the nature of the content (rather than the fact of its dissemination).

Section 3 Index of recommended measures¶

Recommended measure

Application

Relevant duties

Governance and accountability

PCU A1

Annual review of risk management activities

Services likely to be accessed by children that are a large service.

Section 12(2), (3) and (9) to (14) Section 20(2)* Section 21(2)† and (3)†

PCU A2

Individual

All services likely to be accessed by children.

Section 12(2), (3) and (9) to (14) Section 20(2)* Section 21(2)† and (3)†

accountable for the

safety duties

protecting children

and reporting and

complaints duties

PCU A3

Written statements of responsibilities

Services likely to be accessed by children that are either a large service or multi-risk (children).

Section 12(2), (3) and (9) to (14) Section 20(2)* Section 21(2)† and (3)†

PCU A4

Internal monitoring and assurance

Services likely to be accessed by children that are both a large service and multi-risk (children).

Section 12(2), (3) and

(9) to (14)

Section 20(2)*

Section 21(2)† and (3)†

PCU A5

Tracking evidence of new and increasing harm to children

Services likely to be accessed by children that are either a large service or multi-risk (children).

Section 12(2) and (3)

PCU A6

Code of conduct regarding protection of children from harmful content

Services likely to be accessed by children that are either a large service or multi-risk (children).

Section 12(2), (3) and

(9) to (14)

Section 20(2)*

Section 21(2)† and (3)†

PCU A7

Compliance training

Services likely to be accessed by children that are either a large service or multi-risk (children).

Section 12(2), (3) and (9) to (14) Section 20(2)* Section 21(2)† and (3)†

Recommended measure

Application

Relevant duties

Age assurance

PCU B1

Implementing an age assurance process

Services likely to be accessed by children that use highly effective age assurance to identify which United Kingdom users of the service are child users for the purpose of targeting measures recommended in this Code at such users, their user accounts or their content feeds.

Section 12(2), (3), (4) and (6)

PCU B2

Use of highly

Services likely to be accessed by children where the principal purpose of the service is the hosting or dissemination of one or more kinds of primary priority content.

Section 12(3)(a), (4) and (6)

effective age

assurance – services

where the principal

purpose is the

hosting or

dissemination of

primary priority

content

PCU B3

Use of highly effective age assurance – services where the principal purpose is the hosting or dissemination of priority content

Services likely to be accessed by children where the principal purpose of the service is the hosting or dissemination of one or more kinds of priority content.

Section 12(2), (3)(b) and (7)

PCU B4

Use of highly effective age assurance – services that do not prohibit primary priority content

Services likely to be accessed by

Section 12(2), (3)(a), (4) and (6)

children where (a) Recommendation

PCU B2 does not apply to the service

and (b) one or more specific kinds of

primary priority content are allowed

on the service or all kinds of primary

priority content are prohibited on the

service, but it is not currently

technically feasible to take down all

regulated user-generated content the

provider determines is in breach of its

Recommended measure

Application

Relevant duties

PCU B5

Use of highly effective age assurance – services that do not prohibit priority content

Services likely to be accessed by children where (a) Recommendation PCU B3 does not apply to the service and (b) the service is at medium or high risk of one or more specific kinds of priority content and either one or more of those kinds of content is allowed on the service or each of those kinds of content is prohibited on the service, but it is not currently technically feasible to take down all such content when the provider determines it to be in breach of its terms of service.

Section 12(2), (3)(b) and (7)

PCU B6

Use of highly

Services likely to be accessed by children that are (a) at medium or high risk of one or more specific kinds of primary priority content which are allowed on the service, and (b) where a child-accessible part of the service has a content recommender system.

Section 12(2), (3)(a), (4) and (6)

effective age

assurance – services

with a content

recommender

system that pose a

risk of primary

priority content

PCU B7

Use of highly effective age assurance – services with a content recommender system that pose a risk of priority content or non-designated content

Services likely to be accessed by children that are (a) at medium or high risk of one or more specific kinds of priority content, other than bullying content, which are allowed on the service or one or more specific identified kinds of non-designated content which are allowed on the service, and (b) where a child-accessible part of the service has a content recommender system.

Section 12(2), (3)(b), and (7)

Content moderation

PCU C1

Having a content moderation function to review and assess suspected content that is harmful to children

All services likely to be accessed by children.

Section 12(2), (3) and (10) Section 21(2)(b)†

Recommended measure

Application

Relevant duties

PCU C2

Having a content

All services likely to be accessed by children.

Section 12(2), (3), (4), (6), (7) and (10) Section 21(2)(b)†

moderation function

that allows for swift

action against

content harmful to

children

PCU C3

Setting internal content policies

Services likely to be accessed by children that are either a large service or multi-risk (children).

Section 12(2) and (3)

PCU C4

Performance targets

Services likely to be accessed by

Section 12(2) and (3)

children that are either a large service

or multi-risk (children).

PCU C5

Prioritisation

Services likely to be accessed by children that are either a large service or multi-risk (children).

Section 12(2) and (3)

PCU C6

Resourcing

Services likely to be accessed by

Section 12(2) and (3)

children that are either a large service

or multi-risk (children).

PCU C7

Provision of training and materials to individuals working in content moderation (non-volunteers)

Services likely to be accessed by children that are either a large service or multi-risk (children).

Section 12(2) and (3)

PCU C8

Provision of

Services likely to be accessed by

Section 12(2) and (3)

materials to

children that are either a large service

volunteers

or multi-risk (children).

PCU C9

[Not used]

PCU C10

[Not used]

Recommended measure

Application

Relevant duties

PCU C112

Crisis response

Services likely to be accessed by children that are either (a) a large service at medium risk of one or more specified kinds of content, or (b) a service at high risk of one or more specified kinds of content. The specified kinds of content are: abusive content, content inciting hatred, violent content (instructions for an act of serious violence against a person), and violent content (person).

Section 12(2) and 12(3)

PCU C12

Crisis response (dedicated channel for law enforcement)

Services likely to be accessed by

Section 12(2) and 12(3)

children that are a large service at

medium or high risk of one or more

specified kinds of content.

The specified kinds of content are:

abusive content, content inciting

hatred, violent content (instructions

for an act of serious violence against

a person), and violent content

(person).

Reporting and complaints

PCU D1

Enabling complaints

All services likely to be accessed by children.

Section 20(2)*

Section 21(2)(a)†

PCU D2

Having easy to find, easy to access and easy to use complaints systems and processes

All services likely to be accessed by children.

Section 20(2)* Section 21(2)(c)†

PCU D3

Provision of information prior to the submission of a complaint

Services likely to be accessed by

Section 21(2)(c)†

children that are either a large service

or at medium or high risk of any

specific kind of content that is

harmful to children.

Recommended measure

Application

Relevant duties

PCU D4

Appropriate action – sending indicative timeframes

Services likely to be accessed by children that are either a large service or at medium or high risk of any specific kind of content that is harmful to children.

Section 21(2)(b)† and (c)†

PCU D5

Appropriate action –

Services likely to be accessed by

Section 21(2)(b)† and (c)†

sending further

children that are either a large service

information about

or at medium or high risk of any

how the complaint

specific kind of content that is

will be handled

harmful to children.

PCU D6

Opt-out from communications following a complaint

Services likely to be accessed by children that are either a large service or at medium or high risk of any specific kind of content that is harmful to children.

Section 21(2)(b)†

PCU D7

Appropriate action

All services likely to be accessed by children.

Section 12(3) Section 21(2)(b)†

for relevant

complaints about

content considered

harmful to children

PCU D8

Appropriate action for content appeals – determination (services that are large or multi-risk)

Services likely to be accessed by children that are either a large service or multi-risk (children).

Section 21(2)(b)†

PCU D9

Appropriate action

Services likely to be accessed by children that are neither a large service nor multi-risk (children).

Section 21(2)(b)†

for content appeals –

determination

(services that are

neither large nor

multi-risk)

PCU D10

Appropriate action for content appeals – action following determination

All services likely to be accessed by children.

Section 21(2)(b)†

PCU D11

Appropriate action

Services likely to be accessed by children that are either a large service or multi-risk (children).

Section 21(2)(b)†

for age assessment

appeals (services that

are large or multi-

risk)

Recommended measure

Application

Relevant duties

PCU D12

Appropriate action for age assessment appeals (services that are neither large nor multi-risk)

Services likely to be accessed by children that are neither a large service nor multi-risk (children).

Section 21(2)(b)†

PCU D13

Appropriate action

All services likely to be accessed by children.

Section 21(2)(b)†

for complaints about

non-compliance with

certain duties

PCU D14

Exception: manifestly unfounded complaints

All services likely to be accessed by children.

Section 21(2)(b)†

Recommender systems

PCU E1

Content recommender systems: excluding potential primary priority content

Services likely to be accessed by children (a) that are at medium or high risk of one or more specific kinds of primary priority content and (b) where a child-accessible part of the service has a content recommender system.

Section 12(2), (3)(a), (4) and (6)

PCU E2

Content recommender systems: excluding or giving a low degree of prominence to potential primary content and non-designated content

Services likely to be accessed by

Section 12(2), (3)(b) and (7)

children (a) that are at medium or

high risk of one or more specific kinds

of priority content, other than

bullying content, or identified kinds

of non-designated content and (b)

where a child-accessible part of the

service has a content recommender

system.

PCU E3

Content recommender systems: enabling children to give negative feedback

Services likely to be accessed by children that are (a) a large service, (b) at medium or high risk of two or more specific kinds of content that is harmful to children, other than bullying content, and where (c) a child-accessible part of the service has a content recommender system.

Section 12(2) and (3)

Recommended measure

Application

Relevant duties

Settings, functionalities and user support

PCU F1

Providing age-appropriate user support materials for children

Services likely to be accessed by children that are multi-risk (children).

Section 12(2) and (3)

PCU F2

Providing

Services likely to be accessed by children that are a large service and multi-risk (children).

Section 12(2) and (3)

information to

children when they

restrict content or

interactions with

other accounts

PCU F3

Signposting children to support when they report harmful content

Services likely to be accessed by

Section 12(2)

children that are at medium or high

risk of bullying content, eating

disorder content, self-harm content

or suicide content.

PCU F4

Signposting children to support when they post harmful content

Services likely to be accessed by

Section 12(2)

children that (a) are a large service,

(b) are at medium or high risk of

bullying content, eating disorder

content, self-harm content or suicide

content, and (c) where a child-

accessible part of the service has

posting content functionality.

PCU F5

Signposting children to support when they search for harmful content

Services likely to be accessed by

Section 12(2)

children that (a) are at medium or

high risk of eating disorder content,

self-harm content or suicide content,

and (b) where a child-accessible part

of the service has a searching content

functionality.

PCU G1

All services likely to be accessed by children.

Section 12(9), (11) and (12) Section 21(3)†

PCU G2

Category 1 services that are likely to be accessed by children.

Section 12(14)

substance (Category

1 services)

Recommended measure

Application

Relevant duties

PCU G3

All services likely to be accessed by children.

Section 12(13)

User controls

PCU J1

User blocking and muting

Services likely to be accessed by children that have user profiles and where a child-accessible part of the service has at least one specified functionality and that are either (a) at high risk of one or more of the specified kinds of content or (b) are at medium risk of one or more of the specified kinds of content and have more than 700,000 monthly active United Kingdom users. The specified kinds of content are: abusive content, bullying content, content inciting hatred, eating disorder content, self-harm content, suicide content, violent content (animal), violent content (instructions for an act of serious violence against a person), and violent content (person).

