Illegal content code of practice for search services

[DRAFT]Illegal content Codes of Practice for search services

We are consulting on the amendments shown in red text. Please refer to the Illegal Harms Updates, New priority offences: serious self-harm and cyberflashing consultation (published 24 March 2026) which explains the proposed changes.

For reference, amendments proposed in a previous consultation are also shown in this document in blue text. We have not yet made any final decisions about these amendments, and they are not part of the current consultation. For further information, please see the Additional Safety Measures: Online Safety consultation (published 30 June 2025).

Draft published for consultation: 24 March 2026

Contents¶

1. Introduction .............................................................................................................. 4 The Illegal content Codes of Practice for search services .............................................................. 4 The recommended measures ......................................................................................................... 4 Data protection ............................................................................................................................... 5 2. Application and scope ............................................................................................... 6 3. Index of recommended measures .............................................................................. 7 4. Recommended measures ........................................................................................ 11 A. Governance and accountability ................................................................................................ 11 B. [Not used] ................................................................................................................................. 15 C. Search moderation ................................................................................................................... 16 D. Reporting and complaints ........................................................................................................ 25 E. [Not used] ................................................................................................................................. 34 F. Settings, functionalities and user support ................................................................................ 35 G. Publicly available statements ................................................................................................... 38 5. Definitions and interpretation ................................................................................. 40 Risks of illegal harm ...................................................................................................................... 51 User numbers ............................................................................................................................... 58

Section 1 Introduction¶

The Illegal content Codes of Practice for search services¶

1.1 Under the Online Safety Act 2023 (the ‘Act’), Ofcom is required to prepare and issue Codes of Practice (‘Codes’) for providers of Part 3 services, describing measures recommended for the purpose of compliance with specified duties imposed on those providers by the Act.

1.2 This document contains Codes applying to providers of regulated search services (and to providers of combined services, so far as the duties applicable to search services apply in relation to those services) for the purpose of compliance with the following duties:

a the illegal content safety duties set out in section 27(2) to (9) of the Act;

b the duty about content reporting set out in section 31 of the Act, so far as it relates to illegal content; and

c the duties about complaints procedures set out in section 32 of the Act, so far as relating to the complaints set out in section 32(4).

1.3 Recommended measures for user-to-user services are set out separately in the Illegal content Codes of Practice for user-to-user services.

1.4 The Act requires Ofcom to prepare and issue separate Codes for terrorism (arising from the offences set out in Schedule 5 to the Act) and child sexual exploitation and abuse (‘CSEA’) (arising from the offences set out in Schedule 6 to the Act) and one or more Codes for the purpose of compliance with the relevant duties relating to illegal content and harms (except to the extent measures are included within the Codes for terrorism and CSEA). Many of our recommended measures apply to more than one kind of illegal harm. To minimise duplication and simplify the regime for service providers, we have produced one document containing the Codes for terrorism, CSEA and other duties. We identify the relevant Code(s) for each measure in the index of recommended measures which can be found at Section 3 of this document.

1.5 Over time Ofcom will update the Codes to take account of technological developments, new evidence, and any other relevant matters.

The recommended measures¶

1.6 Section 4 of this document sets out the recommended measures and is divided into subsections by thematic area. The meaning of terms in bold, terms in bold and italics and terms which are underlined is explained in Section 5.

1.7 The Act provides that service providers which implement measures recommended to them in these Codes will be treated as complying with the relevant duty or duties to which those measures relate.

1.8 Where a service provider implements measures recommended to it in these Codes which include safeguards for the protection of freedom of expression and/or for the protection of the privacy of United Kingdom users, the Act provides that they will also be treated as

complying with the duties set out in section 33(2) (in respect of freedom of expression) and section 33(3) (in respect of privacy).

1.9 Service providers may seek to comply with a relevant duty in another way by adopting what the Act refers to as alternative measures. In doing so, service providers would also need to comply with the duty to have particular regard to the importance of protecting United Kingdom users' right to freedom of expression and the privacy of United Kingdom users.

1.10 Where they take alternative measures, service providers must also maintain a record of what they have done and how they consider that it meets the relevant duties, including how they have complied with the duty to have particular regard to the importance of protecting freedom of expression and privacy.

Data protection¶

1.11 Implementing the recommended measures set out in these Codes will inevitably involve the processing of personal data. The Information Commissioner’s Office (‘the ICO’) is the statutory regulator for data protection law and has made clear that it expects service providers to comply fully with data protection law when taking measures for the purpose of complying with their online safety duties under the Act.

1.12 The ICO has set out that it expects service providers to take a ‘data protection by design and by default’ approach when implementing online safety systems and processes. It advises service providers to familiarise themselves with the data protection legislation, the ICO’s Children’s code and relevant ICO guidance, including the updated opinion published by the ICO in January 2024 setting out the Commissioner’s expectations for age assurance under the Children’s code, to understand how to comply with the data protection regime.

Section 2 Application and scope¶

2.1 These Codes apply to a provider in respect of: a) the regulated search service that it provides; or b) the combined service that it provides, to the extent that the duties in section 27, section 31 (so far as it relates to illegal content) and section 32 (so far as relating to the complaints set out in section 32(4)) of the Act) apply in relation to the service by virtue of section 7(6) of the Act.

2.2 If a person is the provider of more than one regulated search service (or combined service) these Codes have effect in relation to each such service (so far as applicable).

2.3 These Codes apply regardless of whether or not the provider of the service is inside the United Kingdom.

2.4 The services in respect of which each recommended measure in these Codes applies are specified in the “application” section of each measure. An overview can be found in the index of recommended measures at Section 3 of this document.

2.5 Section 5 of this document includes provision about a service’s risk and size. The subsection headed ‘Risks of illegal harm’ (which begins at paragraph 5.4) sets out when a service is at medium or high risk of a kind of illegal harm, and includes a definition of a ‘multi-risk service’.

2.6 The subsection headed ‘User numbers’ (which begins at paragraph 5.7) explains when a service is to be treated as having more than a particular number of monthly active United Kingdom users for those measures which apply in relation to services of a certain size, and how to calculate the number of monthly active United Kingdom users. Definitions of ‘large service’ and ‘large general search service’ are included in the definitions section in Section 5 of this document.

2.7 The measures in these Codes are recommended for the purpose of compliance with the illegal content safety duties and the reporting and complaints duties and their scope and application should be construed accordingly. In particular, the recommended measures should be construed in light of section 25(1) of the Act which provides that the duties set out in Chapter 3 of Part 3 of the Act extend only to: a) the search content of the service, b) the design, operation and use of the search engine in the United Kingdom, and c) in the case of a duty that is expressed to apply in relation to users of a service, the design, operation and use of the search engine as it affects United Kingdom users of the service.

Section 3 Index of recommended measures¶

Recommended measure

Application

Code(s)

Relevant duties

Governance and accountability

ICS A1

Annual review of risk management activities

Large general search services.

CSEA Terrorism Other duties

Section 27(2), (3), and (5) to (9) Section 31(2)* Section 32(2)† and (3)†

ICS A2

Individual

All services.

Section 27(2), (3), and (5) to (9) Section 31(2)* Section 32(2)† and (3)†

accountable for

illegal content safety

duties and reporting

and complaints

duties

ICS A3

Written statements of responsibilities

Large general search services or multi-risk services.

Section 27(2), (3), and (5) to (9) Section 31(2)* Section 32(2)† and (3)†

ICS A4

Internal monitoring and assurance

Large services that are multi-risk services.

Section 27(2), (3),

and (5) to (9)

Section 31(2)*

Section 32(2)† and

(3)†

ICS A5

Tracking evidence of new and increasing illegal harm

Large general search services or multi-risk services.

Section 27(2) and (3)

ICS A6

Code of conduct regarding protection of users from illegal harm

Section 27(2), (3),

and (5) to (9)

Section 31(2)*

Section 32(2)† and

(3)†

ICS A7

Compliance training

Section 27(2), (3), and (5) to (9) Section 31(2)* Section 32(2)† and (3)†

Recommended measure

Application

Code(s)

Relevant duties

Search moderation

ICS C1

Having a search moderation function designed to action illegal content

All services.

CSEA Terrorism Other duties

Section 27(2) and (3) Section 32(2)(b)†

ICS C2

Setting internal

Large general search services or multi-risk services.

Section 27(2) and

content policies

(3)

ICS C3

Performance targets

Section 27(2) and (3)

ICS C4

Prioritisation

Section 27(2) and

(3)

ICS C5

Resourcing

Section 27(2) and (3)

ICS C6

Provision of training

Section 27(2) and (3)

and materials to

individuals working

in search moderation

(non-volunteers)

ICS C7

Removing listed CSAM URLs from search results

All general search services.

CSEA

Section 27(2) and (3)

ICS C8

Hash matching for

Large general search services.

Other duties

Section 27(2) and (3)

intimate image abuse

content

Reporting and complaints

ICS D1

Enabling complaints

All services.

CSEA Terrorism Other duties

Section 31(2)*

Section 32(2)(a)†

ICS D2

Having easy to find, easy to access and easy to use complaints systems and processes

All services.

Section 31(2)* Section 32(2)(c)†

ICS D3

Appropriate action -sending indicative timeframes

Large general

Section 32(2)(c)†

search services or

services at

medium or high

risk of any kind of

illegal harm.

