EdLaw
UK — Online Safety Act 2023 (scope assessment)
The UK's platform-regulation statute, enforced by Ofcom. Curated here are the provisions that answer the question schools ask us constantly: is our platform in scope? — the service definitions (ss 3–4) and the Schedule 1 exemptions.
Scope assessment for EdTech
- The gateway (section 3): a "user-to-user service" is an internet service by means of which user-generated content may be encountered by another user. A platform where teachers assign content and pupils' work is visible to other pupils can satisfy this; a purely teacher-managed content player does not.
- The education exemption does NOT cover vendors (Schedule 1 para 10): it exempts a service where the provider is the person with legal responsibility for the education (the school/responsible person or safeguarding-bound staff) and the service is provided for the purposes of that education. A third-party EdTech provider is not that person — we cannot ride this exemption; a school's own Moodle can. Public-body services are separately exempt (para 9).
- The realistic exemption for us is limited functionality (para 4): services where user interaction is limited to the listed low-risk kinds are exempt. Whether our sharing/communication features stay within para 4 must be re-assessed whenever a social feature ships — the same feature-gate as the ICO Children's Code and PR Ley 185-2024 analyses.
- Internal business services (paras 7–8) can exempt closed workforce tooling but not a school-and-pupil-facing product.
- If in scope, the operative duties (illegal-content and children's-safety duties, Ofcom codes) are substantial — extract Part 3 when a feature takes us into scope.
Contents
| Document | Covers |
|---|---|
| SCOPE.md | Sections 3–4 (user-to-user service, search service, regulated service) |
| EXEMPTIONS.md | Schedule 1 in full (exempt services, incl. the education/childcare and limited-functionality exemptions, with interpretation) |
Enforcement
Ofcom; fines up to £18m or 10% of qualifying worldwide revenue; senior-manager criminal liability for some duties.
Licence
The corpus reproduces the consolidated text of the Online Safety Act 2023 from legislation.gov.uk. The legislation.gov.uk footer (read 2026-10-01 on legislation.gov.uk) says: "All content is available under the Open Government Licence v3.0 except where otherwise stated." and "© Crown and database right". The text is Crown copyright, which is not an exclusion from copyright, so the label is open-licence.
The Open Government Licence v3.0 (read 2026-10-01) says: "You are free to: copy, publish, distribute and transmit the Information; adapt the Information; exploit the Information commercially and non-commercially". Its conditions: "acknowledge the source of the Information in your product or application by including or linking to any attribution statement specified by the Information Provider(s) and, where possible, provide a link to this licence", and, where no statement is specified, "Contains public sector information licensed under the Open Government Licence v3.0."; and, under Non-endorsement, the licence "does not grant you any right to use the Information in a way that suggests any official status or that the Information Provider and/or Licensor endorse you or your use of the Information."
Conditions, and how this corpus meets them:
- Acknowledge the source: each provision carries a
{.meta}provenance line naming legislation.gov.uk with the consolidation date, and Sources links the publication. Attribution statement: "Contains public sector information licensed under the Open Government Licence v3.0." (licence). - Non-endorsement: the corpus does not claim official status or endorsement by the Crown or The National Archives.
- Changes: the OGL does not require changes to be marked; the selection, layout and added anchors are described in Meta.
- Exemptions: no personal data, logos, crests or Royal Arms are reproduced.
The Ofcom page listed in Sources is cited, not reproduced.
Related
- ICO Children's Code — the privacy-side children's regime
- EU DSA — the EU structural sibling