Ofcom discovers issuing Online Safety Act fines is easier than collecting them

Ofcom chiefs have acknowledged that most fines issued under the Online Safety Act (OSA) remain unpaid, highlighting limitations in the comms regulator's enforcement powers. The regulator's director of enforcement, Suzanne Cater, told the House of Lords Communications and Digital Committee that although another payment arrived this week, "realistically the majority have not been paid." Ofcom has imposed fines totaling more than £7 million ($9.4 million) on 11 service providers under its OSA powers so far, but when asked, it refused to specify exactly how many have not paid, nor detail the payment that came in this week. Oliver Griffiths, group director at Ofcom, said the regulator's enforcement action had primarily focused on smaller companies in the pornography industry. Its largest fine under the OSA, for example, was the £1.4 million ($1.88 million) penalty imposed on 8579 LLC in February. However, Ofcom plans to pursue larger companies, which Griffiths said should make difficulties collecting fines less pronounced. "I think it looks acute at the moment," he told peers on Tuesday. "I think over time, as we are fining the bigger companies, if they're in breach of the act, this will be less of an issue." Asked why it had not collected more of the fines, Ofcom officials pointed to the limits of its powers and the ways online platforms structure their businesses to evade enforcement. Cater said the regulator was beginning to exercise its powers to hold senior managers personally liable in certain circumstances. She acknowledged, however, that its business disruption powers have limits. Ofcom cannot shut down a website globally, but it can ask a court to restrict access to one in the UK. It first invoked that power in May, applying for an order against an unnamed suicide forum whose operator it had already fined £950,000 ($1.2 million). Services do not escape the OSA merely by moving their operations and infrastructure overseas, as courts can order third parties such as ISPs to restrict UK access. However, business disruption measures require continuing noncompliance with the OSA and cannot be used solely to recover an unpaid fine. Griffiths said some services had complied after being fined but failed to pay the penalty, leaving Ofcom to pursue the debt separately – a potentially difficult process when a company has no UK assets. Ofcom regards disruption measures as a last resort. It would prefer to secure compliance before opening an investigation or, when collecting an unpaid penalty, register the fine as a judgment debt. The regulator told The Register that it was working with the UK government to consider strengthening these powers while preserving safeguards for fundamental rights such as freedom of expression. Cater insisted that Ofcom was showing its teeth despite criticism that the regulator had been too timid. "I think we are very active in using our enforcement powers," she told peers, pointing to the six active enforcement programs and 40 formal investigations covering more than 100 different services, including Telegram, TikTok, and X. An Ofcom spokesperson repeated Cater's figures, telling us: "We've been more active than any other regulator in the world when it comes to enforcing online safety laws." They added: "Some of the fines we've issued have been paid and some have not yet passed their deadlines to pay. Where deadlines have passed and we have yet to receive payment, we have initiated work regarding the pursuit of that debt. "If a company has assets in the UK, the process is relatively straightforward. If a company does not have assets in the UK, the process is more complex. Given this is an ongoing operational matter, we can't provide further details about specific companies." Plenty of enforcement, not enough impact Despite Ofcom's defense of its enforcement record, Griffiths said its own tracking metrics left him "underwhelmed" by the OSA's effect on online safety so far. He cited commitments from X to remove hateful and terrorist content more quickly, and from Meta and Snap to tackle grooming, as encouraging signs. "But I think [this is] a one-way ratchet that is going to be building up over time, and we're confident that the commitments that we've seen from some of the big services and the continuing momentum that we have is going to make a significant change over time," Griffiths said. The comments came a week after Children's Commissioner for England Dame Rachel de Souza told peers that children believed the OSA "has made absolutely no difference." Young people have little understanding of the legislation or how it aimed to change their online experience, de Souza said. She was especially critical of the legislation's focus on moderating content instead of looking to change online platforms' harmful and addictive designs. The hearing also turned to Meta's recent settlement of US claims that Facebook and Instagram harmed children. Lord James Knight asked whether the "eye-catching" agreement, worth up to $18 billion, would influence Ofcom's enforcement strategy. Griffiths said the case demonstrated both how much platforms might pay to settle online safety litigation and how effective enforcement could bring about changes to their services. ®