Recommended measure

Application

Code(s)

Relevant duties

ICS D4

Appropriate action – sending further information about how the complaint will be handled

Large general search services or services at medium or high risk of any kind of illegal harm, each that are likely to be accessed by children.

CSEA Terrorism Other duties

Section 32(2)(b)† and (c)†

ICS D5

Opt-out from communications following a complaint

Large general

Section 32(2)(b)†

search services or

services at

medium or high

risk of any kind of

illegal harm.

ICS D6

Appropriate action for relevant complaints about suspected illegal content

All services.

Section 27(3) Section 32(2)(b)†

ICS D7

Appropriate action

Large general search services or multi-risk services.

Section 32(2)(b)†

for relevant

complaints which are

appeals –

determination (large

general or multi-risk

services)

ICS D8

Appropriate action for relevant complaints which are appeals – determination (services that are neither large general nor multi-risk)

Services that are neither large general search services nor multi-risk services.

Section 32(2)(b)†

ICS D9

Appropriate action

All services.

Section 32(2)(b)†

for relevant

complaints which are

appeals – action

following

determination

ICS D10

Appropriate action for relevant complaints about proactive technology, which are not appeals

Section 32(2)(b)†

Recommended measure

Application

Code(s)

Relevant duties

ICS D11

Appropriate action

Section 32(2)(b)†

for all other relevant

complaints

ICS D12

Exception: manifestly unfounded complaints

Section 32(2)(b)†

ICS D13

Dedicated reporting channel for trusted flaggers to report fraud

Large general

Other duties

Section 27(3)

search services

that are at

medium or high

risk of fraud.

Settings, functionalities and user support

ICS F1

Reporting and removal of predictive search suggestions

Large general

CSEA Terrorism Other duties

Section 27(2) and (3)

search services

that use a

predictive search

functionality.

ICS F2

Provision of CSAM content warnings

Large general search services.

CSEA

Section 27(2) and (3)

ICS F3

Provision of suicide

Other duties

Section 27(2) and (3)

and self-harm crisis

prevention

information

Publicly available statements

ICS G1

Publicly available

All services.

CSEA Terrorism Other duties

Section 27(5) and (7) Section 32(3)†

statements:

substance (all

services)

ICS G2

Publicly available statements: substance (Category 2A services)

Category 2A services.

Section 27(9)

ICS G3

Publicly available

All services.

Section 27(8) Section 32(3)†

statements: clarity

and accessibility

* So far as it relates to illegal content.

† So far as relating to the complaints set out in section 32(4).

Section 4 Recommended measures¶

A Governance and accountability¶

ICS A1 Annual review of risk management activities¶

Application¶

ICS A1.1 This measure applies to a provider in respect of each large general search service it provides.

Recommendation¶

ICS A1.2 The provider’s most senior governance body in relation to the service should carry out and record an annual review of risk management activities having to do with illegal harm as it relates to individuals in the UK, including in relation to risk that is remaining after the implementation of appropriate Codes of Practice measures. The review should include how developing risks are being monitored and managed.

ICS A2 Individual accountable for illegal content safety duties and reporting and complaints duties¶

Application¶

ICS A2.1 This measure applies to a provider in respect of each service it provides.

Recommendation¶

ICS A2.2 The provider should name an individual accountable to the most senior governance body for compliance with the illegal content safety duties and the reporting and complaints duties.

ICS A2.3 Being accountable means being required to explain and justify actions or decisions regarding:

a illegal harm risk management and mitigation (including as to risks remaining after the implementation of appropriate Codes of Practice measures); and

b compliance with the relevant duties,

to the most senior governance body.

ICS A3 Written statements of responsibilities¶

Application¶

ICS A3.1 This measure applies to a provider in respect of each service it provides that is either (or both) of the following:

a a large general search service; or

b a multi-risk service.

Recommendation¶

ICS A3.2 The provider should have written statements of responsibilities for senior managers who make decisions about the management of risks having to do with illegal harm in relation to individuals in the UK.

ICS A3.3 A statement of responsibilities is a document which clearly shows the responsibilities that the senior manager performs in relation to the management of risks having to do with illegal harm in relation to individuals in the UK and how they fit in with the provider’s overall governance and management arrangements in relation to the service.

ICS A4 Internal monitoring and assurance¶

Application¶

ICS A4.1 This measure applies to a provider in respect of each service it provides that is both a large service and a multi-risk service.

Recommendation¶

ICS A4.2 The provider should have an internal monitoring and assurance function to provide independent assurance that measures taken to mitigate and manage the risks of harm to individuals identified in the risk assessment are effective on an ongoing basis. This function should report to, and its findings should be considered by, either:

a the body that is responsible for overall governance and strategic direction of a service; or

b an audit committee.

ICS A4.3 This independent assurance may be provided by an existing internal audit function.

ICS A5 Tracking evidence of new and increasing illegal harm¶

Application¶

ICS A5.1 This measure applies to a provider in respect of each service it provides that is either (or both) of the following:

a a large general search service; or

b a multi-risk service.

Recommendation¶

ICS A5.2 The provider should track evidence of new kinds of search content that is illegal content that may be encountered in or via its search results, and unusual increases in particular kinds of illegal content or illegal content proxy. Relevant evidence may include, but is not limited to, that derived from:

a complaints processes;

b search moderation processes;

c referrals from law enforcement; and

d information from trusted flaggers and any other expert group or body the provider considers appropriate.

ICS A5.3 The provider should ensure that any new kinds of illegal content or unusual increases in particular kinds of illegal content or illegal content proxy are regularly reported through relevant governance channels to the most senior governance body.

ICS A5.4 To understand this, the provider should establish a baseline understanding of how frequently particular kinds of illegal content or illegal content proxy occur to the extent possible based on its internal data and evidence. The provider should use this baseline to identify unusual increases in the relevant data.

ICS A5.5 References in this Recommendation ICS A5 to “illegal content” or “illegal content proxy” are to be read as references to illegal content or illegal content proxy that may be encountered by United Kingdom users in the search content of the service.

ICS A6 Code of conduct regarding protection of users from illegal harm¶

Application¶

ICS A6.1 This measure applies to a provider in respect of each service it provides that is either (or both) of the following:

a a large general search service; or

b a multi-risk service.

Recommendation¶

ICS A6.2 The provider should have a code of conduct that sets standards and expectations for individuals working for the provider around protecting United Kingdom users from risks of illegal harm.

ICS A7 Compliance training¶

Application¶

ICS A7.1 This measure applies to a provider in respect of each service it provides that is either (or both) of the following:

a a large general search service; or

b a multi-risk service.

Recommendation¶

ICS A7.2 The provider should secure that individuals working for the provider who are involved in the design and operational management of the service are trained in the service’s approach to compliance with the illegal content safety duties and the reporting and complaints duties, sufficiently to give effect to them. This measure does not apply in relation to volunteers.

ICS A7.3 This does not affect Recommendation ICS C6 (provision of training and materials to individuals working in search moderation (non-volunteers)).

B [Not used]¶

[Intentionally left blank]

C Search moderation¶

ICS C1 Having a search moderation function designed to action illegal content¶

Application¶

ICS C1.1 This measure applies to a provider in respect of each service it provides.

Recommendation¶

ICS C1.2 The provider should, as part of its search moderation function, have systems and processes designed to review, assess and where relevant take appropriate moderation action in relation to search content the provider has reason to suspect may be illegal content.

ICS C1.3 For this purpose, when the provider has reason to suspect that search content may be illegal content, the provider should either:

a make an illegal content judgement in relation to the search content and, if it determines that the search content is illegal content, take appropriate moderation action in relation to the search content; or

b where the provider has identified kinds of content as being subject to appropriate moderation action in its publicly available statement, and the provider is satisfied that the type of illegal content which it has reason to suspect exists is included within those kinds of content, take appropriate moderation action in relation to the search content.

ICS C1.4 For the purpose of ICS C1.2 and ICS C1.3, "appropriate moderation action" includes any action applied to the search content concerned that results in it:

a no longer appearing in search results presented to United Kingdom users; or

b being given a lower priority in the overall ranking of search results presented to United Kingdom users.

ICS C1.5 For the avoidance of doubt, the action specified in ICS C1.4(b) does not require illegal content to appear lower than other search content in search results where this is not possible in response to a given search request because:

a only search content that is illegal content is relevant to a search request; or

b given the specificity of the search request, search content that is illegal content is reasonably considered to be most relevant.

ICS C1.6 In designing the systems and processes referred to in ICS C1.2, and in particular the aspects of those systems and processes relating to what appropriate moderation action to take (including the extent to which search content is given a lower priority in the overall ranking of search results presented to United Kingdom users) the provider should have regard to the following:

a the prevalence of illegal content hosted at the URL or in the database at which the search content concerned is present;

b the interests of users in receiving any lawful material that would be affected; and

c the severity of potential harm to United Kingdom users that may arise if they encounter the content, including whether the content is priority illegal content and the potential harm to children.

ICS C1.7 This does not affect Recommendation ICS C7 (removing listed CSAM URLs from search results).