Section 12(2) and (3)

PCU J2

Disabling comments

Services likely to be accessed by

Section 12(2) and (3)

children that have commenting on

content functionality on a child-

accessible part of the service and that

are either (a) at high risk of one or

Section 4 Recommended measures¶

A Governance and accountability¶

PCU A1 Annual review of risk management activities¶

Application¶

PCU A1.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is a large service.

Recommendation¶

PCU A1.2 The provider’s most senior governance body in relation to the service should carry out and record an annual review of risk management activities having to do with harm to children, including as to risk remaining after the implementation of appropriate Code of Practice measures. The review should include how developing risks are being monitored and managed.

PCU A2 Individual accountable for the safety duties protecting children and reporting and complaints duties¶

Application¶

PCU A2.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides.

Recommendation¶

PCU A2.2 The provider should name an individual accountable to the most senior governance body for compliance with the safety duties protecting children and the reporting and complaints duties.

PCU A2.3 Being accountable means being required to explain and justify actions or decisions regarding:

a harm to children risk management and mitigation (including as to risk remaining after the implementation of appropriate Code of Practice measures), and

b compliance with the relevant duties,

to the most senior governance body.

PCU A3 Written statements of responsibilities¶

Application¶

PCU A3.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both) of the following:

a a large service; or

b multi-risk (children).

Recommendation¶

PCU A3.2 The provider should have written statements of responsibilities for senior managers who make decisions about the management of risks having to do with harm to children.

PCU A3.3 A statement of responsibilities is a document which clearly shows the responsibilities that the senior manager performs in relation to the management of risks having to do with harm to children and how those responsibilities fit in with the provider’s overall governance and management arrangements in relation to the service.

PCU A4 Internal monitoring and assurance¶

Application¶

PCU A4.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is both a large service and multi-risk (children).

Recommendation¶

PCU A4.2 The provider should have an internal monitoring and assurance function to provide independent assurance that measures taken to mitigate and manage the risks of harm to children identified in the children’s risk assessment are effective on an ongoing basis. This function should report to, and its findings should be considered by, either:

a the body that is responsible for overall governance and strategic direction of a service; or

b an audit committee.

PCU A4.3 This independent assurance may be provided by an existing internal audit function.

PCU A5 Tracking evidence of new and increasing harm to children¶

Application¶

PCU A5.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both) of the following:

a a large service; or

b multi-risk (children).

Recommendation¶

PCU A5.2 The provider should track evidence of new kinds of primary priority content or priority content, and unusual increases in particular kinds of content that is harmful to children or content that is harmful to children proxy, on child-accessible parts of the service. Relevant evidence may include, but is not limited to, that derived from:

a complaints processes;

b content moderation processes;

c information that may come to light following an investigation or inquiry by a coroner or procurator fiscal into the death of a child; and

d information from trusted flaggers and any other expert group or body the provider considers appropriate.

PCU A5.3 The provider should ensure that any new kinds of primary priority content or priority content or unusual increases in particular kinds of content that is harmful to children or content that is harmful to children proxy are regularly reported through relevant governance channels to the most senior governance body.

PCU A5.4 To understand this, the provider should establish a baseline understanding of how frequently particular kinds of content that is harmful to children or content that is harmful to children proxy occur on child-accessible parts of the service to the extent possible based on its internal data and evidence. The provider should use this baseline to identify unusual increases in the relevant data.

PCU A6 Code of conduct regarding protection of children from harmful content¶

Application¶

PCU A6.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both) of the following:

a a large service; or

b multi-risk (children).

Recommendation¶

PCU A6.2 The provider should have a code of conduct that sets standards and expectations for individuals working for the provider around protecting children in the United Kingdom from risks of harm to children.

PCU A7 Compliance training¶

Application¶

PCU A7.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both) of the following:

a a large service; or

b multi-risk (children).

Recommendation¶

PCU A7.2 The provider should secure that individuals working for the provider who are involved in the design and operational management of the service are trained in the service’s approach to compliance with the safety duties protecting children and the reporting and complaints duties, sufficiently to give effect to them. This measure does not apply in relation to volunteers.

PCU A7.3 This does not affect Recommendations PCU C7 (provision of training and materials to individuals working in content moderation (non-volunteers)) and PCU C8 (provision of materials to volunteers).

B Age assurance¶

PCU B1 Implementing an age assurance process¶

Application¶

PCU B1.1 This measure applies to a provider in respect of each service likely to be accessed by children that uses highly effective age assurance to identify which United Kingdom users of the service are child users for the purpose of targeting measures recommended in this Code at such users, their user accounts or their content feeds (whether because any of Recommendations B2 to B7 apply to the service or otherwise).

Recommendation¶

PCU B1.2 The provider should have regard to the following when implementing highly effective age assurance on the service:

a the principle that age assurance should be easy to use, including by children in the United Kingdom of different ages and with different needs;

b the principle that age assurance should work effectively for all users regardless of their characteristics or whether they are members of a certain group;

c the desirability of ensuring interoperability between different kinds of age assurance;

d the age appropriate design code and the Information Commissioner’s Opinion titled “Age Assurance for the Children’s code” published on 18 January 2024.3

PCU B1.3 The provider should ensure that users are able to easily access information about what a provider’s highly effective age assurance process is intended to do and how the provider’s highly effective age assurance process works prior to commencing the highly effective age assurance process for the service.

PCU B1.4 The provider should not publish content that directs or encourages United Kingdom users to circumvent the highly effective age assurance process, or content controls or access controls used in conjunction with it, on the service.

3 Information Commissioner's Opinion - Age Assurance for the Children's Code

PCU B2 Use of highly effective age assurance - services where the principal purpose is the hosting or dissemination of primary priority content¶

Application¶

PCU B2.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides where the principal purpose of the service is the hosting or dissemination of one or more kinds of primary priority content.

PCU B2.2 For the purposes of paragraph PCU B2.1, the principal purpose of a service is the hosting or dissemination of one or more kinds of primary priority content if the main activity or objective pursued by the service is the hosting or dissemination of one or more kinds of primary priority content. Factors that are relevant when determining whether the principal purpose of a service is the hosting or dissemination of one or more kinds of priority content include, but are not limited to:

a whether the service promotes one or more kinds of primary priority content;

b the types of regulated user-generated content on the service;

c how regulated user-generated content on the service is presented and described; and

d the extent to which the service provides access to regulated user-generated content other than primary priority content.

Recommendation¶

PCU B2.3 The provider should use highly effective age assurance to target access controls to prevent all United Kingdom users of the service from accessing any user-to-user part of the service unless they have been determined to be an adult by the use of highly effective age assurance.

PCU B2.4 The provider should have systems and processes which enable a United Kingdom user who is unable to access the service, or parts of it, because the age assurance process used to comply with PCU B2.3 has determined them to be a child user, to request that this decision be rectified where it is incorrect. The provider should deal with any such requests promptly.

Safeguards for freedom of expression and privacy¶

PCU B2.5 The following measures are safeguards to protect United Kingdom users' right to freedom of expression and the privacy of United Kingdom users:

a Recommendation PCU B1 (implementing an age assurance process); and

b PCU B2.4.

PCU B3 Use of highly effective age assurance - services where the principal purpose is the hosting or dissemination of priority content¶

Application¶

PCU B3.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides where the principal purpose of the service is the hosting or dissemination of one or more kinds of priority content.

PCU B3.2 For the purposes of PCU B3.1, the principal purpose of a service is the hosting or dissemination of one or more kinds of priority content if the main activity or objective pursued by the service is the hosting or dissemination of one or more kinds of priority content. Factors that are relevant when determining whether the principal purpose of a service is the hosting or dissemination of one or more kinds of priority content include, but are not limited to:

a whether the service promotes one or more kinds of priority content;

b the types of regulated user-generated content on the service;

c how regulated user-generated content on the service is presented and described; and

d the extent to which the service provides access to regulated user-generated content other than priority content.

Recommendation¶

PCU B3.3 The provider should use highly effective age assurance to target access controls to prevent all United Kingdom users of the service from accessing any user-to-user part of the service unless they have been determined to be an adult by the use of highly effective age assurance.

PCU B3.4 The provider should have systems and processes which enable a United Kingdom user who is unable to access the service, or parts of it, because the age assurance process used to comply with PCU B3.3 has determined them to be a child user, to request that this decision be rectified where it is incorrect. The provider should deal with any such requests promptly.

Safeguards for freedom of expression and privacy¶

PCU B3.5 The following measures are safeguards to protect United Kingdom users' right to freedom of expression and the privacy of United Kingdom users:

a Recommendation PCU B1 (implementing an age assurance process);

b PCU B3.4.

PCU B4 Use of highly effective age assurance - services that do not prohibit primary priority content¶

Application¶

PCU B4.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides where:

a Recommendation PCU B2 does not apply to the service; and

b either:

i one or more specific kinds of primary priority content are allowed on the service; or

ii all kinds of primary priority content are prohibited on the service, but it is not currently technically feasible to take down all regulated user-generated content the provider determines is in breach of its terms of service pursuant to PCU C1.3(a).

Recommendation¶

PCU B4.2 For the purpose of targeting content controls or access controls recommended by PCU C2.3(b) and PCU C2.4 at children, the provider should use highly effective age assurance to determine whether or not United Kingdom users of any child-accessible part of the service are children. (But see PCU C2.3(b), PCU C2.4 and PCU C2.12 in relation to where it is not technically feasible to apply HEAA content controls or HEAA access controls.)

PCU B4.3 The age assurance process referred to in PCU B4.2 can be carried out:

a in respect of all United Kingdom users of those parts of the service; or

b in respect of only such of those users as do not wish for appropriate moderation action for primary priority content to restrict their access to content,

so that (in either case) appropriate moderation action for primary priority content does not restrict the access to content of those users determined to be adults.

Safeguards for freedom of expression and privacy¶

PCU B4.4 The following measures are safeguards to protect United Kingdom users' right to freedom of expression and the privacy of United Kingdom users:

a Recommendation PCU B1 (implementing an age assurance process);

b where they are applicable, Recommendations PCU C3, PCU C4, PCU C6, PCU C7 and PCU C8 (in relation to content moderation);

c Recommendations PCU D1 and PCU D2, so far as they relate to content appeals, PCU D8 or PCU D9 (whichever is applicable) and PCU D10; and

d Recommendations PCU D1 and PCU D2, so far as they relate to age assessment appeals, and PCU D11 or PCU D12 (whichever is applicable).

PCU B5 Use of highly effective age assurance – services that do not prohibit priority content¶

Application¶

PCU B5.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides where:

a Recommendation PCU B3 does not apply to the service; and

b the service is at medium or high risk of one or more specific kinds of priority content and either:

i one or more of those kinds of content is allowed on the service; or

ii each of those kinds of content is prohibited on the service, but it is not currently technically feasible to take down all such content when the provider determines it to be in breach of its terms of service in accordance with PCU C1.4(a).

