What Ofcom Can and Cannot Do When Online Safety Fines Go Unpaid

What has Ofcom announced

Ofcom said on 20 July 2026 that changes made by an overseas suicide forum to block UK users are the fullest extent of what the Online Safety Act can achieve, that the forum's £950,000 fine remains unpaid, and that it is reviewing its enforcement powers with the Government.

The forum, which Ofcom does not name and which is reportedly linked with more than 130 deaths in the UK according to figures cited from the Molly Rose Foundation, was the first service ever investigated under the UK's online safety laws and has been cited in multiple coroners' reports. In May 2026 Ofcom found its provider in breach of the duty to protect UK users from illegal content that encourages or assists suicide, fined it £950,000 and warned that it was preparing to seek a court order restricting UK access if its concerns were not addressed. Since then, the provider has tightened its geoblock, closing a route through which registered UK users could still log in without a VPN, and Ofcom says the vast majority of UK users who do not use a VPN can no longer reach the site. The regulator will monitor the geoblock as a priority and says it will act rapidly if it is removed. At the same time, Ofcom was explicit about the limits it has hit: it has identified no further change the provider could make that would materially block UK access without affecting users globally, which the Act cannot require, and all legal routes under the Act are now exhausted.

What happens when a company does not pay an Ofcom fine

Ofcom pursues the unpaid fine as a debt: where a company holds UK assets, through UK court judgments and orders allowing bailiffs to seize and sell them; where it does not, through overseas enforcement agencies and asset tracing, which is slower and less certain.

Ofcom's explainer, published the same day, sets out the mechanics. Fines under the Online Safety Act can reach £18 million or 10% of qualifying worldwide revenue, whichever is greater, and firms must be given a reasonable time to pay of at least 28 days. If payment does not arrive, the route depends on geography. For companies with assets in the UK, which includes the biggest tech companies as well as UK telecoms firms and broadcasters, Ofcom goes to the UK courts for a judgment confirming the penalty is owed as a debt, a judgment debt, and can then obtain orders permitting bailiffs to seize and sell UK assets. For companies without UK assets, recovery means engaging law enforcement agencies and private specialists in other countries to identify individuals and assets, and success can turn on whether a foreign court will recognise a UK judgment at all. Ofcom notes that some providers have deliberately structured themselves to frustrate this, incorporating in jurisdictions where little information reaches the corporate register. The regulator says it has started debt recovery work against every company that missed its payment deadline, including the US-based provider of the suicide forum.

Why can Ofcom not simply block the site in the UK

Because the legal test is not met: business disruption measures, the court-ordered blocks ISPs can be required to apply, are available only for ongoing non-compliance with the Act's duties, and an unpaid fine on its own does not qualify.

Business disruption measures are the Act's strongest tool: Ofcom can apply to a court for an order requiring third parties such as internet service providers to block access to a site in the UK. But the threshold is specific. It is not enough that a site poses a significant risk of harm to people in the UK; there must be continuing non-compliance with duties under the Act. In this case, the provider's tightened geoblock means UK users are no longer encountering the service, so the ongoing non-compliance limb is not satisfied, and failure to pay the fine does not qualify on its own. Ofcom also examined a pre-emptive route, a conditional order that would spring into effect automatically if the geoblock were ever removed, and found the Act provides no mechanism for one. Nor does any power exist, for Ofcom or the courts, to shut a website down globally: the Act extends only to a service's design, operation and use in the UK or as it affects UK users. Criminal liability under the Act arises only in a narrow set of circumstances which this case does not meet. The combined effect is the gap the regulator has now put on the record: a non-paying overseas provider that geoblocks the UK sits beyond every remaining lever the Act provides.

What enforcement action has Ofcom taken under the Act so far

Fines to date include £950,000 against the suicide forum's provider, £630,000 against a pornography provider over age check failings, £450,000 against 4chan, and £80,000 against First Time Videos LLC, alongside action beyond fines such as search delisting.

The published penalties give a picture of early Online Safety Act enforcement. The £950,000 fine against the suicide forum's provider is the largest so far, followed by £630,000 against an online pornography provider, made up of £600,000 for operating without age checks and £30,000 for failing to answer a statutory information request on time, £450,000 against 4chan for not having age checks preventing children from seeing pornography, and £80,000 against pornography provider First Time Videos LLC. The suicide forum case also shows the levers Ofcom reaches for beyond fines and blocking. Following its investigation, major search engines removed links to the forum. Ofcom has also written to UK internet service providers confirming that its net neutrality guidance does not prevent them from including suicide material in their content filters, removing a perceived legal obstacle to ISP-level filtering. Those measures sit outside the Act's formal enforcement machinery but, in the regulator's framing, form part of a coordinated effort across law enforcement, policymakers and the tech industry to limit UK access to harmful services.

What happens next to Ofcom's enforcement powers

Ofcom and the Government are reviewing whether the business disruption powers can be strengthened to make them more effective and deployable, with any change requiring Parliament, and the regulator will monitor the forum's geoblock and pursue the unpaid debt in the meantime.

Ofcom is careful to frame the constraint as one for legislators: it can only use the powers it has been granted, and changes are a matter for Government and Parliament. The live review focuses on the business disruption measures, examining whether they can be made more effective and deployable while keeping safeguards for freedom of expression and other fundamental rights. The obvious candidates for reform are the gaps this case exposed: whether an unpaid penalty should count towards the blocking threshold, and whether conditional orders should exist so a block can activate automatically if a geoblock is withdrawn. For the wider market, the pair of publications reads as deliberate signalling in both directions: to compliant platforms, that fines will be pursued as debts through the courts wherever assets can be found; and to Government, that the Act's current architecture has a documented limit when an overseas provider chooses to wall off the UK rather than comply. The next test of the regime will be whether the powers review produces legislation, and whether the debt recovery now under way against non-paying providers, in the UK and abroad, actually lands.

If you are struggling to cope, you can call Samaritans free on 116 123 at any time, day or night, or find support through the NHS help for suicidal thoughts pages. If there is an immediate risk to your safety or someone else's, call 999.