Safeguards for freedom of expression and privacy¶

ICS C1.8 The following measures are safeguards to protect United Kingdom users’ and interested persons’ rights to freedom of expression and the privacy of United Kingdom users:

a where they are applicable, Recommendations ICS C2, ICS C3, ICS C5 and ICS C6 (in relation to search moderation);

b Recommendations ICS D1 and ICS D2, so far as they relate to appeals or complaints by United Kingdom users and interested persons if they consider that the provider is not complying with its duties in relation to freedom of expression or privacy; and

c Recommendations ICS D7 or ICS D8 (whichever is applicable) and ICS D9 (in relation to appeals).

ICS C2 Setting internal content policies¶

Application¶

ICS C2.1 This measure applies to a provider in respect of each service it provides that is either (or both) of the following:

a a large general search service; or

b a multi-risk service.

Recommendation¶

ICS C2.2 The provider should set and record (but need not publish) internal content policies setting out rules, standards and guidelines around:

a what search content should be actioned in accordance with Recommendation ICS C1 (having a search moderation function designed to action illegal content); and

b how policies should be operationalised and enforced.

ICS C2.3 The policies should be drafted in such a way that appropriate moderation action is taken in accordance with Recommendation ICS C1 (having a search moderation function designed to action illegal content).

ICS C2.4 The provider should:

a have regard to the risk assessment of the service in setting these policies; and

b have processes in place for updating these policies in response to evidence of new and increasing illegal harm on the service (as tracked in accordance with ICS A5.2).

ICS C3 Performance targets¶

Application¶

ICS C3.1 This measure applies to a provider in respect of each service it provides that is either (or both) of the following:

a a large general search service; or

b a multi-risk service.

Recommendation¶

ICS C3.2 The provider should set and record performance targets for its search moderation function, covering at least:

a the time between the provider first having reason to suspect that search content may be illegal content and appropriate moderation action being taken in accordance with Recommendation ICS C1; and

b the accuracy of decision making.

ICS C3.3 In setting its targets, the provider should balance the need to take appropriate moderation action swiftly against the importance of making accurate moderation decisions.

ICS C3.4 The provider should effectively measure and monitor its performance against its performance targets.

ICS C4 Prioritisation¶

Application¶

ICS C4.1 This measure applies to a provider in respect of each service it provides that is either (or both) of the following:

a a large general search service; or

b a multi-risk service.

Recommendation¶

ICS C4.2 The provider should prepare and apply a policy in respect of the prioritisation of search content for review. In setting the policy, the provider should have regard to at least the following:

a how frequently the search content is returned in response to search requests;

b the severity of potential harm to United Kingdom users if they encounter search content that is illegal content on the service, including whether the content is suspected to be priority illegal content, the risk assessment of the service, and the potential harm to children; and

c the likelihood that search content is illegal content, including whether it has been reported by a trusted flagger.

ICS C5 Resourcing¶

Application¶

ICS C5.1 This measure applies to a provider in respect of each service it provides that is either (or both) of the following:

a a large general search service; or

b a multi-risk service.

Recommendation¶

ICS C5.2 The provider should resource its search moderation function so as to give effect to its internal content policies and performance targets, having regard to at least:

a the propensity for external events to lead to a significant increase in demand for search moderation on the service; and

b the particular needs of its United Kingdom user base as identified in its risk assessment, in relation to languages.

ICS C6 Provision of training and materials to individuals working in search moderation (non-volunteers)¶

Application¶

ICS C6.1 This measure applies to a provider in respect of each service it provides that is either (or both) of the following:

a a large general search service; or

b a multi-risk service.

Recommendation¶

ICS C6.2 The provider should ensure individuals working in search moderation receive training and materials that enable them to fulfil their role in moderating search content including in relation to Recommendation ICS C1 and the internal content policies set in accordance with Recommendation ICS C2. This measure does not apply in relation to volunteers.

ICS C6.3 The provider should ensure that in doing so:

a it has regard to at least the risk assessment of the service and evidence of new and increasing illegal harm on the service (as tracked in accordance with ICS A5.2); and

b where the provider identifies a gap in the understanding of individuals working in search moderation in relation to a specific kind of illegal harm, it gives training and materials to remedy this.

ICS C7 Removing listed CSAM URLs from search results¶

Application¶

ICS C7.1 This measure applies to a provider in respect of each general search service it provides.

Key definition¶

ICS C7.2 In this Recommendation ICS C7, “CSAM URL” means a URL at which CSAM is present, or a domain which is entirely or predominantly dedicated to CSAM.

ICS C7.3 For the purpose of ICS C7.2, a domain is “entirely or predominantly dedicated” to CSAM if the content present at the domain, taken overall, entirely or predominantly comprises CSAM (such as indecent images of children) or content related to CSEA content).

Recommendation¶

ICS C7.4 The provider should source one or more lists of CSAM URLs from a person (or persons) with expertise in the identification of CSAM and who meets (in relation to the list) the requirements set out in ICS C7.5.

ICS C7.5 The requirements are that the person has arrangements in place:

a to identify URLs or domains suspected to be CSAM URLs;

b to secure (so far as possible) that suspected CSAM URLs are correctly identified before they are added to the list;

c which, in relation to identifying or assessing suspected CSAM URLs, do not plainly discriminate on the basis of protected characteristics (within the meaning of Part 2 of the Equality Act 20101);

d to regularly update the list with identified CSAM URLs;

e to regularly review listed CSAM URLs, and remove from the list any which are no longer CSAM URLs; and

f to secure the list from unauthorised access, interference or exploitation (whether by persons who work for that person, or by any other persons).

ICS C7.6 The provider should take action to ensure that United Kingdom users of the service do not encounter, in or via search results, search content present at or sourced from listed URLs or URLs that contain a listed domain.

1 2010 c. 15.

ICS C7.7 The provider should ensure that action taken in relation to a listed URL or listed domain for the purpose of ICS C7.6 is swiftly reversed when the URL or domain is removed from the list, unless the provider considers that it would be inappropriate to do so.

ICS C7.8 The provider should ensure that the list or lists are regularly monitored for the purposes of ICS C7.6 and ICS C7.7.

ICS C7.9 The provider should ensure that an appropriate policy is put in place, and that measures are taken in accordance with that policy, to secure any copy of a list held for the purposes of this Recommendation ICS C7 from unauthorised access, interference or exploitation (whether by persons who work for the provider or are providing a service to the provider, or any other person).

Safeguards for freedom of expression¶

ICS C7.10 The following elements of this Recommendation ICS C7 are safeguards to protect United Kingdom users’ and interested persons’ rights to freedom of expression:

a the arrangements referred to in sub-paragraphs (b), (e) and (f) of ICS C7.5;

b ICS C7.7 to ICS C7.9.

ICS C7.11 The following measures are also safeguards to protect United Kingdom users’ and interested persons’ rights to freedom of expression:

a Recommendations ICS D1 and ICS D2, so far as they relate to appeals or complaints by United Kingdom users and interested persons if they consider that the provider is not complying with its duties in relation to freedom of expression;

b Recommendations ICS D7 or ICS D8 (whichever is applicable) and ICS D9 (in relation to appeals); and

c Recommendation ICS G1 (publicly available statements: substance (all services)).

ICS C8 Hash matching for intimate image abuse content¶

Application¶

ICS C8.1 This measure applies to a provider in respect of each large general search service it provides.

Key definition¶

ICS C8.2 In this Recommendation ICS C8 “relevant content” means any search content in the form of photographs, videos or visual images (whether or not combined with written material) that United Kingdom users can encounter in or via search results.

Recommendation¶

ICS C8.3 The provider should ensure that perceptual hash matching technology is used effectively to analyse relevant content to assess whether it is intimate image abuse content.

ICS C8.4 The provider should:

a where relevant content is detected, treat this as reason to suspect that the search content may be illegal content and review the search content in accordance with Recommendation ICS C1; and

b ensure that the systems and processes referred to in ICU C1.2 are operated to ensure human moderators review and assess an appropriate proportion of detected content, having regard to:

i the degree of accuracy achieved by automated systems and/or processes in use for the purposes of ICS C1.2, if any (taking account of data from the service’s complaints procedure enabling an interested person to complain if measures are taken or used in order to comply with a duty set out in section 27 of the Act that result in content relating to that interested person no longer appearing in search results or being given a lower priority in search results);

ii the principle that content with a higher likelihood of being a false positive should be prioritised for review; and

iii the importance of understanding the purpose and context of detected content when determining whether it is intimate image abuse content.

ICS C8.5 For the purposes of ICS C8.3, the provider should ensure that:

a all relevant content that is on the service at the time the technology is implemented is analysed within a reasonable time; and

b relevant content that is able to be encountered in or via search results by United Kingdom users after the technology is implemented is analysed before or as soon as practicable after it can be so encountered.

ICS C8.6 For the use of perceptual hash matching technology to be effective, it should:

a use a suitable perceptual hash function to compare relevant content to an appropriate set of hashes (see ICS C8.7 to ICS C8.11); and

b be configured so that its performance strikes an appropriate balance between precision and recall (see ICS C8.12 to ICS C8.14).

The set of hashes¶

ICS C8.7 For the set of hashes to be appropriate, it should include hashes of intimate image abuse content that meet the requirements set out in ICS C8.9 and sourced from either (or both) of the following:

a one or more persons who maintain a database of hashes of potential intimate image abuse content (whether or not the hashes are verified to be intimate image abuse content); or

b the provider’s own database of hashes of intimate image abuse content (see ICS C8.8).