Recommendation¶

PCU B5.2 For the purpose of targeting control controls or access controls recommended by PCU C2.6(b) and PCU C2.7 at children, the provider should use highly effective age assurance to determine whether or not United Kingdom users of any child-accessible part of the service are children. (But see PCU C2.6(b), PCU C2.7 and PCU C2.12 in relation to where it is not technically feasible to apply HEAA content controls, or either not technically feasible or not considered proportionate to apply HEAA access controls.)

PCU B5.3 The age assurance process referred to in PCU B5.2 can be carried out:

a in respect of all United Kingdom users of those parts of the service; or

b in respect of only such of those users as do not wish for appropriate moderation action for priority content to restrict their access to content.

so that (in either case) appropriate moderation action for priority content does not restrict the access to content of those users determined to be adults.

Safeguards for freedom of expression and privacy¶

PCU B5.4 The following measures are safeguards to protect United Kingdom users' right to freedom of expression and the privacy of United Kingdom users:

a Recommendation PCU B1 (implementing an age assurance process);

b where they are applicable, Recommendations PCU C3, PCU C4, PCU C6, PCU C7 and PCU C8 (in relation to content moderation);

c Recommendations PCU D1 and PCU D2, so far as they relate to content appeals, PCU D8 or PCU D9 (whichever is applicable) and PCU D10; and

d Recommendations PCU D1 and PCU D2, so far as they relate to age assessment appeals, and PCU D11 or PCU D12 (whichever is applicable).

PCU B6 Use of highly effective age assurance - services with a content recommender system that pose a risk of primary priority content¶

Application¶

PCU B6.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that meets both of the following conditions:

a the service is at medium or high risk of one or more specific kinds of primary priority content which are allowed on the service;

b a child-accessible part of the service has a content recommender system.

Recommendation¶

PCU B6.2 For the purpose of excluding content indicated potentially to be primary priority content from children’s content feeds in accordance with Recommendation PCU E1, the provider should use highly effective age assurance to determine whether or not United Kingdom users of any child-accessible part of the service which has a content recommender system are children.

PCU B6.3 The age assurance process referred to in PCU B6.2 can be carried out:

a in respect of all United Kingdom users of that part of the service; or

b in respect of only such of those users who do not wish for content indicated potentially to be primary priority content to be excluded from their content feeds,

so that (in either case) content indicated potentially to be primary priority content is not excluded from the content feeds of those users determined to be adults.

Safeguards for freedom of expression and privacy¶

PCU B6.4 The following measures are safeguards to protect United Kingdom users' right to freedom of expression and the privacy of United Kingdom users:

a Recommendation PCU B1 (implementing an age assurance process);

b Recommendations PCU C1 and PCU C2, and PCU C3 to PCU C8 (where applicable);

c Recommendations PCU D1 and PCU D2, so far as they relate to age assessment appeals, and PCU D11 or PCU D12 (whichever is applicable);

d Recommendations ICU D1 and ICU D2, so far as they relate to complaints by United Kingdom users and affected persons if they consider that the provider is not complying with its duties in relation to freedom of expression or privacy, and ICU D12, in the Illegal content Codes of Practice for user-to-user services.

PCU B7 Use of highly effective age assurance - services with a content recommender system that pose a risk of priority content or non-designated content¶

Application¶

PCU B7.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that meets both of the following conditions:

a the service is at medium or high risk of:

i one or more specific kinds of priority content, other than bullying content, which are allowed on the service; or

ii one or more specific identified kinds of non-designated content which are allowed on the service; and

b a child-accessible part of the service has a content recommender system.

Recommendation¶

PCU B7.2 For the purpose of excluding content indicated potentially to be either priority content or an identified kind of non-designated content from children’s content feeds, or giving such content a low degree of prominence, in accordance with Recommendation PCU E2, the provider should use highly effective age assurance to determine whether or not United Kingdom users of any child-accessible part of the service which has a content recommender system are children.

PCU B7.3 The age assurance process referred to in PCU B7.2 can be carried out:

a in respect of all United Kingdom users of that part of the service; or

b in respect of only such of those users who do not wish for content indicated potentially to be either priority content or an identified kind of non-designated content to be excluded from their content feeds,

so that (in either case) content indicated potentially to be either priority content or an identified kind of non-designated content is not excluded from the content feeds of those users determined to be adults.

Safeguards for freedom of expression and privacy¶

PCU B7.4 The following measures are safeguards to protect United Kingdom users' right to freedom of expression and the privacy of United Kingdom users:

a Recommendation PCU B1 (implementing an age assurance process);

b Recommendations PCU C1 and PCU C2, and PCU C3 to PCU C8 (where applicable);

c Recommendations PCU D1 and PCU D2, so far as they relate to age assessment appeals, and PCU D11 or PCU D12 (whichever is applicable);

C Content moderation¶

PCU C1 Having a content moderation function to review and assess suspected content that is harmful to children¶

Application¶

PCU C1.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides.

Recommendation¶

PCU C1.2 The provider should, as part of its content moderation function, have systems and processes designed to review and assess content present on a child-accessible part of the service that the provider has reason to suspect may be relevant content that is harmful to children.

PCU C1.3 For the purpose of PCU C1.2, when the provider has reason to suspect that the content may be relevant primary priority content, the provider should review the content and either:

a where the provider is satisfied that its terms of service prohibit the kind of relevant primary priority content which it has reason to suspect exists, consider whether the content is in breach of those terms of service;

b otherwise, determine, on the basis of all relevant information that is reasonably available to the provider, whether the content is relevant primary priority content.

PCU C1.4 For the purpose of PCU C1.2, when the provider has reason to suspect that the content may be relevant priority content, the provider should review the content and either:

a where the provider is satisfied that its terms of service prohibit the kind of relevant priority content which it has reason to suspect exists, consider whether the content is in breach of those terms of service;

b otherwise determine, on the basis of all relevant information that is reasonably available to the provider, whether the content is relevant priority content.

PCU C1.5 For the purpose of PCU C1.2, when the provider has reason to suspect that the content may be relevant non-designated content the provider should review the content and either:

a where the provider is satisfied that its terms of service prohibit the kind of relevant non-designated content which it has reason to suspect exists, consider whether the content is in breach of those terms of service;

b otherwise determine, on the basis of all relevant information that is reasonably available to the provider, whether the content is relevant non-designated content.

Safeguards for freedom of expression and privacy¶

PCU C1.6 The following measures are safeguards to protect United Kingdom users' right to freedom of expression and the privacy of United Kingdom users:

a where they are applicable, Recommendations PCU C3, PCU C4, PCU C6, PCU C7 and PCU C8 (in relation to content moderation);

b Recommendations PCU D1 and PCU D2, so far as they relate to content appeals, PCU D8 or PCU D9 (whichever is applicable) and PCU D10; and

c Recommendations ICU D1 and ICU D2, so far as they relate to complaints by United Kingdom users and affected persons if they consider that the provider is not complying with its duties in relation to freedom of expression or privacy, and ICU D12, in the Illegal content Codes of Practice for user-to-user services.

PCU C2 Having a content moderation function that allows for swift action against content harmful to children¶

Application¶

PCU C2.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides.

Recommendation¶

PCU C2.2 The provider should, as part of its content moderation function, have systems and processes designed to:

a prevent child users from encountering relevant primary priority content and primary priority content proxy; and

b protect child users from encountering relevant priority content and priority content proxy; and

c protect child users from encountering relevant non-designated content and non-designated content proxy,

of which it is aware (see also PCU C1.2).

Primary priority content¶

PCU C2.3 When the provider determines that content is in breach of its terms of service (pursuant to PCU C1.3(a)) the provider should:

a swiftly take down the content; or

b where it is not currently technically feasible to take down the content, take appropriate moderation action for primary priority content, unless it is not currently technically feasible to apply HEAA content controls or HEAA access controls.

PCU C2.4 When the provider determines that the content is relevant primary priority content (pursuant to PCU C1.3(b)), the provider should take appropriate moderation action for primary priority content, unless it is not currently technically feasible to apply HEAA content controls or HEAA access controls.

PCU C2.5 Appropriate moderation action for primary priority content means swiftly applying HEAA content controls or HEAA access controls.

Priority content¶

PCU C2.6 When the provider determines that the content is in breach of its terms of service (pursuant to PCU C1.4(a)) the provider should:

a swiftly take down the content; or

b where it is not currently technically feasible to take down the content, swiftly take appropriate moderation action for priority content, unless:

i in relation to a service to which Recommendation PCU B5 applies it is not currently technically feasible to apply HEAA content controls or other content level actions and it is either not currently technically feasible to apply HEAA access controls, or the provider does not consider it proportionate to apply HEAA access controls; or

ii in all other circumstances, it is not currently technically feasible to apply other content level actions.

PCU C2.7 When (pursuant to PCU C1.4(b)) the provider determines that the content is relevant priority content, the provider should take appropriate moderation action for priority content, unless:

a in relation to a service to which Recommendation PCU B5 applies it is not currently technically feasible to apply HEAA content controls or other content level actions and it is either not currently technically feasible to apply HEAA access controls, or the provider does not consider it proportionate to apply HEAA access controls; or

b in all other circumstances, it is not currently technically feasible to apply other content level actions.

PCU C2.8 Appropriate moderation action for priority content means:

a in relation to a service to which Recommendation PCU B5 applies, swiftly applying HEAA content controls, other content level actions or HEAA access controls; and

b otherwise, swiftly applying other content level actions (or, where the provider chooses to do so, HEAA content controls or HEAA access controls instead of or as well as other content level actions).

Non-designated content¶

PCU C2.9 When the provider determines that the content is in breach of its terms of service (pursuant to PCU C1.5(a)) the provider should:

a swiftly take down the content; or

b where it is not currently technically feasible to take down the content, the provider should take appropriate moderation action for non-designated content, unless it is not currently technically feasible to apply other content level actions.

PCU C2.10 When (pursuant to PCU C1.5(b)) the provider determines that the content is relevant non-designated content, the provider should take appropriate moderation action for non-designated content unless it is not currently technically feasible to apply other content level actions.

PCU C2.11 Appropriate moderation action for non-designated content means swiftly applying other content level actions (or, where the provider chooses to do so, HEAA content controls or HEAA access controls instead of or as well as other content level actions).

PCU C2.12 If, in designing the systems and processes referred to in PCU C2.2, the provider concludes that:

a it is not currently technically feasible to apply one or more of HEAA content controls, HEAA access controls or other content level actions (either in specific circumstances or at all); or

b in relation to relevant priority content, it is not proportionate to apply HEAA access controls (either in specific circumstances or at all),

the provider should make and keep a written record of how technical feasibility and/or proportionality (as applicable) has been assessed and the reasons for reaching that conclusion.

PCU C2.13 In designing the systems and processes referred to in PCU C2.2(b) and (c) and in particular the aspects of those systems and processes relating to:

a whether to apply HEAA content controls, other content level actions or HEAA access controls, as applicable (in circumstances where it is technically feasible to apply one or more of these); and

b what type(s) of other content level action to take (if any);

the provider should have regard to at least the following factors:

i the findings of the service’s children’s risk assessment as to risk of harm to children in different age groups from particular kinds of priority content and non-designated content;

ii the nature of the content concerned;

iii the severity of potential harm to child users that may arise if they encounter the content concerned;

iv the extent to which other relevant priority content, priority content proxy, relevant non-designated content and non-designated content proxy has been found to be present on the same part of the service; and

v the interests of children in the United Kingdom in receiving content that is not harmful to them by means of the service.

