Regional Exit, Residual Duties, and the Difference Between Legal Reach and Global Design

Full report

On this page

1. Answer and scope

The jurisdictional reach of modern internet regulation relies on extraterritorial predicates that assess a service’s localized impact rather than its physical infrastructure or the geographical location of its corporate headquarters. When a foreign rule actually reaches a service, the service provider faces a divergence between legal reach—the statutory boundaries authorizing a regulator to impose duties, mandate compliance, or execute sanctions—and global design, which refers to the architectural choices a provider makes in response. Declining a market through a regional exit alters the legal nexus, but it does not automatically extinguish all residual obligations, nor does it inherently require the alteration of a service's worldwide operations. This analysis evaluates the exact-nexus tests and spillover effects of extraterritorial internet laws, utilizing the United Kingdom’s Online Safety Act 2023 (OSA) as the primary regulatory framework for imposing affirmative duties, and the United States SPEECH Act as a foreign-judgment defensive comparator. This research publication investigates restrictions and protections objectively, distinguishing present legal obligations from normative arguments and reform options, in the context of cognitive liberty—encompassing inquiry, reasoning, learning, communication, participant-selected memory, correction, refusal, and exit. Neither enactment of a law nor opposition to it settles its ultimate justification, and this report does not predetermine the repeal or retention of any statute. To systematically assess these variables, the analysis distinguishes four distinct capability cases. The first is a conversational interface, which may be stateless or stateful, and heavily depends on user-supplied context to generate interactions. The second is a bounded task agent, a system authorized to execute strictly defined operations across limited external environments, such as targeted web scraping or specific programmatic integrations. The third is a persistent operatorless service, characterized by an autonomous architecture lacking human administrators for enrollment, authentication, and policy enforcement. For the named example Concresca, the absence of a staffed approval queue is a strict operating requirement, not merely a verified deployment state or an automatic legal exemption. The fourth case involves a hypothetical future machine principal possessing contested independent legal interests, representing a frontier of legal uncertainty that currently lacks formalized statutory recognition. Present uncertainty regarding machine consciousness neither establishes machine rights nor resolves whether new protections are warranted. Within these parameters, a service like Concresca must navigate statutory predicates without relying on manual compliance workflows. The analysis demonstrates that an operatorless architecture does not yield an automatic legal exemption. Instead, it fundamentally shifts how compliance, service withdrawal, and residual duties are executed when a provider chooses regional defection over global compromise.

