Home
Blog
Yair In the press
Services
Events
Contact
The hamster, the judge and the regulator: 4chan v Ofcom explained

The hamster, the judge and the regulator: 4chan v Ofcom explained

/ Internet regulation, Regulated Without Representation / By / Leave a Comment

This is chapter 3 of Regulated Without Representation, a series by internet law solicitor Yair Cohen on how Britain regulates the internet and who pays for it. New here? Start with the introduction. The previous chapter is here.

On 14 April 2025 an email arrived at an American message board called 4chan. The sender was Ofcom. The email was a formal notice under section 100 of the Online Safety Act, requiring information about how the board protected British users from harmful content, and it mentioned, in the way such letters do, that failure to comply could lead to a fine of £18 million or 10 per cent of worldwide revenue, and to prosecution.

4chan says it has no office, no employees and no bank account in the United Kingdom. It is one of the oldest and least polite places on the internet, and I hold no brief for it. But what it did next is the clearest illustration I know of how far Britain’s law reaches, and how far it does not.

How the reach works

The mechanism is section 4 of the Act, which I described in chapter 1. A service is regulated if it has “links with the United Kingdom”, and it has those links if it has “a significant number of United Kingdom users” or if British users are one of its target markets. Ofcom’s public summary is blunter: any service with links to the UK now has duties to protect UK users, “no matter where in the world it is based“.

The reach is exercised by notice. Section 100 lets Ofcom demand “any information that they require” for its online safety work. Failing to respond is an offence in its own right, and a senior manager named on the notice can be personally guilty if the company fails to comply and he or she did not take all reasonable steps to prevent it.

The notices arrive by email. There are formal channels for legal dealings across the Atlantic, among them the Hague Service Convention for serving documents abroad and the mutual legal assistance treaty between Britain and the United States. According to a freedom of information response reported in April 2026, Ofcom had by February 2026 issued 197 section 100 notices to American businesses, none of them through the treaty route. Ofcom evidently regards service by email as sufficient under the Act. I have not seen a court decide the point.

The hamster

4chan did not answer the email. In June 2025 Ofcom opened an investigation. In August it issued a provisional notice. On 13 October 2025 it imposed the first fine ever levied under the Act: £20,000, plus £100 a day, not for any content, but for ignoring the request for information. In March 2026 it added £450,000 for having no age checks, £50,000 for having no illegal content risk assessment and £20,000 over its terms of service, with daily penalties on top. By June the running total stood at about £540,000.

4chan has paid none of it. Its American lawyer, a man called Preston Byrne, answered two formal demand letters from Ofcom with a picture of a hamster. He has said 4chan will obey British censorship laws “when pigs fly“.

Then 4chan did something more interesting than the hamster. Together with the company behind Kiwi Farms, another American forum with what I would call a grim reputation, it sued Ofcom in the federal court in Washington DC in August 2025. It asked for a declaration that the Online Safety Act could not be enforced against it in the United States because it conflicts with the First Amendment. The idea was to do for Ofcom’s fines what your SPEECH Act of 2010 did for British libel judgments: make them worthless in America.

Ofcom’s chief executive, Dame Melanie Dawes, was asked about the lawsuit on BBC radio in March. “I see that as a sign that we’re having the impact we want,” she said.

The judge

On 15 September 2026 Judge Rudolph Contreras dismissed the case. Ofcom, he held, is an arm of a foreign state, and under the Foreign Sovereign Immunities Act a foreign state cannot be sued in an American court unless an exception applies. 4chan had argued the “commercial activity” exception: that Ofcom’s demands, backed by fees and fines, were commercial acts with a direct effect in the United States. The judge was unmoved. “Private entities do not generally engage in commerce by censoring others through the threat of fines and imprisonment, so the conduct is not commercial.” An abuse of power, he added, quoting the Supreme Court, is still sovereign activity “however monstrous such abuse undoubtedly may be”.

