Can the Online Safety Act be fixed?

Three years after the UK's Online Safety Act received Royal Assent, no-one is happy and the air is thick with complaints.

Supporters say that implementation has been too slow, too cautious, and that the Act hasn’t made any real difference. Enforcement is said to be a paper tiger: Ofcom is too risk-averse, interprets the Act too narrowly, doesn’t have strong enough powers, or all three. Ofcom stands accused of failing to meet the expectations of Parliamentarians.

Critics of the Act complain (among many other things) of lack of clarity on scope, baked-in over-removal of user content, chilling effects on small low risk forums, privacy impacts, and overreaching age-gating of user content.

In parallel we have the forthcoming under-16 social media ban. That, according to the DCMS Minister in a recent e-petition debate, will “capture user-to-user platforms whose purpose is to enable online interaction and which allow users to post material, alongside having an algorithm.” The Culture Secretary has recently suggested that that might extend to online marketplaces with messaging functionality.

All this is taking place against a background of US political perception that UK and EU online safety laws are guilty of extraterritorial overreach. 

Proposals for change

In its written evidence to the Lords Communications and Digital Committee Ofcom said: 

“We hear the critique that the pace of change is too slow. Our legal duties and the regulatory process do place constraints on the pace of our work – we need to consult stakeholders on policies, ensure our decision-making is based on robust evidence, take account of human rights law and give firms the opportunity to make representations on our decisions, among other things.” [5.3]

That fairly summarises the encumbrances that tend to attach to a “regulation by regulator” scheme such as the OSA. A defensible compromise between certainty and regulatory flexibility inevitably involves wrapping the legislation in substantive and procedural safeguards on exercise of the regulator’s functions and powers. A wide-ranging regulatory structure that required Ofcom to write and consult on dozens of statutory documents was always likely to take years to implement.

Ofcom continued:

“However, we are committed to finding ways to work faster, while continuing to focus relentlessly on better outcomes for users. We would welcome the opportunity to discuss this further with the Committee once our review is published.” (ibid)

The current clamour for amendments begs the question whether legislation built (as I have argued) on defectively designed foundations can ever be fixed by drawing up a snagging list. If not, we may be destined to go through this exercise over and again: a regulatory boom and bust cycle veering between flexibility and prescription, delegation and legislative control, something like this:

(AI visual assistance acknowledged)

Putting that existential question to one side, we can look at some of the proposals that have been made for amendment of the Act. This selection is gleaned mostly from evidence, mainly but not exclusively from Ofcom, currently being given to the Lords Communications and Digital Committee Inquiry into implementation and impact of the Act. 

These are by no means all the proposals for change that have been floated. The Online Safety Network, for instance, has published a more extensive 10 point list of revisions. On the critics’ side, in May 2025 the Open Rights Group published a 41 point report ‘How to Fix the Online Safety Act: A Rights First Approach’.

Nor does this post discuss plans to extend the ambit of the Act by, for instance, bringing AI services into scope in their own right. For AI-generated illegal content, powers to do that by means of secondary legislation have already been inserted into the Act.

One note of caution: there is a temptation to equate in-scope user-to-user services with large, algorithmically-driven data-hungry social media platforms. The Act covers a far greater variety of platforms, large and small. Ofcom’s overview of in-scope U2U services identifies not only social media services but video-sharing, messaging, online marketplaces and listing sites, dating services, review services, online games, file-sharing, audio-sharing, discussion forums, chat rooms, information sharing services (including collaborative encyclopaedias such as Wikipedia) and fundraising sites. There are more, such as collaborative software development and sharing platforms.

The government’s Bill Impact Assessment estimated that 100,000 service providers world-wide would be in scope. Of 25,000 in-scope UK providers, 80% were estimated to be micro-businesses (less than 10 employees). The Act applies to non-commercial providers such as volunteer-led forums.

