UK Online Safety Act Penalties and Fines

Schedule 13 sets the maximum penalty for the provider of a regulated service at the greater of GBP18 million and 10% of the provider's qualifying worldwide revenue for its most recent complete accounting period. If GBP18 million is greater than 10% of that revenue, GBP18 million is the ceiling; otherwise the 10% figure is the ceiling.

The ceiling does not predict the actual penalty. Ofcom may decide not to impose a financial penalty, or may impose an amount below the maximum, after considering the contravention and the statutory process. Different Schedule 13 rules apply to some penalties imposed on persons who are not providers, so do not apply the provider formula without identifying the recipient.

Where Ofcom makes qualifying related entities or controlling individuals jointly and severally liable under Schedule 15, the Act contains a group-revenue ceiling. Joint liability depends on the statutory relationship and conditions; it is not automatic for every member of a corporate group.

Ofcom considers all circumstances of the case and must regard the penalty as appropriate and proportionate. Its Penalty Guidelines identify potentially relevant factors including the seriousness and duration of the contravention, actual or potential harm, financial or other gain, preventive steps, whether conduct was deliberate or reckless, senior-management knowledge, how quickly the breach ended, remediation, previous contraventions, and cooperation.

Schedule 13 also requires Ofcom to consider representations and evidence from the person and the effects of the failure. For a penalty imposed through a confirmation decision or penalty notice, relevant compliance and remedial steps must be considered. Evidence of harm or risk of harm to children informs Ofcom's application of the penalty factors.

Cooperation and remediation can affect the assessment, but neither guarantees that Ofcom will close a case or waive a penalty. A settlement discount is a separate procedural matter and requires the admissions and conditions in Ofcom's Enforcement Guidance.

Ofcom may impose a single penalty, a daily penalty, or both. A daily penalty may apply where the identified contravention is continuing and a confirmation decision requires action to bring the recipient into compliance. The decision specifies the daily rate and period, generally ending when the required action is completed or when the specified maximum period ends.

Daily penalties are not an automatic addition to every fine. The statutory power, proposed notice, final decision, continuing nature of the failure, and required action determine whether one applies. The final penalty generally cannot exceed the type, amount, or period proposed in the earlier notice for the same breach, subject to the Act's joint-liability exception.

Keep evidence of the date compliance was achieved and notify Ofcom through the route stated in the decision. Internal completion is not enough if the decision requires submission, verification, or another specified step.

The confirmation decision or penalty notice states the amount, reasons, relevant aggravating or mitigating factors, and payment date. Record the payment obligation separately from any remedial steps because paying the fine does not itself complete a required correction.

If a penalty is not paid, Ofcom can pursue recovery as a debt. Ofcom has clarified that non-payment alone does not allow it to seek a court order blocking the service. Business disruption measures require continuing non-compliance with Online Safety Act duties and a court order; they do not amount to a global shutdown.

A person with a sufficient interest in an appealable Ofcom decision may appeal to the Upper Tribunal. The decision, Act, and applicable procedural rules control the deadline and grounds, so obtain case-specific advice immediately.