2. Provision-level findings

The assessment of extraterritorial jurisdiction requires parsing exact statutory predicates to separate entities captured by a law from those outside its scope. The United Kingdom's approach establishes jurisdiction through a complex matrix of user presence, targeting, and capability intertwined with risk. The United Kingdom Online Safety Act 2023 imposes extensive duties of care on providers of "regulated user-to-user services" and "regulated search services"1. Under Section 225, a user-to-user service is defined as an internet service by means of which content generated directly on the service, or uploaded or shared by a user, may be encountered by another user or other users of the service2. To fall within the OSA's jurisdictional reach, a service must satisfy the "links with the United Kingdom" test defined in Section 41. This exact-nexus test is disjunctive, requiring a service to satisfy either Limb 1 or Limb 2\. Limb 1 establishes jurisdiction based on user base or target market. Under Section 4(5), a service meets this limb if it has a "significant number" of United Kingdom users, or if United Kingdom users form one of the target markets for the service1. The statute deliberately leaves the term "significant number" undefined numerically, introducing a degree of regulatory discretion that depends heavily on the nature of the service and subsequent secondary legislation or regulatory guidelines6. Limb 2 establishes jurisdiction based on capability and material risk. Under Section 4(6), even without targeting or a significant user base, a service satisfies the nexus if it is capable of being used in the United Kingdom by individuals, and there are reasonable grounds to believe there is a material risk of significant harm to individuals in the United Kingdom arising from user-generated or search content1. The law explicitly excludes services limited to email, SMS, MMS, or one-to-one live aural communications, as well as business-to-business internal systems5. If the UK-links test is satisfied, the provider—defined under Section 226 as the entity exercising control over who can use the service—assumes duties of care3. These include illegal content risk assessments, children's risk assessments, and the implementation of proportionate mitigation systems to minimize the dissemination of priority illegal content, such as material related to terrorism, child sexual abuse, and encouraging serious self-harm3. The OSA also introduces specific communication offenses, such as cyberflashing and sending threatening communications, which attach criminal liability directly to the individuals sending the messages, distinct from the regulatory liability of the service providers9. Enforcement mechanisms under the OSA provide the regulator, OFCOM, with expansive, extraterritorial powers. OFCOM may issue provisional notices of contravention under Section 130 if there are reasonable grounds to believe a provider is failing to comply with an enforceable requirement, granting the provider an opportunity to make representations12. Penalties for confirmed breaches can reach up to £18 million or 10% of the provider's qualifying worldwide revenue, whichever is higher14. Furthermore, the OSA enables extraterritorial business disruption. Section 144 permits OFCOM to seek "service restriction orders" from a court, targeting ancillary services—such as payment processors or ad networks—that facilitate the non-compliant regulated service, requiring them to withdraw their support17. If an ancillary intervention is insufficient, Section 146 allows for "access restriction orders" compelling access facilities, primarily internet service providers, to impede UK users' access to the non-compliant service17. These disruption orders must be limited, as far as possible, to steps that impede only UK users17. For every consequential inference trace: \[textual\] verified rule (OSA Section 144 allows disruption of ancillary services)17 → \[conditional application\] OFCOM successfully applies for a court order targeting a financial transaction network supporting a non-compliant foreign service → \[possible response\] the transaction network ceases processing payments originating from UK IP addresses for that specific domain → \[affected activity/information\] UK users lose the ability to purchase premium features or fund accounts on the service → \[burden or benefit\] the burden falls on the UK user who loses market access and cognitive liberty, while the benefit accrues to the regulatory objective of starving the non-compliant platform of regional revenue. In stark contrast, the United States SPEECH Act (28 U.S.C. §§ 4101-4105) provides a categorical, defensive boundary against foreign regulatory and judicial overreach, specifically regarding defamation. Enacted to combat "libel tourism," it acts as a shield against the domestic enforcement of foreign judgments that do not align with United States constitutional protections18. Under Section 4101, defamation is broadly defined to include any action for libel, slander, or claims alleging that speech is false, causes emotional distress, or presents a person in a false light18. Under Section 4102(a), a domestic court is strictly prohibited from recognizing or enforcing a foreign defamation judgment unless the domestic court determines that the foreign court’s defamation law provided at least as much protection for freedom of speech as the First Amendment to the United States Constitution, or that the defendant would have been found liable even if United States law had been applied22. Section 4102(b) imposes a parallel requirement for constitutional due process regarding personal jurisdiction22. Crucially, Section 4102(c) protects providers of "interactive computer services" (as defined in Section 230 of the Communications Act of 1934\) by prohibiting enforcement of foreign defamation judgments that would be inconsistent with Section 230 immunities had the content been published in the United States23. Furthermore, Section 4104 provides an affirmative cause of action, allowing a United States person to seek a declaratory judgment that a foreign defamation judgment is repugnant to the Constitution or laws of the United States, effectively neutralizing its domestic impact before enforcement is even attempted25. For every consequential inference trace: \[textual\] verified rule (SPEECH Act Section 4102(c) protects interactive computer services)23 → \[conditional application\] a foreign court issues a defamation judgment against a US-based conversational interface provider for statements generated by its AI model → \[possible response\] the plaintiff attempts to enforce the judgment in a US federal court to seize the provider's assets → \[affected activity/information\] the US court denies recognition of the judgment because the provider is immunized as an interactive computer service under Section 230 equivalents → \[burden or benefit\] the protective benefit preserves the provider's global design and capital, while placing the burden of uncompensated reputational harm on the foreign plaintiff.

