Ofcom Can Fine Overseas Platforms Under the Online Safety Act. Collecting Is a Different Statute Entirely

Ofcom has fined 11 online platforms more than £6m for breaching the Online Safety Act since enforcement powers took effect in March 2025. It has collected about £55,000 against roughly £3m of that total, according to testimony from Suzanne Cater, Ofcom's director of enforcement, before the House of Lords Communications and Digital Committee. Even a payment that landed the week of her evidence session left the picture largely unchanged: "realistically the majority have not been paid," she told the committee, declining to say how many providers were formally in default.

The gap traces to a structural mismatch between where the Online Safety Act's penalties are issued and where the money to pay them actually sits. Ofcom's largest and most-watched target is 4chan, fined £520,000 in a decision that broke down as £450,000 for failing to run age-verification checks, £50,000 for skipping a required illegal-content risk assessment, and £20,000 for not explaining its protections against criminal content, on top of an £800-a-day running penalty for continued non-compliance. 4chan has no UK office, no UK bank account, and no UK-based assets Ofcom can seize. In July 2026 Ofcom said it would ask US law enforcement and courts to help collect the debt, an admission that its own enforcement toolkit stops at the UK border.

4chan's owners tested that border from the other direction. In August 2025, 4chan Community Support LLC and Lolcow LLC sued Ofcom in the US District Court for the District of Columbia, arguing the Online Safety Act cannot reach a US-based publisher protected by the First Amendment and that Ofcom has no jurisdiction over a company with no UK presence. On September 15, 2026, the court dismissed the case, but not on those First Amendment grounds. It ruled Ofcom is an arm of a foreign state and therefore immune from suit in US courts under the Foreign Sovereign Immunities Act, as documented in the court's order recapped by attorney Preston Byrne. The court noted 4chan can still raise its constitutional arguments in the UK, or later, if Ofcom ever tries to enforce a judgment against it in the US.

That last clause matters more than the dismissal itself. Winning immunity from being sued does not give Ofcom a mechanism for collecting what it is owed. Any money judgment against 4chan would likely need to be enforced through a US court, which is exactly the forum where the regulator would face the First Amendment and jurisdictional objections that the DC court just avoided ruling on. Ofcom secured a procedural win that leaves the underlying collection problem exactly where it was.

The Online Safety Act does give Ofcom a harder lever than a fine: a business disruption measure, which can require UK internet service providers to block a site. But that power is not a debt-collection tool. It requires proof of ongoing, substantive non-compliance, such as an unmanaged risk to users, not simply an unpaid invoice. Ofcom cannot ask a court to block a site because a company has failed to pay a penalty; it has to show the underlying safety failure is still live.

That distinction produced a second, quieter failure this year. Ofcom fined an unnamed US-based suicide forum £950,000 in May 2026, following an investigation that ran from March 2025 to April 2026 and that reporting has linked to more than 160 UK deaths. Ofcom began preparing a court application for a blocking order against the site. By July 2026, Ofcom acknowledged it could not get the order through: the operator had implemented a partial geoblock restricting UK access, and that was enough to count as technical compliance, removing the legal grounds Ofcom needed to pursue the block. The forum did not pay the fine or fully comply with the Act. It did the minimum required to take the blocking threat off the table.

The pattern recurs across Ofcom's biggest cases: platforms with no UK footprint calculate that partial or superficial compliance, such as a geoblock or a token filing, costs less than either paying a fine or facing a UK-only site block that a VPN defeats anyway. Age-verification fines against adult sites, including a £1.35m penalty against 8579 LLC in February 2026, follow the same enforcement track and face the same collection question once the decision is issued.

Child-safety campaigners had flagged the credibility gap before Ofcom's first fine had even been paid. In September 2025, Andy Burrows, chief executive of the Molly Rose Foundation, told the Register that "I do not get the impression that the companies are quaking in their boots at Ofcom's enforcement approach." A year on, with a formal enforcement record now in place, the House of Lords committee's questioning suggests Parliament intends to keep separating the two halves of that record at future sessions: how much Ofcom has imposed in fines, and how much it has actually recovered.

Ofcom does not dispute its own jurisdiction. Its confirmation decisions assert authority over any service that reaches UK users regardless of where the company is based, and the DC court's dismissal, on immunity rather than merits, leaves that assertion untested rather than validated. What the 4chan and suicide-forum cases show is that asserting jurisdiction and converting a decision into money or a functioning block are separate problems, and the Act's enforcement architecture was built to solve the first one. The regulator can now point to £6m in fines as evidence the Online Safety Act has teeth. It has yet to show it can make an overseas platform feel them.