ICS C8.8 Where the set of hashes includes hashes of intimate image abuse content sourced from the provider’s own database in accordance with ICS C8.7(b), the provider should ensure that:

a the hashes include either (or both):

i hashes of intimate image abuse content identified by the provider’s search moderation function; or

ii hashes of intimate image abuse content from a database of the kind referred to in ICS C8.7(a); and

b it has arrangements in place to review cases where material is suspected to have been incorrectly identified as intimate image abuse content, and remove such hashes from the database where appropriate.

ICS C8.9 The requirements are that the provider or the person(s) maintaining the database has arrangements in place:

a to regularly update its database with hashes of intimate image abuse content; and

b to secure its database from unauthorised access, interference or exploitation (whether by persons who work for that person or are providing a service to that person, or any other person).

ICS C8.10 The provider should ensure that where the set of hashes includes hashes of intimate image abuse content sourced from a person in accordance with ICS C8.7(a) and ICS C8.9, the latest versions of any databases sourced are regularly obtained and then used for the purposes of ICS C8.3.

ICS C8.11 The provider should ensure an appropriate policy is put in place, and that measures are taken in accordance with that policy, to secure any hashes of intimate image abuse content held for the purposes of this Recommendation ICS C8 from unauthorised access, interference or exploitation (whether by persons who work for the provider or are providing a service to the provider, or any other person).

Technical configuration¶

ICS C8.12 In configuring the technology so that its performance strikes an appropriate balance between precision and recall, the provider should ensure that the following matters are taken into account:

a the service’s risk of harm relating to intimate image abuse, reflecting the risk assessment of the service and any information reasonably

available to the provider about the prevalence of relevant content that is intimate image abuse content on the service;

b the proportion of detected content that is a false positive; and

c the effectiveness of the systems and/or processes used to identify false positives.

ICS C8.13 The provider should ensure that the performance of the technology, and whether the balance between precision and recall continues to be appropriate, is reviewed at least every six months.

ICS C8.14 The provider should ensure that a written record is made of how this balance has been struck in configuring the technology, including what information has been considered, and information about reviews and steps taken in response.

Safeguards for freedom of expression and privacy¶

ICS C8.15 Paragraphs ICS C8.6 to ICS C8.14 of this Recommendation ICS C8 are safeguards to protect United Kingdom users’ and interested persons right to freedom of expression and the privacy of United Kingdom users and interested persons.

ICS C8.16 The following measures are also safeguards to protect United Kingdom users’ and interested persons’ right to freedom of expression and the privacy of United Kingdom users and interested persons:

a Recommendation ICU C1 and ICU C2, and where they are applicable, Recommendations ICS C2, ICS C3, ICS C5 and ICS C6 (in relation to search moderation);

c Recommendations ICS D7 or ICS D8 (whichever is applicable), ICS D9 (in relation to appeals) and ICS D11; and

d Recommendation ICS G1 (publicly available statements: substance (all services)).

D Reporting and complaints¶

ICS D1 Enabling complaints¶

Application¶

ICS D1.1 This measure applies to a provider in respect of each service it provides.

Recommendation¶

ICS D1.2 The provider should have systems and processes which enable prospective complainants to make each type of relevant complaint in a way which will secure that the provider will take appropriate action in relation to them.

ICS D2 Having easy to find, easy to access and easy to use complaints systems and processes¶

Application¶

ICS D2.1 This measure applies to a provider in respect of each service it provides.

Recommendation¶

ICS D2.2 The systems and processes referred to in ICS D1.2 should be operated to ensure that:

a for relevant complaints regarding a specific piece of search content, a reporting function or tool is clearly accessible in relation to that search content;

b processes for making other kinds of relevant complaints are easy to find and easily accessible;

c they are designed so that they only include reasonably necessary steps;

d it is possible when making relevant complaints to give the provider supporting information.

ICS D2.3 In designing the systems and processes referred to in ICS D1.2, including its reporting tool or function, the provider should consider the accessibility needs of its United Kingdom user base having regard to:

a the groups of people its risk assessment has identified as using the service;

b in the case of a service that is likely to be accessed by children, the service’s children’s risk assessment;

c other relevant information the provider holds on its United Kingdom user base;

d industry standards and good practice as to the design of the service, to ensure the reporting and complaints process is accessible to disabled people; and

e comprehensibility, based on the likely reading age of the youngest individual permitted to use the service without the consent of a parent or guardian.

ICS D2.4 For the purposes of ICS D2.3(d), the systems and processes referred to in ICS D1.2 should be designed for the purposes of ensuring usability for those dependent on assistive technologies including:

a keyboard navigation; and

b screen reading technology.

ICS D3 Appropriate action – sending indicative timeframes¶

Application¶

ICS D3.1 This measure applies to a provider in respect of each service it provides that is either (or both) of the following:

a a large general search service; or

b at medium or high risk of any kind of illegal harm.

Recommendation¶

ICS D3.2 The provider should acknowledge receipt of each relevant complaint and provide the complainant with an indicative timeframe for deciding the complaint.

ICS D3.3 ICS D3.2 does not apply if:

a the provider’s acknowledgement is non-ephemeral; and

b the complainant has opted out from receiving non-ephemeral communications in relation to their relevant complaint.

ICS D4 Appropriate action – sending further information about how the complaint will be handled¶

Application¶

ICS D4.1 This measure applies to a provider in respect of each service that is likely to be accessed by children it provides that is either (or both) of the following:

a a large general search service; or

b at medium or high risk of any kind of illegal harm.

Recommendation¶

ICS D4.2 In the acknowledgment of receipt of each relevant complaint, referred to in Recommendation ICS D3, the provider should set out:

a the possible outcomes; and

b confirmation of whether the provider will inform the complainant of its decision whether to uphold the complaint and details of any action taken as a result.

ICS D5 Opt-out from communications following a complaint¶

Application¶

ICS D5.1 This measure applies to a provider in respect of each service it provides that is either (or both) of the following:

a a large general search service; or

b at medium or high risk of any kind of illegal harm.

Recommendation¶

ICS D5.2 The provider should enable the complainant to opt out of receiving any non-ephemeral communications in relation to a relevant complaint.

ICS D6 Appropriate action for relevant complaints about suspected illegal content¶

Application¶

ICS D6.1 This measure applies to a provider in respect of each service it provides.

Recommendation¶

ICS D6.2 When the provider receives a relevant complaint about search content which may be illegal content:

a it should treat the complaint as reason to suspect that the search content may be illegal content, and review the search content in accordance with ICS C1.3; and

b if Recommendations ICS C3 and ICS C4 are not applicable to the provider, it should consider the complaint promptly.

ICS D6.3 ICS C6.2 does not apply to a complaint identified as manifestly unfounded in accordance with ICS D12.2.

ICS D7 Appropriate action for relevant complaints which are appeals – determination (large general or multi-risk services)¶

Application¶

ICS D7.1 This measure applies to a provider in respect of each service it provides that is either (or both) of the following:

a a large general search service; or

b a multi-risk service.

Recommendation¶

ICS D7.2 The provider should determine relevant complaints which are appeals.

ICS D7.3 The provider should, as a minimum, monitor its performance against performance targets relating to the following:

a the time it takes to determine the appeal; and

b the accuracy of decision making,

and should resource itself so as to give effect to those targets.

ICS D7.4 The provider should have regard to the following matters in determining what priority to give to review of a relevant complaint which is an appeal:

a the seriousness of the action taken against the search content as a result of the decision that the search content was illegal content;

b whether the decision that the search content was illegal content was made by content identification technology and, if so,

i any information that Ofcom has recommended the provider collect about the likelihood of false positives generated by the specific content identification technology used; and

ii any other information available about the accuracy of the content identification technology at identifying similar types of illegal content; and

c the past error rate on the service in relation to illegal content judgements of the type concerned.

ICS D8 Appropriate action for relevant complaints which are appeals – determination (services that are neither large general nor multi-risk)¶

Application¶

ICS D8.1 This measure applies to a provider in respect of each service it provides that is neither a large general search service nor a multi-risk service.

Recommendation¶

ICS D8.2 The provider should determine relevant complaints which are appeals promptly.

ICS D9 Appropriate action for relevant complaints which are appeals – action following determination¶

Application¶

ICS D9.1 This measure applies to a provider in respect of each service it provides.

Recommendation¶

ICS D9.2 If, in relation to a relevant complaint that is an appeal, the provider reverses a decision that search content was illegal content, the provider should:

a so far as appropriate and possible for the purpose of restoring the position of the search content to what it would have been had the decision not been made, reverse the action taken in relation to the search content as a result of that decision;

b where there is a pattern or significant evidence of search content not appearing in search results or being given a lower priority in the overall ranking of search results in error, adjust any relevant search moderation guidance if appropriate to ensure it is accurate; and

c where possible and appropriate, take steps to secure that the use of automated moderation technology does not cause the same search content to no longer appear in search results or be given a lower priority in the overall ranking of search results again.

ICS D10 Appropriate action for relevant complaints about proactive technology, which are not appeals¶

Application¶

ICS D10.1 This measure applies to a provider in respect of each service it provides.