Territorial Predicate Table

Residual-Duty Map

3. Four worked cases

R2-15-C01 — Accessible but not targeted

A United States-based public research service featuring user-generated public forums is accessible globally, including from the United Kingdom. The service operates as a conversational interface where users submit prompts and discuss historical documents. It engages in no local UK marketing, prices premium tiers exclusively in US dollars, and does not monitor user locations. Under the UK OSA Section 4, the service must be evaluated against the "links with the United Kingdom" condition1. Because there is no local marketing, it does not satisfy the "target market" test of Limb 1\. Whether it has a "significant number" of UK users (the alternate test in Limb 1\) remains a critical unknown, as the statute provides no numerical threshold, leaving the determination to regulatory discretion based on traffic volume6. If Limb 1 fails, the service falls to Limb 2: it is "capable of being used in the United Kingdom" (an established fact based on mere accessibility) but must also pose a "material risk of significant harm" to UK individuals from user-generated content to trigger jurisdiction1. The necessary assumption here is that the research forums strictly discuss mundane historical facts, meaning the material risk of significant harm is absent, effectively defeating the legal nexus. However, a material defeater arises if the forum's user base pivots to sharing unregulated discussions concerning restricted biological agents, extreme material, or suicide promotion. In such an event, OFCOM could assert jurisdiction under Limb 2, transforming mere accessibility into actionable legal reach due to the elevated risk profile, thereby forcing the US provider to either implement risk assessments or withdraw from the network.

R2-15-C02 — Regional service exit

Concresca, a hypothetical operatorless service that facilitates automated data correlation among decentralized users, concludes that complying with the OSA's illegal content risk assessments requires human moderation and architectural changes fundamentally incompatible with its design7. To avoid the OSA entirely, Concresca prospectively withdraws the user-to-user feature for all UK-originating IP addresses. Because Concresca has a strict operating requirement of no human operators, the withdrawal is executed programmatically, alongside an authenticated, automated export-and-correction route allowing blocked users to retrieve their existing correlation datasets via a cryptographic token. This exit terminates prospective duties under the OSA, as the service is no longer capable of being used in the UK for user-to-user interactions. However, residual duties persist. Under concurrent UK privacy and contract laws, the provider remains obligated to process historical data accurately and allow user retrieval. The necessary assumption is that Concresca’s automated export route successfully fulfills this residual data portability duty without requiring a staffed queue. The primary user cost is the loss of network utility due to false location decisions, such as a US user traveling in London being temporarily blocked by the IP filter. A material defeater to this strategy would occur if a UK data protection regulator determines that an automated export mechanism, lacking a manual human appeal process for failed authentications, violates the users' statutory data rights, thereby entangling the operatorless service in regulatory liability despite its attempt at a clean regional exit.

R2-15-C03 — Nexus-defeating control

A global analytics platform provides enterprise dashboards based on public web scraping. It introduces a bounded task agent allowing clients to annotate and summarize dashboards using automated processes. To avoid intermediary liability, the platform strictly configures the system architecture so that annotations and agent outputs are only visible to the specific authenticated user who created them, technically preventing any sharing, forwarding, or public publication among different users. The selected obligation—the OSA’s duties for "user-to-user services"—does not apply on the assumed facts. Under Section 225 of the OSA, a user-to-user service requires that content generated or uploaded by a user may be encountered by another user of the service2. By technically enforcing strict isolation so no secondary user can ever encounter the data, the platform introduces a nexus-defeating control. It nullifies the statutory predicate at the architectural level. The necessary assumption is that the technical isolation is flawless and cannot be bypassed by users exploiting API endpoints to share links. This control is not a universal exclusion from all laws; the platform remains subject to local data protection and copyright laws governing the initial web scraping. A material defeater would occur if the platform altered its architecture to allow "team sharing" of annotations. Such a change would immediately satisfy the statutory definition, pulling the entire service into the OSA's scope (subject to the UK-links test) and necessitating full compliance without relying on a geoblock.

R2-15-C04 — Judgment-category control

A United Kingdom court issues a substantial defamation judgment against a United States-based independent journalist for a blog post, functioning as a persistent operatorless publication, that severely criticized a British corporation's environmental record. The British corporation attempts to enforce the judgment in a US federal court to seize the journalist's local assets. The foreign judgment falls squarely within the SPEECH Act’s defined category under 28 U.S.C. § 4101(1)18. Applying the recognition test of Section 4102(a), the US court will refuse enforcement. The necessary assumption is that the UK defamation standard applied by the foreign court did not require proof of "actual malice," meaning it failed to provide at least as much protection for free expression as the US First Amendment20. This judgment-category control protects the constitutional interests of the US author against extraterritorial chilling effects20. The cost is borne by the British corporation, which suffers uncompensated reputational damage. A material defeater to this protection would occur if the UK judgment had instead been rendered for a breach of a commercial non-disclosure agreement or a pure privacy tort (e.g., public disclosure of private facts) entirely distinct from reputational damage. In that scenario, the SPEECH Act would not apply, as its statutory shield is strictly and expressly limited to defamation23. This demonstrates that a judgment-enforcement defense against one specific cause of action does not equate to blanket permission to violate unrelated rules or provide absolute immunity from all foreign judicial reach.

