"Realistically the majority have not been paid," Suzanne Cater, Ofcom's director of enforcement, told peers in the House of Lords — a blunt admission that underlines how the regulator's legal power to fine online services is outpacing its ability to turn penalties into cash.
How many fines, and how much money?
Ofcom has issued fines totaling more than £7 million against 11 service providers under the Online Safety Act so far, officials told the committee. When pressed, the regulator declined to specify exactly how many of those penalties remained unpaid, or to detail the payment that "arrived this week." An Ofcom spokesperson said "some of the fines we've issued have been paid and some have not yet passed their deadlines to pay" and that where deadlines have passed the regulator "have initiated work regarding the pursuit of that debt."
Business structures, overseas operations, and practical limits
Officials explained why collecting fines is often difficult. Oliver Griffiths, group director at Ofcom, said enforcement to date had focused on smaller companies in the pornography sector — a choice that, he acknowledged, accentuates collection problems because many such companies lack UK assets. "If a company has assets in the UK, the process is relatively straightforward. If a company does not have assets in the UK, the process is more complex," the regulator told The Register.
Ofcom cannot simply switch off a service worldwide. It can ask a court to restrict access to a site within the UK and can seek orders compelling third parties such as ISPs to block access, but it cannot globally shut a website down. Courts can therefore limit UK access even when operators move infrastructure overseas — but those business disruption measures require ongoing noncompliance with the OSA and "cannot be used solely to recover an unpaid fine."
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleNew levers: disruption orders, judgment debts, and personal liability
Ofcom said it is starting to deploy additional enforcement tools. In May it invoked its business disruption power for the first time, applying for a court order against an unnamed suicide forum whose operator it had already fined £950,000. Cater also told peers the regulator was beginning to exercise powers to hold senior managers personally liable "in certain circumstances."
Still, Ofcom described disruption measures as a last resort. The regulator prefers to secure compliance before opening an investigation, and when pursuing an unpaid penalty would aim to register the fine as a judgment debt. Griffiths suggested the dynamics should improve as Ofcom targets larger companies: "I think it looks acute at the moment," he said. "I think over time, as we are fining the bigger companies, if they're in breach of the act, this will be less of an issue."
The regulator told The Register it was working with the UK government to consider strengthening its powers, while seeking to preserve safeguards for "fundamental rights such as freedom of expression."
Ofcom's enforcement activity and the limited immediate effect on safety
Cater framed Ofcom as active: the regulator points to six active enforcement programmes and 40 formal investigations covering more than 100 different services, including Telegram, TikTok and X. An Ofcom spokesperson said: "We've been more active than any other regulator in the world when it comes to enforcing online safety laws."
Yet internal metrics leave some officials unconvinced of immediate impact. Griffiths said his own tracking left him "underwhelmed" by the OSA's effect so far. He did highlight commitments from X to remove hateful and terrorist content more quickly, and promises from Meta and Snap to tackle grooming, calling those "encouraging signs" in what he described as "a one-way ratchet that is going to be building up over time."
That cautious assessment echoed public criticism from Children's Commissioner for England Dame Rachel de Souza, who told peers that children believed the OSA "has made absolutely no difference," and warned that many young people do not understand the law or how it is supposed to change their online experience.
What this means for platforms, the regulator, and children
- Platforms named in investigations (for example, Telegram, TikTok, and X): Expect continued scrutiny and public pressure. Ofcom says it will shift focus toward larger companies, where Griffiths thinks collection of penalties should be easier; at the same time, some firms have made public commitments on content removal and grooming.
- The regulator (Ofcom and the UK government): Ofcom is balancing enforcement tools — fines, disruption orders, judgment debts, and potential personal liability for managers — while working with ministers to seek stronger powers that retain safeguards for freedom of expression.
- Children and the Children's Commissioner: Despite regulatory activity, officials and the Children's Commissioner report little perceived improvement in online safety for young people; this gap between enforcement and public experience is a central tension in the hearings.
After months of fines, a first disruption order and growing enforcement activity, Ofcom faces a practical bottleneck: the law gives it new teeth, but not always the means to collect the bite. The regulator says it will pursue larger companies and explore strengthened powers with government, but for now the record is a mixed one — active enforcement programmes and public commitments exist alongside unpaid penalties and the very real question of whether those actions are changing children's online lives.