Recommendation¶

ICS D10.2 This Recommendation ICS D10 applies to relevant complaints, which are not appeals, about the use of proactive technology on the service when:

a the use of proactive technology on the service results in search content no longer appearing in search results or being given a lower priority in the overall ranking of search results; and

b the complainant considers that the proactive technology has been used in a way not contemplated by, or in breach of, the publicly available statement (for example, by search content, which is not of a kind specified in the publicly available statement as a kind of search content in relation to which the technology would operate, no longer appearing in search results or being given a lower priority in the overall ranking of search results).

ICS D10.3 The provider should inform the complainant of the action the provider may take in response to the complaint.

ICS D10.4 ICS D10.3 does not apply to a complaint identified as manifestly unfounded in accordance with ICS D12.2.

ICS D11 Appropriate action for all other relevant complaints¶

Application¶

ICS D11.1 This measure applies to a provider in respect of each service that it provides.

Recommendation¶

ICS D11.2 This Recommendation ICS D11 applies to relevant complaints that the provider is not complying with:

a the illegal content safety duties;

b the duty about content reporting set out in section 31 of the Act, so far as it relates to illegal content;

c the provider’s duty in relation to freedom of expression in section 33(2) of the Act; or

d the provider’s duty in relation to privacy in section 33(3) of the Act.

ICS D11.3 The provider should nominate a responsible individual or a team to ensure that such complaints are directed to an appropriate individual or team to be processed.

ICS D11.4 Relevant complaints should be handled:

a in a way that protects United Kingdom users; and

b within timeframes the provider has determined are appropriate.

ICS D11.5 ICS D11.3 and ICS D11.4 do not apply in relation to a complaint identified as manifestly unfounded in accordance with ICS D12.2.

ICS D12 Exception: manifestly unfounded complaints¶

Application¶

ICS D12.1 This measure applies to a provider in respect of each service that it provides.

Recommendation¶

ICS D12.2 When the provider receives a relevant complaint that is not an appeal, it may disregard the complaint only if:

a the provider has prepared and implemented a policy in accordance with ICS D12.3 to ICS D12.6, setting out the information and attributes that indicate a relevant complaint is manifestly unfounded;

b the provider identifies the complaint as manifestly unfounded in accordance with that policy; and

c the provider has in place a process to monitor the degree to which the application of the policy incorrectly identifies complaints which are not manifestly unfounded, and to review the policy in accordance with ICS D12.4 to ICS D12.6.

ICS D12.3 In designing a policy for the purposes of ICS D12.2(a), the provider should have regard to:

a the need to identify manifestly unfounded complaints accurately; and

b the risks posed to particular groups of vulnerable users if relevant complaints are incorrectly identified as manifestly unfounded.

ICS D12.4 The provider should, at minimum, carry out an annual review of the policy to ensure it is not incorrectly identifying relevant complaints as manifestly unfounded.

ICS D12.5 If the policy is incorrectly identifying relevant complaints as manifestly unfounded, the provider should make changes to it with a view to ensuring its accuracy.

ICS D12.6 The provider should keep a record of its review process and any changes it has made.

ICS D13 Dedicated reporting channel for trusted flaggers to report fraud¶

Application¶

ICS D13.1 This measure applies to a provider in respect of each service it provides that is a large general search service and is at medium or high risk of fraud.

Recommendation¶

ICS D13.2 In this Recommendation ICS D13, a ‘recommended trusted flagger’ is each of the following:

a the City of London police force;

b the Dedicated Card and Payment Crime Unit (a joint team of the City of London and Metropolitan Police forces);

c the Department for Work and Pensions;

d the Financial Conduct Authority;

e HM Revenue and Customs;

f the National Crime Agency;

g the National Cyber Security Centre (a part of the Government Communications Headquarters);

h the Police Service of Northern Ireland;

i the Police Service of Scotland (Seirbheis Phoilis na h-Alba).

ICS D13.3 The provider should establish and maintain a dedicated reporting channel for, at minimum, the recommended trusted flaggers, and relating to, at minimum, fraud, in the circumstances set out in this Recommendation ICS D13.

ICS D13.4 The provider should publish a clear and accessible policy on its processes relating to the establishment of a dedicated reporting channel for, at minimum, the recommended trusted flaggers, covering any relevant procedural matters.

ICS D13.5 If a request is made in accordance with the policy by a recommended trusted flagger, the provider should ensure a dedicated reporting channel, run in accordance with ICS D13.3 to ICS D13.8, is made available and maintained for, at minimum, recommended trusted flaggers. The provider may make an existing dedicated reporting channel available to the recommended trusted flagger, if that dedicated reporting channel is run in accordance with ICS D13.3 to ICS D13.8.

ICS D13.6 The provider should engage with the recommended trusted flagger at the start of the relationship to understand the recommended trusted flagger’s needs with respect to the dedicated reporting channel.

ICS D13.7 At least every two years, the provider should seek feedback from, at minimum, the recommended trusted flaggers with which it has made such arrangements, on whether any reasonable adjustments or improvements might be made to the operation of the dedicated reporting channel.

ICS D13.8 ICS D13.9 applies where the provider receives a complaint from a trusted flagger through a dedicated reporting channel established for that trusted flagger if the complaint:

a is about specific search content which may be encountered by United Kingdom users; and

b relates to a matter within the area of expertise of the trusted flagger.

ICS D13.9 The provider should treat the complaint as reason to suspect that the search content may be illegal content and review the search content in accordance with Recommendation ICS C1.

E [Not used]¶

[Intentionally left blank]

F Settings, functionalities and user support¶

ICS F1 Reporting and removal of predictive search suggestions¶

Application¶

ICU F1.1 This measure applies to a provider in respect of each large general search service it provides that uses a predictive search functionality.

Recommendation¶

ICU F1.2 The provider should offer United Kingdom users a means to easily report predictive search suggestions which they consider direct users towards priority illegal content.

ICU F1.3 Where a report is received, the provider should:

a consider whether the wording of a reported predictive search suggestion presents a clear and material risk of United Kingdom users encountering illegal content; and

b if a risk is identified, take appropriate steps to ensure that the reported predictive search suggestion is not recommended to any United Kingdom user.

ICS F2 Provision of CSAM content warnings¶

Application¶

ICS F2.1 This measure applies to a provider in respect of each large general search service it provides.

Recommendation¶

ICS F2.2 The provider should use systems and processes to detect and provide warnings in response to search requests made by United Kingdom users where:

a the wording of the search request clearly suggests that a United Kingdom user may be seeking to encounter CSAM; or

b terms or combinations of letters and symbols that explicitly relate to CSAM are used in the search request.

Warnings should not be provided in response to search requests using terms which, on their face, do not relate to CSAM.

ICS F2.3 A warning should:

a be prominently displayed to United Kingdom users in the search results;

b be in writing or such other format as considered appropriate;

c provide the following:

i information regarding the illegality of CSAM; and

ii link(s) to resources designed to help users refrain from committing CSEA offences that are freely available through a reputable organisation dedicated to tackling child sexual abuse; and

d be developed with input from a person (who may or may not work for the provider) with expertise in in deterring CSEA offences.

The information referred to in paragraph (c)(i) should be comprehensible and suitable in tone and content for as many United Kingdom users as possible, including children.

ICS F2.4 An appropriate list of search terms that meet the description in ICS F2.2 should be developed and maintained by, or sourced from, a person with expertise in the terms commonly used to search for CSAM.

ICS F2.5 The provider should ensure that there are arrangements in place to ensure (so far as possible) that:

a search terms are correctly added to the list and, where a list is sourced from a third party, that only search terms that meet the description in ICS F2.2 are used for the purposes of this measure;

b the list is regularly updated to add and remove relevant search terms as necessary; and

c the list is secured from unauthorised access, interference or exploitation (whether by persons who work for the relevant service or for the person from which the list is sourced, or otherwise).

ICS F3 Provision of suicide and self-harm crisis prevention information¶

Application¶

ICS F3.1 This measure applies to a provider in respect of each large general search service it provides.

Recommendation¶

ICS F3.2 The provider should use systems and processes to detect, and provide crisis prevention information in response to, search requests made by United Kingdom users that contain:

a general queries regarding suicide and/or self-harm; and

b queries seeking specific, practical or instructive information regarding suicide and/or self-harm methods.

ICS F3.3 The crisis prevention information should:

a be prominently displayed to United Kingdom users in the search results;

b be comprehensible and suitable in tone and content for as many United Kingdom users as possible, including children; and

c provide the following:

i a helpline that is both associated with a reputable mental health or suicide and/or self-harm prevention organisation, and is available to all United Kingdom users, irrespective of age or geographical location within the United Kingdom, for 24 hours per day for each day of the year; and

ii link(s) to information and support that is freely available through a reputable mental health or suicide and/or self-harm prevention organisation.

G Publicly available statements¶

ICS G1 Publicly available statements: substance (all services)¶

Application¶

ICS G1.1 This measure applies to a provider in respect of each service it provides.

Recommendation¶

ICS G1.2 The provider should include the following in the publicly available statement:

a provisions specifying how individuals are to be protected from illegal content;

b provisions giving information about any proactive technology used for the purposes of compliance with any of the illegal content safety duties (including the kind of technology, when it is used, and how it works);

c provisions specifying the policies and processes that govern the handling and resolution of relevant complaints.