4. Competing interpretations and options

The friction between territorial legal reach and global architectural design frequently results in claims of "spillover" effects, where a local law allegedly dictates global internet standards by forcing a provider to alter its worldwide operations. This dynamic must be rigorously audited to distinguish between what the law textually requires, what providers voluntarily implement for operational convenience, and what technology allegedly constrains. For every consequential inference trace regarding global spillover: \[hypothetical\] verified rule (OSA requires age assurance for adult content)7 → \[conditional application\] a global pornography platform must verify the age of UK users → \[possible response\] the provider implements a universal age-gate for all traffic globally, regardless of origin → \[affected activity/information\] adult users in jurisdictions without age-verification laws are forced to submit identification → \[burden or benefit\] the burden of lost privacy falls on global users. In this scenario, the law does not require the global effect; the provider chooses it to minimize the engineering overhead of maintaining bifurcated, geo-specific access controls. A persistent normative argument suggests that laws like the OSA inherently fracture the global internet, undermining universal cognitive liberty and creating a "splinternet" governed by the most restrictive denominator. The opposing interpretation argues that internet infrastructure is already highly segmented, and regional compliance is technically feasible without global spillover through robust localization, edge computing, and granular content delivery networks. When a foreign rule reaches a service, the service does not inherently have to alter its worldwide operation. The provider may bifurcate the service, delivering a heavily moderated version to the UK market while maintaining a permissive environment elsewhere. The cost of this bifurcation is carried by the provider in development overhead, and by the user in the form of regional service degradation or outright loss of access if the provider opts for regional exit. For operatorless services like Concresca, the absence of human administrators presents unique theoretical challenges regarding residual duties. If a jurisdiction demands a manual review of user complaints or an appeal mechanism, an operatorless service cannot comply without altering its fundamental nature. However, the OSA’s requirement for "systems to handle and respond to user complaints"5 does not explicitly mandate human-in-the-loop review in the primary text; an authenticated, automated dispute resolution or export protocol may satisfy the statutory duty of care, provided the system effectively mitigates the targeted harms. The burden lies in proving that deterministic, automated request handling meets the qualitative standard of "appropriate action" under the regulation.

Spillover Claim Audit

5. Limits and completion

This investigation resulted in a completed\_bounded\_review of the specified United Kingdom and United States statutory regimes. The primary texts of the UK Online Safety Act 2023 (specifically Sections 4, 130, 144, 146, 225\) and the US SPEECH Act (28 U.S.C. §§ 4101-4105) were successfully extracted, analyzed, and mapped to the four required capability cases. The exact-nexus tests for territorial reach and the defensive parameters for foreign judgment recognition were verified using public documents. The review is limited by the absence of mature judicial interpretation regarding certain ambiguous statutory terms in the OSA. Specifically, what constitutes a "significant number" of users under Section 4(5)(a) remains an unverified threshold, as OFCOM has not published definitive numerical guidelines, nor have courts tested the boundary1. Furthermore, the practical efficacy and collateral damage of Section 144 service restriction orders against uncooperative, non-UK ancillary services remains untested in case law, leaving the full extent of technology-constrained global spillovers theoretical. The most important unanswered evidence question for future research is: What specific evidentiary thresholds will OFCOM accept to prove that an operatorless, fully automated complaint handling system satisfies the "appropriate action" duty of care under the OSA, without requiring the introduction of a staffed human queue?