Safeguards for freedom of expression and privacy¶

PCU C2.14 The following measures are safeguards to protect United Kingdom users' right to freedom of expression and the privacy of United Kingdom users:

a where they are applicable, Recommendations PCU C3, PCU C4, PCU C6, PCU C7 and PCU C8 (in relation to content moderation);

b Recommendations PCU D1 and PCU D2, so far as they relate to content appeals, PCU D8 or PCU D9 (whichever is applicable) and PCU D10;

c Recommendations PCU D1 and PCU D2, so far as they relate to age assessment appeals, and PCU D11 or PCU D12 (whichever is applicable); and

freedom of expression or privacy, and ICU D12, in the Illegal content Codes of Practice for user-to-user services.

PCU C3 Setting internal content policies¶

Application¶

PCU C3.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both) of the following:

a a large service; or

b multi-risk (children).

Recommendation¶

PCU C3.2 The provider should set and record (but need not publish) internal content policies setting out rules, standards and guidelines around:

a how relevant content that is harmful to children is to be dealt with on the service, including whether or not any kinds of content that is harmful to children are or are not allowed on the service or certain parts of it; and

b how policies should be operationalised and enforced.

PCU C3.3 The policies should be drafted in such a way that moderation action is taken in accordance with Recommendation PCU C2 (having a content moderation function that allows for swift action against content harmful to children).

PCU C3.4 The provider should:

a have regard to the service’s children’s risk assessment (including, in so far as relevant, its findings as to harm to children in different age groups) in setting these policies; and

b have processes in place for updating these policies in response to evidence of new and increasing harm to children on the service (as tracked in accordance with PCU A5.2).

PCU C4 Performance targets¶

Application¶

PCU C4.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both):

a a large service; or

b multi-risk (children).

Recommendation¶

PCU C4.2 The provider should set and record performance targets for its content moderation function covering at least:

a the time period for taking relevant content moderation action; and

b the accuracy of decision making.

PCU C4.3 In setting its targets, the provider should balance the need to take relevant content moderation action swiftly against the importance of making accurate moderation decisions.

PCU C4.4 The provider should effectively measure and monitor its performance against those targets.

PCU C4.5 For the purpose of PCU C4.2 and PCU C4.3, “relevant content moderation action” refers to the action recommended in PCU C1.3 to PCU C1.5 and PCU C2.3 to PCU C2.11.

PCU C5 Prioritisation¶

Application¶

PCU C5.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both):

a a large service; or

b multi-risk (children).

Recommendation¶

PCU C5.2 The provider should prepare and apply a policy in respect of the prioritisation of content present on the service for review. In setting the policy, the provider should have regard to at least the following:

a the desirability of minimising the number child users encountering a particular item of relevant content that is harmful to children;

b the severity of potential harm to child users if they encounter relevant content that is harmful to children on the service, including whether the content is suspected to be relevant primary priority content, relevant priority content or relevant non-designated content, and taking into account the children’s risk assessment of the service; and

c the likelihood that the content is relevant content that is harmful to children, including whether it has been reported by a trusted flagger.

PCU C6 Resourcing¶

Application¶

PCU C6.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both):

a a large service; or

b multi-risk (children).

Recommendation¶

PCU C6.2 The provider should resource its content moderation function so as to give effect to its internal content policies and performance targets having regard to at least:

a the propensity for external events to lead to a significant increase in demand for content moderation on the service; and

b the particular needs of its United Kingdom user base as identified in its children’s risk assessment, in relation to languages.

PCU C7 Provision of training and materials to individuals working in content moderation (non-volunteers)¶

Application¶

PCU C7.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both):

a a large service; or

b multi-risk (children).

Recommendation¶

PCU C7.2 The provider should ensure individuals working in content moderation receive training and materials that enable them to fulfil their role in moderating content present on a child-accessible part of the service including in relation to Recommendations PCU C1 and PCU C2 and the internal content policies set in accordance with Recommendation PCU C3. This measure does not apply in relation to volunteers.

PCU C7.3 The provider should ensure that in doing so:

a It has regard to at least the service’s children’s risk assessment and evidence of new and increasing harm to children (as tracked in accordance with PCU A5.2); and

b where the provider identifies a gap the understanding of individuals working in content moderation in relation to a specific kind of content that is harmful to children, it gives training and materials to remedy this.

PCU C8 Provision of materials to volunteers¶

Application¶

PCU C8.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both):

a a large service; or

b multi-risk (children).

Recommendation¶

PCU C8.2 The provider should ensure volunteers in its content moderation function have access to materials that enable them fulfil their role in moderating content present on a child-accessible part of the service including in relation to Recommendations PCU C1 and PCU C2 and the internal content policies set in accordance with Recommendation PCU C3.

PCU C8.3 The provider should ensure that in doing so:

a it has regard to at least the service’s children’s risk assessment and evidence of new and increasing harm to children (as tracked in accordance with PCU A5.2); and

b where the provider identifies a gap in such volunteers’ understanding of a specific kind of content that is harmful to children, it gives materials to remedy this.

PCU C9 [Not used]¶

PCU C10 [Not used]¶

PCU C11 Crisis response¶

Application¶

PCU C11.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that meets either of the following conditions:

a the service is a large service at medium risk of one or more of the following kinds of content:

i abusive content;

ii content inciting hatred;

iii violent content (instructions for an act of serious violence against a person);

iv violent content (person); or

b the service is at high risk of one or more of the kinds of content listed in sub-paragraph (a).

Key definitions¶

PCU C11.2 In this Recommendation PCU C11: “crisis” means an extraordinary situation in which there is a serious threat to public safety in the United Kingdom which is highly likely to:

a have resulted (in whole or in part) from a significant increase in relevant harmful content on the service; and/or

b have caused, or cause, a significant increase in relevant harmful content on the service;

“relevant harmful content” means any of the following kinds of content:

a abusive content;

b content inciting hatred;

c violent content (instructions for an act of serious violence against a person);

d violent content (person).

Recommendation¶

PCU C11.3 The provider should prepare and apply (but need not publish) a written internal protocol (“crisis response protocol”) to identify and respond to a crisis, for the purposes of mitigating and managing the risks arising from a significant increase in relevant harmful content on the service during a crisis.

PCU C11.4 The provider’s crisis response protocol should include, but need not be limited to, the following:

a indicators, identified by the provider, that the provider will consider in determining whether a crisis is occurring or is likely to occur;

b how the provider will regularly monitor the indicators referred to in sub-paragraph (a) to determine whether a crisis is occurring or is likely to occur;

c how the provider will keep the indicators referred to in sub-paragraph (a) under regular review to ensure they remain the relevant indicators to be identified in the crisis response protocol;

d details of a crisis response team, including representatives of sufficient seniority from relevant internal teams, that the provider will deploy if the provider determines that a crisis is occurring or is likely to occur;

e how the provider will deploy the crisis response team referred to in sub-paragraph (d) as soon as reasonably practicable if the provider determines that a crisis is occurring or is likely to occur;

f systems and/or processes, identified by the provider, to mitigate and manage the risks arising from a significant increase in relevant harmful content on the service during a crisis; and

g how the provider will deploy the systems and/or processes referred to in sub-paragraph (f) as soon as reasonably practicable if the provider determines that a crisis is occurring or is likely to occur.

PCU C11.5 If Ofcom gives a public statement notice to the provider by virtue of section 175(3) of the Act, the provider should consider this, in addition to the indicators referred to in PCU C11.4(a), in determining whether a crisis is occurring or is likely to occur.

PCU C11.6 Where the provider determines that any of the indicators referred to in PCU C11.4(a) no longer remain relevant, or where new indicators are identified or existing indicators require updating, it should update its crisis response protocol accordingly.

PCU C11.7 When the provider determines that the crisis has ended, or 90 days after the crisis began, if earlier, the provider should conduct and record (but need not publish) a post-crisis analysis recording key decisions made during the crisis and assessing whether the crisis response protocol remains appropriate for mitigating and managing the risks arising from a significant increase in relevant harmful content on the service during a crisis. The provider should then use the post-crisis analysis to make changes to the crisis response protocol, as needed, to address any identified deficiencies.

Safeguards for freedom of expression and privacy¶

PCU C11.8 The following measures are safeguards to protect United Kingdom users’ right to freedom of expression and the privacy of United Kingdom users:

a where they are applicable, Recommendations PCU C3, PCU C4, PCU C5, PCU C6, PCU C7 and PCU C8;

b Recommendations PCU D1 and PCU D2; and

c Recommendations PCU D8 or PCU D9 (whichever is applicable) and PCU D10.

PCU C12 Crisis response (dedicated channel for law enforcement)¶

Application¶

PCU C12.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is a large service at medium or high risk of one or more of the following kinds of content:

a abusive content;

b content inciting hatred;

c violent content (instructions for an act of serious violence against a person);

d violent content (person).

Key definitions¶

PCU C12.2 In this Recommendation PCU C12: “crisis” means an extraordinary situation in which there is a serious threat to public safety in the United Kingdom which is highly likely to:

a have resulted (in whole or in part) from a significant increase in relevant harmful content on the service; and/or

b have caused, or cause, a significant increase in relevant harmful content on the service;

“relevant harmful content” means any of the following kinds of content:

a abusive content;

b content inciting hatred;

c violent content (instructions for an act of serious violence against a person);

d violent content (person).

Recommendation¶

PCU C12.3 If the provider determines that a crisis is occurring or is likely to occur, it should ensure there is a dedicated channel for law enforcement to contact the provider on matters related to the crisis.

D Reporting and complaints¶

PCU D1 Enabling complaints¶

Application¶

PCU D1.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides.

Recommendation¶

PCU D1.2 The provider should have systems and processes which enable prospective complainants to make each type of relevant complaint in a way which will secure that the provider will take appropriate action in relation to them.

PCU D2 Having easy to find, easy to access and easy to use complaints systems and processes¶

Application¶

PCU D2.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides.

Recommendation¶

PCU D2.2 The systems and processes referred to in PCU D1.2 should be operated to ensure that:

a for relevant complaints regarding a specific piece of content, a reporting function or tool is clearly accessible in relation to that content;

b processes for making other kinds of relevant complaints are easy to find and easily accessible;

c they are designed so that they only include reasonably necessary steps; and

d it is possible when making relevant complaints to give the provider supporting information.

PCU D2.3 In designing the systems and processes referred to in PCU D1.2, including its reporting tool or function, the provider should consider the accessibility needs of its United Kingdom user base having regard to:

a the service’s children’s risk assessment including the groups of children in the United Kingdom identified as using the service;

b other relevant information the provider holds on its United Kingdom user base;

c industry standards and good practice as to the design of the service, to ensure the reporting and complaints process is accessible to disabled people; and

d comprehensibility, based on the likely reading age of the youngest individual permitted to use the service without the consent of a parent or guardian.

PCU D2.4 For the purposes of PCU D2.3, the systems and processes referred to in PCU D1.2 should be designed for the purpose of ensuring usability for those dependent on assistive technologies including:

a keyboard navigation; and

b screen reading technology.

PCU D3 Provision of information prior to the submission of a complaint¶

Application¶

PCU D3.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both) of the following:

a a large service; or

b at medium or high risk of any specific kind of content that is harmful to children.

