Lessons Learnt from Ofcom's First Enforcement of the Online Safety Act - Lessons from 4chan

Since the Online Safety Act’s (OSA) first requirements came into force in January 2025, Ofcom has published its first confirmation decision of a financial penalty under the legislation (Confirmation Decision). This is significant as it is the first substantive publication of an enforcement action undertaken by Ofcom and it gives the details of the first financial penalty issued by Ofcom under the OSA.

With recent news of a £50,000 fine imposed by Ofcom, the second confirmed financial penalty under the OSA, alongside an investigation into 20 more services on 20 November, these lessons are even more important for online platforms under the microscope. 

The Confirmation Decision gave us an insight into Ofcom’s investigation of 4chan and Ofcom’s stance on interpretating the OSA. It also shed some light into the ongoing litigation between 4chan and Ofcom in the US District Court for the District of Columbia where 4chan is seeking:

1. A declaration that Ofcom’s actions are inconsistent with the US Constitution; and
2. Permanent injunctions against Ofcom’s current and future enforcement actions. 

We have previously written about the OSA’s international reach and how Ofcom may conduct enforcement outside of the UK – read more here. 

The timeline so far

• 10 June 2025: Ofcom opened an investigation into 4chan for failing to have proportionate systems/measures to mitigate and prevent the encountering of illegal content
• 13 August 2025: 4chan failed to respond to Ofcom’s statutory request for information. A Provisional Notice of Contravention was issued.
• 27 August 2025: 4chan brought a case in the US District Court (District of Columbia) against Ofcom, seeking to oppose Ofcom’s enforcement actions.
• 13 October 2025: Confirmation Decision of 4chan’s non-compliance was issued with a fixed penalty of £20,000 and a daily non-compliance fine of £100 per day of up to 60 days.
• 18 November 2025: Ofcom publishes its Confirmation Decision, detailing its findings and decisions. 

What have we learnt?

The Confirmation Decision focuses on 4chan’s failure to provide information to Ofcom, specifically on i) 4chan’s illegal content risk assessment; and ii) 4chan’s qualifying worldwide revenue. 

1. Procedure, Procedure, Procedure 

Ofcom has highlighted in great detail, the procedural steps it had undertaken to issue the fine, including how and why the notices were validly served by Ofcom and its powers under the OSA to serve such notices. The Confirmation Decision also goes into explicit detail into why 4chan is subject to the OSA, going through each part of the relevant tests and definitions set out in the OSA, as well as all the evidence and correspondence leading up to the fine being issued.

Ofcom has a clearly defined procedure of escalation and thought process it undertakes before issuing an enforcement action; the benefit of this is that it reveals Ofcom’s interpretation on the scope of the OSA and it makes Ofcom’s actions/next steps predictable in future actions. 

2. The Olive Branch

Although Ofcom’s investigation began on 10 June 2025, the Confirmation Decision reveals that Ofcom reached out to 4chan on 27 March 2025 and 8 April 2025 offering an introductory meeting to develop a relationship. 4chan did not respond to Ofcom’s offers and the situation appears to have escalated to what it is now.

This highlights the importance to develop a working relationship with Ofcom and to actively engage with them, something that we have written about extensively in the face of the ramp up of Ofcom’s enforcement actions. 

3. Extra-Territorial Application is a MUST

Ofcom has strongly rebuked 4chan’s submission that it has no jurisdiction to enforce the OSA on a US company with no physical presence or operation in the UK. Ofcom has dedicated over an entire page in the Confirmation Decision to reject 4chan’s claim that it has no grounds to enforce the OSA overseas. This is a clear indication of Ofcom’s intention to conduct enforcement against overseas companies that operate in the UK.

In light of a wider debate between 4chan and Ofcom as to whether the OSA is infringing on US First Amendment rights, Ofcom has refuted 4chan’s claims that it is violating US First Amendment rights citing that this only binds to US government and not overseas bodies, as such it does not impact Ofcom’s powers to enforce the OSA. This is an interesting view given the recent calls for Australia’s eSafety Commissioner (the equivalent of Ofcom in Australia which has a similar online safety regime) to testify before the US Congress over ‘direct threats of free speech’. 

4. ‘Significant Number of UK Users’

The statutory test of whether an online service has ‘links to the UK’ is broad, one of the suggestions that a platform has ‘links to the UK’ is if it has a ‘significant number of UK users’.

The Confirmation Decision gave us an indication as to what may be considered as ‘significant’, using 4chan’s own data, Ofcom has identified that 4chan having 7% of its users being from the UK and this was sufficient to be ‘significant’, with particular reference to that as being the second largest demographic for 4chan. 

5. Financial Penalties and Considerations

Ofcom outlined its reasoning for imposing a financial penalty, such as the need for accurate and timely information for the critical function of Ofcom. It indicates how Ofcom plans to strictly enforce its information requesting powers. 

Ofcom also highlighted additional factors impacting the financial penalties, such as 4chan’s lack of cooperation on the investigation as an aggravating factor and gains by 4chan as a result of non-compliance. This reinforces the need for engagement and incentivises cooperation with Ofcom throughout the enforcement process to achieve a lower financial penalty.

Ofcom further states that previous breaches are a consideration, this suggests that the existing breach is likely to be used by Ofcom to impose a harsher penalty later on for 4chan’s failure to maintain and conduct an illegal harms risk assessment (as opposed to the failure in duty to provide information to Ofcom).

6. Geo-blocking is not a foolproof method

In response to Ofcom’s investigations, a number of sites have opted to restrict access by UK users. However, this is not a fool-proof method as Ofcom has continued its investigation into certain sites because it is still accessible by UK users as a result of the site being mirrored onto a UK accessible domain.

Ofcom has stated it will continue to monitor sites to ensure access restrictions are maintained consistently and will prioritise enforcement cases against sites that do not maintain access restrictions. This suggests Ofcom may even look into the use of virtual private networks (VPNs) and other circumvention methods in the future.   

What should online platforms do or take from the 4chan enforcement?

Engage with Ofcom when you can

The Confirmation Decision makes several references to 4chan’s lack of cooperation, it is clear that engagement with Ofcom is key, whether it is prior to any enforcement action or during an investigation. Engagement will likely paint you in a good light with Ofcom, demonstrating you are willing to work with them and potentially lessen the impact of a financial penalty. 

Do not ignore Ofcom 

Ignoring Ofcom is an aggravating factor on a financial penalty, it will only make things worse in an investigation and/or enforcement process. Platforms should take Ofcom seriously if they are contacted. 

Being overseas doesn’t mean you escape the OSA

Ofcom has made it abundantly clear in the Confirmation Decision that the OSA applies extra-territorially and it will enforce extra-territorially, the example with 4chan demonstrates that Ofcom will not back down just because an entity is based overseas. 

Ofcom can be predictable 

Ofcom is bound by its procedural steps, as shown in how it has escalated the enforcement and investigation of 4chan, it becomes easier to understand how Ofcom acts and its next steps. This will provide a good basis and precedent (as more enforcement actions take place) of how Ofcom conducts enforcement and investigations. 

Lessons Learnt

There is no doubt this is the first of many confirmation decisions published by Ofcom, particularly against platforms who have no physical presence in the UK.

Just as platforms are getting used to operating with the OSA, there is no doubt that Ofcom are also finding its feet with how it intends to enforce the OSA in the future, but the message from Ofcom is clear, do not ignore them.