A (Byrne &) Storm is Brewing – Do Not Ignore the Online Safety Act’s International Reach

Earlier this year, as deadlines for online platforms passed to implement highly effective age verification and to conduct risk assessments, we wrote extensively about Ofcom’s ramp up of enforcement programme and their flurry of enforcement activity under the Online Safety Act (OSA). 

Now, it appears enforcement actions against international entities, like 4chan, have caught the attention of organisations across the Atlantic where questions around enforceability and free speech have arisen. 

A (Byrne &) Storm is Brewing

Preston Byrne, managing partner of the US law firm Byrne & Storm P.C., announced his intention to file a US federal lawsuit against Ofcom “to protect all Americans from UK censorship”. This has since escalated as Ofcom opened an investigation into 4chan on 10 June 2025, for i) failing to respond to information requests; ii) failing to keep risk assessment records; and iii) non-compliance with duties under the OSA.

On 13 August 2025, Ofcom issued a provisional notice of contravention citing breaches by 4chan for refusing to provide adequate responses to Ofcom’s statutory information requests. 

In a statement, on behalf of 4chan, Byrne & Storm revealed that Ofcom intends to impose a £20,000 penalty (plus a daily fine for continuing non-compliance) for 4chan’s failure to respond to information requests. The statement further adds that “any attempt to impose or enforce a penalty against 4chan will be resisted in U.S. federal court”. Byrne & Storm has further said that their client does not intend to pay Ofcom’s intended penalties.

Preston Byrne has also repeatedly called on the US administration to act on this and to “protect American companies”. 

The ‘Special Relationship’

The enforcement activity against 4chan raises an important question as to how Ofcom can conduct enforcement against international entities, whether that be compliance or financial penalties. With recent reports of diplomatic leverage being used on the UK Government to withdraw its request to access Apple’s encrypted data, it is unclear whether the US administration has its sights set on the OSA’s reach. 

Although the political aspects of Ofcom’s international enforcement are unclear, Ofcom’s legal powers are clearly set out in the OSA and follow a defined escalation pathway.

Ofcom’s Investigatory Process

Ofcom’s investigatory process can be summarised as follows: 

1. Trigger, Triage and Intake: Ofcom will use complaints, monitoring and media reports to identify triggers of non-compliance with the OSA. This is then triaged against Ofcom’s priority framework. 
2. Initial Assessment: a desktop review is conducted with informal enquiries to determine whether a formal investigation will commence.
3. Formal Investigation: a formal investigation is opened and public notice will be given on the Ofcom website (much like 4chan).
4. Evidence Gathering: using measures such as, statutory information notices and interviews, Ofcom will conduct formal information gathering. 
5. Provisional Findings: Ofcom may issue provisional notices if they find there are reasonable grounds of non-compliance with the OSA (such as 4cha’s failure to respond to Ofcom’s information requests).
6. Representations and Hearings: the online platform will be invited to provide written and/or oral submissions.
7. Final Determination: Ofcom may close the case if there is no breach, or issue a confirmation decision, either i) mandating steps to be taken to achieve compliance; and/or ii) imposing a financial penalty.
8. Post-Decision Monitoring: Ofcom will supervise implementation of the mandated steps (with powers to impose daily penalties) and additional business measures. 
9. Case Closure: the investigation will be closed once financial penalties are paid and/or the mandated steps have been taken.

In addition to these administrative powers, Ofcom can seek enforcement orders in the English courts, publicise non-compliance and, in extreme cases, pursue criminal sanctions

OSA Enforcement Beyond the UK

There are recognisable challenges for Ofcom to overcome when conducting enforcement against overseas online platforms, however there are several ways that may be available to Ofcom:

1. Business Disruption Measures: Ofcom may restrict access in the UK to the entire platform or specific services. This is not dependent on where the online platform is based and would impact platform traffic. 
2. Criminal Penalties: criminal sanctions could be applied for specific breaches of the OSA, such as a failure to comply with Ofcom’s information powers and children safety duties. This means individuals overseas could attract criminal penalties in fines and/or imprisonment. It provides Ofcom with greater reach globally, particularly under the Mutual Legal Assistance framework or other criminal extradition frameworks. It also means these individuals travelling to the UK may risk arrest. 
3. Financial Penalty Proceedings: Ofcom may initiate proceedings in English courts if an online platform fails to pay its fines. Enforcement money/debt judgment could result in UK asset seizures, or Ofcom may apply to foreign courts for the money/debt judgment to be recognised under The 2019 Hague Convention on the Recognition and Enforcement of Foreign Judgments in Civil or Commercial Matters. However, given the 2019 Convention excludes administrative matters, it may be difficult to prove the nuance that a money/debt judgment arising from an administrative penalty would apply, as well as issues with that only five countries have ratified the convention and EU member states are pending accession.
4. International Cooperation: Ofcom may work with other overseas regulatory bodies (such as the Global Online Safety Regulators Framework) to establish memorandums of understanding and bi-/multilateral enforcement frameworks. However, countries may be unlikely to cooperate at an enforcement level unless there are similar online safety legislation and policy alignment on enforcing online safety. 

Navigating Escalation and Enforcement

The investigation into 4chan shows that Ofcom will look into all online platforms irrespective of where they are based, and platforms will have to navigate Ofcom’s processes and enforcement.

In the first instance, Ofcom should not be ignored, 4chan’s investigation is a clear indication that Ofcom will not tolerate online platforms providing insufficient information in investigations. As such, platforms should be careful and take Ofcom seriously when they contacted. 

Ofcom has also shown its willingness to work pragmatically with industry actors to achieve the wider goal of improving online safety. As such, online platforms should actively engage with Ofcom. Engagement with Ofcom shows that platforms are taking Ofcom seriously and fosters a cooperative culture. 

Ultimately, Ofcom expects compliance with the OSA regardless of where an online platform is based, platforms should therefore ensure they are compliant with the OSA. The 4chan case is a clear signal that Ofcom will investigate and conduct enforcement against overseas platforms so platforms should be prepared for this. 

--

Katten will be able to advise on your OSA requirements, assist you in conducting risk assessments and advise on the implementation of measures to ensure you are OSA compliant. If you would like more information, please contact Terry Green (terry.green@katten.co.uk) and Larry Wong (larry.wong@katten.co.uk).