A Rare Admission of Defeat
On 20 July 2026, Ofcom did something regulators almost never do: it publicly conceded it had run out of road. The target was a US-based online forum that hosts explicit suicide-method content and has been linked to more than 130 UK deaths. Ofcom said it "has used the powers we've been granted to the fullest extent possible," according to Suzanne Cater, the regulator's director of enforcement, and that the forum's own geoblock now bars the "vast majority" of UK users who don't use a VPN (Ofcom; digit.fyi). Ofcom is now working with government to review whether its "business disruption" powers — court orders compelling ISPs to block a site nationally — should be strengthened.
The Fine, the Geoblock, and the Deaths
This forum was the first service investigated under the Online Safety Act 2023, and in May 2026 Ofcom fined its provider £950,000 for failing to risk-assess, failing to keep illegal suicide-encouragement content off the site, and running a geoblock that UK users could still circumvent by logging into existing accounts without a VPN (Ofcom). That May notice cited "over 130 deaths in the UK" linked to the forum. By July, the Molly Rose Foundation — the charity founded after the death of Molly Russell — was citing a higher figure, 164 UK deaths, and called Ofcom's conclusion that it can do no more "an incomprehensible decision that means more vulnerable people will continue to be groomed on the site" (Molly Rose Foundation). The gap between the two figures isn't a factual dispute so much as a snapshot problem — Ofcom's number is frozen at the point of its May enforcement notice, the Foundation's is its own running count.
Why the Law Ran Out of Road
The mechanics matter here. Under the Online Safety Act, Ofcom can ask a court for a business disruption order — compelling UK ISPs to block a site — only where there is ongoing non-compliance and significant risk of harm. Failure to pay a fine is not, on its own, a lawful basis. Once the forum tightened its geoblock in response to the £950,000 penalty, the specific contravention Ofcom could point to largely disappeared: the site no longer serves most UK users without a VPN, so there is no live breach left to litigate. Ofcom itself noted that going further would mean disrupting access for the forum's users worldwide — "beyond UK jurisdiction" (Yahoo Finance/PA).
The Case for Stronger Powers, Stated Fairly
The Molly Rose Foundation's frustration is legitimate and the strongest version of its argument deserves airtime. A forum that pins and reposts suicide-method instructions, that has been cited in coroners' findings, and that is still reachable via VPN by any determined UK teenager is not, in any meaningful sense, "solved." A regulator whose only remaining lever is a fine the provider can simply ignore looks toothless to grieving families who spent years campaigning to get Ofcom to act at all. If the Online Safety Act's business disruption test effectively expires the moment a bad actor complies just enough to erase the technical breach, that is a real design flaw worth Parliament's attention.
Why Widening the Power Is the Wrong Fix
But the instinct to respond to a hard case by broadening a blocking power is exactly backwards. The "ongoing non-compliance" requirement isn't bureaucratic timidity — it's a due-process safeguard that stops a regulator from imposing a permanent, nationwide access ban on the basis of past conduct alone. Loosen that standard so a lapsed geoblock or an unpaid fine is enough to trigger ISP-level blocking, and the same lever built for a suicide-instruction forum becomes available for any foreign site a future government finds merely undesirable — a template that authoritarian regulators worldwide would be delighted to cite as UK precedent. The Online Safety Act's extraterritorial reach was always going to hit a wall the moment a foreign provider complied with the geoblock but declined to shut down entirely; that is a jurisdictional limit inherent to any single country legislating for a borderless internet, not a uniquely fixable UK statutory gap.
What Should Actually Change
The narrower, more defensible reform is to fix the specific mechanism that failed here: VPN-enabled evasion of an otherwise-compliant geoblock. Ofcom and government could legislate that persistent, known evasion routes count as ongoing non-compliance for business-disruption purposes, without handing Ofcom a general power to block any foreign site whose provider it dislikes. Separately, unpaid fines against foreign providers need a real enforcement mechanism — asset recovery, payment processor pressure, app-store delisting — that doesn't depend on redefining what counts as an active breach. Ofcom's admission of defeat is honest and, refreshingly, not an attempt to spin failure as success. The right response is a scalpel aimed at the VPN-loophole problem, not a broader blocking mandate that trades a rare and tragic edge case for a general-purpose extraterritorial censorship power.