Conclusion 3

Ofcom lacks clarity about how it will identify and respond to non-compliance and when to use its enforcement powers. Ofcom estimates that there could be 100,000 or more service providers subject to regulation, with most of these being small businesses and / or based overseas. Ofcom will rely on automated processes 6 Preparedness for online safety regulation to identify and collect monitoring data on the compliance of the vast majority of service providers, but does not have these processes in place yet. Where non- compliance issues arise, Ofcom will engage with service providers to encourage their compliance. This approach has already had some success, when, following recent news stories about a website promoting suicide, Ofcom contacted its overseas provider which then agreed to block access to the site for UK users. However, Ofcom recognises some providers may choose not to engage, and it may prove difficult to contact the many smaller, overseas companies. Where engagement fails, Ofcom has a range of enforcement powers, including fines of up to 10% of a company’s global revenue and business disruption measures. These enforcement powers will only come into effect in stages as the regime is implemented, and Ofcom has already begun to consult on its approach to using these powers. Recommendation 3: Ofcom should urgently finalise its automated compliance monitoring systems and clarify its enforcement approach with service providers where engagement has not proved possible.