SI 2025/919 - The Online Safety Super-Complaints (Eligibility and Procedural Matters) Regulations 2025

Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format.

STATUTORY INSTRUMENTS 2025 No. 919 ELECTRONIC COMMUNICATIONS The Online Safety Super-Complaints (Eligibility and Procedural Matters) Regulations 2025 Made - - - - 22nd July 2025 Coming into force - - 31st December 2025 The Secretary of State makes these Regulations in exercise of the powers conferred by sections 169(3), 169(4), 170(1), 170(2) and 224(1) of the Online Safety Act 2023(1).

The Secretary of State has consulted OFCOM and such other persons as the Secretary of State considers appropriate, as required by sections 169(5) and 170(3) of that Act.

In accordance with section 225(1)(d) of that Act a draft of this instrument has been laid before Parliament and approved by a resolution of each House of Parliament.

Citation, commencement, extent and interpretation

1.—(1) These Regulations may be cited as the Online Safety Super-Complaints (Eligibility and Procedural Matters) Regulations 2025 and come into force on 31st December 2025.

(2) These Regulations extend to England and Wales, Scotland and Northern Ireland.

(3) In these Regulations— “the 2023 Act” means the Online Safety Act 2023; “complaint” means a complaint submitted to OFCOM under section 169(1) of the 2023 Act (power to make super-complaints).

Eligibility criteria

2.—(1) The criteria referred to in section 169(3) of the 2023 Act (criteria that must be met by an entity(2) for it to be an “eligible entity”) are set out in paragraphs (2) to (6).

(2) The first criterion is that the entity must be a body representing the interests of users of regulated services, or members of the public, or a particular group of such users or members of the public(3).

(1) 2023 c. 50.

(2) “Entity” is defined in section 236(1) of the Online Safety Act 2023.

(3) “Users” is defined in section 169(6) of the Online Safety Act 2023.Document Generated: 2025-12-31

Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format.

(3) The second criterion is that the composition of the entity and the arrangements for its governance and accountability are such that it can be relied upon to act independently from regulated services(4) (see also paragraph (4)).

(4) That an entity—

(a) receives funding from regulated services, or

(b) has one or more representatives from regulated services involved in the governance of that entity, does not prevent that entity from being able to meet the criterion in paragraph (3).

(5) The third criterion is that the entity routinely contributes significantly, as an expert, to public discussions about any aspect of online safety matters(5).

(6) The fourth criterion is that the entity can be relied upon to have due regard to any guidance published by OFCOM under section 171(2) of the 2023 Act.

Eligibility criteria - supporting evidence

3.—(1) Subject to paragraph (3), a complaint must be accompanied by—

(a) information from the entity to explain how it represents the interests of users of regulated services, or members of the public, or a particular group of such users or members of the public (see regulation 2(2)),

(b) information from the entity to explain how its composition and the arrangements for its governance and accountability are such that it can be relied upon to act independently from regulated services (see regulation 2(3)),

(c) information from the entity to explain how it—

(i)is an expert about an aspect of online safety matters, and

(ii)routinely contributes significantly to public discussions about such matters (see regulation 2(5)), and

(d) where a complaint is submitted jointly by more than one entity, information as to which entity is the lead entity.

(2) For the purposes of paragraph (1)(c), OFCOM must treat as irrelevant information about content(6) that an entity has generated, uploaded or shared on a user-to-user service(7).

(3) W here—

(a) OFCOM have previously determined that an entity is an eligible entity under regulation 8(1) (determination whether an entity is eligible),

(b) the complaint is submitted before the end of the period of five years beginning with the day OFCOM made that determination, and

(c) since that determination the entity has not had a complaint rejected on the grounds of regulation 5(1)(a) (the entity is not an eligible entity), the complaint may be accompanied by the statement described in paragraph (4) instead of the information in paragraph (1)(a) and (b).

(4) The statement referred to in paragraph (3) is a statement from the entity—

(a) that there have been no changes to the information the entity previously provided to OFCOM under paragraph (1)(a) and (b), and

(4) “Regulated service” is defined in section 4(4) of the Online Safety Act 2023.