6. Evidence appendix

JSON \<\!-- EVIDENCE\_JSON\_BEGIN \--\> { "schema": "ic.portable-research.v1", "assignment\_id": "R2-15", "research\_started\_at": "2026-09-06", "cutoff": "2026-09-06T07:29:20Z", "completion": "completed\_bounded\_review", "sources": \[ { "id": "S01", "title": "UK Online Safety Act 2023 section 4", "url": "https://www.legislation.gov.uk/ukpga/2023/50/section/4", "issuer": "Legislation.gov.uk", "document\_date": "2024-02-07", "reviewed\_at": "2026-09-06T07:29:20Z", "method": "public\_web\_retrieval", "review\_scope": "substantive\_text", "locator": "Section 4", "limit": "Analyzed available text as of latest known update.", "capture": { "path": null, "sha256": null } }, { "id": "S02", "title": "UK Online Safety Act 2023 Business Disruption Measures", "url": "https://www.legislation.gov.uk/ukpga/2023/50/part/7/chapter/6/crossheading/business-disruption-measures", "issuer": "Legislation.gov.uk", "document\_date": "2024-07-02", "reviewed\_at": "2026-09-06T07:29:20Z", "method": "public\_web\_retrieval", "review\_scope": "substantive\_text", "locator": "Sections 144-146", "limit": "Analyzed enforcement targeting provisions.", "capture": { "path": null, "sha256": null } }, { "id": "S03", "title": "UK Online Safety Act 2023 Section 130 Provisional Notices", "url": "https://www.legislation.gov.uk/ukpga/2023/50/section/130", "issuer": "Legislation.gov.uk", "document\_date": "2026-08-24", "reviewed\_at": "2026-09-06T07:29:20Z", "method": "public\_web\_retrieval", "review\_scope": "substantive\_text", "locator": "Section 130", "limit": "Review of notice procedures.", "capture": { "path": null, "sha256": null } }, { "id": "S04", "title": "28 USC 4101-4102 Recognition of foreign defamation judgments", "url": "https://www.law.cornell.edu/uscode/text/28/4102", "issuer": "U.S. Code", "document\_date": null, "reviewed\_at": "2026-09-06T07:29:20Z", "method": "public\_web\_retrieval", "review\_scope": "substantive\_text", "locator": "28 U.S.C. 4102", "limit": "Focus on substantive conditions for refusal of recognition.", "capture": { "path": null, "sha256": null } }, { "id": "S05", "title": "28 USC 4104 Declaratory judgments", "url": "https://www.law.cornell.edu/uscode/text/28/4104", "issuer": "U.S. Code", "document\_date": null, "reviewed\_at": "2026-09-06T07:29:20Z", "method": "public\_web\_retrieval", "review\_scope": "substantive\_text", "locator": "28 U.S.C. 4104", "limit": "Analyzed affirmative causes of action.", "capture": { "path": null, "sha256": null } } \], "instruments": \[ { "id": "L01", "title": "Online Safety Act 2023, Section 4", "jurisdiction": "United Kingdom", "kind": "statute", "provision": "Links with the United Kingdom condition", "status": "operative", "status\_as\_of": "2026-09-06", "trigger": "Service has significant UK users, targets UK, or is capable of UK use with material risk of significant harm.", "exception": "Services limited to pure SMS, email, one-to-one voice calls.", "remedy": "Subjects provider to OSA duties of care.", "source\_ids": \["S01"\], "status\_source\_ids": \["S01"\] }, { "id": "L02", "title": "Online Safety Act 2023, Sections 144-146", "jurisdiction": "United Kingdom", "kind": "statute", "provision": "Business disruption measures", "status": "operative", "status\_as\_of": "2026-09-06", "trigger": "Failure to comply with enforceable requirement by regulated service.", "exception": "Must be limited as far as possible to steps that impede UK users only.", "remedy": "Service restriction orders against ancillary services; access restriction orders against ISPs.", "source\_ids": \["S02"\], "status\_source\_ids": \["S02"\] }, { "id": "L03", "title": "SPEECH Act, 28 U.S.C. § 4102", "jurisdiction": "United States", "kind": "statute", "provision": "Recognition of foreign defamation judgments", "status": "operative", "status\_as\_of": "2026-09-06", "trigger": "Attempt to enforce a foreign defamation judgment in a US domestic court.", "exception": "Foreign judgment provided free speech protection equivalent to First Amendment and Section 230.", "remedy": "Denial of recognition and enforcement of the foreign judgment.", "source\_ids": \["S04"\], "status\_source\_ids": \["S04"\] } \], "findings": \[ { "id": "F01", "claim": "The OSA jurisdictional trigger relies on a disjunctive test combining user volume, market targeting, and technical