What the court decided
On 30 October 2026, a Divisional Court of Lord Justice Singh and Mrs Justice Collins Rice dismissed the challenges brought by Meta and WhatsApp, X and TikTok to information notices Ofcom issued under Section 100 of the Online Safety Act 2023. The judiciary's press summary calls these the first judicial review proceedings to test Ofcom's power to issue such notices. The reported neutral citation is [2026] EWHC 2779 (Admin), according to TechTimes, and the full judgment is published on the judiciary website.
The notices, issued in February 2026 after several months of dialogue with the companies, sought six categories of information. According to the press summary, these were:
- an explanation of the definitions each provider uses;
- total user activity on each service, broken down by age group;
- the volume of content and accounts subject to moderation action, the time taken, and how far content harmful to children was the target;
- how many UK users, including children, were exposed to content that was later actioned;
- the outcomes of appeals and the time taken to process them;
- the volume and outcomes of reports filed by UK users.
The court rejected every ground except proportionality as unarguable in law or on the facts. It then granted permission on proportionality, weighed the question itself, and rejected it on the merits.
The strongest case for Ofcom
The regulator's argument deserves a fair statement. A regime that asks platforms to assess and manage risk cannot be supervised on the platforms' own say-so. Section 100 lets Ofcom require "any information that they require for the purpose of exercising, or deciding whether to exercise, any of their online safety functions", as the press summary quotes it. Without comparable numbers on removals, appeals and child exposure, Ofcom cannot tell whether a service's safety claims are true. Ofcom said it "welcomes the High Court's decision" and that gathering information is "fundamental to our ability to do our job", City AM reported.
Ofcom also has form for being tested on this point. In 2024 it fined TikTok £1.875 million for an inaccurate response to an earlier statutory information request, after a 25% settlement discount, as set out in its investigation page. Regulators that cannot trust the data they receive have a real problem.
Where the ruling should worry innovators
Granting all of that, the judgment still deserves scrutiny from anyone who wants proportionate regulation, for three reasons.
First, the statutory limit is carrying a lot of weight. Section 100 says the power "must be exercised in a way that is proportionate to the use to which the information is to be put". That is the main protection platforms have against open-ended data demands. The court held that it works, but it did not find that Ofcom's notices were light. Meta said it brought the challenge because "information-gathering of this scale goes beyond what is necessary or proportionate", per City AM. TechTimes reports that X's witness statement called the request the most burdensome it had received from any regulator. These are the companies' own characterisations, not findings of the court.
Second, the challengers lost on evidence rather than principle. The court said their evidence of onerousness "does not sufficiently identify the necessary baselines or differential resource impact" and could not tip the balance towards disproportionality. The lesson for future litigants is that general complaints about burden will not succeed. They must show the baseline cost of compliance and the extra resources a notice requires. That is a high bar for smaller services, which have fewer engineers and lawyers than Meta or TikTok.
Third, the dispute shows the limits of Ofcom's discretion in practice. There was no ruling that Ofcom must have a particular future task in mind before demanding data. The press summary points to paragraphs on the meaning of Section 100 and its "place in the regulatory regime". It is a broad reading, so Ofcom's own published information-gathering guidance now matters a great deal.
What proportionality should mean in practice
The real risk is not that Ofcom will ask for exposure data. Data about how many children encounter harmful content is reasonable, and platforms already hold much of it for their own purposes. The risk is cumulative. Every notice that defines "actioned content" differently from a company's internal taxonomy forces custom engineering. A platform with a few hundred staff will find that a notice calling for age-disaggregated activity data across every service is a material cost. The Act's penalties go up to £18 million or 10 per cent of qualifying worldwide revenue, whichever is greater, as City AM reports, so refusal is not a realistic option for smaller firms.
There is also a speech dimension. Appeals and removal data are measures of over-removal as much as under-removal. If Ofcom publishes or acts on volumes of content removed without paying equal attention to wrongful takedowns, platforms will be pushed toward removing more. Regulators that measure only the harms they were asked to reduce will tend to get more removal and less lawful speech.
What Ofcom should do now
A win in court is not a reason to relax. Ofcom should:
- publish the definitions it uses so platforms can reuse existing datasets rather than build bespoke ones;
- require data on wrongful removals and successful appeals alongside harmful-content volumes;
- scale expectations to the size of the service, since this judgment concerns some of the largest platforms;
- explain publicly how each category of data will be used.
The judgment confirms that Ofcom's powers are lawful. It does not say they have been used as well as they could be. Other disputes remain open, including Meta's separate challenge to the fees and penalties regime, which TechTimes says is awaiting judgment. The test now moves from the courtroom to Ofcom's own conduct, where proportionality will be judged by whether the data it collects makes services safer without making lawful speech harder to host.