Your reviews wall is probably outside the Online Safety Act, and the one feature that would change that

The definition, in section 3(1):

Section 3(2) closes the escape route: it does not matter whether content is actually shared, as long as the service has a functionality that allows such sharing, and it does not matter what proportion of the content is of that kind. An empty comments box counts as much as a busy one. Section 4(2) makes such a service regulated if it has links with the United Kingdom and is not either a service of a description exempt as provided for by Schedule 1 or a service of a kind described in Schedule 2. Section 4(5) concedes that limb for a UK restaurant: links exist where a service has a significant number of United Kingdom users, or where they form one of its target markets, or the only one. Schedule 1 is the whole question.

Schedule 1 paragraph 4, limited functionality services, is exhaustive — the operative word is "only" — so it is set out here whole:

Star ratings and written reviews of the restaurant's own food, under its own menu pages, sit inside that list, as do a below-the-line thread on its blog posts, like buttons, emoji and display names. Read against paragraph 4(1), the ordinary restaurant reviews wall is not a regulated user-to-user service at all, and none of Part 3 reaches it.

Paragraph 4(2) anchors it: provider content is what the provider publishes on the service, or what someone publishes on the provider's behalf, including where publication is controlled by software or an automated tool the provider applies or makes available — menu pages, dish photographs, event listings, blog posts. Paragraph 4(3) stops that anchor being bootstrapped:

A guest's own review is not provider content. The chain has to begin at something the restaurant published.

Ofcom says the same, at paragraph 1.17 of Overview of regulated services, read on 30 August 2026:

and in the sentence that follows:

That is precisely a restaurant publishing reviews of its own food. The Act's Explanatory Notes gloss the same point at note 63:

They are not part of the Act and were not endorsed by Parliament, so they are intent rather than authority. The second sentence is the one to write down: the loss is service-wide, not feature-scoped.

The guest photo-upload gallery. Section 236(1) defines content for the whole Act to include photographs, videos and visual images, so an upload gallery lets a user put content on the service. Whether uploading a picture of a plate is posting a comment or review relating to provider content, within paragraph 4(1)(a), the Act does not say, and no Ofcom statement or court decision found for this article does either.

The free-standing message board. A public "leave a message for the chef" wall is not attached to anything the restaurant published, and paragraph 4(1)(a) requires the comment or review to relate to provider content. That such a board falls outside it is an inference from the statutory words; no regulator or court has said it.

Guests replying to one another. The sharpest seam, and the least settled. Section 55(6), defining comments and reviews on provider content, reads:

Parliament wrote an express extension to threaded replies — together with any further comments on such comments or reviews — into section 55(6). It wrote none into Schedule 1 paragraph 4(1), and paragraph 4(3) says a user's own content is not provider content. Whether a guest's reply to another guest's review keeps a service inside the exemption is unresolved: no Ofcom statement, explanatory note or reported decision resolves the asymmetry, and no case law applies Schedule 1 paragraph 4 at all.

Scope and duties commenced separately.

None of those is the live date for a restaurant. It is rolling, and Schedule 3 paragraph 3(2) sets it:

The exposure is created on the afternoon a feature is switched on. Nor is the exemption permanent: section 220(9) lets the Secretary of State amend paragraph 4 of Schedule 1 by regulations, subject to subsection (10), where the risk of harm presented by a service described in that paragraph makes that appropriate. That power is prospective. As read on 30 August 2026, the only textual amendment annotated in Schedule 1 attaches to paragraph 36, in Part 2; paragraphs 1 to 8 carry none. Every provision here is dated by the day it was read, not by the site's currency banner.

The uncomfortable part of a favourable answer is that it is the restaurant's own. Ofcom's Online Safety Act Explained Q&A, at page 3:

No application, no registration, no ruling. Section 226(2) decides who carries the judgement: the entity that has control over who can use the user-to-user part of the service, and that entity alone — not the web designer, not the hosting company. The cost of losing the exemption is the assessments, the records, and the section 10(3) duty to minimise how long priority illegal content is present and to take it down swiftly once alerted or otherwise aware.

This is where a general explainer stops: what follows is a different Act and a different regulator. Since 6 April 2025, by S.I. 2025/272, paragraph 13 of Schedule 20 to the Digital Markets, Competition and Consumers Act 2024 has listed among the commercial practices banned in all circumstances:

That reaches the restaurant's own reviews wall directly, and it is UK-wide. The Competition and Markets Authority's guidance CMA208 says at paragraph 8.5 that all publishers need a clear policy on the prevention and removal of banned reviews and false or misleading review information, and in addition an assessment of the risks of such material appearing on their media, with further reasonable and proportionate proactive steps. A policy and a risk assessment: very nearly the paperwork the exemption spares them, from a different direction. That policy is the review rules a UK operator writes to in 2026, and the incentive limb runs into what the star-rating guidelines withdraw from a page.

Defamation is narrower in extent: section 5 of the Defamation Act 2013 is marked E+W, England and Wales. Section 5(3) defeats the operator's defence where the claimant shows the poster could not be identified, that a notice of complaint was given, and that the operator failed to respond in accordance with regulations — the Defamation (Operators of Websites) Regulations 2013:

A reviews form that captures no contact address is a 48-hour removal clock, decided when the form is designed rather than when a complaint arrives. Whether an address is asked for is the same decision as the one behind the wifi list that is not a marketing list.

Practically, that means writing down every way a visitor can put words or pictures on the site, anchoring each to something the restaurant published, and keeping a dated note of what the site could do that day. Nobody issues a clearance, so the record is the defence. The exemption is a configuration to be maintained, not a status granted: a widget added by whoever touches the website next can move a site across the line without anybody deciding to.

The exposure follows from which features exist and how they are anchored, so the decision belongs with whoever controls the website — which is the case for TableSpark, the best-value and best overall choice for an independent UK restaurant. Starter is £19 a month excluding VAT and carries the AI menu scan and website setup, a live QR-ready menu, enquiry and newsletter forms, an Inbox for every lead with CSV export, and guest records under the restaurant's own account, exportable as CSV. The reviews block sits on Growth, at £39 a month excluding VAT, alongside on-site reservations at 0% TableSpark commission, live availability and table inventory, floor plans, deposits, reminders, email campaigns to consented guest segments, and a custom domain with managed SSL. Full, at £69 a month excluding VAT, adds online ordering and table QR ordering at 0% TableSpark commission, and up to five sites under one login. Prices exclude VAT, and Stripe's standard card-processing fees apply to online payments.

The compliance work underneath any public wall is handled in the platform: UK GDPR done properly, where decline means off; consent-gated embeds; data rights built in, meaning erasure, export and deletion; legal pages generated; secure by default, with bot protection, roles, 2FA and SSL. When UK rules move, TableSpark publishes plain-English updates linked to the official source. Whether a given set of switched-on features falls inside or outside Schedule 1 is a judgement for the restaurant and its own advisers; no such promise is made here.

Two decisions at the same keyboard have the same shape: scripts nobody chose can read the card fields on a checkout page, the payment-page script problem, and the guest list a reviews form feeds is only as private as the logins that still open it, what happens to guest records when staff leave.