Skip to main content

Determining the cost of online safety

How to prepare for the UK’s new fees and penalties regime

At a glance:
 

  • The Online Safety Act (‘the Act’) provides for Ofcom’s associated regulatory costs to be covered by providers of regulated services through a fees regime, and states that the calculation of fees should be based on providers' qualifying worldwide revenue (‘QWR’).
  • Ofcom has recently closed a public consultation on its proposed approach to implementing the new fees regime, which also forms the basis for determining maximum enforcement penalties under the Act. Based on the published responses to Ofcom’s consultation, it’s clear that there are a number of differing views on Ofcom’s proposed approach.
  • Given the complexity and potential financial implications associated with the new fees and penalties regime, all online services within scope of the Act should have this on their radar now, preparing accordingly where the proposed thresholds indicate they may be liable for fees.
  • In this blog, the first of a two-part series, we set out details of how Ofcom intends the new regime to function, highlighting key strategic considerations for online services relevant to how fees will be calculated, using two hypothetical case studies to bring this to life.
  • We then outline five key steps that online services can take to develop a robust QWR methodology, based on Ofcom’s proposed (but not yet finalised) approach.
  • Once the regime is finalised (expected later this year), we will publish a follow up blog which will outline the final strategic implications in the context of Ofcom’s confirmed approach.

Understanding the fees regime and the role of QWR


The cost of regulation can be significant. According to Ofcom’s Accounts, the cost of its work on Online Safety amounted to £54m in FY 2023/24, with £63m provided for FY 2024/25. As Ofcom continues to implement and begins enforcing the regime, funding its work on Online Safety will remain an ongoing cost. This regime will ultimately be funded by the providers of regulated services.

Charging regulated companies to cover the cost of regulation is not a new concept. Much of Ofcom’s funding comes from fees paid by regulated companies, across the telecoms, broadcast and postal sectors, as set out in its Tariff Tables. Similar models are used by other regulators; for example, the FCA makes use of variable ‘periodic fees’ and the ICO is largely funded by a tiered ‘data protection fee’.

However, the QWR approach discussed below is novel, in part reflecting the global nature of regulated firms. This approach may also represent the regulatory direction of travel for future regimes: QWR is also referenced in the Media Act 2024 in relation to penalties.

We provide a high-level overview of Ofcom’s current proposals in Figure 1 below:

Figure 1: Overview of Ofcom’s proposed approach to fees and penalties under the Act

Figure 1 is based on Ofcom’s proposals set out in its recent consultation. These proposals have prompted a number of responses from affected stakeholders, many of whom have argued for a different approach on a number of key elements. Proposed changes raised include:

  • Changes to the QWR calculation, including calculating QWR by reference to UK referable revenue only, and varying QWR based on service type, for example excluding services with a lower risk.
  • Altering the fee threshold, including lowering the financial QWR fee threshold, and adding a fee threshold based on user numbers.
  • Changes to penalty calculations, including basing QWR for penalties only on revenue generated by the service in breach rather than all regulated services, and not including revenue from unregulated services in calculations when multiple group undertakings are jointly liable.

Ofcom will need to take into account all responses before it reaches its final position later this year. Given the contentiousness of this issue this will be an area to watch closely, as some degree of change is possible. We set out the expected timeline for the finalisation and implementation of the regime in Figure 2, below:

Figure 2: Timeline for finalisation and implementation of the OSA fees & penalties regime

For the remainder of this blog, we outline a number of key considerations associated with QWR calculations based on Ofcom’s current proposals, and consider how firms can develop a defensible and robust methodology as a result. Many of these observations will hold irrespective of Ofcom’s final approach.

