Ofcom fines 4chan for breaches of Online Safety Act

The question

What does Ofcom’s fine against 4chan indicate about the expectations for age assurance, illegal-content risk assessment and transparency obligations under the Online Safety Act 2023 (OSA) for services accessible in the UK?

The key takeaway

The OSA is concerned with protecting people in the UK and does not require platforms to restrict what users in other countries can see. For platforms operating globally, compliance will require UK-specific controls if their typical controls do not meet Ofcom's standards for "appropriate safety measures".  Ofcom's decision highlights its willingness to impose short remediation deadlines backed by daily penalties, increasing the urgency for platforms to evidence compliance with OSA requirements on an ongoing basis.

The background

Ofcom is the UK’s online safety regulator and has enforcement powers under the OSA in relation to services provided to consumers in the UK.  4chan is a US based global messaging platform, where users can post and discuss content, often anonymously, across topic-based boards. As Ofcom treats 4chan as a service accessible to people in the UK, it is therefore within scope of the OSA online safety requirements.

The development

On 19 March 2026, Ofcom fined 4chan £450,000 for failing to implement “highly effective age assurance” to prevent children in the UK from accessing pornography. Ofcom refers to research from the Children's Commissioner indicating that children often encounter pornography accidentally, supporting the policy rationale for mandatory age assurance on pornography services. The imposition of a fine confirms that Ofcom will not hesitate to take decisive enforcement action now the mandatory age assurance checks are an operational requirement. Ofcom required 4chan to implement appropriate age assurance measures by 2 April 2026 and confirmed that a failure to do so may trigger a daily penalty of £500.

Ofcom has also issued a £50,000 fine to 4chan for failing to assess the risk of people in the UK encountering illegal content. This demonstrates that risk assessments are “fundamental”, because providers must understand how harm could occur before selecting appropriate safety measures. Ofcom has required completion of a “suitable and sufficient” illegal content risk assessment by 2 April 2026, with a stated daily penalty of £200 for continued non-compliance.

Finally, Ofcom also fined 4chan £20,000 for failing to specify in its terms of service how individuals are protected from illegal content, requiring updated terms by 2 April 2026 with a stated daily penalty of £100 if not addressed.

Interestingly, at the time of writing, it looks like 4chan has failed to take the required remedial action (meaning we assume the daily penalties are racking up) and continues with its current action in the USA, which seeks a declaration that Ofcom's enforcement of the OSA is inconsistent with the US Constitution.

Why is this important?

For large platforms, the key message is that Ofcom is treating age assurance, risk assessments and user-facing transparency as threshold controls that must be implemented, documented, operationally sustainable, and defensible under enforcement scrutiny. The short remediation window and daily penalties framework increase the operational premium on having deployable age-assurance options and audit-ready compliance documentation (risk assessments, decision logs and terms mappings etc.) in place before any investigation begins. The jurisdictional point also reinforces that global services should include UK-specific controls rather than assuming a single global standard will satisfy UK requirements.

Ofcom highlights its broader enforcement toolkit, including court-based recovery of unpaid fines and potential “business disruption measures” (such as requiring payment providers/advertisers to withdraw services or ISPs to block a site in the UK) where a provider fails to comply with safety duties.

Any practical tips?

Businesses should:

• confirm whether any part of their service is in scope of the OSA and, if so, ensure “highly effective age assurance” is implemented and can be evidenced;
• ensure illegal-content risk assessments are completed, kept current, and demonstrably used to select and prioritise mitigations (because Ofcom frames the assessment as a necessary precursor to “appropriate safety measures”);
• review consumer-facing terms to ensure they clearly explain how users are protected from illegal content, as Ofcom has shown it will fine for missing or inadequate specification in terms; and
• prepare for escalation by mapping potential dependencies on payment providers, advertisers and UK ISPs (given Ofcom’s stated ability to seek “business disruption measures” where safety duties are not met).

Summer 2026