If legislation is designed on the premise that the target is algorithmic social media services, it is unlikely to be a good fit for what in reality may constitute the vast numerical majority of services covered by the Act.

Legal certainty and foreseeability

Some might like simply to hand Ofcom a litigation-proof cudgel with which to beat up any tech company that incurs their displeasure. But that will not do. Foreseeability is a basic rule of law and European Convention on Human Rights (ECHR) tenet: subjects of statutory regulation should be able to predict in advance, with reasonable certainty, what they have to do to comply with their obligations. The Online Safety Act, either itself or as implemented by Ofcom, has to provide sufficiently clear and precise rules. Even the Devil, as Robert Bolt wrote in A Man for All Seasons, should be given the benefit of law.

In evidence to the Lords Communications and Digital Committee the Children’s Commissioner complained about Ofcom’s Children’s Code of Practice:

“When I read the children’s code, I was so disappointed. It felt like it was a technical document written for the companies, not a document written to every child in this country about how Ofcom was going to try to keep them safe. That is what it should have been.” (Dame Rachel de Souza, Oral evidence Q7, 1 September 2026)

An OSA Code of Practice, however, is not meant to be a children’s guidebook. Its function is to enable platforms to know what they have to do to comply. Schedule 4 of the Act spells it out: Code of Practice measures must be sufficiently clear, and at a sufficiently detailed level, that providers understand what those measures entail in practice.

In addition, for the Online Safety Act foreseeability is not just about platforms themselves. It is also about users. The Act sets up a triangular relationship between legislation/regulator, platform and user. A user’s freedom of expression rights under Article 10 ECHR are engaged when a platform, in order to discharge its OSA duties, takes steps that may affect a user’s posts.

So Ofcom’s recommendations for platforms have to be crafted with an eye to enabling a user to foresee, with reasonable certainty, whether what they want to post is liable to be affected by the platform’s compliance with an Ofcom Code of Practice. Even if it clearly sets out what a platform has to do to comply, an Ofcom recommended measure may yet be insufficiently foreseeable in its effects on users. An example of this is noted below, under Proactive technology.

The contribution that Ofcom’s Codes of Practice can make to foreseeability is seen in the government’s ECHR Memorandum on the draft Bill. When discussing the Article 10 rights of platforms and users it said:

“Prescribed by law: The Bill establishes an overarching regulatory framework governing the treatment of content online. In addition to the detailed provisions contained in the primary legislation, its application in specific cases will be given a higher degree of legal certainty through the exercise of delegated powers by the Secretary of State and the issuing of codes of practice by OFCOM.” [27]

Even if Schedule 4 of the Act did not stipulate for clear and detailed measures, the ECHR “prescribed by law” threshold would still require a reasonable level of clarity and precision to be achieved. The more broadly drawn the duties in the Act itself, the greater the need for Ofcom to provide that clarity and precision.

Is legal certainty really a problem?

It might be suggested that if common law duties of care like negligence and occupier’s liability can be articulated in broad terms such as a duty to take reasonable care, why cannot the Online Safety Act and Ofcom do the same? It is a good question. But a hidden danger lies in building a regulatory structure on the foundation of analogies that, although appealing at first sight, prove to be more different than they are similar.

Lack of congruence with existing duties of care feeds into requirements of legal certainty. The further the Online Safety Act goes beyond incremental development of established duties, the greater the need - if its duties are to pass the ECHR or rule of law foreseeability test – for their content to be clearly and precisely spelt out.

Established duties of care based on the common law can pass the ECHR and rule of law foreseeability test, first because they draw on a substantial volume of existing caselaw; and second, because any development of that law by the courts is incremental and thus within the bounds of reasonable foreseeability.

The Online Safety Act illegality duties, however, venture into new territory. They bear little resemblance to the subject matter or content of established safety-related duties of care (or, for that matter, health and safety regulation) with which analogies have been drawn.

Two aspects, in particular, undermine the comparison.