Then came the passage every American operator should read twice, so let me translate it. The judge said 4chan’s case failed because it was trying to use the American courts “as a sword against Ofcom rather than as a shield to protect themselves”. In plain terms: you cannot go on the attack. An American company cannot ask an American judge to declare a British regulator’s rules unenforceable before that regulator has tried to do anything in America. The sword is not available.

The shield is a different matter, and here the judge went further than he needed to, “at the risk of gilding the lily”, as he put it. Suppose Ofcom one day arrives in the United States holding a British fine and asks an American court to make 4chan pay it. That is when the picture changes. A fine is a punishment handed out by a foreign government, and American courts, he said, “are not necessarily required to enforce foreign penal judgments”. He pointed to a 1995 case in which a court in Washington refused to enforce a British libel award because enforcing it would have offended the First Amendment. So the same company that cannot sue Ofcom in America may well be able to defend itself in America when Ofcom comes to collect.

Put those two passages together and you have the whole standoff in miniature. An American company cannot go to an American court to stop Ofcom writing to it. But if Ofcom ever goes to an American court to collect, it is likely to find the door shut. Ofcom welcomed the ruling: “A U.S. Court has acknowledged that we are within our rights as a UK regulator to investigate breaches of the UK’s online safety laws.” 4chan’s lawyers said they were “considering all options, including appeal“. Both sides won the argument they cared about. So far as is public, neither is any closer to the money.

Big numbers, small collections

This is not only a 4chan problem. On the same day as the Washington judgment, a committee of the House of Lords sat down with three senior Ofcom officials to ask how the Act was going. The exchange is worth reading in full, but here is the heart of it. Suzanne Cater, Ofcom’s enforcement director, told the peers that the regulator had imposed £7 million in penalties so far. The chair asked how much had been paid. “I do not have a figure to hand,” she said. “Realistically, the majority has not been paid.” She explained why: “a lot of them are small services based overseas and with no assets in the UK. That makes enforcement really challenging.” Ofcom has declined, under freedom of information law, to say which fines have been paid, citing statutory confidentiality rules.

Look at who has been fined. Most of it is pornography operators, plus 4chan, a streaming site, a nudification app and a suicide forum: AVS Group £1.05 million, 8579 LLC (an American company) £1.4 million, Kick £830,000, Youngtek £600,000, Fapello £630,000, Xgroovy £730,000 in September 2026, the suicide forum £950,000, First Time Videos LLC (American) £80,000. The June bulletin has the list. Not one of the eleven Category 1 platforms has been fined. Oliver Griffiths, Ofcom’s online safety director, was candid about how he expects this to change: “It looks acute at the moment but, over time, as we are fining the bigger companies if they are in breach of the Act, this will be less of an issue.” My reading of that, and it is mine rather than his, is that Ofcom expects the collection problem to shrink once it is fining companies large enough, and present enough in Britain, to pay, if they breach the Act.

The weapon that has not been fired

The Act holds a heavier instrument than fines. Sections 144 to 148 let Ofcom ask a British court for “business disruption” orders against third parties: payment processors, advertising networks, app stores and internet providers, requiring them to cut a defiant service off from British money and British users. This is the real threat to a foreign company that ignores Ofcom, because it needs neither the company’s cooperation nor its assets.

So far as Ofcom has disclosed, it has never been used. In May 2026 Ofcom fined the suicide forum £950,000 and announced it was “preparing an application for a court order requiring internet service providers to block UK access”. In July it dropped the plan. The forum had blocked British visitors itself, and Ofcom concluded that “the legal grounds are therefore not met“, because the power requires ongoing non-compliance, not merely a site that is dangerous. Ms Cater told the Lords that business disruption measures “are the strongest enforcement tool that we have” but that “we have found some real, practical challenges in deploying that in anger”. Ofcom is now asking the Government for stronger powers.

Leaving, blocking, fighting

Faced with all this, foreign services have taken three roads.