ICS G2 Publicly available statements: substance (Category 2A services)¶

Application¶

ICS G2.1 This measure applies to a provider in respect of each Category 2A service it provides.

Recommendation¶

ICS G2.2 The provider should summarise the findings of its risk assessment (including as to levels of risk and as to the nature, and severity, of potential harm) in the publicly available statement.

ICS G3 Publicly available statements: clarity and accessibility¶

Application¶

ICS G3.1 This measure applies to a provider in respect of each service it provides.

Recommendation¶

ICS G3.2 The provider should ensure that the provisions included in the publicly available statement in accordance with Recommendation ICS G1 are:

a easy to find, such that they are:

i clearly signposted for the general public, regardless of whether they have registered with or are using the service; and

ii locatable within the publicly available statement;

b laid out and formatted in a way that helps United Kingdom users read and understand them;

c written to a reading age comprehensible for the youngest individual permitted to use the service without the consent of a parent or guardian; and

d designed for the purposes of ensuring usability for those dependent on assistive technologies, including:

i keyboard navigation; and

ii screen reading technology.

Section 5 Definitions and interpretation¶

5.1 Terms in bold used in these Codes have the meanings set out in table A. The meaning given applies even if the term is also used in the Act.

5.2 Terms in bold and italics used in these Codes have the same meaning as in the Act. Table B provides a reference to the provision(s) in the Act containing the definition of the relevant term as well as additional notes and references which are intended to assist the reader. In the event of any inconsistency between the Act and the information in table B, the Act

should be regarded as authoritative. 5.3 Terms which are underlined are references to kinds of illegal harms set out in table C. Table A - Definitions of terms in bold used in these Codes

Term

Meaning

Act

The Online Safety Act 2023 (c.50).

Active United Kingdom users

As defined in paragraph 5.10.

Appeal

A complaint by an interested person if the provider takes or

uses measures in order to comply with the illegal content

safety duties that result in content relating to that

interested person no longer appearing in search results or

being given a lower priority in search results.

Appropriate moderation

As defined in ICS C1.4 and ICS C1.5.

action

Children

People under the age of 18 in the United Kingdom.

Children’s risk assessment

The most recent risk assessment carried out by the provider of a service pursuant to section 28 of the Act.

Complainant

The United Kingdom user, affected person or interested

person who made the complaint.

CSAM (child sexual abuse material)

Content that amounts to an offence specified in any of the following paragraphs of Schedule 6 to the Act— a) paragraph 1 to 4, 7 or 8; b) paragraph 9 so far as any of the offences it contains are committed in relation to an offence specified in paragraphs 1 to 4, 7 or 8; c) paragraph 10; or d) paragraph 13 so far as any of the offences it contains are committed in relation to an offence specified in paragraph 10.

CSEA offence(s)

An offence specified in Schedule 6 to the Act.

Term

Meaning

Detected Content

Search content detected by the use of a relevant technology as being (or as likely to be) target content (and related expressions are to be read accordingly).

False positive

Detected content that is not target content.

General search service

A service that enables users to search for information across the internet, whether from (in principle) all websites or databases or only some websites or databases. It derives search results from an underlying search index and presents search results using algorithms that rank based on relevance to a search request. (For the avoidance of doubt, this term includes combined services, the public search engine part of which enables users to search the internet in the manner described above.)

Governance body

A body which makes decisions within an organisation, for

example a board of directors.

Illegal content judgement

A judgement about whether content is illegal content or illegal content of a particular kind, made in accordance with section 192(2) and section 192(5) to (7) of the Act.

Illegal content proxy

Search content that is content of a kind that is identified in

the provider’s publicly available statement for the service

as being subject to appropriate moderation action, where

the provider is satisfied that illegal content is included

within that kind of content (including but not limited to

priority illegal content).

Illegal content safety duties

The duties set out in section 27 of the Act.

Illegal harm

Harm arising from illegal content.

Intimate image abuse content

Search content which amounts to an offence: a) under section 66B of the Sexual Offences Act 2003 (sharing or threatening to share intimate image or film); or b) under section 2 of the Abusive Behaviour and Sexual Harm (Scotland) Act 2016 (asp 22) (disclosing, or threatening to disclose, an intimate photograph or film).

Kind of illegal harm

See the subsection headed ‘Risks of illegal harm’ below

(which begins at paragraph 5.4).

Large general search service

A general search service which has more than 7 million monthly active United Kingdom users (see paragraphs 5.7 to 5.11).

Term

Meaning

Large service

A service which has more than 7 million monthly active

United Kingdom users (see paragraphs 5.7 to 5.11).

Multi-risk service

See paragraph 5.6.

Perceptual hash matching technology

Image matching technology which compares the similarity

between hashes created from images by means of an

algorithm known as a perceptual hash function, to assess

whether those images are perceptually similar to each

other. This does not include technology which compares

similarity through the use of machine learning.

Precision

A measure of statistical accuracy, calculated as the proportion of detected content that a relevant technology has correctly identified as target content.

Predictive search functionality

An algorithmic feature embedded in the search field

through which a search service predicts a user’s search

request and provides a list of predictive search suggestions.

Predictive search suggestions

Search request suggested to users by means of a predictive search functionality.

Prospective complainants

United Kingdom users, affected persons and interested

persons.

Publicly available statement

The statement that providers are required to make available to members of the public in the United Kingdom pursuant to section 27 of the Act. In relation to a combined service, references to a publicly available statement include the service’s terms of service (consistent with section 25(2)(a) of the Act).

Recall

A measure of statistical accuracy, calculated as the

proportion of target content analysed by a relevant

technology that the technology has detected.

Recommended trusted

As defined in ICS D13.2.

flagger

Regulated search service

An internet service that is, or includes, a search engine

(subject to section 3(5) to (7) of the Act) that is a regulated

search service under section 4 of the Act (subject to the

disapplication in section 5 of the Act).

Term

Meaning

Relevant complaints

The following kinds of complaint: a) complaints (including reports) by United Kingdom users and affected persons about search content which they consider to be illegal content; b) complaints by United Kingdom users and affected persons if they consider that the provider is not complying with a duty set out in the following sections of the Act– i) section 27 (illegal content safety duties), ii) section 31 (content reporting) so far as it relates to illegal content, or iii) section 33 (freedom of expression or privacy); c) complaints by an interested person if the provider of a search service takes or uses measures in order to comply with a duty set out in section 27 of the Act that result in content relating to that interested person no longer appearing in search results or being given a lower priority in search results; d) complaints by an interested person if— i) the use of proactive technology on a search service results in content relating to that interested person no longer appearing in search results or being given a lower priority in search results, and ii) the interested person considers that the proactive technology has been used in a way not contemplated by, or in breach of, the provider’s policies on its use (for example, by affecting content not of a kind specified in those policies as a kind of content in relation to which the technology would operate).

Relevant technology

The kind of technology specified in the measure in question.

Reporting and complaints duties

The duty set out in section 31 of the Act, so far as it relates to illegal content, and the duties set out in section 32 of the Act, so far as relating to the complaints set out in section 32(4).

Term

Meaning

Reports

Complaints by United Kingdom users and affected persons

about search content which they consider to be illegal

content, made using a reporting function or tool provided by

the service.

Risk

See the subsection headed ‘Risks of illegal harm’ below (which begins at paragraph 5.4).

Risk assessment

The most recent risk assessment carried out by the provider

pursuant to section 26 of the Act.

Search index

A collection of URLs that are obtained by deploying crawlers to find content across the internet, which is subsequently stored and organised.

Search moderation function

The systems and processes designed to review, assess and

take appropriate moderation action in relation to search

content, including search content a provider has reason to

suspect may be illegal content.

Service

A regulated search service or a combined service, to the extent that the illegal content safety duties or the reporting and complaints duties apply in relation to such a service by virtue of section 7(6) of the Act. This includes (but is not limited to) general search services and vertical search services.

Target content

Content of the kind the use of a relevant technology is

designed to identify.

Trusted flagger

An entity which is a recommended trusted flagger and any other person: a) whom the provider has reasonably determined has expertise in a particular illegal harm; and b) for whom the provider has established a dedicated reporting channel.

URL

Uniform Resource Locator, meaning a reference that

specifies the location of a resource accessible by means of

the internet.

Term

Meaning

Vertical search service

A service that enables users to search for specific topics, or products or services offered by third parties with which the provider has a relevant arrangement (which may be contractual). Unlike general search services, they do not return search results based on an underlying search index. Rather, they use an API or equivalent technical means to directly query selected websites or databases, and to return search results to users.

Volunteer

An individual who, in relation to the activity in question, is

not:

a) employed by the provider or anyone else,

b) remunerated,

c) acting by way of a business.

Table B - Terms used in these Codes that have the meaning given in the Act¶

Term

Meaning under the Act

Affected person

Section 31(5)

Category 2A service

Section 95(10)(b) Section 95(2)(b) requires Ofcom to establish a register, a part of which sets out the regulated search services and combined services which Ofcom considers meet the Category 2A threshold conditions (as specified in regulations made under paragraph 1(2) of Schedule 11). Services for the time being included in that part of the register are Category 2A services. A regulated search service is an internet service (see the entry for “internet service” regarding the definition of that term) that is, or includes, a search engine (see the entry for “search engine” regarding the definition of that term) (subject to section 3(5) to (7)) that is a regulated search service under section 4 (subject to the disapplication in section 5). See the entry for “combined service” regarding the definition of that term.