First, the subject-matter of the illegality duties is different. Instead of readily understood and identifiable notions of safety - personal injury and damage to property - the OSA applies its illegality duties to complex legal constructs: over 140 criminal offences and their inchoate corollaries (encouraging, assisting etc). It does not take 444 pages of Ofcom Illegal Content Judgements Guidance to understand what a broken leg or a property fire is.

Second, perhaps most fundamentally, the OSA’s duties on platforms typically engage the ECHR Article 10 freedom of expression rights of visitors to the platform. That brings into play requirements of clarity and precision, necessity and proportionality as they apply to speech.

That is not the case for typical offline safety-related duties of care. No visitor’s right of freedom of expression is affected by an occupier’s duty to take reasonable care not to leave a nail protruding from a floorboard, a building site operator’s duty to ensure that scaffolding is not laid on oil drums supported by piles of loose bricks (an example from the 1972 Robens Report on Safety and Health at Work), or a workshop owner’s duty to place a guard on a circular saw.

In short, speech is not a tripping hazard and it is asking for trouble to design this kind of legislation as if it were. The regulatory quicksand awaits those who try.

In addition, to the extent that a valid comparison can be drawn with established safety-related duties of care, only exceptionally do those impose a duty to prevent visitors injuring each other; and the content of any such duty tends to be limited.

The tripping hazard analogy appears to have gained traction by the time of the White Paper and Bill and evidently continues to do so. Indeed it featured in a recent Lords Committee oral evidence session. Lord Holmes asked whether, as then Culture Secretary Nadine Dorries had said to the draft Bill Committee in November 2021, an overarching duty of care could not get past parliamentary counsel. Sir Jeremy Wright KC MP, Culture Secretary at the time of publication of the White Paper, said:

“… if you go back—Lorna [Woods] will correct me if I have misremembered this—the original thought was that we can do something in the online space similar to the operation of the Health and Safety at Work etc. Act 1974. The Act does not require you to do something specific with the buckets on the floor or the shelving, specifically. What it says is that you have to create a safe environment. The objective here was to do the same online, and I am not persuaded that that would not have worked. (Oral evidence Q97, 3 November 2026, Uncorrected transcript.)

Professor Woods commented:

“Unless someone comes up with a specific problem, I am struggling to think what the problem is because we have other sectors where a similarly broad approach has been taken. There may be problems but they are just not leaping to my mind at the moment.” (Oral evidence Q98, 3 November 2026, Uncorrected transcript.)

The problem is that a bucket left untidily on the floor is - at least to my mind - categorically different from site visitors talking to each other.

If adult “legal but harmful” duties, such as for misinformation, were proposed to be reintroduced to the Act, the lack of congruence with existing safety-related duties of care would be even more pronounced, the subject-matter more nebulous and subjective and the problems of ECHR and rule of law compatibility yet more vexing.

Codes of Practice

Ofcom Codes of Practice are central to the OSA legislative scheme. When a Code of Practice is issued, a service provider is deemed to fulfil the duty if it complies with the Code of Practice. A service provider can choose to comply with the duty in an alternative way, if it is able to justify that to Ofcom. 

Somewhat confusingly, this “comply or explain” approach has come to be described as a “safe harbour”. That label has long been used for the qualified liability shields that derive from the Electronic Commerce Directive, and which operate in parallel with the OSA. To be clear, those have nothing to do, practically or conceptually, with the function and status of Ofcom’s Codes of Practice under the Act.

The objections now made to the Act’s system of Codes of Practice are first, that it provides insufficient connection between the risk assessment that a service provider is required to carry out and the steps that it should then take to mitigate identified risks; and second, that it places the burden on Ofcom to prescribe how a risk should be mitigated; unless and until Ofcom does so, there is no duty to take mitigation steps.

Ultimately, those are two facets of the same objection: that since Ofcom’s Codes of Practice authoritatively define how a duty can be complied with, that leaves no room for any residual obligation to take further steps to fulfil the Act’s broadly stated safety duties – even if a risk is not addressed in a Code of Practice but has been identified in the platform’s risk assessment.

