A ceiling, not a fine
On 13 October 2026 Meta opened its High Court judicial review (claim AC-2025-LON-004500) of the Qualifying Worldwide Revenue Regulations 2025. The case is about how Ofcom calculates two things under the Online Safety Act 2023: annual supervision fees and the maximum penalty for breaching the Act.
The strongest case for Ofcom is straightforward, and it deserves a fair statement. Parliament wrote the cap into the Act itself. Schedule 13 sets the maximum penalty at £18,000,000 or 10% of qualifying worldwide revenue, whichever is greater. Ofcom's argument is that a global company can absorb a fine calibrated to UK revenue as a cost of doing business, so only a worldwide base deters. It also stresses that the figure is a ceiling, and that any actual penalty must be proportionate to the breach. Ofcom told the court it applied a plain reading of the statute and struck a careful balance.
That is a serious argument. It is also not a complete answer.
What Meta is actually contesting
According to Tech Times' account of the hearing, Meta makes two claims. First, fees and penalties should follow revenue tied to the UK market rather than worldwide earnings. Second, Ofcom's approach of pooling Facebook, Instagram and WhatsApp into one revenue base goes beyond the statute and concentrates risk on a few firms. Meta's counsel, Monica Carss-Frisk KC, called the approach troubling. A Meta spokesperson said a service-by-service, country-by-country approach would still permit large UK fines.
Applied to Meta's roughly $201 billion of 2025 revenue, the 10% cap yields a theoretical ceiling of about £15 billion. That is the figure driving the headlines, and it is the reason the case matters beyond Meta.
Ofcom's own policy statement shows this was a considered choice. Its 26 June 2025 fees and penalties statement fixed the framework, and techUK's summary notes that where a parent and subsidiary are jointly liable, Ofcom will use full group revenue. Ofcom also said a worldwide base was preferable partly because it produces a higher deterrent ceiling. That reasoning is candid, and it is exactly what is being tested.
Why pooling matters more than the headline
The worldwide-versus-UK question is partly a matter of statutory interpretation, and the court will decide it. The pooling question is more interesting for policy.
A fine is meant to be tied to the harm and the entity responsible. If one service breaches its duties, a cap computed from the revenue of unrelated products sold in other countries is only loosely connected to the conduct. WhatsApp, a messaging service, and Instagram, a public content platform, present very different risk profiles under the Act. Treating them as one revenue pool makes the ceiling a function of corporate structure rather than of the regulated activity.
That has practical consequences. Large firms can litigate and price in the risk. The firms that cannot are smaller, and they carry the weight of an unpredictable regime. Ofcom's own officials have acknowledged operating in a highly litigious environment: in September 2026, Ofcom's Oliver Griffiths told a House of Lords committee that Meta had brought two judicial reviews against the fees regime, as reported by Tech Times.
The fee side is the quieter issue
The regulations also determine who pays for Ofcom. The mandatory fee threshold is £250 million of qualifying worldwide revenue, and Ofcom has invoiced about £88 million in supervision fees for 2026/27, per the same report. A funding model that scales with global revenue is administratively simple, but it means UK fee-payers are subsidising a regulator's work in proportion to income earned elsewhere. Whether Parliament authorised that is a legal question. Whether it is sensible is a policy one.
The EU offers a cautionary comparison. The Digital Services Act caps penalties at 6% of global turnover, lower than the UK's 10%. In September 2025 the EU General Court annulled the DSA supervisory fee for very large platforms on procedural grounds, because the Commission used the wrong legal instrument. A fee regime that rests on a shaky legal foundation invites exactly this kind of challenge.
A wider pattern of litigation
The fees case followed a separate hearing, which began on 5 October, in which Meta, TikTok and X asked the court to quash Ofcom's information notices. According to The Star's report, X called the notices the most burdensome information request it has received from any regulator, and Ofcom says the data is needed to assess whether the regime is working. Both positions are credible. Regulators need data to test whether their rules work, and companies are right to ask that requests have a defined purpose.
A pro-innovation reading does not require siding with Meta on everything. Online safety duties are legitimate, and a regulator with no credible sanction is not a regulator. Ofcom has so far issued over £7 million in fines against eleven providers since October 2025, the largest being £520,000 against 4chan. That record suggests the regime's real enforcement is far from the £15bn headline.
What a proportionate outcome looks like
The gap between a £15bn ceiling and a £520,000 largest fine is itself the point. A cap so far above realistic penalties provides little guidance to companies about actual exposure, while giving the regulator wide discretion. Predictable law is better for investment than discretion that depends on how a regulator feels in a given year.
A court quashing order would send Ofcom back to remake the regulations rather than repeal the Act, and the treatment of fees already collected is unresolved. No bench ruling is expected, with a written judgment likely weeks or months away.
Whatever the court decides, the better policy response is for Ofcom to publish clear guidance on how it would calibrate penalties to the specific service in breach, rather than relying on the group-wide ceiling as the signal. That would preserve deterrence, answer the proportionality objection, and reduce the incentive to litigate every element of the regime.