Recommendation¶

PCU D3.2 The provider should ensure that the reporting function or tool for relevant complaints regarding a specific piece of content enables prospective complainants to easily access information on the following matters prior to the submission of a complaint:

a whether the provider discloses (either routinely, upon request or otherwise) the fact that a complaint relating to a specific piece of content has been submitted to:

i the user that generated, uploaded or shared the content complained about; or

ii any user other than the complainant;

and, if so,

iii the circumstances in which the provider makes the relevant disclosure; and

iv the information disclosed about the complaint and the person that submitted the complaint; and

b the information about the complaint and the complainant that the provider discloses to another user appealing an action taken by the provider in relation to content generated, uploaded or shared by the user.

PCU D4 Appropriate action – sending indicative timeframes¶

Application¶

PCU D4.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both) of the following:

a a large service; or

b at medium or high risk of any specific kind of content that is harmful to children.

Recommendation¶

PCU D4.2 The provider should acknowledge receipt of each relevant complaint and provide the complainant with an indicative timeframe for deciding the complaint.

PCU D4.3 PCU D4.2 does not apply if:

a the provider’s acknowledgement is non-ephemeral; and

b the complainant has opted out from receiving non-ephemeral communications in relation to their relevant complaint.

PCU D5 Appropriate action – sending further information about how the complaint will be handled¶

Application¶

PCU D5.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both) of the following:

a a large service; or

b at medium or high risk of any specific kind of content that is harmful to children.

Recommendation¶

PCU D5.2 In the acknowledgment of receipt of each relevant complaint, referred to in Recommendation PCU D4, the provider should set out:

a the possible outcomes; and

b confirmation of whether the provider will inform the complainant of its decision whether to uphold the complaint and details of any action taken as a result.

PCU D6 Opt-out from communications following a complaint¶

Application¶

PCU D6.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both) of the following:

a a large service; or

b at medium or high risk of any specific kind of content that is harmful to children.

Recommendation¶

PCU D6.2 The provider should enable the complainant to opt out of receiving any non-ephemeral communications in relation to a relevant complaint.

PCU D7 Appropriate action for relevant complaints about content considered harmful to children¶

Application¶

PCU D7.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides.

Recommendation¶

PCU D7.2 When the provider receives a relevant complaint about content present on a child-accessible part of the service which may be content that is harmful to children:

a it should treat the complaint as reason to suspect that the content may be relevant primary priority content or relevant priority content and/or relevant non-designated content (as applicable) and review the content in accordance with PCU C1.3 or PCU C1.4 (as applicable); and

b if Recommendations PCU C4 and PCU C5 are not applicable to the provider, it should consider the complaint promptly.

PCU D7.3 PCU D7.2 does not apply to a complaint identified as manifestly unfounded in accordance with PCU D14.2.

PCU D8 Appropriate action for content appeals – determination (services that are large or multi-risk)¶

Application¶

PCU D8.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both) of the following:

a a large service; or

b multi-risk (children).

Recommendation¶

PCU D8.2 The provider should determine relevant complaints which are content appeals.

PCU D8.3 The provider should, as a minimum, monitor its performance against performance targets relating to the following:

a the time it takes to determine the content appeal; and

b the accuracy of decision making,

and should resource itself so as to give effect to those targets.

PCU D8.4 The provider should have regard to the following matters in determining what priority to give to review of a relevant complaint which is a content appeal:

a the seriousness of the action taken against the user or in relation to the content (or both) to which the content appeal relates;

b whether the decision that the content was content that is harmful to children was made by content identification technology and, if so, any other information available about the accuracy of the content identification technology at identifying similar types of content that is harmful to children; and

c the past error rate on the service in relation to decisions about similar kinds of content that is harmful to children.

PCU D9 Appropriate action for content appeals – determination (services that are neither large nor multi-risk)¶

Application¶

PCU D9.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is neither of the following:

a a large service; or

b multi-risk (children).

Recommendation¶

PCU D9.2 The provider should determine relevant complaints which are content appeals promptly.

PCU D10 Appropriate action for content appeals – action following determination¶

Application¶

PCU D10.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides.

Recommendation¶

PCU D10.2 If, in relation to a relevant complaint that is a content appeal, the provider reverses a decision that content was content that is harmful to children, the provider should:

a so far as appropriate and possible for the purpose of restoring the position of the content or user (or both) to what it would have been had the decision not been made, reverse the action taken against the user or the content (or both) as a result of that decision;

b where there is a pattern or significant evidence of regulated user-generated content being taken down, or access to such content being restricted, in error, adjust any relevant content moderation guidance if appropriate to ensure it is accurate; and

c where possible and appropriate, take steps to secure that the use of automated content moderation technology does not cause the same content to be taken down, or access to it restricted, again.

PCU D11 Appropriate action for age assessment appeals (services that are large or multi-risk)¶

Application¶

PCU D11.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is either (or both) of the following:

a a large service; or

b multi-risk (children).

Recommendation¶

PCU D11.2 The provider should have regard to the following matters in determining what priority to give to consideration of an age assessment appeal:

a the seriousness of the restriction applied to the user’s ability to access content on the service as a result of the assessment of their age;

b whether the decision to restrict access to content on the basis of the user’s age was made without human oversight and, if so, information available about the accuracy of the specific technology used in making age assessments of the type concerned;

c the past error rate on the service in relation to age assessments of the type concerned; and

d any representations made by the user as part of the complaint as to the effect of the decision on their livelihood.

PCU D11.3 The provider should, as a minimum, monitor its performance against performance targets relating to the following:

a the time it takes to determine the age assessment appeal; and

b the accuracy of decision making,

and should resource itself so as to give effect to those targets.

PCU D11.4 If the provider determines that the user’s age was incorrectly assessed, the provider should take any necessary steps to enable the user to access content to which access was restricted as a result of that incorrect assessment (so far as appropriate and possible for the purpose of restoring the position to what it would have been had the assessment been correct).

PCU D11.5 The provider should monitor trends in age assessment appeals to help improve any age assurance process used on the service.

PCU D12 Appropriate action for age assessment appeals (services that are neither large nor multi-risk)¶

Application¶

PCU D12.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is neither a large service nor multi-risk (children).

Recommendation¶

PCU D12.2 The provider should determine age assessment appeals promptly.

PCU D12.3 If the provider determines that the user’s age was incorrectly assessed, the provider should take any necessary steps to enable the user to access content to which access was restricted as a result of that incorrect assessment (so far as appropriate and possible for the purpose of restoring the position to what it would have been had the assessment been correct).

PCU D12.4 The provider should monitor trends in age assessment appeals to help improve any age assurance process used on the service.

PCU D13 Appropriate action for complaints about non-compliance with certain duties¶

Application¶

PCU D13.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides.

Recommendation¶

PCU D13.2 This Recommendation PCU D13 applies to relevant complaints that the provider is not complying with:

a the safety duties protecting children;

b the duty about content reporting set out in section 20 of the Act, so far as it relates to content that is harmful to children present on a child-accessible part of the service.

PCU D13.3 The provider should nominate a responsible individual or a team to ensure that such complaints are directed to an appropriate individual or team to be processed.

PCU D13.4 Relevant complaints should be handled:

a in a way that protects United Kingdom users, including children; and

b within timeframes the provider has determined are appropriate.

PCU D13.5 PCU D13.3 and PCU D13.4 do not apply in relation to complaints identified as manifestly unfounded in accordance with PCU D14.2.

PCU D14 Exception: manifestly unfounded complaints¶

Application¶

PCU D14.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides.

Recommendation¶

PCU D14.2 When the provider receives a relevant complaint that is not a content appeal or an age assessment appeal, it may disregard the complaint only if:

a the provider has prepared and implemented a policy in accordance with PCU D14.3 to PCU D14.6, setting out the information and attributes that indicate a relevant complaint is manifestly unfounded;

b the provider identifies the complaint as manifestly unfounded in accordance with that policy; and

c the provider has in place a process to monitor the degree to which the application of the policy incorrectly identifies complaints which are not manifestly unfounded, and to review the policy in accordance with PCU D14.4 to PCU D14.6.

PCU D14.3 In designing a policy for the purposes of PCU D14.2(a), the provider should have regard to:

a the need to identify manifestly unfounded complaints accurately; and

b the risks posed to (i) particular groups of vulnerable users and (ii) child users, if relevant complaints are incorrectly identified as manifestly unfounded.

PCU D14.4 The provider should, at minimum, carry out an annual review of the policy to ensure it is not incorrectly identifying relevant complaints as manifestly unfounded.

PCU D14.5 If the policy is incorrectly identifying relevant complaints as manifestly unfounded, the provider should make changes to it with a view to ensuring its accuracy.

PCU D14.6 The provider should keep a record of its review process and any changes it has made.

E Recommender systems¶

PCU E1 Content recommender systems: excluding potential primary priority content¶

Application¶

PCU E1.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that meets both of the following conditions:

a the service is at medium or high risk of one or more specific kinds of primary priority content; and

b a child-accessible part of the service has a content recommender system.

Recommendation¶

PCU E1.2 In this Recommendation, “relevant user” means any United Kingdom user of the service, other than any user determined to be an adult by the use of highly effective age assurance (and see Recommendation PCU B6 (use of highly effective age assurance by services with a content recommender system that pose a risk of primary priority content).

PCU E1.3 The provider should ensure that any content recommender system on a child-accessible part of the service is designed and operated so that content indicated potentially to be primary priority content on the basis of relevant available information is excluded from relevant users’ content feeds.

PCU E1.4 For the purposes of PCU E1.3, the provider should:

a identify what relevant available information exists;

b design the content recommender system so as to take appropriate account of that relevant available information; and

c) ensure the content recommender system operates so that content

indicated potentially to be primary priority content is excluded from

relevant users’ content feeds.

PCU E1.5 If the service’s content moderation function reviews content indicated (for the purposes of this Recommendation) potentially to be primary priority content and determines it not to be relevant primary priority content in accordance with PCU C1.3, this Recommendation no longer applies to that content.

PCU E1.6 This Recommendation does not recommend the use of any specific kind of proactive technology, or the use of proactive technology to analyse user-

generated content communicated privately or metadata relating to user-generated content communicated privately.4

Safeguards for freedom of expression and privacy¶

PCU E1.7 The following measures are safeguards to protect United Kingdom users’ right to freedom of expression and the privacy of United Kingdom users:

a Recommendation PCU B6 (use of highly effective age assurance by services with a content recommender system that pose a risk of primary priority content);

b Recommendations PCU C1 and PCU C2, and PCU C3 to PCU C8 (where applicable);

c Recommendations PCU D1 and PCU D2, so far as they relate to age assessment appeals, and PCU D11 or PCU D12 (whichever is applicable);

PCU E2 Content recommender systems: excluding or giving a low degree of prominence to potential priority content and non-designated content¶

Application¶

PCU E2.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that meets both of the following conditions:

a the service is at medium or high risk of one or more specific kinds of priority content, other than bullying content, or identified kinds of non-designated content; and

b a child-accessible part of the service has a content recommender system.

Recommendation¶

PCU E2.2 In this Recommendation, “relevant user” means any United Kingdom user of the service, other than any user determined to be an adult by the use of highly effective age assurance (and see Recommendation PCU B7 (use of highly

4 Ofcom has published guidance on content communicated ‘publicly’ and ‘privately’ under the Online Safety Act.

effective age assurance by services with a content recommender system that pose a risk of priority content or non-designated content).