The Online Safety Network, it should be noted, has questioned that interpretation of the Act. In any event, its Ten Point Plan proposes that the Act’s “safe harbour” provision should be removed and that the “clear and precise” and accompanying “technically feasible” conditions in Schedule 4 should be revised to allow for “more stretching, outcome-focused measures” in the OSA Codes of Practice.

Mark Bunting, Ofcom's Director of Online Safety Strategy Delivery, summarised the arguments in oral evidence to the Lords Communications and Digital Committee, answering a question from Viscount Colville about whether Ofcom would like to see the safe harbour taken out of the Act:

“This is a really important issue and not one that I can give you a simple answer to. There are some complicated issues to weigh up. The original legislation in effect created two parallel frameworks, almost. There is the risk-based component where companies have to assess risks and take steps to mitigate them. Then there are the codes of practice and the safe harbour. The challenge that we see—and a number of stakeholders highlighted the same challenge—is that, if companies do all the things in our codes of practice, they are deemed to be compliant with the Act, even if they still have risks that have not been adequately addressed through those measures.” (Oral Evidence, Q.30; 15 September 2026.)

Touching on the issues of legal certainty already mentioned, he also argued that a duty that is not sufficiently clear and precise is unenforceable:

“The reason that I cannot give you a very straight answer is because that system was put in place to give companies legal certainty about what they needed to do in order to comply. That legal certainty is also important to our ability to enforce against them. If we are not clear with companies about what they need to do to come into compliance, it is very hard for us to successfully bring investigations against them. The Act was trying to have its cake and eat it, so to have this very broad risk-based framework that also creates legal certainty for companies.” (ibid)

Ofcom’s written evidence to the Committee observed:

“[W]e cannot put in place a generic measure that providers should mitigate all risks identified in their risk assessments. Such a measure would not be consistent with the OSA or be enforceable by Ofcom.” [5.6]

The 2019 Online Harms White Paper did propose (subsequently confirmed in the government’s formal consultation response) an overarching and residual duty of care:

“Companies will still need to be compliant with the overarching duty of care even where a specific code does not exist, for example assessing and responding to the risk associated with emerging harms or technology.” [3.6]

The idea of an overarching or residual duty of care did not make it into the legislation. Lord Clement-Jones, during the Bill’s Lords Second Reading debate in February 2023, noted that “we have diverged a long way from the 2019 White Paper with its concept of the overarching duty of care.”

The issue identified by Ofcom and others is not so much that a specific code may not exist, but that an existing code may not stipulate steps to address a specific harm identified in a risk assessment.

Ofcom’s written evidence, although hinting that the government may wish to revisit this topic, is evidently alive to the potential issues with broader and less specific requirements:

“5.9 … [T]here are clear limits to what we can achieve via enforcement using formal powers given the safe harbour, and ‘clear and detailed’ requirements of the OSA.

5.10 In considering options in this area, Government and Parliament would need to consider how to balance broader requirements (for example ensuring that some or all firms address all reasonably foreseeable risks, or take all proportionate steps to address such risks) with the risk that such requirements are too vague to be enforceable, and fail to provide firms with adequate legal certainty.”

To reiterate, it is not only service providers that have to be provided with sufficient legal certainty, but users whose online posts are liable to be affected by steps taken by platforms to comply with a requirement to address risks.

Proactive technology

Ofcom’s recent evidence to Parliamentary committees displays some enthusiasm for a greater ability to recommend use of proactive technology (i.e. automated content filtering). 

