On 13 October 2026, Meta went to the Administrative Court in London to argue that Ofcom unlawfully gave itself the power to measure Online Safety Act fees and fines against a company's worldwide earnings. The hearing was scheduled for a day and a half, and no ruling from the bench is expected. Judgments in judicial review usually follow weeks or months later, according to Tech Times' account of the hearing. A week earlier, on 6 October, Ofcom opened its first formal Online Safety Act investigation into Meta. The two events are separate legal matters, but they land together, and they show the weakness in how the UK has built its platform enforcement.
The case for Ofcom's design
The regulator's argument is stronger than Meta's lawyers allow. A fine capped at £18 million means little to a company with a $201 billion annual revenue. Penalties that scale with the size of the firm are a familiar deterrent design, and Ofcom's policy statement on fees and penalties says it needs the revenue-based cap so that the largest providers face an effective deterrent. Smaller services stay under the £18 million maximum. Ofcom also points out that the ceiling is notional. It says any actual penalty must be proportionate to the specific breach, and that a global metric reflects how cross-border platforms actually operate. Both points are summarised in CMS's analysis of the policy statement.
Process matters too. This was not a regulator acting alone. The Online Safety Act 2023 (Qualifying Worldwide Revenue) Regulations 2025 were laid before Parliament on 25 June 2025, scrutinised by the Secondary Legislation Scrutiny Committee and the Joint Committee on Statutory Instruments, debated in a Commons committee on 2 September and a Lords Grand Committee on 8 September, and approved by both Houses by 15 September. They were made on 17 September and came into force on 8 October 2025, according to the UK Parliament's procedure record. That is democratic legitimacy, even if the debate did not settle every question.
Where Meta's argument has force
Meta advances two claims. First, it says counting worldwide revenue, not just UK-derived revenue, for both supervision fees and penalty ceilings goes beyond what Parliament intended. Second, it says Ofcom may pool the revenue of a whole corporate group, covering Facebook, Instagram and WhatsApp, to set the ceiling even when only one service is in breach. Meta's counsel, Monica Carss-Frisk KC, described the approach as troubling and argued that a handful of companies, Meta among them, end up bearing the vast majority of Ofcom's costs, according to Tech Times.
The numbers explain why the dispute matters. Applying the 10% formula to Meta's roughly $201 billion 2025 revenue gives a theoretical ceiling of about £15 billion, or $20 billion. Ofcom has invoiced around £88 million in supervision fees for 2026/27, and the mandatory fee threshold is £250 million in qualifying worldwide revenue. Few companies cross that line, so the cost of the regime falls on very few firms.
The UK does not need a global-revenue ceiling to be tough. It needs one that is predictable. A cap tied to the revenue of an entire group, including services unrelated to the breach, produces a ceiling with no link to the harm. Ceilings anchor negotiations. When a regulator can threaten a nine-figure or ten-figure sanction, companies settle, over-comply and remove lawful features and content to stay clear of the risk. That pressure falls hardest on lawful speech, because a platform facing an uncertain penalty over borderline content will tend to take the content down.
The Instagram Instants investigation
Ofcom's 6 October investigation shows the enforcement approach in practice. It is examining whether Meta carried out suitable illegal content and children's risk assessments before launching Instagram Instants, a feature released in May in which shared content disappears after it has been viewed. George Lusty, Ofcom's Director of Enforcement, said: "Our online safety laws are clear – significant changes to platforms must be risk assessed before they're launched." The details are in Ofcom's announcement.
This is a process duty, not a content ruling, and it is a reasonable one. Requiring a risk assessment before a major launch is proportionate, and the breach, if there is one, is easy to describe: a missing or inadequate document. That is where the argument about the ceiling becomes concrete. If Ofcom finds a paperwork failure on one feature, the sanction should reflect a paperwork failure on one feature. A fine calculated from Meta's entire global balance sheet would be disconnected from that conduct.
What proportionate looks like
Ofcom's track record so far points to restraint. Per the Tech Times report, it has issued over £7 million in fines against eleven providers since October 2025, including a £520,000 fine against 4chan. Nothing close to the theoretical ceiling has been used. That supports Ofcom's claim that the cap is a backstop. It also exposes the problem. A regulator's promise of self-restraint is not a legal limit, and different leadership could read the same power differently.
There are three practical steps.
- Publish penalty methodology. Ofcom should say how breach gravity, duration and company size translate into a fine, with worked ranges, so firms and courts can test whether outcomes are proportionate.
- Link group-wide revenue to group-wide failures. If one service is in breach and the others are not, the ceiling should reflect that unless Ofcom shows a genuine shared failure of governance.
- Review the cost allocation. Fees concentrated on a few firms make the regime look like a levy, not a cost-recovery mechanism, and invite the sort of challenge now before the court.
The court may well uphold the regulations. The statute gives Ofcom broad room, and Parliament approved the instrument. If so, the burden falls on Ofcom to show that a very large ceiling produces proportionate outcomes in practice. If the court strikes down part of the regime, the government will need to rewrite it. Either way, the lesson is the same: strong online safety enforcement and limits on regulatory discretion belong together, and the UK will have a more durable regime if the second is built in explicitly.