PCU E2.3 The provider should ensure that any content recommender system on a child-accessible part of the service is designed and operated so that content indicated potentially to be either priority content or an identified kind of non-designated content on the basis of relevant available information is excluded from, or given a low degree of prominence in, relevant users’ content feeds.

PCU E2.4 For the purposes of PCU E2.3, the provider should:

a identify what relevant available information exists;

b design the content recommender system so as to take appropriate account of that relevant available information; and

c) ensure the content recommender system operates so that content

indicated potentially to be either priority content or an identified kind

of non-designated content is excluded from, or given a low degree of

prominence in, relevant users’ content feeds.

In this Recommendation “relevant user” means any United Kingdom user of

the service, other than any user determined to be an adult by the use of highly

effective age assurance.

The provider should ensure that the content recommender system is designed

and operated so as to take account of negative feedback given by a relevant

user for the purpose of reducing the likelihood of that user encountering similar

regulated user-generated content.

PCU E2.5 In designing the systems and processes for the action to be taken by the content recommender system in relation to content indicated potentially to be either priority content or an identified kind of non-designated content, the provider should take account of the service’s children’s risk assessment (including its findings as to risk of harm to children in different age groups).

PCU E2.6 The provider should also ensure that content which the service’s content moderation function has determined to be relevant priority content or relevant non-designated content is excluded from, or given a low degree of prominence in, relevant users’ content feeds.

PCU E2.7 If the service’s content moderation function reviews content indicated (for the purposes of this Recommendation) potentially to be either priority content or an identified kind of non-designated content and determines it not to be relevant priority content or relevant non-designated content in accordance with PCU C1.4 or PCU C1.5, this Recommendation no longer applies to that content.

PCU E2.8 This Recommendation does not recommend the use of any specific kind of proactive technology, or the use of proactive technology to analyse user-generated content communicated privately or metadata relating to user-generated content communicated privately.5

5 Ofcom has published guidance on content communicated ‘publicly’ and ‘privately’ under the Online Safety Act.

Safeguards for freedom of expression and privacy¶

PCU E2.9 The following measures are safeguards to protect United Kingdom users’ right to freedom of expression and the privacy of United Kingdom users:

a Recommendation PCU B7 (use of highly effective age assurance by services with a content recommender system that pose a risk of priority content or non-designated content);

b Recommendations PCU C1 and PCU C2, and PCU C3 to PCU C8 (where applicable);

c Recommendations PCU D1 and PCU D2, so far as they relate to content appeals, PCU D8 or PCU D9 (whichever is applicable) and PCU D10;

d Recommendations PCU D1 and PCU D2, so far as they relate to age assessment appeals, and PCU D11 or PCU D12 (whichever is applicable); and

e Recommendations ICU D1 and ICU D2, so far as they relate to complaints by United Kingdom users and affected persons if they consider that the provider is not complying with its duties in relation to freedom of expression or privacy, and ICU D12, in the Illegal content Codes of Practice for user-to-user services.

PCU E3 Content recommender systems: enabling children to give negative feedback¶

Application¶

PCU E3.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that meets all of the following conditions:

a the service is a large service;

b the service is at medium or high risk of two or more specific kinds of content that is harmful to children, other than bullying content; and

c a child-accessible part of the service has a content recommender system.

Recommendation¶

PCU E3.2

PCU E3.3 The provider should ensure that a feature is included enabling relevant users to give negative feedback on pieces of regulated user-generated content

encountered as a result of the operation of a content recommender system on a child-accessible part of the service.

PCU E3.4 The feature should not make visible to other users of the service:

a the fact that a particular user has given negative feedback on a specific piece of content, or

b the number of times that users have given negative feedback on a specific piece of content.

PCU E3.5 Where a relevant user has given negative feedback on a specific piece of content, that piece of content should be excluded from that user’s content feed.

PCU E3.6

PCU E3.7 This Recommendation does not recommend the use of proactive technology to analyse user-generated content communicated privately, or metadata relating to user-generated content communicated privately.6

Safeguards for freedom of expression and privacy¶

PCU E3.8 Recommendations ICU D1 and ICU D2, so far as they relate to complaints by United Kingdom users and affected persons if they consider that the provider is not complying with its duties in relation to freedom of expression or privacy, and ICU D12 in the Illegal content Codes of Practice for user-to-user services are safeguards to protect United Kingdom users’ right to freedom of expression and the privacy of United Kingdom users.

6 Ofcom has published guidance on content communicated ‘publicly’ and ‘privately’ under the Online Safety Act.

F Settings, functionalities and user support¶

PCU F1 Providing age-appropriate user support materials for children¶

Application¶

PCU F1.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is multi-risk (children).

Recommendation¶

PCU F1.2 The provider should make publicly available (including to United Kingdom users who are not registered to use the service and persons in the United Kingdom who are not users of the service) materials which explain:

a how United Kingdom users or affected persons can report content which they consider to be content that is harmful to children; and

b how to make other kinds of relevant complaints.

PCU F1.3 Where a child-accessible part of the service includes the feature in question, the provider should also make publicly available (including to United Kingdom users who are not registered to use the service and persons in the United Kingdom who are not users of the service) materials which explain:

a how to block or mute other user accounts (and see Recommendation PCU J1);

b how a user can prevent other users from commenting on content which that user has posted (and see Recommendation PCU J2); and

c how to control whether to become part of a group chat (and see Recommendation PCU J3).

PCU F1.4 The materials should in each case include:

a a section aimed at children which includes at least one of the following:

i visual elements;

ii audio-visual elements;

iii interactive elements; and

b a section aimed at the parents or guardians of children.

PCU F1.5 The section of the materials aimed at children should be clear, comprehensible and easy for a child user to understand.

PCU F1.6 The materials should not include any material which would be content that is harmful to children if it were regulated user-generated content in relation to a service.

PCU F1.7 If it is possible to register to use the service, the provider should ensure that the materials are provided to United Kingdom users during the registration process.

PCU F1.8 The provider should ensure that the materials are easy to find on the service.

PCU F2 Providing information to children when they restrict content or interactions with other accounts¶

Application¶

PCU F2.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is both a large service and multi-risk (children).

Recommendation¶

PCU F2.2 In this Recommendation “relevant user” means any United Kingdom user of the service, other than any user determined to be an adult by the use of highly effective age assurance.

PCU F2.3 PCU F2.4 applies when, on a child-accessible part of the service, a relevant user seeks to:

a block, mute, report conduct or take equivalent action against a user or user account;

b use a content restriction tool with an indication that the user considers the content to be content that is harmful to children; or

c report regulated user-generated content using a reporting function or tool.

PCU F2.4 The provider must provide the relevant user with information about:

a the effect of the action, including any types of interaction or access to content that it would restrict;

b in the case of action against a user or user account, whether that user’s user account would be notified; and

c the further options available to limit interaction with another user’s user account or restrict the content they encounter, or otherwise increase their safety.

PCU F2.5 The information should be:

a prominently displayed; and

b clear, comprehensible and easy for a child user to understand.

PCU F3 Signposting children to support when they report harmful content¶

Application¶

PCU F3.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that is at medium or high risk of one or more of the following kinds of content:

a bullying content;

b eating disorder content;

c self-harm content;

d suicide content.

Recommendation¶

PCU F3.2 In this Recommendation: “relevant harmful content” means any of the following kinds of content in respect of which the service is at medium or high risk:

a bullying content;

b eating disorder content;

c self-harm content;

d suicide content;

“relevant user” means any United Kingdom user of the service, other than any user determined to be an adult by the use of highly effective age assurance.

PCU F3.3 PCU F3.4 and F3.5 apply where a relevant user reports regulated user-generated content on the service using a reporting function or tool.

PCU F3.4 Where the provider:

a has a means of identifying that the report relates, or might relate, to a specific kind (or kinds) of relevant harmful content, or

b is otherwise aware that the content reported is or might be relevant harmful content of a specific kind (or kinds),

the provider should signpost that user to appropriate support for that kind (or those kinds) of content as quickly as possible after the report is made.

PCU F3.5 Otherwise, the provider should signpost that user to appropriate support for all kinds of relevant harmful content as quickly as possible after the report is made.

PCU F3.6 Appropriate support for a kind of relevant harmful content is support that:

a can be accessed by children in the United Kingdom;

b is comprehensible and suitable in tone and content for the youngest individual permitted to use the service without the consent of a parent or guardian;

c relates to the harm to children associated with that kind of harmful content; and

d is either produced by, or in consultation with, one or more third party organisations that have expertise relating to that type of harm.

PCU F3.7 Before signposting to support provided by a third party organisation which is not a public body, the provider should have regard to any terms published by the relevant organisation relating to the use of its support, including as to obtaining its consent.

PCU F4 Signposting children to support when they post harmful content¶

Application¶

PCU F4.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that meets all of the following conditions:

a the service is a large service;

b the service is at medium or high risk of one or more of the following kinds of content:

i bullying content;

ii eating disorder content;

iii self-harm content;

iv suicide content;

c a child-accessible part of the service has posting content functionality.

Recommendation¶

PCU F4.2 In this Recommendation: “relevant harmful content” means any of the following kinds of content in respect of which the service is at medium or high risk:

a bullying content;

b eating disorder content;

c self-harm content;

d suicide content;

“relevant user” means any United Kingdom user of the service, other than any user determined to be an adult by the use of highly effective age assurance.

PCU F4.3 Where the provider becomes aware (through their systems and processes) that content posted by a relevant user on a child-accessible part of the service is or might be relevant harmful content of a specific kind (or kinds), the provider should signpost that user to appropriate support for that kind (or those kinds) of content as quickly as possible after becoming so aware.

PCU F4.4 Appropriate support for a kind of relevant harmful content is support that:

a can be accessed by children in the United Kingdom;

b is comprehensible and suitable in tone and content for the youngest individual permitted to use the service without the consent of a parent or guardian;

c relates to the harm to children associated with that kind of harmful content; and

d is either produced by, or in consultation with, one or more third party organisations that have expertise relating to that type of harm.

PCU F4.5 Before signposting to support provided by a third party organisation which is not a public body, the provider should have regard to any terms published by the relevant organisation relating to the use of its support, including as to obtaining its consent.

PCU F5 Signposting children to support when they search for harmful content¶

Application¶

PCU F5.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that meets both of the following conditions:

a the service is at medium or high risk of one or more of the following kinds of content:

i eating disorder content;

ii self-harm content;

iii suicide content; and

b a child-accessible part of the service has a searching content functionality.

Recommendation¶

PCU F5.2 In this Recommendation: “relevant harmful content” means any of the following kinds of content in respect of which the service is at medium or high risk:

a eating disorder content;

b self-harm content;

c suicide content;

“relevant user” means any United Kingdom user of the service, other than any user determined to be an adult by the use of highly effective age assurance.

PCU F5.3 Where the provider becomes aware (through their systems and processes) that a relevant user on a child-accessible part of the service has searched:

a using one or more terms relating to suicide, an act of deliberate self-injury or an eating disorder; or

b for content containing specific, practical or instructive information regarding suicide methods, an act of deliberate self-injury, an eating disorder or behaviours associated with an eating disorder,

the provider should signpost that user to appropriate support for the kind of relevant harmful content to which the search request relates as quickly as possible after becoming so aware.