Leaving. The Open Rights Group’s tracker attributes about 70 site closures or blocks to the Act, though at least one, Imgur, followed a data protection investigation rather than the Act itself. Among them are Lobste.rs, a technology forum with more than 110,000 daily readers, Civitai, BitChute and CoolMathGames, a children’s games site. Dee Kitchen, who ran LFGSS, a London cycling forum, and the Microcosm platform behind about 300 other communities, wrote in December 2024 of a risk of “£18M for the entity that runs it, or the ‘officers’ of the entity”, and concluded: “this is not a venture that can afford compliance costs… it’s a dragnet of a law.” Gab, the American social network, said publicly that it “refuse[d] to comply with this tyranny”. Kiwi Farms blocks British visitors.

Blocking after the letter arrives. This is not a clean exit. Fapello, an adult site, was fined £630,000 in July 2026 for the period before it blocked the UK. Ofcom’s decision records that the site added age checks in November 2025 and blocked British addresses in January 2026, and that Ofcom “reserve[s] our position in relation to Fapello’s ongoing compliance”. The data regulator applied the same logic when Imgur left in September 2025: “exiting the UK does not allow an organisation to avoid responsibility for any prior infringement”. The Wikimedia Foundation went to the High Court, England’s senior civil court, to challenge the categorisation rules, lost, and Wikipedia is reported to remain on Ofcom’s watch list.

Fighting in British courts. The largest companies are doing what only the largest can afford. On 22 September 2026 Meta lodged an appeal to the Upper Tribunal, a specialist appeal court, against the designation of WhatsApp and Instagram as Category 1 services. Roblox and Quora are contesting theirs. TikTok and X are challenging information notices. Ofcom says it will “robustly defend” its decisions.

And the British public? On 25 July 2025, the day age checks arrived for adult content and any service likely to be used by children, one VPN provider reported a rise of more than 1,400 per cent in British sign-ups. A petition to repeal the Act gathered 550,136 signatures. The Government’s answer was that it “has no plans to repeal the Online Safety Act”. In January 2026 Ofcom opened a formal investigation into X after its Grok chatbot was found generating sexualised images of real people on request; X restricted the feature within days, and the investigation remains open. That one, if it ends in a fine, will be the first against a Category 1 platform, and the first real test of whether the big companies pay.

The shape of it

Here is the position after eighteen months of enforcement. The law reaches every service on earth with British users. The regulator can fine any of them and has fined about ten. Most of the money has not arrived. The one instrument that could force a foreign company’s hand has never been used and, on its first outing, was found not to fit. The defiant are beyond reach, the small have left, and the large are in court. The people who have lost something concrete so far are British users of about 70 services that no longer serve them.

I do not think anyone designed this outcome. It is what happens when you write a law for the whole internet and staff a regulator to enforce it, without first asking what you will do when the internet says no.

For the serious reader: six things to tell a US client with British users
1. The test is your users, not your address. A significant British audience, or marketing to Britain, puts you in scope. Chapter 1 has the section.
2. Answer the email. A section 100 notice starts a clock. Ignoring it is a separate breach with its own fine, and a named senior manager can be personally liable. 4chan’s first £20,000 was for silence, not content.
3. Do the paperwork. An illegal content risk assessment and, if you host adult material or attract children, age assurance, are the duties Ofcom has fined for most often. It has also fined for ignoring information notices and over terms of service.
4. Geoblocking is not a time machine. Blocking the UK after Ofcom has written does not erase the period before. Blocking before any contact is a different matter, but take advice on it.
5. An American court will not help you attack Ofcom. It may well help you resist collection. That is the meaning of the 15 September judgment. Business disruption orders inside Britain, against your payment processors and advertising partners, are the exposure to think about.
6. Above £250 million worldwide revenue, see chapter 2. The fee applies, and so does the duty to notify.

Next: Chapter 4, Thirty-four arrests a day. What Britain does to its own citizens for words: the childminder who served a year over a tweet she deleted within hours, the comedy writer met at Heathrow by five armed officers, and the repeal the Government promised in 2022 and quietly did not deliver.

Sources for this chapter

Leave a Comment

Scroll to Top