United Kingdom

[GB] Ofcom escalates Online Safety Act enforcement with GBP 950 000 suicide forum fine

IRIS 2026-5:1/7

Alexandros K. Antoniou

University of Essex

Ofcom, the UK’s communications regulator, has imposed a GBP 950 000 penalty on the provider of an online suicide discussion forum for continuing failures under the Online Safety Act 2023 (OSA). The decision marks a further expansion of the OSA enforcement beyond pornography and age-assurance obligations (see IRIS 2026-1:1/25, IRIS 2026-3:1/10 and IRIS 2026-4:1/3) into the Act’s illegal-content duties concerning content that may encourage or assist suicide. Ofcom has not named the forum or provider because of the nature of the service. The regulator says the forum had been cited in connection with more than 130 UK deaths and appeared in multiple coroners’ reports. It is also preparing a court application for business disruption measures, including a possible UK access block.

The decision concerns a platform on which users may upload, share or generate material such as posts, comments, messages, images or videos (a "user-to-user service" under the OSA). Ofcom determined that the forum falls within the Act because it can be accessed in the UK, including by registered UK users without a VPN or similar tool. The regulator concluded that the service retained sufficient UK links and that user-generated content on the platform posed a material risk of significant harm to individuals in the UK. The provider therefore remains subject to the Act’s illegal-content duties, despite being outside the UK.

Ofcom’s findings did not rest merely on the presence of discussion concerning suicide, but on content considered capable of amounting to unlawful encouragement or assistance of suicide under UK law. In particular, under UK law, intentionally encouraging or assisting the suicide, or attempted suicide, of another person is a criminal offence. Ofcom’s decision focuses on content likely to fall within that category, including instructional material describing suicide methods and responses encouraging users to take their own lives. The regulator considered evidence from the Mental Health Foundation, the Molly Rose Foundation and Samaritans. It found that illegal suicide content was present throughout, including method guides and detailed threads. Ofcom also relied on evidence that some material had been pinned or reposted by the provider itself, reinforcing the regulator’s conclusion that the provider was aware of the presence of illegal suicide content on the service.

The confirmation decision, issued under section 132 of the Act, identifies failures across the illegal-content architecture of the online safety regime. Ofcom found that the provider had not carried out a suitable and sufficient illegal-content risk assessment, contrary to section 9(2). It also found ongoing breaches of section 10: the provider had not used proportionate measures to prevent users encountering priority illegal content; had not operated systems and processes to minimise the time such content remained available or to remove illegal content swiftly once aware of it; and had not explained in its terms how users would be protected.

The decision also addresses reporting and complaints. Specifically, Ofcom found that the service did not provide easy mechanisms for users and affected persons to report content they considered illegal, contrary to the Act’s reporting and complaints duties. It further found failures under section 21, including the absence of an accessible complaints procedure and insufficient terms explaining how complaints would be handled and resolved. The provider must adopt relevant measures from Ofcom’s Illegal Content Codes of Practice for user-to-user services, or suitable alternatives.

The GBP 950 000 penalty is a single financial sanction covering those contraventions. Ofcom described the breaches as “serious and deliberate” and said the amount reflected the grave nature of the failings, the risk of harm to people in the UK and the size of the provider. The regulator has also directed the provider to take compliance steps (imposing a timeframe of ten working days), including completing a suitable risk assessment, introducing moderation and takedown processes, updating terms of service, and establishing complaints arrangements.

A central feature of the investigation was the provider’s attempted restriction of UK access. During the investigation it introduced a geo-block for users with UK IP addresses on two mirrored URLs and later removed landing-page wording promoting ways to bypass the block. Ofcom nevertheless found that the restrictions were not consistently effective. Evidence supplied by Samaritans (a major registered charity dedicated to suicide prevention) showed that a third “mirror site” was directly accessible from the UK. That site was later taken offline, but registered UK users could still access the service without a VPN. Those facts meant the service retained UK links and remained within the Act.

The regulator’s next step may be to seek business disruption measures through the courts if the provider does not comply. This may involve requiring payment providers or advertisers to withdraw services, or internet service providers to block UK access. Under the statutory enforcement framework, criminal proceedings cannot be pursued where a financial penalty has already been imposed in relation to the same contraventions.

Ofcom’s decision illustrates the territorial reach of the OSA and highlights the widening scope of enforcement activity beyond pornography and age-assurance obligations into broader illegal-content duties. It also emphasises that the OSA is increasingly employed by the regulator not only to penalise unlawful content exposure, but also to scrutinise whether platforms maintain operational systems capable of identifying, reporting and removing illegal material.