Navigating the Challenges of QWR Calculation


Where services are clearly in or out of scope of the OSA, with revenues easily attributable to specific services, calculating QWR can be simple, as set out in the hypothetical case study (‘SocialCorp’, a social media and gaming company) in Figure 3 below: 

Figure 3: SocialCorp Case Study

Here, revenue from SocialCorp Engage is the sole determinant of QWR. Despite SocialCorp’s total revenue being over the £250m threshold, QWR is below the threshold, meaning SocialCorp is not liable for fees. Maximum fines are also set at 10% of QWR: £20m.

QWR calculation may be straightforward in cases such as the above. However, for many firms, its practical calculation can raise challenges:

  • Attributing revenue to specific services may be complex. Companies with diversified offerings may find it difficult to directly attribute revenue to each service. Firms might offer a range of services, and revenue may arise from across a number of these. Disentangling the revenue streams associated with each service can be a complex undertaking and may require a more nuanced approach to how revenue is calculated for the purposes of financial statements.
  • Attributing revenue to different elements of a single service requires judgement. A service may have a subset of in-scope parts of a larger service or platform. In many cases, revenue will not be directly attributable to individual parts of a service, but the relevant feature or functionality provides some value to users and so contributes in some way towards revenue. Determining the scale of this contribution and how much revenue should be attributed from this is not straightforward.
  • The accuracy of QWR calculation hinges on the quality and completeness of data. Companies must have robust systems in place to collect, store, and analyse data related to revenue and its source, which may require further data on areas such as user activity and service usage. Incomplete or inaccurate data could skew QWR calculations, leading to either underestimation or overestimation, both of which carry potential consequences.
  • For firms with high revenue but limited UK presence, calculating UK referable revenue to determine whether they qualify for an exemption poses an additional challenge.

Whilst each firm will have a unique set of challenges, we highlight some of this complexity in the hypothetical case study (‘VideoCorp’, a video platform), as set out in Figure 4 below:

Figure 4: VideoCorp Case Study

For VideoCorp, developing a “just and reasonable approach” to apportion revenue to the review and comment section is not straightforward:

  • If users pay a subscription for the overall service, it is not clear what proportion relates to the review and comment section. Many subscribers may not use it, and others may be indifferent to it and be willing to pay even if it were removed.
  • If advertising appears throughout the platform, it is not obvious what proportion of advertising revenues relate to the review and comment section. Even if advertisements appear separately within the section, VideoCorp may not capture data on exactly where ad impressions occur in its current course of business.  

The ultimate calculation can have significant consequences. For example:

  • If 3% of revenue (£150m) is apportioned to the review and comment section, VideoCorp is not liable for any fees and faces maximum fines of £18m (as this is greater than 10% of QWR).
  • If 6% of revenue (£300m) is apportioned to the review and comment section, the firm is liable for ongoing fees (£60,000 per year based on 0.02%), additional fees to cover the initial costs of setting up the online safety regime, and maximum fines of £30m.

Developing a Robust QWR Methodology


In developing a methodology, it is important to note that there is not necessarily a single correct way to calculate QWR. Ofcom notes that there may be a number of just and reasonable approaches that could be taken depending on the information available to the provider. However, Ofcom’s expectation is that the amount of revenue “apportioned to the regulated service reasonably reflects the relative contribution of the regulated service to the revenue in question.“

Given this, developing a methodology that can be justified in a manner that is credible to Ofcom is critical. Ofcom has significant experience in determining whether allocations could be deemed as appropriate or not, derived from its existing responsibilities for the regulation of electronic communications markets.

This process will require significant cross-organisational working across Legal, Finance, Compliance, Product and Operations. Throughout this process, firms should document all steps involved, including data sources, definitions, principles, methodologies and assumptions. Whilst details will vary by firm, the following steps will be helpful to gather the right information.

Firms should identify which of their services, or which elements of their services, fall within scope of the OSA. This requires careful review of the regulations and guidance. Once scope is defined, firms should identify all revenue streams associated with regulated services. It is key for firms to ensure consistency with how revenues have been recognised elsewhere.