PCU F5.4 Appropriate support for a kind of relevant harmful content is support that:

a can be accessed by children in the United Kingdom;

b is comprehensible and suitable in tone and content for the youngest individual permitted to use the service without the consent of a parent or guardian;

c relates to the harm to children associated with that kind of harmful content; and

d is either produced by, or in consultation with, one or more third party organisations that have expertise relating to that type of harm.

PCU F5.5 Before signposting to support provided by a third party organisation which is not a public body, the provider should have regard to any terms published by the relevant organisation relating to the use of its support, including as to obtaining its consent.

G Terms of service¶

PCU G1 Terms of service: substance (all services)¶

Application¶

PCU G1.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides.

Recommendation¶

PCU G1.2 The provider should include the following in the terms of service:

a provisions specifying how children in the United Kingdom are to be protected from content that is harmful to children, addressing:

i separately for each kind of primary priority content, how children of any age will be prevented from encountering that kind of content by means of the service;

ii separately for each kind of priority content, how children will be protected (or prevented) from encountering that kind of content by means of the service (including any ways in which that protection differs for children in different age groups); and

iii how children will be protected (or prevented) from encountering identified kinds of non-designated content by means of the service (including any ways in which that protection differs for children in different age groups);

b provisions giving information about any proactive technology used for the purposes of compliance with a safety duty protecting children set out in section 12(2) or (3) of the Act (including the kind of technology, when it is used, and how it works);

c provisions specifying the policies and processes that govern the handling and resolution of relevant complaints;

d provisions specifying details about the operation of any measures which are designed to prevent children in the United Kingdom under a certain age from accessing the whole or a part of the service.

PCU G1.3 The provider should apply the provisions referred to in PCU G1.2(d) consistently.

PCU G2 Terms of service: substance (Category 1 services)¶

Application¶

PCU G2.1 This measure applies to a provider in respect of each Category 1 service that is likely to be accessed by children it provides.

Recommendation¶

PCU G2.2 The provider should summarise the findings of its children’s risk assessment (including as to levels of risk and as to the nature, and severity, of potential harm to children) in the terms of service.

PCU G3 Terms of service: clarity and accessibility¶

Application¶

PCU G3.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides.

Recommendation¶

PCU G3.2 The provider should ensure that the provisions included in the terms of service in accordance with Recommendation PCU G1 are:

a easy to find, such that they are:

i clearly signposted for the general public, regardless of whether they have registered with or are using the service; and

ii locatable within the terms of service;

b laid out and formatted in a way that helps United Kingdom users, including children, read and understand them;

c written to a reading age comprehensible for the youngest individual permitted to use the service without the consent of a parent or guardian; and

d designed for the purposes of ensuring usability for those dependent on assistive technologies, including:

i keyboard navigation; and

ii screen reading technology.

H [Not used]¶

[Intentionally left blank]

I [Not used]¶

[Intentionally left blank]

J User controls¶

PCU J1 User blocking and muting¶

Application¶

PCU J1.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that meets all of the following conditions:

a the service is:

i at high risk of one or more of the kinds of content set out in PCU J1.2; or

ii at medium risk of one or more of the kinds of content set out in PCU J1.2 and has more than 700,000 monthly active United Kingdom users (see paragraphs 5.6 to 5.9);

b the service has user profiles; and

c a child-accessible part of the service has one or more of the following functionalities:

i user connection functionality;

ii posting content functionality;

iii user communication (including but not limited to: (1) direct messaging functionality; and (2) commenting on content functionality).

PCU J1.2 The kinds of content are:

a abusive content;

b bullying content;

c content inciting hatred;

d eating disorder content;

e self-harm content;

f suicide content;

g violent content (animal);

h violent content (instructions for an act of serious violence against a person);

i violent content (person).

Recommendation¶

PCU J1.3 In this Recommendation “relevant user” means any United Kingdom user of the service, other than any user determined to be an adult by the use of highly effective age assurance.

PCU J1.4 PCU J1.5 and PCU J1.7 apply in relation to any child-accessible part of the service which has user connection functionality, posting content functionality or user communication (including but not limited to direct messaging functionality and commenting on content functionality).

PCU J1.5 The provider should make available to all relevant users who are registered to use the service the option to block each of:

a a specific user account, whether or not connected to that relevant user’s user account; and

b where the service has user connection functionality, all user accounts which are not connected to that relevant user’s user account.

PCU J1.6 “Block” means to take action that will result in:

a blocked users being unable to send direct messages from the blocked account to the blocking account;

b blocking users being unable to send direct messages from the blocking account to the blocked account;

c the blocking user being unable to encounter, by means of the blocking account, any content posted on the service using the blocked account (regardless of where on the service it is posted), including but not limited to: (i) reactions to content; and (ii) content posted using the blocked account which is subsequently posted by another user;

d the blocked user being unable to encounter, by means of the blocked account, any content posted on the service using the blocking account (regardless of where on the service it is posted), including but not limited to: (i) reactions to content; and (ii) content posted using the blocking account which is subsequently posted by another user; and

e the blocking account and blocked account, if they were connected, no longer being connected,

and “blocking” is to be read accordingly. “Blocked account” means the user account that action has been taken against.

“Blocking account” means the user account through which the action resulting in blocking has taken place. “Blocked user” means the user operating the blocked account. “Blocking user” means the user operating the blocking account.

PCU J1.7 The provider should make available to all relevant users who are registered to use the service the option to mute other user accounts (whether or not connected to that relevant user’s user account) on the service.

PCU J1.8 “Mute” means to take action that will result in the muting user being unable to encounter any content posted on the service using the muted account, including:

a reactions to content posted using the muted account; and

b content posted using the muted account which is posted by another user,

by means of the muting account, unless the muting user visits the user profile associated with the muted account, in which case the muting user will experience that user profile as if the muted account had not been muted, and “muting” is to be read accordingly. “Muting account” means the user account through which the action resulting in muting has taken place. “Muted account” means the user account that the action has been taken against. “Muted user” means the user operating the muted account. “Muting user” means the user operating the muting account.

PCU J1.9 For the avoidance of doubt:

a save for where muting is reciprocal, muted users should continue to encounter the content posted using the muting account;

b functionality from the muted user’s perspective should continue as if the muting user had not muted the muted account; and

c providers should not at any time notify muted users, or otherwise make them aware, that the muted account has been muted by the muting user.

Muting is reciprocal where a user has through a user account (“A”) muted a user account (“B”), and a user has through user account B also muted user account A.

PCU J2 Disabling comments¶

Application¶

PCU J2.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that meets both of the following conditions:

a the service is:

i at high risk of one or more of the kinds of content set out in PCU J2.2; or

ii at medium risk of one or more of the kinds of content set out in PCU J2.2 and has more than 700,000 monthly active United Kingdom users (see paragraphs 5.6 to 5.95.9); and

b a child-accessible part of the service has commenting on content functionality.

PCU J2.2 The kinds of content are:

a abusive content;

b bullying content;

c content inciting hatred;

d eating disorder content;

e self-harm content;

f suicide content;

g violent content (animal);

h violent content (instructions for an act of serious violence against a person);

i violent content (person).

Recommendation¶

PCU J2.3 In this Recommendation “relevant user” means any United Kingdom user of the service, other than any user determined to be an adult by the use of highly effective age assurance.

PCU J2.4 PCU J2.5 and PCU J2.6 apply in relation to any child-accessible part of the service which has commenting on content functionality.

PCU J2.5 The provider should make available to all relevant users who are registered to use the service a feature which, if used or applied by a relevant user in relation

to a piece of content posted using that user’s user account, will prevent other users of the service from commenting on that content.

PCU J2.6 Relevant users should be able to use or apply the feature referred to in PCU J2.5 when posting content or after having posted content.

PCU J3 Invitations to group chats¶

Application¶

PCU J3.1 This measure applies to a provider in respect of each service likely to be accessed by children it provides that meets both of the following conditions:

a the service is at medium or high risk of one or more of the following kinds of content:

i abusive content;

ii bullying content;

iii content inciting hatred;

iv eating disorder content;

v regulated pornographic content;

vi self-harm content;

vii suicide content;

viii violent content (animal);

ix violent content (instructions for an act of serious violence against a person);

x violent content (person); and

b a child-accessible part of the service has group messaging functionality.

Recommendation¶

PCU J3.2 In this Recommendation: “group chat invitation” means a notification sent to the user account of a relevant user (the “invited user”) informing the invited user that another user (the “inviting user”) has sought to make the invited user part of a particular group chat; “relevant user” means any United Kingdom user of the service, other than any user determined to be an adult by the use of highly effective age assurance.

PCU J3.3 The provider should ensure that a relevant user only becomes part of a group chat on a child-accessible part of the service (including a group chat that the user has previously been part of) once the user has received a group chat invitation and has actively confirmed that they wish to become part of that group chat.

PCU J3.4 A group chat invitation should:

a include any relevant publicly available information about the inviting user and the group chat;

b be laid out and formatted in a way that helps children in the United Kingdom read and understand the information in it; and

c be written to a reading age comprehensible to the youngest individual permitted to use the service without the consent of a parent or guardian.

PCU J3.5 A group chat invitation should not be designed in a way that encourages the invited user to confirm that they wish to become part of the group chat.

PCU J3.6 The provider should ensure that the invited user is given a reasonable period of time after receiving the group chat invitation to decide whether they wish to become part of the relevant group chat (and if so to give that confirmation).

PCU J3.7 The provider should not directly notify the inviting user if the invited user declines to be part of the relevant group chat.

Section 5 Definitions and interpretation¶

5.1 Terms in bold used in this Code have the meanings set out in table A. The meaning given applies even if the term is also used in the Act.

5.2 Terms in bold and italics used in this Code have the same meaning as in the Act. Table B provides a reference to the provision(s) in the Act containing the definition of the relevant term as well as additional notes and references which are intended to assist the reader. In the event of any inconsistency between the Act and the information in table B, the Act should be regarded as authoritative.

Table A - Definitions of terms in bold used in this Code¶

Term

Meaning

Abusive content

The content described in section 62(2) of the Act.

Access control

A means of restricting specific United Kingdom users’ access to any user-to-user part, or all user-to-user parts of a service.

Act

The Online Safety Act 2023 (c.50).

Active United Kingdom user

As defined in paragraph 5.9.

Age appropriate design

The code of practice issued under section 125 of the Data

code

Protection Act 2018 (c. 12) on 12 August 2020.

Age assessment appeal

A complaint by a United Kingdom user who is unable to access content because measures used to comply with a duty set out in section 12(2) or (3) of the Act have resulted in an incorrect assessment of the user’s age.

Age assurance

Age verification and age estimation.

Age assurance process

A system or process designed to determine whether a particular user is, or is not, a child that is comprised of one or more age assurance measures.

Allowed (content)

See the subsection headed ‘Content prohibited on a service’

(which begins at paragraph 5.16).

Appropriate moderation

As defined in PCU C2.11.

action for non-designated

content

Appropriate moderation action for primary priority content

As defined in PCU C2.5.

Term

Meaning

Appropriate moderation

As defined in PCU C2.8.

action for priority content

Block, Blocking

As defined in PCU J1.6.

Blocked account

As defined in PCU J1.6.

Blocked user

As defined in PCU J1.6.

Blocking account

As defined in PCU J1.6.

Blocking user

As defined in PCU J1.6.

