Guide
Online Safety Act penalties and enforcement powers
Quick reference to Ofcom's enforcement powers, penalty calculations, and senior manager criminal liability under the Online Safety Act 2023.
UK-wide
Ofcom can enforce penalties if your online service does not comply with the Online Safety Act 2023. Penalties can be up to 10% of your global revenue or £18 million. Senior managers may face criminal charges if their service breaks the rules.
- Register your service with Ofcom if you meet user thresholds
- Respond to Ofcom information notices within deadlines
- Fix issues identified in provisional notices to avoid penalties
- Face up to 10% global revenue fines for non-compliance
- Senior managers risk 2 years prison for failing to act
- Prepare skilled persons reports if Ofcom requests them
- Use approved tech to remove illegal content when required
- Check if your service meets Category 1 or 2 thresholds
- Pay penalties within 30 days of receiving a notice
- Appeal penalties through Ofcom's process if needed
Ofcom's enforcement powers under the Online Safety Act 2023, including financial penalties and criminal liability provisions.
- Maximum financial penalty
- Up to 10% of qualifying worldwide revenue, or GBP 18 million (whichever is greater)
- Daily default penalty
- Up to 5% of qualifying worldwide revenue per day for ongoing non-compliance
- Business disruption measures
- Ofcom can apply to court for access restriction orders blocking UK access to non-compliant services
- Information notice penalties
- Failure to respond to an Ofcom information notice is a separate offence with its own penalty
- Criminal liability trigger
- Section 110 — senior managers face personal criminal liability for failure to comply with information notices
- Criminal penalty (individuals)
- Up to 2 years' imprisonment and/or an unlimited fine for senior managers convicted under s.110
Enforcement escalation
Ofcom follows a graduated enforcement approach. The typical escalation sequence is:
- Provisional notice of contravention — formal notification of suspected breach
- Confirmation decision — Ofcom confirms the breach after considering representations
- Enforcement notice — requires the service to take specific steps by a deadline
- Penalty notice — financial penalty for confirmed non-compliance
- Business disruption measures — court-ordered access restrictions for the most serious cases
For how to set up compliant systems, see Set up content moderation and Write compliant terms of service.