Ofcom fined a porn site £700,000 for a year of ignoring children's safety duties. Its own decision gives two issue dates 26 days apart, and both its payment deadline and appeal window depend on which one is right.
Estimated reading time: 6 minutes
.jpg){kind=link}
In short. Ofcom's Confirmation Decision against the provider of xgroovy.com imposes a £700,000 fine for failing to implement highly effective age assurance and a £30,000 fine for ignoring a statutory information request [[3]]. The document's own cover page states it was "Issued: 29 September 2026" (p.1) [[3]], but its penalty clauses compute the daily-penalty start date and the payment deadline from 3 September 2026 instead (p.4, p.31) [[3]], exactly the date Ofcom's own case-history page says the decision was issued [[2]]. A second finding: the Online Safety Act caps this penalty at £18 million or 10% of the company's worldwide revenue, whichever is greater [[4]], but Ofcom's own document says it "was not able to find reliable revenue information for Xgroovy" because the company never answered the request that would have supplied it (p.29) [[3]], the same request it was separately fined £30,000 for ignoring. Two documented mistakes: four stars.
On 4 September 2026 Ofcom announced it had fined "an online porn provider £700,000 for not having age checks in place, and a further £30,000 for failing to respond to a legally binding information request" [[1]]. The provider is xgroovy.com. The announcement reads as settled, finished business: a fine imposed, a lesson learned. The Confirmation Decision behind it, read in full, is a document that cannot agree with itself about the one date that governs when the money, and any appeal against it, falls due.
A decision that disputes its own cover page
The non-confidential Confirmation Decision, published by Ofcom on 30 September 2026 under case reference CW/01318/09/25, opens with a single line beneath its title: "Issued: 29 September 2026" (p.1) [[3]]. Four pages later, the document's own overview sets out the consequence of Xgroovy's continuing failure to answer Ofcom's information request: a daily penalty of £200 "starting from 04 September 2026 (the day after the date of issue of this Confirmation Decision - the 'Information Notice Compliance Date')" (p.4) [[3]]. The day after 29 September is 30 September, not 4 September. Later still, paragraph 4.55 sets the payment deadline for both fines at "3 November 2026 (two calendar months from the date of this Confirmation Decision issued under section 132 of the Act)" (p.31) [[3]]. Two calendar months from 29 September is 29 November, not 3 November. Both figures land exactly right if the Decision's true issue date is 3 September 2026, not 29 September, and Ofcom's own case-history page for the investigation confirms that date in plain prose: "On 3 September 2026 we issued the provider of Xgroovy[dot]com with a Confirmation Decision in relation to its failure to comply with section 12 of the Act and its failure to comply with a statutory information request" [[2]].
That leaves the document with two issue dates on record, 26 days apart, and no note anywhere in its 35 pages explaining the gap. Under section 168 of the Act, cited on the Decision's own final page, Xgroovy has a right to appeal to the Upper Tribunal (p.31) [[3]]; appeal windows in Ofcom's enforcement regime run from the date of the decision. A document whose own clauses cannot agree on what that date is has left that clock, and the £730,000 payment clock beside it, resting on an answer the reader has to work out independently rather than one the document states.
A penalty with no revenue to measure it against
The Act does not leave the size of a penalty to guesswork. Schedule 13, paragraph 4(1) fixes the maximum at "whichever is the greater of (a) £18 million, and (b) 10% of the person's qualifying worldwide revenue for the person's most recent complete accounting period" [[4]], confirmed directly against the Act's own text rather than taken from Ofcom's summary of it. Setting a penalty within that ceiling is meant to track what the company actually earns. Xgroovy made that impossible. Ofcom's own account of its reasoning states plainly: "Ofcom requested financial information from Xgroovy in the March 2026 Notice but received no response. Ofcom was not able to find reliable revenue information for Xgroovy. Absent this information, Ofcom has therefore been unable to consider Xgroovy's financial position when determining the penalty amount" (p.29) [[3]]. The £700,000 figure that resulted is, by the document's own account, a deterrence judgement made in the dark, not a revenue-scaled calculation.
