EdLaw
UK — Online Safety Act 2023 (scope assessment)
The UK's platform-regulation statute, enforced by Ofcom. Curated here are the provisions that answer the question schools ask us constantly: is our platform in scope? — the service definitions (ss 3–4) and the Schedule 1 exemptions.
Scope assessment for EdTech
- The gateway (section 3): a "user-to-user service" is an internet service by means of which user-generated content may be encountered by another user. A platform where teachers assign content and pupils' work is visible to other pupils can satisfy this; a purely teacher-managed content player does not.
- The education exemption does NOT cover vendors (Schedule 1 para 10): it exempts a service where the provider is the person with legal responsibility for the education (the school/responsible person or safeguarding-bound staff) and the service is provided for the purposes of that education. A third-party EdTech provider is not that person — we cannot ride this exemption; a school's own Moodle can. Public-body services are separately exempt (para 9).
- The realistic exemption for us is limited functionality (para 4): services where user interaction is limited to the listed low-risk kinds are exempt. Whether our sharing/communication features stay within para 4 must be re-assessed whenever a social feature ships — the same feature-gate as the ICO Children's Code and PR Ley 185-2024 analyses.
- Internal business services (paras 7–8) can exempt closed workforce tooling but not a school-and-pupil-facing product.
- If in scope, the operative duties (illegal-content and children's-safety duties, Ofcom codes) are substantial — extract Part 3 when a feature takes us into scope.
Contents
| Document | Covers |
|---|---|
| SCOPE.md | Sections 3–4 (user-to-user service, search service, regulated service) |
| EXEMPTIONS.md | Schedule 1 in full (exempt services, incl. the education/childcare and limited-functionality exemptions, with interpretation) |
Enforcement
Ofcom; fines up to £18m or 10% of qualifying worldwide revenue; senior-manager criminal liability for some duties.
Related
- ICO Children's Code — the privacy-side children's regime
- EU DSA — the EU structural sibling
Sources
Meta
Provision text is reproduced verbatim from the consolidated Act on legislation.gov.uk via the shared CLML converter by tools/legislation-gov-uk/build_osa2023.py (which taught the converter to render schedule paragraphs outside P1groups); verify re-checks every source text node. Official legislation.gov.uk ids are kept as anchors.