Technology & Digital Enforcement and Penalties UK-wide

Online Safety Act penalties and enforcement powers

Quick reference to Ofcom's enforcement powers, penalty calculations, and senior manager criminal liability under the Online Safety Act 2023.

Guide summary

You must comply with the Online Safety Act 2023. Ofcom can fine you up to 10% of your global turnover or £18 million (whichever is larger). Senior managers can be sent to prison for up to 2 years for not giving Ofcom information when asked. Ofcom can also ask a court to block your service in the UK.

  • Pay fines up to 10% of global turnover or £18m
  • Senior managers can face 2 years in prison for ignoring information requests
  • Provide information when Ofcom asks or face separate penalties
  • Daily default penalty up to 5% of global turnover for ongoing breaches
  • Ofcom may ask court to block your service in the UK
  • Use accredited technology to remove illegal content if ordered
  • Check if your platform is Category 1, 2A or 2B for different rules
  • Keep records to show you are compliant
On this page

Related guides in Digital & Technology

Tech Sector Compliance Overview

Comprehensive guide to regulatory compliance for technology businesses - UK GDPR, data protection, online safety, cybersecurity, and sector-specific …

Ofcom's enforcement powers under the Online Safety Act 2023, including financial penalties and criminal liability provisions.

Maximum financial penalty
Up to 10% of qualifying worldwide revenue, or GBP 18 million (whichever is greater)
Daily default penalty
Up to 5% of qualifying worldwide revenue per day for ongoing non-compliance
Business disruption measures
Ofcom can apply to court for access restriction orders blocking UK access to non-compliant services
Information notice penalties
Failure to respond to an Ofcom information notice is a separate offence with its own penalty
Criminal liability trigger
Section 110 — senior managers face personal criminal liability for failure to comply with information notices
Criminal penalty (individuals)
Up to 2 years' imprisonment and/or an unlimited fine for senior managers convicted under s.110

Enforcement escalation

Ofcom follows a graduated enforcement approach. The typical escalation sequence is:

  1. Provisional notice of contravention — formal notification of suspected breach
  2. Confirmation decision — Ofcom confirms the breach after considering representations
  3. Enforcement notice — requires the service to take specific steps by a deadline
  4. Penalty notice — financial penalty for confirmed non-compliance
  5. Business disruption measures — court-ordered access restrictions for the most serious cases

For how to set up compliant systems, see Set up content moderation and Write compliant terms of service.

Official enforcement guidance