For a regulated service provider, Ofcom's maximum Online Safety Act penalty is the greater of GBP18 million and 10% of for the provider's most recent complete accounting period.
The maximum is a ceiling, not an automatic fine. Ofcom must set an appropriate and proportionate amount and may use a single penalty, a daily penalty for a continuing failure, or both.
Online Safety Act penalties depend on the recipient, breach, revenue rules, and facts of the case. For a regulated service provider, the ceiling is the greater of GBP18 million and 10% of for its most recent complete accounting period. Ofcom considers seriousness, harm, gain, prevention, knowledge, remediation, history, cooperation, size, and turnover when setting an amount.
Schedule 13 sets the maximum penalty for the provider of a regulated service at the greater of GBP18 million and 10% of the provider's for its most recent complete accounting period. If GBP18 million is greater than 10% of that revenue, GBP18 million is the ceiling; otherwise the 10% figure is the ceiling.
The ceiling does not predict the actual penalty. Ofcom may decide not to impose a financial penalty, or may impose an amount below the maximum, after considering the contravention and the statutory process. Different Schedule 13 rules apply to some penalties imposed on persons who are not providers, so do not apply the provider formula without identifying the recipient.
Where Ofcom makes qualifying related entities or controlling individuals jointly and severally liable under Schedule 15, the Act contains a group-revenue ceiling. Joint liability depends on the statutory relationship and conditions; it is not automatic for every member of a corporate group.
Sources (3)
Binding rules for penalty principles, the provider and group maximums, daily penalties, other recipients, and recovery.
Explains the greater-of-GBP18-million-or-10% provider maximum and the group maximum where entities are jointly liable.
Defines qualifying worldwide revenue and how revenue referable to regulated services and relevant group undertakings is treated.
Ofcom considers all circumstances of the case and must regard the penalty as appropriate and proportionate. Its Penalty Guidelines identify potentially relevant factors including the seriousness and duration of the contravention, actual or potential harm, financial or other gain, preventive steps, whether conduct was deliberate or reckless, senior-management knowledge, how quickly the breach ended, remediation, previous contraventions, and cooperation.
Schedule 13 also requires Ofcom to consider representations and evidence from the person and the effects of the failure. For a penalty imposed through a confirmation decision or penalty notice, relevant compliance and remedial steps must be considered. Evidence of harm or risk of harm to children informs Ofcom's application of the penalty factors.
Cooperation and remediation can affect the assessment, but neither guarantees that Ofcom will close a case or waive a penalty. A settlement discount is a separate procedural matter and requires the admissions and conditions in Ofcom's Enforcement Guidance.
Sources (2)
Sets out Ofcom's deterrence objective and the factors it may consider when determining an appropriate and proportionate amount.
Explains how Ofcom applies the Penalty Guidelines, considers child harm, and handles settlement discounts separately from cooperation.
Ofcom may impose a single penalty, a daily penalty, or both. A daily penalty may apply where the identified contravention is continuing and a confirmation decision requires action to bring the recipient into compliance. The decision specifies the daily rate and period, generally ending when the required action is completed or when the specified maximum period ends.
Daily penalties are not an automatic addition to every fine. The statutory power, proposed notice, final decision, continuing nature of the failure, and required action determine whether one applies. The final penalty generally cannot exceed the type, amount, or period proposed in the earlier notice for the same breach, subject to the Act's joint-liability exception.
Keep evidence of the date compliance was achieved and notify Ofcom through the route stated in the decision. Internal completion is not enough if the decision requires submission, verification, or another specified step.
Sources (2)
Binding rules for daily penalties and the limitation by the penalty proposed in the earlier notice.
Explains when Ofcom may combine single and daily penalties and how a daily penalty relates to required compliance action.
The confirmation decision or penalty notice states the amount, reasons, relevant aggravating or mitigating factors, and payment date. Record the payment obligation separately from any remedial steps because paying the fine does not itself complete a required correction.
If a penalty is not paid, Ofcom can pursue recovery as a debt. Ofcom has clarified that non-payment alone does not allow it to seek a court order blocking the service. Business disruption measures require continuing non-compliance with Online Safety Act duties and a court order; they do not amount to a global shutdown.
A person with a sufficient interest in an appealable Ofcom decision may appeal to the Upper Tribunal. The decision, Act, and applicable procedural rules control the deadline and grounds, so obtain case-specific advice immediately.
Sources (2)
Binding source for penalty notices, recovery, confirmation decisions, appeals, and business disruption measures.
Explains debt recovery and confirms that non-payment alone is not a basis for seeking a court order to block a service.
Keep the revenue calculation, breach chronology, mitigation evidence, notice terms, and payment or appeal dates in one controlled record.
Turn the penalty calculation and mitigation evidence into assigned review work.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
Decide whether children are likely to access a regulated service or part of it, document the evidence, and identify when a children's risk assessment follows.