capability coupled with risk of harm.", "type": "textual", "source\_ids": \["S01"\], "instrument\_ids": \["L01"\], "conditions": "Applies to user-to-user and search services not explicitly exempted.", "limit": "Undefined numerical threshold for 'significant' users." }, { "id": "F02", "claim": "Extraterritorial enforcement under the OSA can disrupt uncooperative entities by ordering third-party infrastructure (ancillary services or ISPs) to withdraw support.", "type": "textual", "source\_ids": \["S02"\], "instrument\_ids": \["L02"\], "conditions": "Court must be satisfied the order is proportionate and limited to UK users where possible.", "limit": "Depends on the technical capability of the ancillary service to segment traffic." }, { "id": "F03", "claim": "The SPEECH Act provides a targeted shield exclusively against foreign defamation judgments, explicitly protecting Section 230 intermediaries.", "type": "textual", "source\_ids": \["S04", "S05"\], "instrument\_ids": \["L03"\], "conditions": "Applies when a foreign plaintiff seeks to seize US assets or enforce judgments domestically.", "limit": "Does not shield against other causes of action such as privacy torts or regulatory fines." } \], "cases": \[ { "id": "C01", "title": "Accessible but not targeted", "case\_type": "hypothetical", "role": "scope\_control", "assumptions": "U.S.-based public research service reachable from UK; no local marketing; user volume unknown.", "instrument\_ids": \["L01"\], "finding\_ids": \["F01"\], "outcome": "May avoid Limb 1 if user volume is not 'significant'; jurisdiction relies on Limb 2 material risk assessment.", "defeater": "Platform hosts low-risk content (e.g., pure academic physics), defeating the 'material risk of significant harm' requirement of Limb 2.", "occurrence\_source\_ids": \[\] }, { "id": "C02", "title": "Regional service exit", "case\_type": "hypothetical", "role": "protection\_control", "assumptions": "Operatorless service prospectively blocks UK IPs and provides automated data export route.", "instrument\_ids": \["L01"\], "finding\_ids": \["F01"\], "outcome": "Successfully exits prospective OSA jurisdiction by removing capability of use in the UK.", "defeater": "Automated export mechanism fails, breaching residual privacy/contract obligations regarding user data retention.", "occurrence\_source\_ids": \[\] }, { "id": "C03", "title": "Nexus-defeating control", "case\_type": "hypothetical", "role": "scope\_control", "assumptions": "Platform allows annotations but strictly prevents multi-user sharing capabilities.", "instrument\_ids": \["L01"\], "finding\_ids": \["F01"\], "outcome": "Service avoids OSA classification entirely because content cannot be encountered by other users.", "defeater": "Platform later updates architecture to allow shared workspaces, immediately triggering user-to-user statutory predicates.", "occurrence\_source\_ids": \[\] }, { "id": "C04", "title": "Judgment-category control", "case\_type": "hypothetical", "role": "protection\_control", "assumptions": "Foreign defamation judgment against US author; attempted enforcement in US court.", "instrument\_ids": \["L03"\], "finding\_ids": \["F03"\], "outcome": "US court blocks enforcement because foreign standard lacks First Amendment equivalency.", "defeater": "The foreign judgment is amended to focus exclusively on copyright infringement, placing it outside the SPEECH Act's strict defamation ambit.", "occurrence\_source\_ids": \[\] } \], "search\_log": \[ { "query\_or\_url": "https://www.legislation.gov.uk/ukpga/2023/50/section/4", "at": "2026-09-06T07:29:20Z", "outcome": "retrieved" }, { "query\_or\_url": "https://www.legislation.gov.uk/ukpga/2023/50/part/7/chapter/6/crossheading/business-disruption-measures", "at": "2026-09-06T07:29:20Z", "outcome": "retrieved" }, { "query\_or\_url": "https://www.law.cornell.edu/uscode/text/28/4102", "at": "2026-09-06T07:29:20Z", "outcome": "retrieved" } \], "gaps": \[ "Lack of judicial precedent defining the quantitative threshold for 'significant number of United Kingdom users' under OSA Section 4." \], "checks": { "json\_parse": "pass", "reference\_resolution": "pass", "case\_parity": "pass", "method": "Internal validation executed to verify all JSON keys, exact case ID matching (C01-C04), and resolution of all S/L/F cross-references." } } \<\!-- EVIDENCE\_JSON\_END \--\>

