The headline number is £18 million or 10% of qualifying worldwide revenue. The more useful thing to understand is how a service gets there, because the path almost always starts with an information notice rather than a scandal.
Part of our UK Online Safety Act guides. Not legal advice.
- What Ofcom can do
- Penalty levels
- How an investigation runs
- Senior manager liability
- What preparedness looks like
- Frequently asked questions
What Ofcom can actually do
Information notices
Ofcom can compel a service to produce documents, data and explanations. Failure to respond accurately is an offence in its own right, independent of the underlying safety question.
Investigations
Opened where Ofcom has grounds to suspect a breach. Investigations are frequently published, so reputational exposure begins well before any penalty.
Provisional notice of contravention
Sets out the suspected breach and gives the service an opportunity to make representations before a decision.
Confirmation decision
The formal finding, which can require specific remedial steps within a set timeframe as well as impose a penalty.
Business disruption measures
Court-backed orders requiring payment providers or advertisers to withdraw services, or ISPs to restrict access to the service in the UK. Reserved for serious cases.
Exposure
Detail
Maximum financial penalty
The greater of £18 million or 10% of qualifying worldwide revenue
Remedial requirements
Specific steps within a defined timeframe, enforceable on their own terms
Business disruption
Court orders withdrawing payment or advertising services, or restricting UK access
Criminal offences
Relating to information notices and certain child safety duties, including senior manager provisions
Figures are the statutory maxima set out in the Act. Actual penalties are set case by case against Ofcom's published penalty guidance.
Typically: an information notice, then an assessment of the response, then an investigation if Ofcom has grounds to suspect a breach, then a provisional notice of contravention giving you the chance to make representations, then a confirmation decision with any penalty and remedial requirements attached.
The point of maximum leverage is the information notice, not the penalty stage. A service that can produce a current risk assessment and operational evidence within the deadline often ends the matter there. One that cannot has already demonstrated a records problem.
The Act creates criminal offences connected to information notices, including provisions reaching senior managers who fail to prevent an offence, alongside offences relating to certain child safety duties. This is narrower than personal liability for an unsafe service, and it is deliberately targeted at obstruction and misinformation during regulatory contact. The practical implication is that whoever signs off your assessments should be able to stand behind their accuracy.
What preparedness actually looks like
- A current illegal harms risk assessment and, where applicable, children's access and risk assessments
- Operational data that demonstrates the measures you described are running, not just documented
- An audit trail per moderation decision: who decided, on what basis, and when
- A named accountable owner and a defined route for responding to an information notice
- Retained records that survive staff turnover and tooling changes
Related reading: the illegal harms risk assessment and the Protection of Children Codes.
How large can Online Safety Act fines be?
Under the Act, Ofcom can impose penalties of up to £18 million or 10% of qualifying worldwide revenue, whichever is greater. For a large platform the revenue limb is by far the more significant figure. Penalty size is not the only exposure, though: business disruption measures can restrict UK access to a service entirely.
Does Ofcom fine services for a single piece of harmful content?
The regime is systems-based. Ofcom assesses whether you have adequate systems and processes, not whether any individual item slipped through. A service with a rigorous risk assessment and demonstrable measures is in a very different position from one without, even if both had the same content incident.
What triggers an investigation?
Common routes include complaints, super-complaints, media reporting, Ofcom's own monitoring, and failures to respond adequately to an information notice. In practice, an unanswered or thin response to an information request is one of the faster ways to escalate a situation.
Can individuals be held personally liable?
Yes, in defined circumstances. The Act creates criminal offences relating to information notices, including where a senior manager has failed to prevent the offence, and separate offences relating to certain child safety duties. This is narrower than general liability for a service being unsafe, but it is real and it is why governance sign-off on the assessments matters.
We are based outside the UK. Does this reach us?
The Act applies on the basis of links to the UK rather than where the company is incorporated. A significant UK user base, or targeting the UK market, brings a service into scope. Business disruption measures exist partly because Ofcom needs leverage over services with no UK legal entity.