Bullying content

The content described in section 62(5) of the Act. See also section 62(12) of the Act.

Challenge age

The estimated age below which further steps will be taken to

estimate or verify the exact age of the user before

determining whether the user is a child as part of a challenge

age approach.

Challenge age approach

An age assurance process comprised of two stages whereby if, at the end of the first stage of process, the estimated age of a user is found to be below a specified age, further steps are taken to estimate or verify the exact age of the user before determining whether the user is a child.

Child user

A United Kingdom user who is under the age of 18.

Child-accessible part (of a service)

A user-to-user part of a service other than any part which children in the United Kingdom are not normally able to access as a result of the use on the service of age verification or age estimation.

Children in the United

People under the age of 18 in the United Kingdom.

Kingdom

Children’s risk assessment

The most recent risk assessment carried out by the provider of a service pursuant to section 11 of the Act.

Comment on content

Reply to user-generated content or generate, upload or share

content in response to another piece of user-generated

content posted on open channels of communication, in such a

way that the reply or content (as the case may be) is visually

accessible directly from the original user-generated content

without navigating away from that user-generated content.

Commenting on content functionality

User-to-user service functionality that allows users to comment on content.

Term

Meaning

Complainant

The United Kingdom user or affected person who made the

complaint.

Connect

See connection.

Connected (accounts)

Two user accounts with a connection.

Connection

An established link between two user accounts that one or both of the users operating those accounts has taken steps to establish. Connections include, but are not limited to: a) established links created when one user invites another user to establish a link between the user accounts of the two users that the other user accepts; b) established links created when one user elects to follow another user’s user account; and c) established links created when one user elects to subscribe to another user’s user account. The terms “connect”, “connected” and “connection” are to be read accordingly.

Content appeal

A complaint by a United Kingdom user about any of the

following actions, if the action concerned has been taken by

the provider on the basis that content generated, uploaded or

shared by the user is content that is harmful to children:

a) the content being taken down,

b) access to the content being restricted;

c) the user being given a warning;

d) the user being suspended, banned, or in any other

way restricted from using the service.

Content control

A means of restricting specific United Kingdom users’ access to a particular piece (or pieces) of regulated user-generated content on a service.

Content inciting hatred

The content described in section 62(3) of the Act.

Content moderation function

The systems and processes designed to review, assess and take action to in relation to content, including content a provider has reason to suspect may be relevant content that is harmful to children.

Term

Meaning

Content posted

Content generated, uploaded and/or shared on open

channels of communication by a user of the service.

“Posting content” and “posted content” are to be read

accordingly.

Content recommender system

An algorithmic system which determines the relative ranking of an identified pool of content that includes regulated user-generated content from multiple users on content feeds. Content is recommended based on factors that it is programmed to account for, which may include but are not limited to: a) user feedback, such as interactions with a piece of content by means of likes, views and shares; b) predicted engagement with content based on a user’s consumption history, such as likelihood of liking, sharing, and commenting on a piece of content; c) profile and contextual characteristics, such as age and location; d) content liked by users with a similar consumption and engagement history; and e) popularity of a certain piece of content. For the avoidance of doubt, references to content recommender systems in this Code do not include: a) a content recommender system employed exclusively in the operation of a functionality which suggests content to users in direct response to a search query; b) a product recommender system; or c) a network recommender system that suggests users and groups to follow.

Content restriction tool

A feature which enables a user to give negative feedback on a

specific piece of content in a manner that is not visible to

other users of the service, and which results in that piece of

content or other pieces of content that share significant

characteristics with it no longer appearing in the user's feed(s)

or being given lower prominence.

Term

Meaning

Content that is harmful to children

a) Primary priority content; b) priority content; or c) content which is an identified kind of non-designated content.

Content that is harmful to

Primary priority content proxy, priority content proxy or

children proxy

non-designated content proxy.

Direct message

A message sent from a user account to a recipient user account that can only be immediately viewed or read on that specific recipient user account.

Direct messaging

User-to-user service functionality that allows users to send

functionality

direct messages.

Eating disorder content

The content described in section 61(5) of the Act.

Governance body

A body which makes decisions within an organisation, for

example a board of directors.

Group chat

A closed channel of communication in which specific user accounts can send and receive group messages.

Group chat invitation

As defined in PCU J3.2.

Group message

A message sent from a user account to more than one recipient user accounts that can only immediately be viewed or read on those user accounts.

Group messaging functionality

User-to-user service functionality that enables a user to send

group messages, through a closed channel of communication,

to more than one recipient at a time and which can be

immediately viewed or read by all recipients.

Harm to children

Harm to children in the United Kingdom presented by content that is harmful to children.

HEAA access controls

Access controls that prevent all United Kingdom users of the

service, other than any user determined to be an adult by the

use of highly effective age assurance, accessing the part of

the service on which the content is located.

HEAA content controls

Content controls that prevent all United Kingdom users of the service, other than any user determined to be an adult by the use of highly effective age assurance, encountering the content.

Highly effective age

See paragraphs 5.10 to 5.15.

assurance

Term

Meaning

Identified kind of non-designated content

A kind of non-designated content that is harmful to children in respect of which the service’s children’s risk assessment has identified a low, medium or high risk of harm to children in the United Kingdom.

Invited user

As defined in PCU J3.2.

Inviting user

As defined in paragraph PCU J3.2.

Large service

A service which has more than 7 million monthly active

United Kingdom users (see paragraphs 5.6 to 5.9).

Multi-risk (children)

See paragraph 5.5.

Mute, muting

As defined in PCU J1.8.

Muted account

As defined in PCU J1.8.

Muted user

As defined in PCU J1.8.

Muting account

As defined in PCU J1.8.

Muting user

As defined in PCU J1.8.

Non-designated content proxy

Content that a provider determines to be in breach of its terms of service, where: a) the provider had reason to suspect that the content may be relevant non-designated content; and b) the provider is satisfied that its terms of service prohibit the type of relevant non-designated content which it had reason to suspect existed.

Table B - Terms used in this Code that have the meaning given in the Act¶

Term

Meaning under the OSA

Adult

Section 236(1)

Affected person

Section 20(5)

Risks of harm¶

Risk of harm¶

5.3 A service is at low, medium or high risk of a specific kind of content that is harmful to children if the service’s children’s risk assessment of the service identified a low, medium or high risk (as the case may be) of harm to children in the United Kingdom presented by that kind of content that is harmful to children.

5.4 A service is also at medium or high risk of a specific kind of content that is harmful to children if, by virtue of a confirmation decision given under section 134 of the Act in relation to a risk of serious harm, the duty set out in section 12(2)(a) of the Act applies in relation to the service as if a risk assessment carried out by the provider pursuant to section 11 of the Act had identified a medium or high risk (as the case may be) of serious harm presented by that kind of content that is harmful to children.

Multi-risk (children)¶

5.5 A service is multi-risk (children) if it is at medium or high risk of two or more specific kinds of content that is harmful to children.

User numbers¶

5.6 This subsection applies for the purpose of determining whether a service has more than a particular number of monthly active United Kingdom users.

5.7 A service has more than a particular number of monthly active United Kingdom users: a) from such time as the average number of monthly active United Kingdom users is more than that number; and b) until such time as the average number of monthly active United Kingdom users has been at or below that number for a continuous period of six months.

5.8 A service’s average number of monthly active United Kingdom users is the mean number of active United Kingdom users per month for: a) the six-month period ending with the month preceding the time in question; or b) where the service has been in operation for less than six months, the period for which the service has been in operation.

5.9 In this subsection, an active United Kingdom user means any United Kingdom user who has accessed the user-to-user part of the service.

Highly effective age assurance¶

5.10 This subsection contains the definition of highly effective age assurance.

5.11 Highly effective age assurance is an age assurance process that fulfils the criteria of technical accuracy, robustness, reliability and fairness.

5.12 The technical accuracy criterion is fulfilled if: a) the provider has ensured that the measures forming part of the age assurance process for the service have been evaluated against appropriate metrics to assess the extent to which they can correctly determine the age or age range of a person under test lab conditions and the results indicate that the measures are able to correctly determine whether or not a particular user is a child; b) where the age assurance process used on the service involves the use of age estimation, the provider uses a challenge age approach; and c) the provider periodically reviews whether the technical accuracy of the age assurance process for the service could be improved by making use of new technology and, where appropriate, makes changes to the age assurance process.

5.13 The robustness criterion is fulfilled if: a) the provider has:

i taken steps to identify methods children use to circumvent the age assurance process used on the service to determine that the relevant individual is not a child; and

ii taken feasible and proportionate steps to prevent children using those methods; and

b) the provider has ensured that the age assurance measures forming part of the age assurance process for the service have been tested in multiple different environments during the development of the age assurance process; and

c) the provider has identified, and taken appropriate steps to mitigate against, methods of circumvention that are easily accessible to children in the United Kingdom and where it is reasonable to assume that children in the United Kingdom may use them.

5.14 The reliability criterion is fulfilled if: a) where age assurance measures forming part of the age assurance process rely on artificial intelligence or machine learning, the provider has taken steps to ensure that:

i the artificial intelligence or machine learning has been suitably tested during the development of the age assurance process to ensure it produces reproducible results;

ii the artificial intelligence or machine learning is regularly tested to ensure it produces reproducible results;

iii the outputs of the artificial intelligence or machine learning used are monitored and assessed against key performance indicators designed to identify whether the artificial intelligence or machine learning produces reproducible results;

iv in circumstances where the artificial intelligence or machine learning used are observed to be producing unreliable or unexpected results, the root cause of the issue is identified and rectified.

b) The provider has taken steps to ensure that any evidence relied upon as part of the age assurance process comes from a trustworthy source.

5.15 The fairness criterion is fulfilled if: a) the provider has ensured that any elements of the age assurance process for a service, which rely on artificial intelligence or machine learning have been tested and trained on data sets which reflect the diversity in the target population; and b) the provider has ensured that any elements of the age assurance process which rely on artificial intelligence or machine learning have been evaluated against the outcome / error parity and the results indicate that the age assurance process does not produce significant bias or discriminatory outcomes.

Content prohibited on a service¶

5.16 A kind of primary priority content that is harmful to children (or relevant primary priority content) is prohibited on a service if the provisions that have been included in the terms of service specify (regardless of the form of words used), for the purpose of compliance with section 12(9) of the Act, that the presence of that kind of content is prohibited on all child-accessible parts of the service for all users of those parts of the service. A kind of primary priority content that is harmful to children (or relevant primary priority content) that is not prohibited on a service is allowed on that service.

5.17 A kind of priority content that is harmful to children (or relevant priority content) is prohibited on a service if the provisions that have been included in the terms of service specify (regardless of the form of words used), for the purpose of compliance with section 12(9) of the Act, that the presence of that kind of content is prohibited on all child-accessible parts of the service for all users of those parts of the service. A kind of priority content that is harmful to children or relevant priority content that is not prohibited on a service is allowed on that service.

5.18 A kind of non-designated content that is harmful to children (or relevant non-designated content) is prohibited on a service if the provisions that have been included in the terms of service specify (regardless of the form of words used), for the purpose of compliance with section 12(9) of the Act, that the presence of that kind of content is prohibited on all child-accessible parts of the service for all users of those parts of the service. A kind of non-designated content that is harmful to children or relevant non-designated content that is not prohibited on a service is allowed on that service.