In her evidence to a regular Commons Digital, Culture, Media and Sport Committee session on 20 October 2026, Dame Melanie Dawes (Ofcom’s Chief Executive) said this:

“When it comes to things we would like to be able to do in our code, it would be to require platforms to use AI to search for illegal content more than is currently allowed by the Act. The bar for us to require that is very high. We think the technology is there and that it should be deployed more on illegal harms in particular, so that platforms can find this stuff proactively rather than relying on members of the public to report it to them.” (Q. 54)

The new Ofcom chair, Sir Ian Cheshire, added:

“It is a great example of something where, if you had said that three years ago, the tech probably was not up to scratch, but the latest releases are.” (Q.54)

Schedule 4 of the Act sets out the bars that Ofcom has to surmount before recommending proactive technology for publicly communicated user content. Paragraph (5) addresses proportionality. Paragraph (6) says that in deciding whether to include a proactive technology measure in a code of practice, OFCOM must have regard to the degree of accuracy, effectiveness and lack of bias achieved by the technology in question. It may refer to industry or technical standards for the technology (where they exist); and it may set out principles designed to ensure that the technology or its use is (so far as possible) accurate, effective and free of bias.

Pausing there, it would seem odd if Ofcom did not have to have regard to the accuracy, effectiveness and lack of bias achieved by the technology.

At any rate, proactive technology came up in Ofcom’s evidence to the Lords Communications and Digital Committee. Commenting on paragraph (6), Ofcom’s written evidence said:

“This means that we need robust evidence on these points before we can propose such measures, and this tends to favour codes measures prescribing specific existing technologies – such as hash-matching – over broader measures requiring firms to innovate or consider a range of possible technical solutions.” [5.14]

It noted, however:

“In considering options in this area, it is important to acknowledge that the current restrictions on use of proactive technology are a response to the significant impacts of such tools on privacy and freedom of expression. The prospect of firms routinely scanning all content uploaded to their platforms, even if they are doing so in order to weed out illegal material or content harmful to children, rightly requires careful consideration, as requirements to do so – if not carefully designed – could represent disproportionate infringements of human rights. Ofcom is required to act in line with human rights law, and we will continue to do so in reaching decisions on what measures we can and cannot impose in this area.” [5.16]

That point was reinforced by Mark Bunting in oral evidence:

“Because of concerns about privacy and freedom of expression, the Act set out that we could require those tools only when we were convinced that they met certain thresholds for accuracy and effectiveness. We are gathering evidence to try to stack up that case and will be saying more about that once we have finalised our consultation this autumn.

            …

We think it is right that we should have to think carefully before we require use of these tools, because they are very intrusive in that they require all material to be scanned by social media firms as it is uploaded. However, we think that the case for that is strong and, as I say, we are working on our proposals in this area at the moment. I think we will have more to say about it before the inquiry is concluded.” (Oral evidence Q34, 15 September 2026)

In its Additional Measures consultation last year Ofcom did propose to go beyond existing technologies such as hash-matching. It proposed a broader ‘principles-based’ measure that would involve platforms researching or developing proactive technologies and deciding for themselves what level of accuracy was acceptable.

I have argued that it is doubtful whether such an approach could satisfy the “prescribed by law” foreseeability threshold for users’ ECHR Article 10 rights. We await seeing whether Ofcom will pursue that measure when it publishes its final recommendations.

Quantifying proportionality

The potential for recommended proactive technology to inflict collateral damage on legitimate user speech has obvious consequences for freedom of expression. That would go to proportionality as well as foreseeability. 

In its Code of Practice recommendations and also in its accuracy recommendations for technology notices under S.121, Ofcom has avoided setting minimum accuracy standards such as acceptable levels of false positives.

In a recent journal article Content Moderation, the UK Online Safety Act, and the European Convention on Human Rights¹ Ricki-Lee Gerbrandt has proposed that “As Ofcom’s regulation progresses, it should provide far more nuanced requirements concerning acceptable and proportionate error rates (“performance targets”) and make sure that platforms meet them.” She suggests that acceptable error rates could vary depending on context such as kind of illegality, the kind of speech involved (evaluated according to the ECtHR speech hierarchy), and the external situation (such as a crisis or an election).