Where revenues can clearly be attributed to regulated services, as in the case of SocialCorp, the sum of these revenues constitutes QWR. In this case, firms should skip to Step 5. Otherwise, a just and reasonable approach to apportioning revenue must be developed.

Firms should conduct a thorough inventory of relevant data sources. Firms should assess the quality, completeness, and reliability of this data, identifying any potential gaps or limitations. The extent and quality of data available will depend on the firm’s data management, revenue attribution, and financial reporting systems. We provide a simplified example of potentially relevant data in Figure 5 below, again using the hypothetical video platform ‘VideoCorp’.

Figure 5: VideoCorp Case Study - continued

In VideoCorp’s case, it is not immediately apparent which data points are most relevant. Different data points can point in different directions. Given this, firms should develop a framework to appropriately assess the relevance of the data.

Firms should develop a clear and consistent set of principles designed to identify the relative contribution of the regulated services or features to the revenue in question. In other regimes, Ofcom has determined the appropriateness of allocations against a set of principles. For example, Ofcom has used a principle-based approach when considering whether allocations used to produce regulatory financial statements were appropriate. Therefore, setting out a set of principles upfront to guide decision making is more likely to ensure credibility with Ofcom.

Ofcom has made it clear that it expects the apportionment approach to reflect the contribution of a service to a revenue stream. Therefore, it is important to articulate how regulated and non-regulated services generate value including how these contributions intersect. This is complex and requires a sound understanding of the firm’s specific business model, revenue generation mechanisms, and user behaviour. The exact approach will therefore vary by business and based on the available data.

It is important for firms to consider the overall impact of different approaches to calculating QWR. Even if an approach is ‘just and reasonable’ in theory, it is important to consider whether the approach in reality, given data available, gives an output that reasonably reflects the relative contribution of the regulated service. The firm must be able to justify the ultimate choice they select with relevant data and analysis.

Firms with a calculated QWR above the threshold must notify Ofcom, unless exempt (under current proposals, if UK referable revenue is less than £10m). Firms must supply a statement; evidence substantiating regulated service details and QWR (including details on how revenue has been apportioned where relevant), which may include the underlying data; and a declaration of accuracy and completeness in relation to the evidence supplied. It is important to ensure this is signed off at a senior level, as in most cases this declaration must be made by a senior manager, as defined in the Act.

Following initial notification, Ofcom has indicated that it will issue requests for information on a rolling basis every charging year to ascertain QWR. Information requests from Ofcom carry significant weight and failure to comply in a timely way, including ensuring that any information provided is accurate in all material respects, could lead to enforcement action, including fines and, in extreme cases, criminal sanctions for individuals.

Firms above the threshold should therefore implement annual processes to ensure their QWR calculation is up to date. This should include updating revenue figures and monitoring changes in regulations, business operations, and data availability which may affect the appropriate QWR calculation methodology.

For firms with a calculated QWR below the threshold, it is not necessary to notify Ofcom. However, they should ensure they maintain a record of their calculation, methodology and supporting data, ready to supply on request. Firms must also notify Ofcom in the event their QWR goes above the threshold in future years. Given this, these firms should periodically update their calculation, particularly if there is a substantive change in their activities or revenue that might suggest an increase in QWR.

Conclusion


Calculating QWR is a necessary action for many firms in scope of the OSA. Failing to notify Ofcom or providing incomplete or inaccurate information may result in enforcement action. However, calculating QWR is not merely a compliance exercise; it has significant implications for fees and potential penalties. Overstating QWR due to a lack of analysis could unnecessarily inflate a company's financial obligations.

Elements of Ofcom’s proposed approach could change, and we will discuss the implications of any changes in our follow-up blog later this year once the regime is finalised. However, firms should not wait until they have full clarity before thinking through these issues. By starting early and embracing a proactive approach, firms can develop a robust methodology to navigate the complexities of the regulations, mitigate risks, and effectively manage their financial obligations.