Online Safety Act fees and penalties to set by reference to revenue

Sadie Welch of Pinsent Masons was commenting after Ofcom published its final policy statement on the implementation of the fees and penalties regime under the Online Safety Act. Ofcom is the regulator responsible for monitoring and enforcing compliance with the Act in the UK. It held a consultation on its implementation of the fees and penalties regime between October 2024 and January this year.

Ofcom’s online safety work will be funded by the service providers it regulates. Fees will be calculated based on each provider’s ‘qualifying worldwide revenue’ (QWR). QWR has been defined as “the total amount of revenue the provider receives that is referable to relevant parts of a regulated service”. This will include revenue from advertising, subscriptions, one-off payments, and the supply of goods or services. The “relevant parts” of a regulated service are the parts on which user-generated content, search content, or regulated provider pornographic content may be encountered.

The use of ‘relevant parts’ represents a clarification of Ofcom’s position set out in its consultation paper, which referenced referable revenue in the context of ‘all of the parts’ of a regulated service and defined referable revenue as including both relevant and non-relevant parts of a regulated service in the draft QWR Regulations.

Companies with QWR above a particular threshold to be set by the Secretary of State will have a duty to pay fees under the regime. Ofcom has recommended that this threshold should be at or above £250 million, although it considers any figure between £200m and £500m would be appropriate.

Ofcom has recommended that the Secretary of State exempt providers of regulated services from payment of fees if their UK referable revenue is less than £10 million. ‘UK referable revenue’ is the revenues of a provider which may arise anywhere in the world but is attributable to the provision of one or more regulated services to UK users.

The same calculation of QWR will be used to calculate the maximum penalties that can be imposed by Ofcom where a provider is found to have breached the Act. Penalties can be up to 10% of QWR or £18m, whichever is greater. However, Ofcom has recommended adopting a different definition of QWR for the purposes of determining the maximum penalty cap when it finds a provider and one or more undertakings in a group of companies jointly and severally liable for breaches of the Act. In that situation, the QWR would be defined as the worldwide revenue from all companies within a group, regardless of whether that revenue is referable to a regulated service in the UK.

Ofcom published consultation responses from several service providers in scope of the Act alongside its policy statement. Some of these responses advocated for lowering of thresholds and implementation of fee caps and argued that the focus should be profit rather than revenue. Welch said that approach would align more closely with that adopted under the EU Digital Services Act, where supervisory fees are calculated using a formula that takes account of user numbers and then is capped at 0.05% of the service provider’s worldwide profit in the preceding financial year.

Welch said: “There has been very little change in Ofcom’s approach to the fees and penalties regime established by the Online Safety Act between the publishing of its consultation on this topic and its final policy statement, despite the clear concerns expressed in response to that consultation by service providers who will be impacted most by Ofcom’s proposals.”

“While several of these proposals are still subject to Secretary of State approval, this indicates that providers of regulated services that will be caught by the thresholds should start considering how to calculate QWR now, ensuring a robust and defensible methodology is used to avoid potential enforcement action later down the line,” she said.

While Ofcom has laid draft regulations designed to underpin its final policy on QWR for parliamentary approval, the Secretary of State he has yet to lay regulations regarding QWR thresholds.

It is expected that online services will need to calculate and notify their QWR to Ofcom by Q2 2026, with fees due in Q3 2026. Following initial notification, Ofcom intends to make requests for information every charging year to ascertain QWR. Failure to comply with such requests could lead to Ofcom taking enforcement action.

Ofcom has opened a fresh consultation on proposed new guidance on QWR that it has developed.

The draft guidance sets out Ofcom’s suggested methods for apportioning revenues to relevant parts of regulated services in a just and reasonable manner, which includes apportionment based on the proportion of usage or engagement by users on relevant parts versus non-relevant parts. Ofcom said this approach is likely to be “preferable to one based on costs” where “suitable data is available”, but said it recognises that providers will operate different business models and may prefer to adopt one of the other approaches to apportionment it has proposed. It has encouraged service providers to take independent advice.

Where a service provider is required to notify Ofcom of its QWR but fails to do so, or where Ofcom disagrees with the QWR that has been submitted by a service provider, the amount of a provider’s QWR will be determined by Ofcom. The guidance sets out other methods Ofcom may use to estimate QWR, which includes benchmarking based on the revenues of comparator standalone regulated services with similar functionality and quality in the market or by estimating the costs of providing the relevant parts plus a commercial return.

“This highlights the importance of accurate data collection by service providers and the development of a calculation methodology based on and defensible by reference to this data,” Welch said.

Ofcom’s consultation on its QWR guidance closes on 10 September.