As it stands neither Ofcom nor Parliament has got to grips with the question of how much legitimate user content it is acceptable to sacrifice in the pursuit of illegal content.

Council of Europe

It is noteworthy that the UK has signed the Council of Europe’s April 2026 Committee of Ministers Recommendation on Online Safety and User Empowerment. Although the Recommendation is in many ways an unsatisfactory document, it does state that:

“42. State authorities should not directly or indirectly impose a general obligation on intermediaries to monitor content which they merely give access to or which they transmit or store, be it by automated means or not.”

The Explanatory Memorandum is more specific:

“Paragraph 42 reiterates a principle enshrined in the Recommendation CM/Rec(2018)2 on the role and responsibilities of internet intermediaries. States should not impose any action that may lead to the obligation of intermediaries to systematically monitor user activity or to actively seek facts or circumstances that would indicate illegal activity, for instance by requiring the use of automated systems to proactively scan user data or content for legal infringements.”

On its face that reads directly on to proactive technology duties.

Safety by design

Safety by design is a recurring theme. It is now almost the motherhood and apple pie of online safety. Nevertheless there is evidence of a lack of consensus as to how it should and should not translate into concrete measures.

Safety by design is, in some versions at any rate, predicated on the proposition that online harm is, at least primarily, a product of the design of the platform. If the platform is designed from the outset so as to remove or adapt the features that create or exacerbate the risk of harm, then (so the theory goes) harm can eventually be designed out or at least minimised.  

The problem, at least within the context of the OSA illegality safety duties, is with identifying such risk-creating features. When the theory is applied beyond algorithmically-driven social media, or beyond features considered risky for children, general purpose computing functionality ends up being categorised as risky - such as when Ofcom designated as a risk factor (for terrorism, CSAM URLs and foreign interference offences) the ability to use hyperlinks.

Ofcom was able to do that by dint of abandoning safety by design’s core predicate of risk-creating or risk-enhancing design features, in favour of functionality – even if inherently innocuous – of which bad actors make use:

“We recognise that not all characteristics are inherently harmful; we therefore use the term ‘risk factor’ to describe a characteristic for which there is evidence of a risk of harm to individuals. For example, a functionality like livestreaming is not inherently risky but evidence has shown that it can be abused by perpetrators; when considering specific offences such as terrorism or CSEA, a functionality like livestreaming can give rise to risk of harm or the commission or facilitation of an offence.” [5.26]

Safety by design and content moderation

Safety by design proponents tend to favour content-neutral safety measures, avoiding or minimising the need for content moderation. The Online Safety Network Ten Point Plan complained that Ofcom has produced:

“ a suite of unambitious ex-post measures to reduce the impact of harm that has already occurred rather than upstream, content-neutral, “by-design” interventions to seek to prevent it occurring in the first place.”

It suggests that a definition of safety by design should be added to the Act to make clear to Ofcom and services what it was that Parliament intended.

The corollary of content-neutral safety by design is that content moderation is a fallback, not a safety by design feature. Although safety by design is focused on a platform’s systems and processes, it should not (so it is said) be equated to systems for content moderation. That ought to exclude proactive technology and automated content filtering.

That view, however, is not universally accepted. The government’s Statement of Strategic Priorities, for instance, regards automated content filtering as a safety by design measure. 

OSN complained in a submission to the Ofcom Additional Measures consultation that while Ofcom had framed some proposed measures, including automated content moderation, as being “safer by design”:

“these are primarily about ex-post mitigations for harmful content (reporting content, or relying on user action after harm has occurred) or introducing a form of safety tech (proactive tech measures) rather than embedding safe design at the level of systems and processes.” (emphasis added)

However, OSN’s companion detailed submission to the same consultation said:

“We broadly support the move towards requiring proactive technology as a safety-by-design approach to user safety”.”

