UK Online Safety Act Enforcement and Penalties

Not every concern becomes a formal investigation. Ofcom may first assess the issue, gather information, seek voluntary compliance, or use compliance remediation. If it opens an investigation and considers there are reasonable grounds to believe an enforceable requirement has been breached, it may issue a provisional notice of contravention.

The provisional notice identifies the suspected failure, Ofcom's reasons, any proposed penalty, and any steps Ofcom considers necessary. The recipient may make written representations and, where applicable, oral representations. A separate final decision maker then decides whether to close the case, issue another provisional notice, settle the matter, or issue a confirmation decision.

A confirmation decision records Ofcom's final breach finding and may require specified steps, set a deadline, and impose a financial penalty. Teams should treat each stage as a distinct legal event and preserve the evidence, submissions, and decisions for that stage.

A confirmation decision can require the recipient to take specified steps to comply with an obligation or remedy the failure, either immediately or by a stated deadline. Depending on the contravention and statutory limits, Ofcom can also impose a single financial penalty, a daily penalty for a continuing failure, or both.

For a regulated service provider, Schedule 13 sets the maximum at the greater of GBP18 million and 10% of the provider's qualifying worldwide revenue for its most recent complete accounting period. That figure is a ceiling, not a standard tariff. Ofcom must consider the case in the round and set an amount it considers appropriate and proportionate.

Ofcom may pursue qualifying related companies or controlling individuals jointly with the service provider in circumstances set out in Schedule 15. That does not make every director, shareholder, parent, or affiliate automatically liable.

Ofcom cannot itself order a global shutdown. In serious cases of continuing non-compliance, the Act allows Ofcom to apply to a court for business disruption measures. A court may make a service restriction order affecting ancillary services or an access restriction order requiring an access facility, such as an internet access service, to impede access in the UK. The Act also provides interim orders where the court is satisfied about likely non-compliance and the risk, nature, and severity of harm make it inappropriate to wait for a final failure finding.

Failure to pay a fine alone does not give Ofcom power to seek an order blocking the service. Ofcom has stated that continuing non-compliance with Online Safety Act duties is required. Unpaid penalties can instead be pursued as a debt, with the recovery route depending on the provider's assets, location, and applicable court process.

Some failures involving information notices, interviews, inspections, or confirmation decisions may also constitute criminal offences under the Act. Do not describe ordinary non-compliance with every safety duty as personal criminal liability.

Create one response record for the matter, led by legal or regulatory affairs and supported by the product or operations owner who can fix the issue. Record the exact obligation, service, period, Ofcom stage, response deadline, preservation scope, factual position, remediation decision, and approval route.

Respond to information requirements completely, accurately, and on time. If the request is unclear or the deadline cannot be met, escalate promptly and use the route stated by Ofcom rather than omitting information or assuming an extension. Remediation can affect Ofcom's next step and penalty assessment, but it does not erase a past breach.