Technology & Digital Enforcement and Penalties

Online Safety Act penalties and enforcement powers

Quick reference to Ofcom's enforcement powers, penalty calculations, and senior manager criminal liability under the Online Safety Act 2023.

UK-wide
Guide summary

Ofcom can enforce penalties if your online service does not comply with the Online Safety Act 2023. Penalties can be up to 10% of your global revenue or £18 million. Senior managers may face criminal charges if their service breaks the rules.

  • Register your service with Ofcom if you meet user thresholds
  • Respond to Ofcom information notices within deadlines
  • Fix issues identified in provisional notices to avoid penalties
  • Face up to 10% global revenue fines for non-compliance
  • Senior managers risk 2 years prison for failing to act
  • Prepare skilled persons reports if Ofcom requests them
  • Use approved tech to remove illegal content when required
  • Check if your service meets Category 1 or 2 thresholds
  • Pay penalties within 30 days of receiving a notice
  • Appeal penalties through Ofcom's process if needed
On this page
UK-wide

Related guides in Digital & Technology

Tech Sector Compliance Overview

Comprehensive guide to regulatory compliance for technology businesses - UK GDPR, data protection, online safety, cybersecurity, and sector-specific …

Ofcom's enforcement powers under the Online Safety Act 2023, including financial penalties and criminal liability provisions.

Maximum financial penalty
Up to 10% of qualifying worldwide revenue, or GBP 18 million (whichever is greater)
Daily default penalty
Up to 5% of qualifying worldwide revenue per day for ongoing non-compliance
Business disruption measures
Ofcom can apply to court for access restriction orders blocking UK access to non-compliant services
Information notice penalties
Failure to respond to an Ofcom information notice is a separate offence with its own penalty
Criminal liability trigger
Section 110 — senior managers face personal criminal liability for failure to comply with information notices
Criminal penalty (individuals)
Up to 2 years' imprisonment and/or an unlimited fine for senior managers convicted under s.110

Enforcement escalation

Ofcom follows a graduated enforcement approach. The typical escalation sequence is:

  1. Provisional notice of contravention — formal notification of suspected breach
  2. Confirmation decision — Ofcom confirms the breach after considering representations
  3. Enforcement notice — requires the service to take specific steps by a deadline
  4. Penalty notice — financial penalty for confirmed non-compliance
  5. Business disruption measures — court-ordered access restrictions for the most serious cases

For how to set up compliant systems, see Set up content moderation and Write compliant terms of service.

Official enforcement guidance