The timeline makes the gap harder to excuse. Ofcom first wrote to Xgroovy about its age-assurance duties on 25 April 2025, and again on 15 August 2025, before opening a formal investigation on 10 September 2025 [[2]] [[3]]. A statutory information notice followed on 23 September 2025; it went unanswered. Ofcom reissued it on 30 March 2026 with a fresh deadline of 6 April 2026; that went unanswered too, and remained unanswered "as at the date of this Confirmation Decision" (p.29) [[3]]. For the information failure, over roughly that same stretch, the consequence is a flat £30,000 plus a daily rate capped at £12,000 by 3 November 2026 [[3]]. For the age-assurance failure, confirmed for the period 25 July to 25 November 2025 (p.19) [[3]], the consequence is £700,000 set without the one number, the company's revenue, that the law's own cap exists to measure it against. A company that answers Ofcom's questions risks a penalty scaled to what it earns. A company that does not appears, on this case, to risk a flat number Ofcom reaches by judgement instead.
The claims, tested
| The document's own words | What the record shows | Verdict |
|---|---|---|
| A daily penalty runs "starting from 04 September 2026 (the day after the date of issue of this Confirmation Decision)" (p.4), and payment is due "3 November 2026 (two calendar months from the date of this Confirmation Decision)" (p.31) [[3]] | The Decision's own cover page states "Issued: 29 September 2026" (p.1) [[3]]; both computed dates only work from an issue date of 3 September 2026, which is what Ofcom's case-history page separately states [[2]] | The one document fixing a payment deadline and an appeal window gives two issue dates for itself, 26 days apart |
| The statutory maximum penalty is "£18 million or 10% of the person's QWR... whichever is greater" (p.24) [[3]], confirmed against Schedule 13, paragraph 4(1) of the Act [[4]] | "Ofcom was not able to find reliable revenue information for Xgroovy... unable to consider Xgroovy's financial position when determining the penalty amount" (p.29) [[3]] | The £700,000 fine has no stated relationship to either half of the statutory formula, because the company withheld the figure the formula needs |
Credit where due
Ofcom does not hide either gap; both sit in plain text inside a published, non-confidential document, not buried in an annex. The Decision also credits Xgroovy, fairly, where it acted: the company implemented a form of age assurance by 28 November 2025 and blocked UK IP addresses by 8 December 2025, and Ofcom records both dates as a mitigating factor in setting the penalty (p.30) [[3]]. The daily-rate mechanism for the information-notice breach is a genuine attempt to keep pressure on a company that has otherwise ignored every letter Ofcom has sent it since April 2025. The problem this piece documents sits in the small print of how the Decision dates and justifies itself, not in whether Ofcom was right to act.
Verdict
Four stars, from two documented mistakes. Ofcom pursued a company that ignored it for the best part of a year, and secured a published, reasoned, substantial penalty. What undermines confidence in the document itself is that its own legally operative dates contradict each other, and its headline fine was set without the one figure the law's proportionality test is built on, because withholding that figure cost the company less than disclosing it might have.
The star score counts two documented mistakes. First, the Confirmation Decision's cover page states it was issued on 29 September 2026, but the document's own payment deadline (3 November 2026) and daily-penalty start date (4 September 2026) are calculated correctly only from an issue date of 3 September 2026, matching Ofcom's separate case-history page; the 26-day discrepancy sits inside the one document that fixes a legally binding payment and appeal clock. Second, the Online Safety Act caps this penalty at £18 million or 10% of worldwide revenue, whichever is greater, but Ofcom's own document records that it could not obtain reliable revenue information for Xgroovy and set the £700,000 fine without it, after the company ignored the information notice that would have supplied that figure. Two falls in the 1 to 3 band: four stars; the bands are on the ratings page. This piece makes no finding about the competence of any named Ofcom official; the criticism is of the published document's internal dates and its stated penalty methodology, not of any person's conduct. Checked directly against Ofcom's press release, its case-history page and the Confirmation Decision PDF, and against the Online Safety Act's own text on legislation.gov.uk, all fetched 10 October 2026.
Sources
- Porn site deploys age checks as Ofcom fines it £730,000, Ofcom, 4 September 2026
- Investigation into the provider of www.Xgroovy.com's compliance with the duty to prevent children from encountering pornographic content through the use of age assurance, Ofcom, case reference CW/01318/09/25, last updated 30 September 2026
- Confirmation Decision: Investigation into the provider of xgroovy.com's failure to comply with requirements to implement Highly Effective Age Assurance, Ofcom, non-confidential version (PDF)
- Online Safety Act 2023, Schedule 13, paragraph 4, legislation.gov.uk