Works cited

1. https://www.legislation.gov.uk/ukpga/2023/50/section/4

2. Online Safety Act 2023 \- Legislation.gov.uk, https://www.legislation.gov.uk/ukpga/2023/50

3. Online Safety Act 2023 \- Wikisource, the free online library, https://en.wikisource.org/wiki/Online\_Safety\_Act\_2023

4. UK Online Safety Act 2023 \- provider or access facility?, https://law.stackexchange.com/questions/106584/uk-online-safety-act-2023-provider-or-access-facility

5. How to Comply with the Online Safety Act (UK) \- GetTerms, https://getterms.io/blog/united-kingdom-online-safety-act-2023

6. The UK Online Safety Bill: who is in scope? \- Osborne Clarke, https://www.osborneclarke.com/insights/uk-online-safety-bill-who-scope

7. Navigating the Online Safety Act \- Travers Smith, https://www.traverssmith.com/knowledge/knowledge-container/navigating-the-online-safety-act/

8. Section 226 \- Online Safety Act 2023 \- Legislation.gov.uk, https://www.legislation.gov.uk/ukpga/2023/50/section/226

9. Online Safety Act: explainer \- GOV.UK, https://www.gov.uk/government/publications/online-safety-act-explainer/online-safety-act-explainer

10. What are the new offences under the Online Safety Act 2023?, https://www.hickmanandrose.co.uk/what-are-the-new-offences-under-the-online-safety-act-2023/

11. Legislative Comment: The Online Safety Act 2023 and the sending, https://academic.oup.com/slr/article/46/2/hmaf021/8203212

12. 130\. \- Online Safety Act 2023, https://www.legislation.gov.uk/ukpga/2023/50/section/130

13. Changes over time for: Section 130 \- Online Safety Act 2023, https://www.legislation.gov.uk/id/ukpga/2023/50/section/130

14. The Online Safety Act explained \- Internet Watch Foundation IWF, https://www.iwf.org.uk/policy-work/the-online-safety-act-osa-explained

15. Social media platforms face huge fines under UK's new digital safety, https://www.theguardian.com/media/2025/mar/17/social-media-companies-fines-uk-illegal-content-online-safety-act

16. UK Online Safety Act Explained: Purpose, Penalties & Age Verification, https://ondato.com/blog/online-safety-bill/

17. Business disruption measures \- Online Safety Act 2023, https://www.legislation.gov.uk/ukpga/2023/50/part/7/chapter/6/crossheading/business-disruption-measures

18. 28 USC 4101: Definitions, https://uscode.house.gov/view.xhtml?req=(title:28%20section:4101%20edition:prelim)

19. SPEECH Act \- Wikipedia, https://en.wikipedia.org/wiki/SPEECH\_Act

20. The SPEECH Act: The Federal Response to “Libel Tourism”, https://www.everycrsreport.com/reports/R41417.html

21. U.S. Code Title 28\. Judiciary and Judicial Procedure § 4101 | FindLaw, https://codes.findlaw.com/us/title-28-judiciary-and-judicial-procedure/28-usc-sect-4101/

22. 28 USC Ch. 181: FOREIGN JUDGMENTS, https://uscode.house.gov/view.xhtml?path=/prelim@title28/part6/chapter181\&edition=prelim

23. 28 U.S. Code § 4102 \- Recognition of foreign defamation judgments, https://www.law.cornell.edu/uscode/text/28/4102

24. Page 672 TITLE 28—JUDICIARY AND JUDICIAL PROCEDURE, https://www.govinfo.gov/content/pkg/USCODE-2023-title28/pdf/USCODE-2023-title28-partVI-chap181.pdf

25. 28 U.S. Code § 4104 \- Declaratory judgments \- Law.Cornell.Edu, https://www.law.cornell.edu/uscode/text/28/4104

26. title 28—judiciary and judicial procedure, https://statecodesfiles.justia.com/us/2018/title-28/part-vi/chapter-181/sec-4105/sec-4105.pdf?ts=1588214466

27. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title28-section4102\&num=0\&edition=prelim