[Implementing safety measures]

The Protection of Children Codes sets out a range of measures for user-to-user and search services.

The Protection of Children Codes of Practice include measures in the following areas for user-to-user services:

- governance and accountability
- terms of service
- age assurance
- content moderation
- user reporting and complaints
- recommender systems
- settings, functionalities, and user support
- terms of service

The Protection of Children Codes of Practice include measures in the following areas for search services:

- governance and accountability
- content moderation (we call this ‘search moderation’)
- user reporting and complaints
- search features, functionalities, and user support
- publicly available statements

#### Your safety measures will depend on your service

The Act is clear that the safety measures you need to put in place should be proportionate. We recommend different measures for different types of services based on factors such as:

- the type of service you provide (including user-to-user or search);
- the number of users your service has (size);
- the outcome of your latest children’s risk assessment, and what risks have been identified in relation to content harmful to children; and
- the relevant functionalities and other characteristics of your service that have been shown to pose risks to children (for example whether you have a content recommender system).

Some measures will apply to all services. For example, naming an individual accountable for compliance with the children’s safety duties, ensuring your terms of service (or publicly available statements) are clear and accessible, having a user reporting and complaints process, and some content and search moderation measures.

Your children’s risk assessment must cover the level of risk of child users encountering each kind of content harmful to children on your service. You must assign a risk level - negligible, low, medium, or high – to each kind of content harmful to children. These risk levels must accurately reflect the risks on your service.

The measures that we recommend will be based on the risk levels assigned:

- If your service is low or negligible risk for all kinds of content harmful to children, it is a ‘low risk service’ and a core set of measures apply.
- If your service is medium or high risk for (at least) one kind of content harmful to children, further measures may apply. Some of these measures apply irrespective of which kind(s) of content harmful to children the risk level relates to (e.g. some reporting and complaints measures), whereas other measures only apply if the risk level relates to specific kinds of content harmful to children listed as relevant to the measure (such as suicide content, self-harm content, eating disorder content or bullying content).
- If your service is medium or high risk for two or more kinds of content harmful to children, we call it a ‘multi-risk’ service and further measures may apply.

Certain measures apply to large services (even if they are low risk), such as undertaking an annual review of risk management activities and provision of training and materials to individuals working in content moderation.

In the Codes of Practice, we have defined a large service as a service which has an average user base of 7 million or more per month in the UK. This is equivalent to approximately 10% of the UK population. A user does not need to be registered with the service, or post anything. Just viewing content is enough to count as using that service.

Some of the measures involve using highly effective age assurance to determine which users are children, so that you can target appropriate safety measures at children, while respecting adults’ rights to access legal content.

In some cases, providers of user-to-user services will need to use highly effective age assurance to prevent children from accessing the entire service. This is where the principal purpose of a service is to host or disseminate a kind of primary priority content that is harmful to children, such as pornography, or priority content that is harmful to children, such as violent content. 'Principal purpose’ in this context refers to the main activity or objective of the service.

Other user-to-user service providers may need to use highly effective age assurance to target safety measures towards children to protect them from being exposed to harmful content they have identified through content moderation or in children’s recommender feeds.