Ofcom has finalised its industry guidance on how it will exercise its wide-ranging powers to demand information from regulated tech firms as it seeks to make life online safer.

Under the Online Safety Act, Ofcom has legal powers to access information held by regulated companies and third parties, which Ofcom says is fundamental to its role as a regulator.

The regulator will also be able to remotely inspect how a platform’s algorithm works in real time as it holds organisations to account for example, about what they recommend to users particularly children.

Ofcom intends to use the information it collects to help it scrutinise how effective tech firms’ safety measures are, as well as demand data where the regulator has found specific concerns that its rules are not being followed.

Now, the regulator has introduced new guidance for online services about the factors Ofcom may take into account when deciding how to exercise these new information gathering powers.

The guidance also explains the legal duties imposed on regulated services and other third parties, setting out the expectations on how these companies should respond to a statutory request from Ofcom.

The regulator said it had received broad support for its draft guidance from respondents of its consultation, but are making some clarificatory changes in the final version.

This includes providing more information about the protections the Online Safety Act provides in relation to Ofcom’s disclosure to overseas regulators.

The regulator will also provide further detail about when and how it may use its powers to require tests or demonstrations and other general mechanics around some of the powers, including remote viewing.

Failure to comply with a request for information (known as an ‘information notice’) from Ofcom in an accurate, complete, and timely way will have consequences for firms, the regulator warned.

Recommended reading

• Ofcom Issues New Online Safety Guidance to Protect Women & Girls
• Ofcom Introduces Over 40 New Online Safety Measures
• Children First See Violent Online Content at Primary School Age

It could result in tech companies facing fines of up to £18m or 10% of their worldwide revenue – whichever is higher. Or, in the most extreme cases, there could be criminal liability.

In 2024, Ofcom fined TikTok, under the separate rules governing video-sharing platforms, for failing to respond to a request for information about its parental controls.

The regulator’s investigation into OnlyFans compliance with a request for information remains ongoing.

The guidance released today will be effective immediately, Ofcom clarified.