Ofcom has linked safety by design to the role of Codes of Practice. Mark Bunting’s oral evidence to the Lords Communications and Digital Committee viewed safety by design in terms of the onus being not on Ofcom to identify emerging harms and address them in a Code of Practice, but on platforms to identify harms in their risk assessments and mitigate them:

“Safety by design is right at the heart [of the Act], but it is limited by this point about the safe harbour. The concept of safety by design is exactly as you have described it: it is about designing a service to remove risk as far as possible. It is never going to be possible to remove all risk from the types of services that we are talking about here, but we think that, in the end, the codes of practice and the approach to them put all the weight on Ofcom to identify what companies need to change. The sentiment of safety by design, which I completely agree with, is that the onus should be on the companies to identify what they need to do to address risk.” (Oral Evidence Q33, 15 September 2026)

That, however, says nothing about whether there are certain kinds of risk removal steps that do or do not amount to a safety by design measure – specifically whether those steps should be content-neutral or whether they encompass systems for content moderation such as automated content filtering.

Enforcement

Ofcom’s attempts to apply the Act to uncooperative overseas platforms with no assets or physical presence in the UK have been well publicised. Fines have been levied and most remain unpaid. Ofcom has not yet sought to obtain any of the Act’s last resort court orders, such as to require ISPs to block the platform.

In one case Ofcom has said that it has exhausted the remedies that are available to it under the Act. That seems to have been due to the site voluntarily geo-blocking UK users. The spectacle of another site, 4Chan, publicly thumbing its nose at the UK regulator has drawn media and political attention.  

Ofcom has suggested expanding its powers to seek business disruption orders from the court, of which more below.

Underlying all this are two questions:

-         How far can or should a regulator in any country go in enforcing its local laws against foreign sites, either as a matter of principle or in practice?

-         What is the aim of the Act’s fallback business disruption powers? Is it to punish foreign sites for disrespecting the UK regulator and ignoring its fines? Or is it to protect UK users? Or a combination of the two?

How far can extraterritoriality go?

There will be different answers to the question of principle posed in the first question, depending on how far one thinks that the UK (or any other country)’s writ should run internationally. Traditionally, limits on extraterritoriality are considered as a matter of territorial sovereignty (refrain from encroaching on a foreign state’s own territorial jurisdiction) and mutual comity (do as you would be done by - foreign countries can be expected to respect our sovereignty only if we respect theirs).

How those principles should translate to the inherently cross-border medium of the internet has long been discussed and still falls short of consensus. However, asserting jurisdiction over internet sites worldwide on the basis of their mere accessibility is likely to provoke criticism as exorbitant.

Whatever view may be taken on points of principle, what can be achieved in practice is another matter.

Ofcom comment in their supplementary written evidence to the Lords Committee that:

“We have initiated work regarding the pursuit of debt from all companies that have not paid their fines by their deadlines.”

They also observe:

“Whether we are able to recover debt through assets in another country can also depend on whether a court in that country will recognise a UK court judgment…”

The OSA does enable Ofcom penalties to be registered as civil judgments in the High Court or county courts. Although in principle a UK civil judgment may be pursuable via a foreign court, an Ofcom penalty is likely to encounter the objection that, in substance, it is a penal law. The US court in the proceedings brought by 4Chan against Ofcom noted that:

“…to the extent any foreign judgment against Plaintiffs [i.e. 4Chan] were penal in nature, Plaintiffs may find a receptive audience before American courts regardless of the judgment’s compatibility with the United States Constitution.”

The leading English law textbook, Dicey, Morris and Collins, comments that:

“There is a well-established and almost universal principle that the courts of one country will not enforce the penal and revenue laws of another country.”

This principle will have been well known to the drafters of the OSA. It is, no doubt, why the Act empowers Ofcom to apply to a UK court for various kinds of business disruption measure (BDM), designed to cut off a site’s UK advertising and revenue or, in the last resort, to require ISPs to block access to the site by UK users.