(5) “Online safety matters” is defined in section 235(4) of the Online Safety Act 2003.

(6) “Content” is defined in section 236(1) of the Online Safety Act 2023.

(7) “User-to-user service” is defined in section 3(1) of the Online Safety Act 2023.

2Document Generated: 2025-12-31

Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format.

(b) requesting OFCOM apply regulation 8(2) (15-day time-limit for determining eligibility status) to determine whether the entity is still an eligible entity.

Information to be included in a super-complaint

4.—(1) A complaint must—

(a) be in writing,

(b) provide the name and email address of an individual representing the entity who may be contacted by OFCOM about the complaint and where the complaint is submitted jointly by more than one entity this individual must represent the lead entity (see regulation 3(1)(d)),

(c) set out the feature of one or more regulated services, or the conduct of one or more providers(8) of such services, or the combination of such features and such conduct, to which the complaint relates,

(d) set out the regulated services or providers of such services to which the complaint relates,

(e) set out which of the grounds in section 169(1)(a), (b) or (c) of the 2023 Act the complaint relates to,

(f) be accompanied by evidence and explain how that evidence supports the entity’s view that one of the grounds in section 169(1)(a), (b) or (c) of the 2023 Act is met,

(g) provide sufficient information for OFCOM to—

(i)be able to verify that any claims made about the evidence in the complaint are accurate, including the source of the evidence and any specific findings quoted in the complaint,

(ii)be able to evaluate and interpret that evidence for themselves, and

(iii)be satisfied that the evidence referred to in sub-paragraph (f) is—

(aa)relevant to the complaint,

(bb)current, and

(cc)objective, and

(h) where the complaint relates to a single regulated service or a single provider of one or more regulated services, explain—

(i)why the complaint is of particular importance, or

(ii)how the complaint relates to the impacts on a particularly large number of users of the service or members of the public.

(2) Where a complaint, or part of a complaint, merely repeats the substance of another complaint that has been considered by OFCOM and the circumstances described in regulation 5(2)(c)(i) and

(ii) apply, the complaint must set out why the entity considers that there has been the material change of circumstances referred to in regulation 5(2)(c).

(3) Where an entity is requesting that OFCOM apply regulation 10(2) (where an eligible entity wants OFCOM to consider complaint D instead of complaint C), complaint D must be accompanied by the statement referred to in regulation 10(2)(b).

Grounds for rejecting a super-complaint

5.—(1) OFCOM must reject a complaint if—

(a) it determines that the entity is not an eligible entity;

(b) it determines that the complaint is not of a type described in section 169(1) of the 2023 Act;

(8) “Provider” is defined in section 226 of the Online Safety Act 2023.

3Document Generated: 2025-12-31

Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format.

(c) where the complaint relates to a single regulated service or to a single provider of one or more regulated services, OFCOM determines that the complaint is not admissible under

section 169(2) of the 2023 Act;

(d) the period between the day OFCOM received the complaint and the day OFCOM received any previous complaint from the entity, not including a previous complaint rejected under this sub-paragraph, is less than six months starting with the day OFCOM received any previous complaint from the entity, except in the circumstances described in regulation 10(2) to (4).

(2) OFCOM may reject—

(a) a complaint, or any part of a complaint, that does not meet the requirements of regulation 3 or regulation 4;

(b) a complaint, or any part of a complaint, that merely repeats the substance of another complaint that is being considered by OFCOM;

(c) a complaint, or any part of a complaint, (“complaint B”) that merely repeats the substance of another complaint (“complaint A”) that has been considered by OFCOM where—

(i)OFCOM made publicly available information relating to complaint A under regulation 9(1)(b), and

(ii)complaint B is received by OFCOM before the end of two years starting with the day OFCOM made publicly available information relating to complaint A under regulation 9(1)(b), unless complaint A was rejected solely on the ground described in paragraph (1)(d) (non- compliance with the six-month rule) or there has been a material change of circumstances since complaint A was made;

(d) a complaint where some or all of the matter of the complaint is being considered by a court in the United Kingdom.

