OFCOM

Institutional Archetype

THE GATEKEEPER — The archetype is the license office that inherited the open internet. Ofcom’s native method is the regulator’s classic triad — license, code of practice, fine — built for a world of scarce spectrum and numbered broadcasters, where the regulated are few, known, and permitted. The Online Safety Act handed that method a categorically different object: the open web, where the regulated are numberless and the “license” is, functionally, compliance with identity-gated access rules. The structural power is the convergence itself. A platform negotiating its age-check obligations is negotiating with the same authority that licenses broadcasters, allocates spectrum, and regulates the ISPs that carry it — and that can, with a court’s permission, order payment providers and advertisers to withdraw from a non-compliant service. Every layer of the stack, one desk.

Mandate & Origin

Ofcom was created by the Office of Communications Act 2002 and received its powers under the Communications Act 2003, merging the UK’s separate broadcast, telecom, and spectrum regulators into a single converged authority. Its remit has expanded roughly once a decade since — postal services, video-sharing platforms, and then the step-change: the Online Safety Act 2023 made it the statutory online-safety regulator, with duties over user-to-user and search services, enforceable fines of up to £18 million or ten percent of qualifying worldwide revenue, court-backed business disruption measures, and senior-manager criminal liability in defined cases. The enforcement calendar it set: illegal-content duties enforceable 17 March 2025; “highly effective age assurance” duties in force 25 July 2025.

Leadership is the civil-service and establishment pipeline, stated as fact: Dame Melanie Dawes, Chief Executive since March 2020, came directly from Permanent Secretary at the Ministry of Housing, Communities and Local Government. Lord Michael Grade chaired from May 2022 to April 2026; on 3 June 2026 the government confirmed Sir Ian Cheshire — former chair of Channel 4 and Barclays UK, former chief executive of Kingfisher — as chair, after a parliamentary pre-appointment hearing that Parliament’s own committee framed as arriving at “a critical moment for the online safety regulator.”

Funding & Backers

The regulated pay the regulator — by statutory design. Ofcom recovers its costs through fees on the sectors it regulates, and the Online Safety Act extended the model to the internet: providers whose qualifying worldwide revenue meets or exceeds £250 million (with at least £10 million UK-referable) pay annual fees of roughly 0.02–0.03 percent of qualifying worldwide revenue to fund the online-safety regime, under a fee regime live since 11 December 2025. The model is the standard one for utility regulators, and the standard observation applies: an authority whose budget scales with the size of the industry it polices has no fiscal reason to want the industry smaller, and every institutional reason to want the regime permanent. That is a structural note about regulatory economics, not an accusation — Ofcom did not write its own funding statute. Parliament did.

Actions & Leadership Choices

Founding purpose, judged on evidence. Convergence was the founding purpose — one rational regulator replacing five sectoral ones — and for two decades the record is that of a competent utility regulator: spectrum auctioned, broadband rolled out, broadcast standards enforced with published reasoning. The online-safety remit was not Ofcom’s ambition on the record; it was Parliament’s assignment. The deeds below are weighed against what it did with the assignment.

The enforcement ledger, where the conduct shows. Ofcom built the machine on schedule and used it within months. By November 2025 it had 76 sites under investigation under the Act. Its first confirmation decision, 18 November 2025, fined 4chan £20,000 — for failing to provide an illegal-content risk assessment when requested, a process offense. It fined a “nudification” site £50,000 for failing to introduce age checks, and AVS Group Limited £1 million — with £1,000 per day accruing for continued non-compliance — for not having robust age checks, described in contemporaneous legal coverage as among its largest online-safety fines to date. The selection pattern is the standard one for a new content regime and is recorded as such: the first precedents were built on the marginal and the odious — an imageboard’s paperwork, a nudification service, an adult-site operator — the targets least likely to attract defenders while the categories harden.

The values-under-cost test. For a regulator, the test is whether procedure survives contact with a politically inconvenient fact. The inconvenient fact arrived on day one: the 1,400 percent VPN surge was reported everywhere, quantified the public’s refusal, and handed critics their strongest exhibit. Ofcom neither denied the number nor paused the programme; it continued enforcing the statute as written. Read one way, that is the rule of law — a regulator’s job is the statute, not the polls. Read the other way, it is the confirmation that the machinery is indifferent to consent. Both readings are on the record, and the file holds them together; a regulator that enforces an unpopular statute is doing exactly what a statute-instrument does.

CONDUCT verdict: STATE-INSTRUMENT — ONE DESK, EVERY LAYER. A procedurally serious converged regulator, executing a parliamentary mandate with published codes and appealable decisions — whose remit now spans every layer of the national communications stack, whose online-safety budget is paid by the platforms it polices, whose first-year precedents were built on the marginal, and whose enforcement continued through the largest documented act of mass circumvention in the regime’s history.

Sources: Office of Communications Act 2002 — legislation.gov.uk; Communications Act 2003 — legislation.gov.uk; Online Safety Act 2023 — legislation.gov.uk; Ofcom Board appoints Dame Melanie Dawes as Chief Executive — Ofcom; Sir Ian Cheshire appointed as Chair of Ofcom — Ofcom; Government Confirms Sir Ian Cheshire as Ofcom’s New UK Chairman — ISPreview, Jun 2026; Committee endorse appointment of Sir Ian Cheshire as Ofcom chair — UK Parliament, Science, Innovation and Technology Committee; Statement: Protecting people from illegal harms online — Ofcom; Age checks for online safety — Ofcom; Enforcement under the Online Safety Act — Bristows; Online safety fees and penalties — Ofcom; Ofcom sets out fees and penalties regime under the Online Safety Act — Lewis Silkin, Jul 2025; 2025 UK Online Safety Act round-up — CMS Law-Now, Dec 2025; Ofcom fines nudification site £50,000 — Ofcom; Ofcom fines adult website provider £1 million — Lewis Silkin, Dec 2025; The UK’s Online Safety Act’s Predictable Consequences — ITIF, Sep 2025; Yoti facial age estimation ready for Online Safety Act enforcement — Yoti.