UK Online Safety Act Ofcom Enforcement

Ofcom can use statutory information notices to obtain information needed for its online-safety functions. It can open an investigation where it suspects non-compliance. Its enforcement guidance describes a process that may lead to a provisional notice of contravention, an opportunity for written and oral representations, and then a confirmation decision, a further provisional notice, settlement, or closure.

A confirmation decision can record a contravention, require steps to remedy it or comply with the obligation, and impose a financial penalty. Ofcom may also impose daily penalties in circumstances allowed by the Act. The specific process and available outcome depend on the requirement being enforced.

For many enforceable requirements, the maximum financial penalty is the greater of GBP18 million or 10% of qualifying worldwide revenue. Schedule 13 contains the penalty framework, including how qualifying worldwide revenue is determined. The actual amount depends on the legal power, facts, seriousness, and Ofcom's penalty guidance.

In serious cases and subject to the statutory conditions, Ofcom can apply to the court for service-restriction or access-restriction orders directed at ancillary services or access facilities. These are court orders, not an automatic result of an investigation. Criminal offences also exist for specified information failures and related conduct; individual and senior-manager exposure depends on the exact offence and facts.

Enforcement readiness is the ability to reproduce a compliance decision and answer a regulator accurately. Keep current scope analyses, risk assessments, code mappings or alternative-measure rationales, child-access and age-assurance records, terms, complaints evidence, transparency data definitions, governance approvals, incidents, tests, and change logs.

Ofcom does not resolve individual users' complaints or direct a service to remove or reinstate specific content. It can use complaints and other intelligence to identify systemic compliance issues. A provider therefore needs an internal complaints process that works and an evidence trail showing whether recurring failures were fed back into risk assessments and controls.