An Ofcom application for a BDM can be brought only in respect of a regulated service.  In order to be regulated, a site must have UK links. These can be one of three kinds: a significant number of UK users, the UK as a target market, or it is capable of being used in the UK by individuals, and there are reasonable grounds to believe that user-generated content on the service presents a material risk of significant physical or psychological harm to UK individuals.

If, therefore, a site voluntarily geo-blocks UK users, and if as a result it is no longer ‘UK-linked’, it is not a regulated service and Ofcom has no basis on which to apply for business disruption measures.

The size of the task that awaits a regulator seeking to persuade a court to block an entire platform should not be underestimated. While the Act certainly contemplates that such an order may be proportionate, the court would have to be persuaded that for the site in question it is appropriate to make the order for the purpose of preventing significant harm (meaning physical or psychological harm) to individuals in the UK, and that the order is proportionate to the risk of such harm.

What is the aim of business disruption orders?

Is voluntary geo-blocking an indication of regulatory success or failure?

Notably, in evidence to the Commons DCMS Committee, Dame Melanie Dawes remarked that a particular forum:

“… has been geo-blocked in the UK. No other jurisdiction has achieved that, and we were unable to go any further. There was nothing more that a court could have done to block the service beyond the way it has already been blocked.” (Oral evidence Q32, 20 October 2026)

In an interview with LBC about unpaid fines she said:

“Let me tell you the really good news here, because of those 11 companies, actually nine have introduced the changes we wanted or they have left the UK. They’ve just said ‘right, OK, we don’t want to comply with these laws, but we won’t offer our service to the British public anymore’, which is a good result as far as I’m concerned. …

There are going to be foreign courts that support small companies that aren’t based in the UK in not paying fines, but we will chase it down as far as we can. But what we’re really chasing here is the outcomes and we are starting to see that.”

From a practical perspective, if a site has geo-blocked the UK would a purpose be served in obtaining a site-blocking order against ISPs? If a voluntary geo-block can be circumvented by use of VPNs, would the same be true of an ISP site block?

Ofcom has provided the Lords Communications and Digital Committee with a list of changes that it would like to see made to its ability to apply to court for BDM orders. The first is to remove the requirement to show that a site is in continuing breach of its duties. This would enable Ofcom to apply for a BDM order if a site was no longer in breach, for instance as a result of geo-blocking UK users or taking the site down. Ofcom notes that, unlike a voluntary geo-block or take-down, a court-ordered ISP block cannot be reversed by the site.

Ofcom also suggests that it should be able to apply for a BDM for failure to pay a fine alone. This would apply to a site that had come into compliance with OSA requirements or has voluntarily geo-blocked, but had not paid a previous fine. That has the sense of a shift away from a pure focus on protecting UK users towards encompassing a means of publicly punishing the site.

Ofcom would also like to lower the threshold for securing interim business disruption orders. It proposes that the threshold should be reduced from likelihood of failure to comply with an enforceable requirement, to grounds to suspect a breach, coupled with reasons of urgency and risk of serious harm to the public interest.

It would also like the legislation to clarify that it is possible to get ‘dynamic orders’ that can be expanded to cover new sites with the same content/branding (such as mirror sites) without having to go back to the Court. This would be akin to a practice that the courts have developed for copyright ISP blocking injunctions.

Remarking that court-led BDMs do not enable particularly speedy action, Ofcom also asks the Committee to consider a new power that would enable Ofcom to require a regulated service provider to take action on an interim basis in an urgent case. As a direction to a regulated service provider rather than an order against a third party provider of business or internet access services, this would appear to be a different kind of power. Ofcom say that such a power would need to be designed with ‘appropriate limits and safeguards’. As an order against a regulated service provider, it would no doubt encounter practical limits to extraterritorial enforcement.

Ofcom, it should be noted, has at the request of the government conducted a review of whether Ofcom has the right capabilities in place to enforce the OSA. It remains to be seen whether it will contain more than what it has already indicated to the Lords Committee.

1. [2026] Public Law October, 717.