Combined service

Section 4(7)

Term

Meaning under the Act

Paragraph 7(2) of Schedule 1 sets out the conditions to be met for a search engine not to be considered a public search engine. See the entry for “search engine” regarding the definition of that term. A “regulated user-to-user service” is a “user-to-user service” (as defined in sections 3(1) and (2), and section 204(1)) which is a regulated user-to-user service under section 4 (subject to the disapplication in section 5).  See the entries for “content”, “encounter”, “internet service” and “user” regarding the definitions of those terms.

Content

Section 236(1) See the entry for “internet service” regarding the definition of that term. See section 232 in relation to “content communicated “publicly” or “privately”.

Content identification technology

Section 231(2) Under section 231(1), content identification technology is listed as a form of “proactive technology”. Section 231(3) describes situations where content identification technology will not be proactive technology.

CSEA content

Section 59(9) Schedule 6 lists the relevant offences for determining when content is CSEA content. Sections 59(11) to (14) contain further interpretative provisions. Section 55(2) defines “regulated user-generated content”. Sections 55(5) to (12) contain interpretative provisions. Sections 55(3) and (4) deﬁne “user-generated content”. Section 55(4) provides interpretation of the scope of “content generated, uploaded or shared by a user” and explains when a bot or other automated tool may be regarded as a user of a service. A “regulated user-to-user service” is a “user-to-user service” (as defined in sections 3(1) and (2), and section 204(1)) which is a regulated user-to-user service under section 4 (subject to the disapplication in section 5).

Term

Meaning under the Act

See the entries for “combined service”, “content”, “encounter”, “internet service”, “search content” and “user” regarding the definitions of those terms.

Encounter (in relation to content)

Section 236(1)

Illegal content

Section 59(2) Section 59(3) sets out when content will amount to a relevant offence. Sections 59(4), (5) and (7) set out what is meant by a relevant offence. Section 59(6) describes offences which are not relevant offences. Sections 59(11) to (15) contain further interpretative provisions. A “regulated user-to-user service” is a “user-to-user service” (as defined in sections 3(1) and (2), and section 204(1)) which is a regulated user-to-user service under section 4 (subject to the disapplication in section 5). Section 55(2) defines “regulated user-generated content”. Sections 55(5) to (12) contain interpretative provisions. Section 236(1) defines “identifying content”. Section 56 defines “recognised news publisher”. See the entries for “combined service”, “content”, “encounter”, “internet service” “search content” and “user” regarding the definitions of those terms.

Interested person

Section 227(7) Sections 3(1) and (2) and section 204(1) define “user-to-user service”. See the entries for “content”, “combined service”, “encounter”, “internet service”, “search engine”, “search service” and “user” regarding the definitions of those terms.

Internet service

Section 228(1) and section 204(1) Sections 228(2) and (3) describe what is meant by a service that is made available by means of the internet.

Likely to be accessed by children

Section 37

Term

Meaning under the Act

Section 35(1) sets out what is meant by a “children’s access assessment”. Section 35(3) sets out when the “child user condition” is met in relation to a service. Section 36 details the requirement to carry out a children’s access assessment. Schedule 3 makes provision about the deadline by which a first “children’s access assessment” must be carried out. Section 236 defines a “child” (see also section 35(5)). Section 4(3) defines “Part 3 service”. Sections 230(2) and (4) define “age verification”. Sections 230(3) and (4) define “age estimation”. Sections 3(1) and (2) and section 204(1) define “user-to-user service”. Section 236(1) defines “user-to-user part” in relation to a “user-to-user service”. Sections 55(3) and (4) define “user-generated content”. Section 55(4) provides interpretation of the scope of “content generated, uploaded or shared by a user” and explains when a bot or other automated tool may be regarded as a user of a service. See the entries for “content”, “encounter”, “internet service”, “search engine”, “United Kingdom user” and “user” regarding the definitions of those terms.

Priority illegal content

Section 59(10) Sections 59(8) and (9) define "terrorism content" and "CSEA content".  Sections 59(11) to (14) contain further interpretative provisions. A “regulated user-to-user service” is a “user-to-user service” (as defined in sections 3(1) and (2), and section 204(1)) which is a regulated user-to-user service under section 4 (subject to the disapplication in section 5). Section 55(2) defines “regulated user-generated content”. Sections 55(5) to (12) contain interpretative provisions. Section 236(1) defines “identifying content”. Section 56 defines “recognised news publisher”. See the entries for “combined service”, “content”, “encounter”, “internet service” “search content” and “user” regarding the definitions of those terms.

Proactive technology

Section 231(1)

Term

Meaning under the Act

Sections 231(4) and (6) define “user profiling technology” and “behaviour identification technology”. Sections 231(3), (5) and (7) explain when these technologies will not be proactive technology. Sections 231(8) to (13) contain further interpretative provisions. Section 79(2) defines “provider pornographic content”. Section 236(1) defines “pornographic content”. Section 236(1) defines “personal data”. Section 4(4) defines “regulated service”. Sections 125(12) and (13) define “accredited technology”. Section 59(8) defines “terrorism content”. Schedule 5 lists the relevant offences for determining when content is terrorism content. Sections 59(11) to (14) contain further interpretative provisions. Sections 55(3) and (4) define “user-generated content”. Section 55(4) provides interpretation of the scope of “content generated, uploaded or shared by a user” and explains when a bot or other automated tool may be regarded as a user of a service. A “regulated user-to-user service” is a “user-to-user service” (as defined in sections 3(1) and (2), and section 204(1)) which is a regulated user-to-user service under section 4 (subject to the disapplication in section 5). A “regulated search service” is an internet service (see the entry for “internet service” regarding the definition of that term) that is, or includes, a search engine (subject to section 3(5) to (7)) (see the entry for “search engine” regarding the definition of that term) that is a regulated search service under section 4 (subject to the disapplication in section 5). See the entries for “combined service”, “content”, “content identification technology”, “CSEA content”, “encounter”, “illegal content”, “internet service”, “search engine”, “search service”, “United Kingdom user” and “user” regarding the definitions of those terms.

Provider

Section 226

Term

Meaning under the Act

See the entries for “combined service”, “internet service”, “search engine”, “search service” and “user” regarding the definitions of those terms.

Search content

Section 57(2) Section 57(4) sets out the meaning of “search”.  See section 57(6) regarding the reference to a “search service”. Sections 3(1) and (2) and section 204(1) define “user-to-user service”. See the entries for “content”, “encounter” “internet service”, “search engine”, “search results”, “search service”, “user” and “via” (in relation to references to encountering content “via search results”) regarding the definitions of those terms. Section 236(1) defines “paid-for-advertisements”. Section 56(1) defines “recognised news publisher”.

Search engine

Section 229 Section 57(4) defines “search”. Sections 3(1) and (2) and section 204(1) define “user-to-user service”. See the entries for “content”, “encounter”, “internet service” and “user” regarding the definitions of those terms.

Search or search request

Section 57(4)

Search results

Section 57(3) See section 57(6) regarding the reference to a “search service”. See the entries for “search engine”, “search request”, “search service” and “user” regarding the definitions of those terms.

Search service

Section 3(4) and section 204(1) See the entries for “internet service” and “search engine” regarding the definitions of those terms.

Term

Meaning under the Act

Systems and/or processes

Section 236(1)

United Kingdom user

Section 227(1) See the entry for “user” regarding the definition of that term.

User

Section 227(2)-(3) Section 227(3) sets out individuals and entities that will not be users for the purposes of the Act. Sections 227(4) to (6) provide further interpretation of terminology used throughout section 227. Section 57(4) defines “search”. Sections 3(1) and (2) and section 204(1) define “user-to-user service”. See the entries for “content”, “encounter”, “internet service”, “search engine” “search service” and “user” regarding the definitions of those terms.

Via (in relation to references to encountering

Section 57(5) See section 57(6) regarding the reference to a “search service”. See the entries for “content”, “encounter”, “internet service”, “search results” and “search service” regarding the deﬁnitions of those terms.

content “via search results”)

harm set out in table C. Table C – Kinds of illegal harm

Kind of illegal harm

Offences

Terrorism

An offence specified in Schedule 5 to the Act.

CSEA

An offence specified Schedule 6 to the Act.

Encouraging or assisting suicide (or attempted suicide) and serious-self harm

An offence under:

(a) section 2 of the Suicide Act 1961 (assisting suicide

etc);

(b) section 13 of the Criminal Justice Act (Northern

Ireland) 1966 (c. 20 (N.I.)) (assisting suicide etc);

2023 (encouraging or assisting serious self-harm).

Kind of illegal harm

Offences

Hate

An offence under any of the following provisions of the Public Order Act 1986— (a) section 18 (use of words or behaviour or display of written material); (b) section 19 (publishing or distributing written material); (c) section 21 (distributing, showing or playing a recording); (d) section 29B (use of words or behaviour or display of written material); (e) section 29C (publishing or distributing written material); (f) section 29E (distributing, showing or playing a recording). An offence under any of the following provisions of the Crime and Disorder Act 1998— (a) section 31 (racially or religiously aggravated public order offences); (b) section 32 (racially or religiously aggravated harassment etc).

