Enforcement under the Online Safety Act

Nowhere to hide? Ofcom’s powers and obligations under the OSA

Download PDF

The OSA contains complex and far-reaching obligations in relation to a variety of online platforms. While on one hand, the OSA attempts to maintain a proportionate and risk-based approach to enforcement, it does contain wide-ranging and probing investigatory and enforcement powers. That’s where Ofcom, the regulator responsible for overseeing and enforcing the regime, comes in. This article explores what powers it holds and how it intends to use them.

Risk based approach

Ofcom uses a risk-based and outcomes-focused approach to supervision and enforcement. It may seek compliance through guidance, engagement, monitoring and other supervisory tools, but can also launch formal investigations and impose penalties where this is necessary and proportionate.

In selecting its approach, Ofcom considers a range of factors including the severity and scale of the harm, whether any apparent non-compliance is deliberate and the robustness of the available evidence. There is now a growing body of live enforcement activity on Ofcom’s enforcement register, even though some of Ofcom’s more intrusive powers are yet to be tested.

Resources

Ofcom has outlined several means of driving improvements in online safety. The first of these is to provide resources to help companies understand and manage risk. These resources include: commissioning research into specific online safety topics e.g., children’s mental health online; analysing the cause and impacts of online harms; providing guidance (on a range of topics from protecting women and girls to freedom of expression); and publishing codes of practices, which explain what services can do to mitigate against certain online harms. Importantly, the codes of practice operate as a “safe-harbour” whereby if an organisation can demonstrate compliance with the relevant code of practice, it will be presumed to be compliant with the OSA.

Regulatory supervision

Interestingly, the OSA provides Ofcom with certain powers that appear to replicate those held by Ofcom’s colleagues in the Digital Regulation Cooperation Forum or DRCF under relevant legislation (including the Financial Conduct Authority or FCA). For example, Ofcom engages with the “largest and riskiest services” via what it calls “continuous regulatory supervision” - this mirrors certain powers held by the FCA. This approach centres on maintaining pro-active communication with online platforms to improve online safety measures on a rolling basis. SMEs may also benefit from this kind of supervision.

Enforcement process and notices

While Ofcom’s preference is to encourage voluntary compliance with the OSA through providing resources and supervision, if necessary, it will launch (and has launched) investigatory and enforcement actions.

Ofcom has published guidance (available on its website here), on how the enforcement process works from start to finish. Ofcom will undertake an initial assessment where infringements of the OSA are alleged. If these allegations appear to have some merit, a formal investigation may be launched. If the case is not closed post investigation, then a provisional notice of contravention will be issued, at which point the parties may provide representations and take actions to address Ofcom’s concerns. Ofcom will consider these representations (and may even publish a further provisional notice allowing for additional representations by the parties) before publishing a so-called “confirmation decision”. This decision can include a penalty or any other enforcement steps – discussed further below.

Since coming into force, Ofcom has been engaged in a number of enforcement programmes to assess industry compliance with the duties under the OSA, such as in relation to illegal harm risk assessments and the implementation of highly effective age assurance. Ofcom provides regular updates on its live investigations which you can track its central enforcement register.

Investigation powers – in more depth

Ofcom has a general power to ask companies to provide “any information” that it requires for the purpose of exercising, or deciding whether to exercise, any of its online safety functions. Specific information notices may also be issued to companies under defined circumstances – including those that allow Ofcom to request information relating to a deceased child's social media account if requested to do so by a coroner investigating the child’s death. Ofcom has also published guidance on its information gathering powers available on its website here.

Further, Ofcom may commission reports by “skilled persons” to shed light on failures or possible failures of companies to comply with a requirement under the OSA – this is also a concept employed by other DRCF regulators including the FCA. Ofcom also has general powers in the context of investigations to enter, inspect and audit business premises – including under certain circumstances – with just a notice (i.e., no warrant is required). The regulator may also require interviews with the services provider’s staff.

Enforcement powers – in more depth

Fines

Ofcom has now finalised key elements of its online safety fees and penalties regime, including its approach to qualifying worldwide revenue. The first charging year is 2026/27, and Ofcom has published the applicable tariff and begun implementing the fees regime. See further information here. The maximum financial penalty for a breach remains £18 million or 10% of qualifying worldwide revenue, whichever is greater.

Business disruption measures

In the most serious cases of non-compliance, Ofcom is able to exercise some highly invasive powers, including the ability to seek a court order imposing business disruption measures, which may require third parties (e.g., payment or advertising providers) to withdraw from, or limit access to, the breaching services in the UK. Practically, it is not entirely clear at this time when Ofcom would consider a breach of the OSA to be so egregious that such invasive powers would be used – especially given (at least theoretically) the measures can be imposed without confirmation that a provisional or confirmation notice was not complied with. Interim measures will also be possible in relation to both service restriction and access orders.

Technology Notices: Requirements to use certain technologies

Another significant provision of the OSA is that Ofcom is able, under certain circumstances, to issue notices which require companies to utilise certain accredited technologies to identify and/or remove illegal content relating to terrorism and child abuse related content. These powers were the subject of much debate, when initially enacted as some commentators interpreted the provisions to mean that online platforms will have to pro-actively scan content, including potentially by decrypting content. Ofcom has sought to address these concerns by publishing guidance on the exercise of these powers. In addition, Ofcom has provided advice to the Secretary of State on how to set minimum standards of accuracy when deploying such technologies. Once those standards have been approved and published, Ofcom will be responsible for establishing the process for accrediting technologies against them.

Criminal liability and senior management liability

Regulated service providers may commit a criminal offence if they fail to comply with certain provisions of the OSA, including if they do not meet the requirements of an information notice or if they fail without reasonable excuse to take action against certain illegal content e.g., failing to take child safety measures against child sexual abuse content. In such cases, directors and other senior managers of the provider may also be criminally liable for the failures. Senior management should also note that information notices will be able to publicly name them.

Appeals and super-complaints

All of Ofcom’s decisions are subject to appeal. However, this can be a difficult process to pursue given that an appeal may only be brought with permission of the Upper Tribunal, which will only decide the appeal on the same principles as would be applied for judicial review. This is a notoriously high standard to meet for appellants.

A new “super-complaints” regime also commenced on 1 January 2026, and Ofcom published guidance on this on 10 February 2026. Eligible organisations representing users or the public can submit a super-complaint concerning features or conduct of regulated services that create a material risk of significant harm, adversely affect freedom of expression or otherwise have a significant adverse impact. There is no fixed list of designated complainants: Ofcom assesses whether an organisation satisfies the eligibility and admissibility criteria set out in legislation and its guidance.

Transparency measures

Ofcom will have significant powers to require certain services to be more transparent about their online safety measures, including powers to evaluate the impact of these measures, and their implications for user rights and freedoms.

Providers of categorised services (see our article on the OSA’s scope) may be required to publish annual transparency reports in accordance with notices issued by Ofcom. Ofcom published its transparency-reporting guidance on how to do such reports in July 2025. Ofcom must also produce its own transparency reports, drawing conclusions from providers’ reports and other relevant information.

Last updated: 22 October 2026