On 15 September 2026, Ofcom's enforcement director Suzanne Cater told the House of Lords Communications and Digital Committee that "realistically the majority have not been paid" of the more than £7 million in Online Safety Act fines levied on 11 providers, according to The Register's report of the hearing. Ofcom did not say how many fines are outstanding. Some had not yet reached their payment deadlines.
The case for the regulator
The strongest defence of Ofcom is that a fine is not the only tool, and that a fine's face value is not the measure of success. Ofcom is required to give firms at least 28 days to pay, so some of the unpaid total is simply not yet due. Ofcom can also seek court-ordered business disruption measures, such as ISP blocking, and it did invoke blocking powers in May against a suicide forum. The Register reports that some services complied with the rules after being fined but still did not pay. That suggests the fines changed behaviour even where the money did not arrive. Ofcom also says it has been more active than any other regulator worldwide, with 40 formal investigations covering more than 100 services.
That defence deserves a fair hearing. It also concedes the central point.
Where the model breaks
The fines that are not being collected are mostly aimed at operators who have no UK presence. The largest single penalty so far, £1.4 million against 8579 LLC in February, is against a US-registered entity. In March, Ofcom fined 4chan a total of £520,000 across three findings: £450,000 for lacking age checks, £50,000 for failing to assess illegal-content risk, and £20,000 for inadequate terms of service. Ofcom's own guidance describes the recovery route for such firms. For a company with UK assets it obtains a court judgment and can send bailiffs to seize and sell those assets. For a company without them, Ofcom says it must "engage with law enforcement agencies and private specialists in other countries to identify individuals and assets." It acknowledges that some providers deliberately incorporate in jurisdictions with minimal corporate transparency.
The statutory ceiling makes the problem clear. Ofcom can fine up to £18 million or 10% of qualifying worldwide revenue, whichever is greater. A ceiling only deters if the target can be made to pay. For an operator with no UK assets, a £18 million fine and a £20,000 fine are equally uncollectable, and the operator knows it.
The blocking route is also narrower than it looks. Ofcom states that it lacks "the legal powers to apply to block a site in the UK for failure to pay a fine alone." Blocking requires continuing breach of the Act's duties. An operator that complies just enough to stay reachable, and never pays, sits in a gap between the two remedies. That is the pattern the Register headline describes.
Why this matters for speech and innovation
A regime that cannot collect from the operators it targets will drift towards the operators it can reach. Ofcom has said it will focus on larger companies and begin holding senior managers personally liable in some circumstances. Large firms with UK staff and assets are the ones for whom a fine is collectable. They are also the platforms that carry mainstream speech and the UK start-ups that build on them.
That is a proportionality problem. Compliance costs and enforcement risk fall on firms that can be found, while the offshore operators the Act was largely written to reach face little consequence. The Act's supporters can fairly say that reaching bad actors is hard for every regulator. But the answer is not to reach for blunter tools against the reachable. Broader blocking and payment-provider disruption carry over-blocking risks that hit lawful speech, and lawful users get caught in the net first.
This is also not an isolated admission. City AM reported on 15 September that Ofcom itself was "underwhelmed" by progress on major platforms, that the Act will not be fully operational until around June 2027, and that a planned under-16 social media ban could strain its capacity: "Without extra staff and extra funding, then something will have to give."
What a proportionate fix looks like
- Publish collection data. Ofcom declined to say how many fines are unpaid. Fines, payment status and recovery costs should be reported each quarter so Parliament can judge whether enforcement works.
- Tie penalties to outcomes. Where a firm has changed its conduct, as some fined services reportedly have, the regulator should say so. Compliance is the goal, not revenue.
- Prioritise international cooperation. Recovery against firms without UK assets depends on foreign law enforcement and private specialists. Investing there is more useful than raising a ceiling nobody can reach.
- Resist scope creep. Adding new duties, or a new age-based ban, while existing enforcement is unresolved stretches a regulator that has already said it lacks capacity.
The Lords committee is examining the Act, and its questions should start with this evidence. If Ofcom cannot collect from the operators it has already penalised, then a bigger headline fine changes little. The way to make the Act credible is to show it works against the firms it was aimed at before adding to what it asks of the firms it can already reach.