Kind of illegal harm

Offences

Harassment, stalking, threats and abuse

An offence under section 16 of the Offences against the

Person Act 1861 (threats to kill).

An offence under any of the following provisions of the

Public Order Act 1986—

(a) section 4 (fear or provocation of violence);

(b) section 4A (intentional harassment, alarm or distress);

An offence under any of the following provisions of the

Protection from Harassment Act 1997—

(a) section 2 (harassment);

(b) section 2A (stalking);

(d) section 4A (stalking involving fear of violence or

serious alarm or distress).

An offence under any of the following provisions of the

Protection from Harassment (Northern Ireland) Order

1997 (S.I. 1997/1180 (N.I. 9))—

(a) Article 4 (harassment);

(b) Article 6 (putting people in fear of violence)

An offence under any of the following provisions of the

Criminal Justice and Licensing (Scotland) Act 2010 (asp

13)—

(a) section 38 (threatening or abusive behaviour);

(b) section 39 (stalking).

Controlling or coercive behaviour

An offence under section 76 of the Serious Crime Act 2015 (controlling or coercive behaviour in an intimate or family relationship).

Drugs and psychoactive substances

An offence under any of the following provisions of the

Misuse of Drugs Act 1971—

(a) section 4(3) (unlawful supply, or offer to supply, of

controlled drugs);

(b) section 9A (prohibition of supply etc of articles for

administering or preparing controlled drugs);

An offence under section 5 of the Psychoactive

Substances Act 2016 (supplying, or offering to supply, a

psychoactive substance).

Firearms and other weapons

An offence under section 1(1) or (2) of the Restriction of Offensive Weapons Act 1959 (sale etc of flick knife etc). An offence under any of the following provisions of the Firearms Act 1968— (a) section 1(1) (purchase etc of firearms or ammunition without certificate); (b) section 2(1) (purchase etc of shot gun without certificate); (c) section 3(1) (dealing etc in firearms or ammunition by way of trade or business without being registered); (d) section 3(2) (sale etc of firearms or ammunition to person other than registered dealer); (e) section 5(1), (1A) or (2A) (purchase, sale etc of prohibited weapons); (f) section 21(5) (sale etc of firearms or ammunition to persons previously convicted of crime); (g) section 22(1) (purchase etc of firearms or ammunition by person under 18); (h) section 24 (supplying firearms to minors); (i) section 24A (supplying imitation firearms to minors). An offence under any of the following provisions of the Crossbows Act 1987— (a) section 1 (sale and letting on hire of crossbow); (b) section 2 (purchase and hiring of crossbow). An offence under any of the following provisions of the Criminal Justice Act 1988— (a) section 141(1) or (4) (sale etc of offensive weapons); (b) section 141A (sale of knives etc to persons under 18). An offence under any of the following provisions of the Criminal Justice (Northern Ireland) Order 1996 (S.I. 1996/3160 (N.I. 24))— (a) Article 53 (sale etc of knives); (b) Article 54 (sale of knives etc to minors). An offence under any of the following provisions of the Knives Act 1997— (a) section 1 (unlawful marketing of knives); (b) section 2 (publication of material in connection with marketing of knives).

Kind of illegal harm

Offences

An offence under any of the following provisions of the Firearms (Northern Ireland) Order 2004 (S.I. 2004/702 (N.I. 3))— (a) Article 24 (sale etc of firearms or ammunition without certificate); (b) Article 37(1) (sale etc of firearms or ammunition to person without certificate etc); (c) Article 45(1) or (2) (purchase, sale etc of prohibited weapons); (d) Article 63(8) (sale etc of firearms or ammunition to people who have been in prison etc); (e) Article 66A (supplying imitation firearms to minors). An offence under section 36(1)(c) or (d) of the Violent Crime Reduction Act 2006 (sale etc of realistic imitation firearms). An offence under any of the following provisions of the Air Weapons and Licensing (Scotland) Act 2015 (asp 10)— (a) section 2 (requirement for air weapon certificate); (b) section 24 (restrictions on sale etc of air weapons).

Unlawful immigration

An offence under any of the following provisions of the

Immigration Act 1971—

(a) section 24(A1), (B1), (C1) or (D1) (illegal entry and

similar offences);

(b) section 25 (assisting unlawful immigration).

10. Human trafficking

An offence under section 2 of the Modern Slavery Act 2015 (human trafficking). An offence under section 1 of the Human Trafficking and Exploitation (Scotland) Act 2015 (asp 12) (human trafficking). An offence under section 2 of the Human Trafficking and Exploitation (Criminal Justice and Support for Victims) Act (Northern Ireland) 2015 (c. 2 (N.I.)) (human trafficking).

Kind of illegal harm

Offences

11. Sexual exploitation of adults

An offence under any of the following provisions of the

Sexual Offences Act 2003—

(a) section 52 (causing or inciting prostitution for gain);

(b) section 53 (controlling prostitution for gain).

An offence under any of the following provisions of the

Sexual Offences (Northern Ireland) Order 2008 (S.I.

2008/1769 (N.I. 2))—

(a) Article 62 (causing or inciting prostitution for gain);

(b) Article 63 (controlling prostitution for gain).

12. Extreme pornography

An offence under section 63 of the Criminal Justice and Immigration Act 2008 (possession of extreme pornographic images).

13. Intimate image abuse

An offence under section 66B of the Sexual Offences Act

2003 (sharing or threatening to share intimate

photograph or film).

An offence under section 2 of the Abusive Behaviour and

Sexual Harm (Scotland) Act 2016 (asp 22) (disclosing, or

threatening to disclose, an intimate photograph or film).

14. Proceeds of crime

An offence under any of the following provisions of the Proceeds of Crime Act 2002— (a) section 327 (concealing etc criminal property); (b) section 328 (arrangements facilitating acquisition etc of criminal property); (c) section 329 (acquisition, use and possession of criminal property).

Kind of illegal harm

Offences

15.

Fraud (and financial services)

An offence under any of the following provisions of the

Fraud Act 2006—

(a) section 2 (fraud by false representation);

(b) section 4 (fraud by abuse of position);

frauds);

(d) section 9 (participating in fraudulent business carried

on by sole trader etc).

An offence under section 49(3) of the Criminal Justice

and Licensing (Scotland) Act 2010 (articles for use in

fraud).

An offence under any of the following provisions of the

Financial Services and Markets Act 2000—

(a) section 23 (contravention of prohibition on carrying

on regulated activity unless authorised or exempt);

(b) section 24 (false claims to be authorised or exempt);

promotion).

An offence under any of the following provisions of the

Financial Services Act 2012—

(a) section 89 (misleading statements);

(b) section 90 (misleading impressions).

16. Foreign interference offence

An offence under section 13 of the National Security Act 2023 (foreign interference).

17. Animal cruelty

An offence under section 4(1) of the Animal Welfare Act

2006 (unnecessary suffering of an animal).

18. Cyberflashing

An offence under section 66A of the Sexual Offences Act 2003 (sending etc photograph or film of genitals).

User numbers

Risks of illegal harm¶

Risk of a kind of illegal harm¶

5.4 A service is at medium or high risk of a kind of illegal harm set out in table C if either:

a) the risk assessment of the service identified a medium or high risk2 (as the case may be) in relation to the offences (taken together) specified in relation to that kind of harm in table C; or b) by virtue of a confirmation decision given under section 134 of the Act in relation to a risk of serious harm, the duty set out in section 27(2) of the Act applies in relation to the service as if an illegal content risk assessment carried out by the provider pursuant to section 26 of

2 Ofcom has given guidance on risk assessments entitled ‘Risk Assessment Guidance and Risk Profiles’ (16 December 2024).

the Act had identified a medium or high risk of serious harm (as the case may be) in relation to that kind of harm.

5.5 In relation to each offence specified in rows 3 to 18 of table C, the offence also, to the extent relevant, includes the offences of encouraging, assisting, conspiring to commit, aiding, abetting, counselling, procuring, attempting, or (in Scotland) inciting or being involved art and part in, the commission of that offence.

Multi-risk services¶

5.6 A service is a multi-risk service if it is at medium or high risk of two or more kinds of illegal

5.7 This subsection applies for the purpose of determining whether a service has more than a particular number of monthly active United Kingdom users.

5.8 A service has more than a particular number of monthly active United Kingdom users:

a) from such time as the average number of monthly active United Kingdom users is more than that number; and b) until such time as the average number of monthly active United Kingdom users has been at or below that number for a continuous period of six months.

5.9 A service’s average number of monthly active United Kingdom users is the mean number of active United Kingdom users per month for:

a) the six-month period ending with the month preceding the time in question; or b) where the service has been in operation for less than six months, the period for which the service has been in operation.

5.10 In this subsection, an active United Kingdom user means any United Kingdom user who has encountered search content in or via search results of the service.

5.11 For the avoidance of doubt, in relation to a combined service, only United Kingdom users who have encountered search content in or via search results of the service’s public search engine (within the meaning given by section 4(7) of the Act) are active United Kingdom users of that service for the purposes of this subsection.