Rules and ethics
Part of Community management rules and ethics in England
How UK online safety, data protection, consumer and advertising rules can apply to an online community
Explains how UK online safety, data protection, consumer and advertising rules can apply to an online community, with scope checks, roles and questions.
No single UK law governs every community. The rules depend on who provides the service, what members can do, whose personal data is used, whether children may access it and whether commercial claims appear. A provider should check those facts before asking which regime applies.
This overview is general information checked on 5 September 2026, not legal advice. Scope can be technical, so use current regulator material and obtain qualified advice.
What to take away
- No single UK law covers every online community, so start with the facts that decide scope.
- The Online Safety Act may apply to certain internet services with UK links, including user-to-user and search services.
- Data protection follows the processing, and buying a platform does not transfer every responsibility to the provider.
- Consumer and advertising rules depend on activity such as paid membership, recommendations, reviews or promotional posts.
- Other duties can enter through the subject, including employment, equality, intellectual property, defamation and sector regulation.
| Regime | Regulator |
|---|---|
| Online safety | Ofcom |
| Data protection | ICO |
| Consumer protection | CMA |
| Advertising codes | ASA |
Online safety may apply to the service provider
The Online Safety Act is relevant to certain internet services with links to the UK. Ofcom's Regulation Checker starts by distinguishing user-to-user, search and pornography services. A brand using an unrelated social network and a business providing its own forum may occupy different positions. Do not assume that calling a space "private" or "B2B" answers the scope question.
Does the Online Safety Act apply?
Does the service have UK links?
Check Ofcom Regulation Checker
Outside online safety scope
The core illegal content duties apply to in-scope user-to-user and search services regardless of size. Categorisation uses a threshold of more than 7 million UK monthly active users for the largest categories. The Act exempts limited functionality services, such as one-to-one live voice and video calls, email, SMS and MMS.
Small user-to-user services with fewer than 7 million UK monthly active users are exempt from some additional duties, but the core illegal content and children's duties still apply. Ofcom's illegal content duties commenced on 17 March 2025, with risk assessments required by that date. Children's access assessment duties commenced on 17 April 2025.
Children's risk assessment duties and Ofcom's deadline for those assessments was 17 July 2025. Children's safety duties commenced on 25 July 2025.
For example, a members-only forum with 500 UK users that allows posts and comments is likely a user-to-user service. It needs an illegal content risk assessment even if it has no children. A one-to-one email list with 20 subscribers is likely exempt under the limited functionality exemption. These are illustrative figures.
For an in-scope service, Ofcom's current page on illegal content duties describes risk assessment, safety, record-keeping, reporting and complaints requirements. It also links the operative guidance and codes. Follow the regulator's current documents rather than relying on an old launch checklist.
If children may use the service, further assessment and protection duties can arise. Ofcom explains children's access assessment duties. Age, access and likely use need evidence; a terms clause saying "adults only" is not necessarily the end of the enquiry.
Data protection follows the processing
Member accounts, posts, moderation records, event attendance and analytics can involve personal data. The organisation must establish purpose, lawful basis, transparency, minimisation, access, retention, security and individual-rights handling under the applicable UK data protection regime.
Buying a platform does not transfer every responsibility. The Information Commissioner's Office's controller and processor guidance explains that roles depend on the decisions made about processing. The same parties can occupy different roles in different contexts.
A subject access request must normally be answered within one month. The ICO can fine up to £17.5 million or 4% of annual global turnover, whichever is higher, for serious UK GDPR breaches.
Consumer and advertising rules depend on activity
A paid membership, product recommendation, customer review or promotional post can create separate consumer or advertising questions. The Competition and Markets Authority's unfair commercial practices guidance covers Digital Markets, Competition and Consumers Act provisions applying to commercial practices from 6 April 2025.
Community rules should not conceal incentives, manipulate reviews or omit material information from consumer decisions.
The CAP Code can apply to non-broadcast marketing communications. Whether a member contribution becomes advertising depends on the commercial relationship, content and control, not simply the fact that it appears inside a community.
Other duties can enter through the subject
Employment, equality, intellectual property, defamation, safeguarding, sector regulation and contract law may matter according to the audience and activity. A health peer group and a software customer forum should not share a generic risk conclusion.
Accessibility also needs a route into planning. Public-sector bodies have specific legal obligations, while other service providers can face duties under equality law according to the relationship and facts. A conformance statement or an accessible theme does not prove that joining, posting, reporting and leaving work for disabled members.
Test the actual journey and obtain advice on the applicable duty.
Member content can introduce copyright and confidentiality questions. Decide what permission the service needs to display a contribution, how alleged infringement is reported and who reviews a request. Do not assume that material available elsewhere online is free to republish inside a commercial knowledge base.
Sector rules may change who may answer. Financial, health, legal or regulated professional discussions need boundaries around advice and escalation. Community disclaimers do not automatically remove responsibilities created by the provider's own statements or conduct.
Keep one scope record with the service feature, relevant people, potential regime, evidence, owner and review date. Revisit it when access, recommendation features, monetisation or member age changes.
Before you act
- Record who provides the service and what members can do.
- Check Ofcom's Regulation Checker for online safety scope.
- Assess whether children may access the service.
- Record each processing activity and the roles of each party.
- Review consumer and advertising rules for commercial activity.
- Keep a scope record with owner and review date.
Common questions
Does the Online Safety Act apply to every online community?
No. See the Online safety section above for thresholds, exemptions and dates. Ofcom's Regulation Checker distinguishes user-to-user, search and pornography services. A private or B2B label does not settle scope.
Does buying a platform transfer all data protection responsibilities?
No. The ICO guidance explains that controller and processor roles depend on the decisions made about processing. Member accounts, posts, moderation records, event attendance and analytics can all involve personal data. See the Data protection section for the DSAR deadline and penalty figures.
When do consumer and advertising rules apply to a community?
A paid membership, recommendation, review or promotional post can trigger separate consumer or advertising rules. See the Consumer and advertising section for the CMA and CAP position.
