The gap Ofcom just admitted to
On 20 July 2026, Ofcom announced that "all possible legal routes under the [Online Safety] Act have now been exhausted" against a US-based suicide forum that the Molly Rose Foundation says is linked to at least 164 UK deaths (Ofcom, 20 July 2026). The forum had already been fined £950,000 on 13 May 2026 for failing to assess and mitigate the risk of UK users encountering illegal suicide-method content — content Ofcom found the operator had itself pinned and reposted (Ofcom fine notice). That fine remains unpaid.
Normally, an unpaid penalty plus continued illegal content would be exactly the scenario the Act's toughest tool — a court-ordered "access restriction order" compelling UK ISPs to block a site — is built for. Ofcom cannot get there. The forum tightened its geoblock during the investigation, and under the Act a court will only impose business disruption measures where a service poses significant harm to UK users and is in ongoing non-compliance. A geoblock that keeps out "the vast majority of UK users who do not use a VPN," in Ofcom's words, satisfies that second condition even though VPN users — including, presumably, some of the most determined and vulnerable — can still reach the site.
Why this is a real regulatory failure, not just noise
The strongest case for a stronger tool here is not abstract. Ofcom's director of enforcement, Suzanne Cater, said the regulator has "used the powers we've been granted to the fullest extent possible, which has resulted in blocking this site for the vast majority of users in the UK" (digit.fyi) — and still landed on an outcome that satisfies no one. Andy Burrows, chief executive of the Molly Rose Foundation, called it "an incomprehensible decision that means more vulnerable people will continue to be groomed on the site and which will ultimately result in more lost lives," after families spent more than a year pushing Ofcom to keep investigating in the first place (Molly Rose Foundation). A £950,000 fine that goes uncollected against an operator outside UK jurisdiction is not deterrence; it is a number on a press release. When the harm is instructional suicide content actively curated by the operator, and the regulator's own account concedes the fix is porous, the case for closing the gap is real and does not need exaggeration.
"Families and survivors have been left devastated by this incomprehensible decision." — Andy Burrows, Molly Rose Foundation
Why the fix should stay narrow
But the honest reading of Ofcom's statement is not that the Online Safety Act is toothless — it is that the Act draws its jurisdictional line exactly where Parliament put it. Ofcom said plainly that it cannot go further because the Act "only extends to the design, operation and use of a service in the UK or as it affects UK users" (Ofcom, 20 July 2026). That limit is a feature, not a drafting accident: a British regulator ordering blanket measures against a foreign-hosted service on the strength of UK harm alone is precisely the extraterritorial overreach that critics — including this publication — have warned could be turned against ordinary speech platforms, small forums, and services that are complying in good faith but imperfectly.
The two failure points in this case are narrower than "the Act needs more teeth" suggests. First, there is no mechanism to pursue an operator for simply not paying a fine — that is a collections and enforcement-cooperation problem, arguably best solved through mutual legal assistance with US authorities rather than a UK statutory rewrite. Second, there is no "conditional order" that stays in reserve if a geoblock that cleared the compliance bar is later loosened or removed — a lapse-triggered order is a targeted fix that punishes bad-faith backsliding without lowering the bar for every other regulated service. Ofcom itself is now reviewing with government "whether the business disruption powers can be strengthened to make them more effective and deployable," and that framing — deployability against demonstrated bad actors, not a general lowering of the significant-harm or non-compliance thresholds — is the right one.
What to watch
The risk in this moment is that a genuinely sympathetic case gets used to justify a broad expansion of blocking powers that Ofcom could apply well beyond this forum. The OSA already reaches an estimated 100,000-plus services worldwide by virtue of UK-user access alone; loosening the "ongoing non-compliance" test to catch a determined bad actor's technical geoblock would also catch platforms mid-remediation, disproportionately burdening smaller and foreign operators with less compliance capacity than large platforms. The better outcome from this review is a scalpel — non-payment enforcement cooperation and lapse-conditional orders — not a lower bar that expands discretionary blocking authority across the whole regulated population. Parliament should get the specifics of any legislative fix, given how directly it will shape the next case that isn't nearly this clear-cut.