Online safety fees: who pays for Ofcom’s online safety regulation
In short: Online safety fees are payable to Ofcom by providers of regulated services with a qualifying worldwide revenue of £250m or more, from the charging year beginning 1 April 2026. Until then Ofcom funded the regime from spectrum receipts it was permitted to retain. Its Annual Report and Accounts for 2025/26, published on 9 July 2026, show £72.6m spent on online safety.
Ofcom cannot charge the cost of regulating online safety to the companies it already regulates. Section 38 of the Communications Act 2003 confines what it may recover from a Communications Provider to the cost of a closed list of telecoms functions, and its online safety work is not on that list. So the money came from spectrum receipts the Treasury allowed it to keep, and Parliament required Ofcom to recover an equal sum from the online services. Its Annual Report and Accounts 2025/26 (HC 363), published on 9 July 2026, is the last set of accounts drawn on that basis.
Key findings (Ofcom Annual Report and Accounts 2025/26)
- Ofcom spent £72.6m on online safety in 2025/26, a third of its £227.6m budget. The figure was £41.6m in 2022/23. Source: Annual Report and Accounts 2025/26, Financial Review, Table 5.
- Ofcom’s core duties, which cover telecoms, broadcasting and spectrum, took £143.8m, against £139.1m in 2022/23. Ofcom records that its core fees have been flat in cash terms for a decade, so the real cost of that regulation to industry has fallen. Source: Annual Report and Accounts 2025/26, Financial Review.
- Ofcom collected £520.4m under section 400 of the Communications Act 2003 and retained £155.1m of it. It records that the retained sum includes funding for online safety pending the introduction of the industry fee system. Source: Annual Report and Accounts 2025/26, Financial Review.
- Wireless Telegraphy Act receipts made up £295m of the £520.4m collected. Financial penalties made up £47m. Source: Annual Report and Accounts 2025/26, Financial Review, Figure 4.
- Providers of regulated services with a qualifying worldwide revenue of £250m or more must pay online safety fees from the charging year beginning 1 April 2026. Source: Online Safety Act 2023 (Fees) (Threshold Figure) Regulations 2025, SI 2025/1204, reg 2.
- Ofcom published its Statement of Charging Principles on 17 March 2026, the last document section 88 requires before it can charge a fee. The notification window for the initial charging year closed on 11 April 2026. Source: Ofcom, Statement of Charging Principles, online safety fees.
- Schedule 10 of the Online Safety Act 2023 requires Ofcom to recover a sum equal to the spectrum receipts it retained to meet its initial online safety costs, by charging additional fees to providers of regulated services. Source: Online Safety Act 2023, Schedule 10, paragraph 1.
| What Ofcom funds (£m) | 2022/23 | 2023/24 | 2024/25 | 2025/26 |
|---|---|---|---|---|
| Core duties (telecoms, broadcasting, spectrum, post) | 139.1 | 140.0 | 140.5 | 143.8 |
| Online safety | 41.6 | 47.0 | 66.0 | 72.6 |
| Media Act | — | — | 4.8 | 6.1 |
| Premium rate services | — | — | 1.0 | 4.0 |
| DRCF and AI hub | — | 0.6 | 1.2 | 1.1 |
| Total budget | 180.7 | 187.6 | 213.5 | 227.6 |
What Ofcom may charge a telecoms operator
Section 38 of the Communications Act 2003 lets Ofcom fix an administrative charge on a Communications Provider, and it constrains that charge tightly. Section 38(4)(a) requires the aggregate of the charges to be sufficient to meet, but not exceed, the annual cost of the functions listed in section 38(5). Section 38(6) sets out what those functions are, and every one of them is an electronic communications function: setting and enforcing conditions under section 45, supervising providers, market analysis, the Electronic Communications Code. Section 38(4)(b) requires the charges to be objectively justifiable and proportionate to the matters they are imposed for.
Ofcom’s online safety functions are in Part 7 of the Online Safety Act 2023. They are not in the section 38 list. A Communications Provider’s administrative charge pays for telecoms regulation and cannot be made to carry a cost outside that list. Parliament wrote the same constraint into the online safety regime: section 88(2)(a) of the Online Safety Act 2023 requires online safety fees to be sufficient to meet, but not exceed, the annual cost of Ofcom’s online safety functions, in the same words section 38(4)(a) uses for telecoms. Each regime pays for itself.
How Ofcom has paid for online safety so far
Section 400 of the Communications Act 2003 requires Ofcom to pay what it receives under the Wireless Telegraphy Act 2006 into the Consolidated Fund. Section 401 is the exception, and it is the whole answer. Ofcom may make a statement, with the consent of the Treasury and the Secretary of State, setting out the principles on which it retains those receipts and the costs it retains them against. Section 401(1)(b) says those costs “may include costs other than those incurred in the exercise of their functions under those provisions”. Retained spectrum money may be spent on things that have nothing to do with spectrum.
That is how the online safety regime has been paid for. Ofcom collected £520.4m in 2025/26, of which £295m was Wireless Telegraphy Act receipts, and it retained £155.1m to fund core responsibilities including, in its own words, online safety regulation pending the forthcoming introduction of the industry fee system. A wireless telegraphy licence fee is the same fee whether Ofcom keeps it or pays it over; retention changes where the money ends up, not what the licensee pays. The Exchequer has been carrying the cost of online safety regulation, through receipts that never reached the Consolidated Fund.
