Online Safety Act 2023UK · 2023 c. 50
Digiphile
Online Safety Act 2023 (c. 50) – Section 66 – Requirement to report CSEA content to the NCA

Sections

Section 66Requirement to report CSEA content to the NCA

(1) A UK provider of a regulated user-to-user service must operate the service using systems and processes which secure (so far as possible) that the provider reports all detected and unreported CSEA content present on the service to the NCA.
(2) A non-UK provider of a regulated user-to-user service must operate the service using systems and processes which secure (so far as possible) that the provider reports all detected and unreported UK-linked CSEA content present on the service to the NCA (and does not report to the NCA CSEA content which is not UK-linked).
(3) A UK provider of a regulated search service must operate the service using systems and processes which secure (so far as possible) that the provider reports all detected and unreported CSEA content present on websites or databases capable of being searched by the search engine to the NCA.
(4) A non-UK provider of a regulated search service must operate the service using systems and processes which secure (so far as possible) that the provider reports all detected and unreported UK-linked CSEA content present on websites or databases capable of being searched by the search engine to the NCA (and does not report to the NCA CSEA content which is not UK-linked).
(5) A UK provider of a combined service must comply with the requirement under subsection (3) in relation to the search engine of the service.
(6) A non-UK provider of a combined service must comply with the requirement under subsection (4) in relation to the search engine of the service.
(7) Providers’ reports under this section—
  • (a)
    must meet the requirements set out in regulations under section 67, and
  • (b)
    must be sent to the NCA in the manner, and within the time frames, set out in those regulations.
(8) If a person is the provider of more than one regulated user-to-user service or regulated search service, requirements under this section apply in relation to each such service.
(9) Terms used in this section are defined in section 70.
(10) This section applies only in relation to CSEA content detected on or after the date on which this section comes into force.

Pending amendment (not yet in force)

legislation.gov.uk records the following amendment(s) to this Section that had not been brought into force on 19 September 2026 and are therefore not reflected in the text above:

  • s. 66(1)(2): coming into force by S.I. 2025/371, reg. 2(1)(a)
  • s. 66(7)-(10): coming into force by S.I. 2025/371, reg. 2(1)(b), (2) (only so far as it relates to regulated user-to-user services)

Annotations

Commencement Information

  1. I1 S. 66 not in force at Royal Assent, see s. 240(1)
  2. I2 S. 66(1)(2) in force at 7.4.2026 by S.I. 2026/262, reg. 2(1)(a)
  3. I3 S. 66(7)-(10) in force at 7.4.2026 for specified purposes by S.I. 2026/262, reg. 2(1)(b)(2)

https://osa.digiphile.law/article/article-66.html

Text as at 19 September 2026.

This is an unofficial convenience version of the Online Safety Act 2023. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.

Type to search the full text.