(3) Where some or all of the matter of the complaint is being considered by another regulator in the United Kingdom, OFCOM may reject the whole complaint or that part of the complaint that OFCOM believes is being considered by the other regulator.

(4) Paragraph (5) applies where OFCOM have—

(a) requested further information from the entity (see regulation 8(5) and regulation 9(3)) and the entity has not provided that information within a reasonable time, or

(b) given an information notice(9) to the entity under section 100(1) of the 2023 Act (power to require information) and the entity has not provided the information in accordance with that notice.

(5) Where this paragraph applies, OFCOM may reject—

(a) the whole complaint where OFCOM consider that they cannot—

(i)determine the entity’s eligibility, or

(ii)respond to any part of the complaint, without the further information, or

(b) those parts of the complaint that OFCOM consider they cannot respond to without the further information.

(9) “Information notice” is defined in section 236(1) of the Online Safety Act 2023 as meaning a notice given under section 100(1) or 101(1).

4Document Generated: 2025-12-31

Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format.

Withdrawing a super-complaint

6. An entity may withdraw their complaint by writing to OFCOM, but a complaint cannot be withdrawn after OFCOM have informed the entity of their response under regulation 9(1)(a).

Duty to acknowledge receipt

7.—(1) OFCOM must acknowledge, to the individual named under regulation 4(1)(b), receipt of a complaint as soon as practicable after receiving that complaint.

(2) The acknowledgement must include the date that OFCOM received the complaint.

Determination whether an entity is eligible

8.—(1) Where a complaint is not accompanied by the statement referred to in regulation 3(3), OFCOM must determine, by the end of 30 days beginning with the day after the day on which the complaint was received by OFCOM, whether the entity is an eligible entity (see regulation 2).

(2) Where a complaint is accompanied by the statement referred to in regulation 3(3), OFCOM must determine, by the end of 15 days beginning with the day after the day on which the complaint was received by OFCOM, whether the entity is still an eligible entity (see regulation 2).

(3) Where a complaint is submitted jointly by more than one entity, OFCOM is only required to determine whether the lead entity (see regulation 3(1)(d)) is eligible.

(4) OFCOM must inform the entity of their determination under paragraph (1) or (2), and the date that determination was made, as soon as practicable after having made that determination.

(5) Where OFCOM consider that they need further information from the entity to be able to determine whether the entity is eligible (for example, the complaint is missing information that is required under regulation 3), OFCOM may write to the entity to request that further information.

(6) Where OFCOM consider that they need further information from the entity to be able to determine whether the entity is eligible and—

(a) OFCOM have written to the entity to request that further information from the entity under paragraph (5), OFCOM may extend the 30 days or 15 days referred to in paragraphs (1) and (2), as is applicable, by the number of days from the day that OFCOM writes to the entity to the day that the requested information is received by OFCOM;

(b) OFCOM have given an information notice to the entity under section 100(1) of the 2023 Act (power to require information) in order to obtain that information, OFCOM may extend the 30 days or 15 days referred to in paragraphs (1) and (2), as is applicable, by the number of days from the day that the information notice is given to the day that the required information is provided.

Responding to a super-complaint

9.—(1) Where OFCOM have determined that an entity is eligible, OFCOM must, by the end of the relevant period, consider the complaint and—

(a) inform the eligible entity of their response in writing and reasons for that response, including, where the response is a rejection of all or part of the complaint, on which of the grounds in regulation 5 the complaint, or part of the complaint, is rejected, and

(b) make publicly available a summary of the complaint, OFCOM’s response to it and their reasons for that response, including, where the response is a rejection of all or part of the complaint, on which of the grounds in regulation 5 the complaint, or part of the complaint, is rejected.

(2) The relevant period is 90 days beginning with the day after— 5Document Generated: 2025-12-31

Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format.

(a) the period of 30 days referred to in regulation 8(1) ends,

(b) the period of 15 days referred to in regulation 8(2) ends, or

(c) any longer period calculated in accordance with regulation 8(6) ends, whichever is applicable (see also regulation 10(2)(b)(ii)).