Parliament anticipated this and required the money back. Section 89 and Schedule 10 of the Online Safety Act 2023 are drafted directly onto section 401: Schedule 10 concerns the recovery of an amount equal to the Wireless Telegraphy Act receipts which, in accordance with section 401(1) and Ofcom’s statement under it, Ofcom retained to meet its initial costs. Ofcom must seek to recover that amount by charging additional fees to providers of regulated services. Ofcom does not keep what it recovers: section 400(1)(k) and section 400(3A) send the Schedule 10 additional fees to the Consolidated Fund. The Exchequer met the cost of the regime out of retained spectrum receipts, and the online services are repaying the Exchequer.
The online safety fees regime from 1 April 2026
Part 6 of the Online Safety Act 2023 sets out the ongoing regime. Section 84 lets Ofcom require a provider of a regulated service to pay a fee for a charging year, computed by reference to the provider’s qualifying worldwide revenue. Section 86 gives the threshold decision to the Secretary of State, on Ofcom’s advice, and he has taken it. The Online Safety Act 2023 (Fees) (Threshold Figure) Regulations 2025 (SI 2025/1204) were made on 18 November 2025 and came into force on 11 December 2025. Regulation 2 sets the threshold figure at £250 million, with effect from the charging year beginning 1 April 2026.
Qualifying worldwide revenue is defined in the Online Safety Act 2023 (Qualifying Worldwide Revenue) Regulations 2025 (SI 2025/1032) as the revenue a provider receives in the qualifying period that is referable to the regulated service, and the qualifying period is the second calendar year before the one in which the charging year begins. For the 2026/27 charging year that is calendar 2024. The Secretary of State has also approved an Ofcom exemption for providers whose UK-referable revenue falls below £10 million, set out in his letter to Ofcom.
The last piece fell into place on 17 March 2026, when Ofcom published its Statement of Charging Principles. Section 88(1) of the Online Safety Act 2023 stops Ofcom requiring any fee until that statement is in force, and Ofcom describes it as the final regulatory document needed to implement the regime. The deadline that follows it has already gone: section 83(5)(a) gave fee-liable providers four months from the day the threshold Regulations came into force to notify Ofcom, and the notification window for the initial charging year closed on 11 April 2026. A provider above the threshold that has not notified is in breach of a statutory duty now, not facing a deadline later.
Enforcement does not pay for the regulator
Penalties fund nothing. Section 400 sends Ofcom’s penalty income to the Consolidated Fund, and section 400(3A) sends online safety penalties there specifically. The section 401 retention power reaches Wireless Telegraphy Act receipts and section 53D fees; it does not reach penalties. Ofcom collected £47m in financial penalties in 2025/26, including £23.8m from a telecoms operator over its treatment of telecare customers during a landline migration and a series of smaller fines on online services over age checks, and none of it stayed with Ofcom. A large fine is a transfer to the Treasury and makes no difference to what Ofcom can spend. The fees are what pay for the regulator.
Viewpoint
I read the 2025/26 accounts as a closing balance. Ofcom built an online safety regime over four years on money the Treasury let it keep, and on 1 April 2026 the bill started going to the companies being regulated. The interesting number is not the £72.6m. It is the £250 million threshold, because that is the line between a service that pays for the regime and a service that gets it for nothing, and it is a line the Secretary of State can move under section 86(3) whenever he thinks it appropriate.
In our experience advising regulated firms on fee regimes, the question is whether a firm is in scope, not what the fee will be once it is. Qualifying worldwide revenue is a worldwide measure, but only the part referable to the regulated service counts, and for a group with a mixed business the referability analysis is the whole exercise. A provider that sat above £250 million for calendar 2024 and read itself out of scope has already missed the 11 April 2026 notification window, and the duty in section 83 does not expire because the date has. Section 38 has not moved, meanwhile, and will not: a telecoms operator’s administrative charge pays for telecoms regulation, whatever happens to Ofcom’s total budget.
Frequently asked questions
Who has to pay Ofcom’s online safety fees?
Providers of regulated services whose qualifying worldwide revenue is at or above £250 million, from the charging year beginning 1 April 2026, under section 84 of the Online Safety Act 2023 and SI 2025/1204. The Secretary of State has approved an Ofcom exemption for providers whose UK-referable revenue is below £10 million.
What is qualifying worldwide revenue?
The revenue a provider receives in the qualifying period that is referable to the regulated service, as defined in SI 2025/1032. The qualifying period is the second calendar year before the one in which the charging year begins, so the 2026/27 charging year is assessed on calendar year 2024 revenue.
When was the deadline to notify Ofcom?
The notification window for the initial charging year closed on 11 April 2026, four months after the threshold Regulations came into force on 11 December 2025, under section 83(5)(a) of the Online Safety Act 2023. A provider above the threshold that has not notified is in breach of the section 83 duty.
Can Ofcom charge telecoms companies for online safety regulation?
No. Section 38 of the Communications Act 2003 confines a Communications Provider’s administrative charge to the cost of the functions listed in section 38(5), all of which are electronic communications functions, and requires the charge to be objectively justifiable and proportionate to the matters it is imposed for. Ofcom’s online safety functions are in Part 7 of the Online Safety Act 2023 and are outside that list.
Do Ofcom’s fines pay for its regulation?
No. Section 400 of the Communications Act 2003 requires penalty income to be paid into the Consolidated Fund, and the section 401 retention power does not extend to penalties. Ofcom collected £47m in penalties in 2025/26 and none of it funded its own regulation.
For advice on whether a service is in scope of the online safety fees regime, or on how Ofcom’s administrative charges apply to a Communications Provider, contact Rob Bratby at Bratby Law. Our regulatory perimeter and market entry page covers scope questions of this kind, and our telecoms regulation pages set out the wider work.
