UK Online Safety Act Enforcement And Penalties

The core enforcement question is what Ofcom can do if a provider does not meet its Online Safety Act duties. The official government collection says Ofcom has a broad range of powers to assess and enforce compliance, including investigating non-compliance, imposing fines of up to 10% of qualifying worldwide revenue, and in the most serious cases applying to the courts to block services.

For teams, the practical task is to identify the duty at issue, keep evidence that the relevant risk assessment and controls were completed, and escalate any likely breach quickly so legal, trust and safety, and product owners can respond before Ofcom opens or escalates an enforcement case.

Ownership should sit with the team that can change service design, moderation, recommender systems, age assurance, reporting, complaints, terms, or transparency data, with legal and trust-safety review.

Evidence should show service categorisation, illegal-content risk assessment, children access assessment, children risk assessment, mitigation controls, age-assurance decisions, terms/complaints records, and Ofcom reporting readiness.

Most Online Safety Act mistakes happen at the boundary between user-to-user, search, pornography, category, child-access, illegal-content, and transparency duties.

Use this section before launching a user feature, recommender change, moderation change, age-assurance flow, complaint process, or transparency-reporting process.

Use an Online Safety Act workflow that captures service scope, user groups, risk assessment, code mapping, child-access status, mitigation owner, evidence, and Ofcom escalation path.

The output should be a service-scope memo, risk assessment, children access assessment, mitigation plan, age-assurance decision, complaint workflow, or transparency-report evidence pack.