UK Online Safety Act Ofcom Enforcement

Ofcom may receive a complaint, identify a concern through supervision or an enforcement programme, or use its information powers to test compliance. It first assesses the issue and may seek voluntary compliance, provide remediation time, gather more information, open a formal investigation, or take no further action. Not every concern reaches a formal breach decision.

If Ofcom opens an investigation, it normally tells the subject the scope and legal provisions under review and may issue information notices, require interviews, appoint a skilled person, or use other statutory powers. The subject must continue meeting the underlying Online Safety Act duties while the investigation runs.

Where Ofcom considers there are reasonable grounds to believe an enforceable requirement has been breached, it may issue a provisional notice of contravention. A final breach finding is made through a confirmation decision after the recipient has had an opportunity to make representations.

Ofcom enforces provider duties, can require information, investigate suspected failures, issue confirmation and penalty decisions, and seek court orders that restrict access or business support in serious cases. The maximum financial penalty is generally the greater of £18 million or 10% of qualifying worldwide revenue, subject to the statutory route and calculation rules.

Readiness starts before an investigation: keep current scope and assessment records, the measures adopted under each duty, code or alternative-measure reasoning, terms enforcement, complaints data, testing, governance approvals, and change history. A notice-response procedure should authenticate the notice, preserve records, assign legal and factual owners, validate data, meet the stated deadline, and retain submission evidence.

Give legal or regulatory affairs one response record for the matter, supported by the product or operations owner who controls the relevant service. Record the exact obligation, service, period, Ofcom stage, response deadline, preservation scope, factual position, and remediation decision.

The evidence depends on the issue. It may include service-scope decisions, risk-assessment records, underlying data, moderation and recommender-system documentation, age-assurance testing, complaints and reporting records, terms of service, governance approvals, implementation logs, and communications with Ofcom. Preserve source data and explain limitations rather than reconstructing a cleaner record after the event.

After investigating, Ofcom may close the case without a provisional notice, issue a provisional notice of contravention, or use another compliance route. A provisional notice states the obligations and period in question, Ofcom's reasons, and any proposed penalty or remedial steps. The recipient can make representations before a separate final decision maker reaches a final outcome.

Ofcom may then close the case, issue a further provisional notice where the legal conditions are met, settle the case, or issue a confirmation decision. A confirmation decision may find a breach, require specified steps, and impose a financial penalty. Closure after remediation does not necessarily mean Ofcom found that no breach occurred; the published case statement and decision explain the outcome.

Treat an Ofcom information notice or enforcement notice as a controlled regulatory response. Confirm the legal entity and service, record when and how the notice was received, identify every request and definition, preserve relevant material, and assign owners for collection, verification, legal review, approval, and submission.

Information must be complete, accurate in all material respects, and provided in the required form and by the stated deadline. If a request is unclear or the provider needs more time, use Ofcom's stated contact route promptly. Do not assume that a discussion changes the deadline unless Ofcom confirms that change.

The response record should also capture service scope, affected user groups, the relevant risk assessment, code or alternative-measure reasoning, child-access status, mitigation owner, and Ofcom correspondence.

The output depends on the notice: it may be a verified information return, representations on provisional findings, a remedial plan, evidence that required steps are complete, or a combination of those records.