(3) Where OFCOM consider that they need further information from the entity to be able to consider the complaint (for example, the complaint is missing information that is required under regulation 4), OFCOM may write to the entity to request that further information.

(4) Where OFCOM consider that they need further information from the entity to be able to consider the complaint and—

(a) OFCOM have written to an entity to request that further information from the entity under paragraph (3), OFCOM may extend the 90 days referred to in paragraph (1) by the number of days from the day that OFCOM writes to the entity to the day that the requested information is received by OFCOM;

(b) OFCOM have given an information notice to the entity under section 100(1) of the 2023 Act (power to require information) in order to obtain that information, OFCOM may extend the 90 days referred to in paragraph (1) by the number of days from the day that the information notice is given to the day that the required information is provided.

Restrictions on submitting a super-complaint

10.—(1) Where an entity has submitted a complaint other than any complaint rejected solely on the ground described in regulation 5(1)(d) (non-compliance with the six-month rule) (“complaint C”), the entity may not submit another complaint until the day after the end of six months beginning with the day that OFCOM received complaint C, except in the circumstances described in paragraphs

(2) to (4).

(2) W here—

(a) OFCOM have not informed the entity of their response to complaint C under regulation 9(1)(a), and

(b) the entity submits a different complaint (“complaint D”) accompanied with a statement that the entity is withdrawing complaint C and wants OFCOM to consider complaint D instead, OFCOM must—

(i)determine, if OFCOM have not already, whether the entity is eligible in accordance with regulation 8 and if the entity is eligible, consider complaint D in accordance with regulation 9, or

(ii)if OFCOM have already determined, in relation to complaint C, that the entity is eligible, consider complaint D in accordance with regulation 9 as if the 90 days (see regulation 9(2)) started on the day that OFCOM received complaint D.

(3) W here—

(a) OFCOM have—

(i)previously rejected a complaint on the grounds that the matter of the complaint was being considered by a court (see regulation 5(2)(d)), or

(ii)previously rejected a complaint or part of a complaint on the grounds that some or all of the matter of the complaint was being considered by another regulator (see regulation 5(3)), and

(b) the matter is no longer under consideration by a court or other regulator in the United Kingdom, 6Document Generated: 2025-12-31

Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format. the entity may, at any time, submit that complaint, or the part of the complaint that was rejected on the grounds of regulation 5(3), again to OFCOM.

(4) Regulation 10(1) does not apply to an entity (“Entity A”) that jointly submits a complaint with one or more other entities where Entity A is not the lead entity for that complaint.

Jones of Whitchurch Parliamentary Under-Secretary of State Department for Science, Innovation and 22nd July 2025 Technology 7Document Generated: 2025-12-31

Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format.

EXPLANATORY NOTE (This note is not part of the Regulations) Under section 169(1) of the Online Safety Act 2023 (c. 50) (power to make super-complaints) an eligible entity may make a complaint to OFCOM about certain issues relating to online safety. These Regulations set out the criteria that an entity must meet to be an “eligible entity” for this purpose and contain provision about procedural matters relating to such complaints.

Regulation 2 specifies the criteria an entity must meet to be an eligible entity. Regulation 3 sets out the supporting evidence that an entity must submit in relation to the eligibility criteria specified in regulation 2. Regulation 8 makes provision about OFCOM determining whether an entity is eligible. If OFCOM determine that an entity is not eligible, OFCOM does not need to consider the complaint and must reject the complaint (see regulation 5(1)(a)).

Regulation 4 makes provision about the information that an entity must include in a complaint. Regulation 5 sets out the grounds for rejecting a complaint; OFCOM must reject a complaint if one of the grounds in regulation 5(1) applies and may reject a complaint if one of the grounds in regulation 5(2), (3) or (5) applies. Regulation 9 makes provision about OFCOM’s functions of considering and responding to a complaint. Regulation 10 sets out restrictions on submitting a complaint; where an entity has submitted a complaint, it may not submit another complaint within six months of submitting the previous complaint unless one of the circumstances in regulation 10(2) to (4) applies.

A full impact assessment has not been produced for this instrument as no, or no significant, impact on the private, voluntary or public sector is foreseen.

8