The Online Safety Act (OSA) makes businesses, and anyone else who operates a wide range of online services, legally responsible for keeping people (especially children) in the UK safe online.
Under the OSA, Ofcom's regulatory role is to make online services safer for the people who use them. We have a range of powers and duties to implement the new rules and we make sure companies have effective systems in place to protect users from harm.
We’ve set out our expected timelines for implementation in our roadmap to regulation. If you’re unsure whether the online safety rules apply to you, our regulation checker tool can help.
Our approach to information gathering
As an evidence-based regulator, there will be times when we need to formally obtain information held by stakeholders to carry out our duties, including developing evidence-based proposals to regulate effectively and proportionately.
Under the OSA, we have been given the power to request information for the purposes of exercising, or deciding to exercise, any of our online safety duties and functions.
If we think you have information that will help us fulfil our role to keep UK users safer online, we might send you a request for that information and explain why we need it. Formal information requests (also called ‘statutory information requests’ or ‘statutory information notices’ in the OSA) are the means through which we gather the information we need. Our formal information requests are co-ordinated and issued by our Information Registry team who will guide you through each step of the process.
For further details about information requests from Ofcom, including guidance on what to do once you receive a request, visit our website.
Online services have a legal duty to comply with requests for information
We want to work with you to keep adults and children safe online. It's important you provide clear, complete and accurate responses to a statutory information notice by the deadline given. If you don’t, we may open an investigation into your failure to comply.
Failing to comply with a statutory information notice may lead to enforcement action and can result in significant consequences (such as a financial penalty). Failing to comply can include not responding by the given deadline or providing an inaccurate or incomplete response (to one or more questions or parts of questions). When considering whether to take enforcement action for non-compliance of such requirements, we will follow our relevant enforcement procedures, for example our enforcement guidelines for regulatory investigations in line with the OS Enforcement Guidance.
We’ve published details of previous cases in which we have imposed financial penalties for non-compliance with a statutory information requests. Recent cases include:
- The investigation into Tapnet’s compliance with a statutory information request in 2023, where we decided to impose a penalty of £2,000 in respect of its contraventions.
- Our investigation into TikTok for providing inaccurate data on safety controls, where we decided to impose a penalty of £1.875m.
For more information on the rules for online services, check out the quick support guides on our website.