Route and decide Online Safety Act complaints, record the required response, and distinguish an internal review from an Ofcom complaint or super-complaint.
Assess illegal-content risks by offence kind, likelihood, severity, affected users, service design, controls, evidence, and review triggers.
Decide whether an online service is a regulated user-to-user service, search service, combined service, or exempt service under the UK Online Safety Act.
Compare age verification and age estimation methods by assurance, privacy, accessibility, bias, evasion risk, and operational evidence.
When Online Safety Act services need age assurance, what highly effective age assurance means, and how safety duties interact with data protection.
Choose an age-assurance method for an Online Safety Act duty by testing effectiveness, privacy, accessibility, evasion risk, and the consequence of error.
Test whether a service is covered by the UK Online Safety Act by checking service functionality, UK links, exemptions, and the duties that follow.
Apply the UK Online Safety Act Category 1, 2A, and 2B thresholds, calculate active UK users, and use Ofcom's register first published in June 2026 and most recently updated in September.
Verify UK Online Safety Act scope, assessments, controls, reporting, complaints, records, child safety, and category-specific work.
Apply the UK Online Safety Act children's access, risk-assessment, safety, age-assurance, reporting, complaints, and record-keeping duties.
Build a UK Online Safety Act compliance program from service scope through assessments, controls, evidence, review, and Ofcom response.
Design UK Online Safety Act moderation, content-reporting, complaints, and review processes for illegal content and content harmful to children.
UK Online Safety Act compliance dates for risk assessments, child safety, categorised services, fees, and event-based deadlines.
How Ofcom investigates Online Safety Act breaches, issues decisions, requires remedies, imposes penalties, and seeks court orders.
Standalone answers and decision paths for UK Online Safety Act scope, risk assessments, child protection, age assurance, categories, reporting, and enforcement.
Apply the Online Safety Act and UK data protection law together for age assurance, moderation, profiling, recommender systems, and safety-data sharing.
Understand the illegal-content risk assessment, safety, reporting, complaints, record-keeping, and review duties for regulated user-to-user and search services.
Build moderation, content-reporting, and complaints procedures for regulated services, and understand where the Online Safety Act does and does not require an appeal.
How Ofcom assesses Online Safety Act concerns, gathers information, investigates suspected breaches, and reaches enforcement decisions.
Understand which user-to-user, search, combined, and provider-pornography services the UK Online Safety Act regulates and which exemptions narrow scope.
See which UK Online Safety Act requirements apply to Part 3 services, child-accessible services, provider pornography, and categorised services.
A field-by-field template for recording service facts, statutory risks, evidence, controls, residual risk, approval, and reassessment triggers.
Run illegal-content and children's risk assessments in the right order, with evidence for risks, controls, governance, and reassessment triggers.
Organise recurring Online Safety Act risk assessments across product, safety, data, engineering, legal, and governance teams.
Understand when a named senior manager or corporate officer can face personal liability for Online Safety Act information offences and how to control the risk.
Decide whether a service is regulated, whether it is user-to-user or search, which exemptions apply, and whether Ofcom categorisation adds duties.
Move from UK Online Safety Act service scope to Category 1, 2A, or 2B threshold analysis without confusing categorisation with basic coverage.
Understand who must publish an Online Safety Act transparency report, what an Ofcom notice controls, and how to prepare traceable reporting data.
Compare UK Online Safety Act and EU DSA scope, service classes, child-safety and platform duties, dates, evidence, exemptions, and enforcement.
A practical scope test for user-to-user, search, and provider-pornography services under the UK Online Safety Act, including UK links and exemptions.
How the UK Online Safety Act, UK GDPR, Data Protection Act 2018, and Children's Code apply together to safety technologies and children's data.
Ofcom information notices, investigations, representations, confirmation decisions, penalties, remediation, and court-based service restrictions.
The two-stage UK Online Safety Act children's access assessment, evidence, timing, reassessment triggers, and next duties.
UK Online Safety Act illegal content risk assessment scope, required elements, deadlines, review triggers, records, and resulting safety measures.
Classify user-to-user, search, and combined services under the UK Online Safety Act, apply the UK-links and exemption tests, and identify the next duties.
Who receives Ofcom transparency notices, what Schedule 8 can require, the 2026 notice process, first-report timing, and evidence controls.
How UK Online Safety Act duties shape content moderation, user reporting, complaints, reinstatement, terms, records, and human oversight.
How Category 1, 2A, and 2B thresholds work, how Ofcom categorises services, and what the register updated in September 2026 means.
When section 110 can make a named senior manager liable for an Online Safety Act information offence, the available defences, and the controls to keep.
When UK Online Safety Act services need highly effective age assurance, what Ofcom expects, and how UK data protection law applies.