A UK court handed Britain’s communications regulator its first judicial victory in OSA history on October 30, 2026, dismissing all legal challenges brought by Meta, WhatsApp, X, and TikTok against Ofcom’s demands for granular content-moderation data — and foreclosing the most fundamental legal argument platforms could have raised by refusing even to grant a hearing on it.
The Divisional Court of the King’s Bench Division — the specialized judicial panel that hears challenges to government and regulatory decisions — ruled in R (Meta Platforms and others) v Ofcom [2026] EWHC 2779 (Admin) that Ofcom’s Section 100 information notices were lawful, proportionate, and squarely within the regulator’s statutory powers. Lord Justice Singh and Mrs Justice Collins Rice presided over three linked cases — case numbers AC-2026-LON-002160, AC-2026-LON-002053, and AC-2026-LON-001872 — and dismissed all legal challenges in Ofcom’s favor entirely.
The notices, issued in February 2026 under Section 100 of the Online Safety Act 2023, require the four companies to disclose specific data about their content-moderation operations. They are now legally in force, with all four platforms formally obligated to comply.
What Ofcom Actually Asked For
Ofcom’s February 2026 notices were not vague requests for general information. Under Section 100 power to require information, the regulator can require any person to provide specified information for the purposes of Ofcom’s online safety functions — and Ofcom used that power with precision.
The notices required each platform to supply:
- The definitions each company uses for content-moderation actions — how it operationally defines what counts as a removal, a restriction, or a warning
- Volumes of content and accounts subject to moderation in specified periods
- The number of posts removed or having visibility restricted
- Exposure data — how many UK users, and specifically how many UK children, encountered content that was subsequently actioned by the platform’s own moderation systems
- Statistics on user appeals and user-submitted reports
The exposure-of-children data category is central to why Ofcom sought this information in the first place. The Online Safety Act’s purpose is protecting users from harmful content — with particular emphasis on children — from illegal and harmful material. To assess whether platforms are meeting their obligations, Ofcom needs to know not just what was moderated, but how many people saw it before moderation reached it.
The Legal Challenge
The four companies filed coordinated legal challenges filed in Administrative Court, attacking the notices on multiple legal fronts.
Three principal grounds were advanced:
- Ultra vires — that Ofcom had exceeded its statutory powers under Section 100 of the Online Safety Act in issuing notices of this scope; that Parliament had not authorized demands of this breadth
- Disproportionality — that the compliance burden was not justified by any legitimate regulatory purpose; that the cost of providing the data was excessive relative to any benefit Ofcom would obtain
- Improper purpose — that Ofcom sought the data for reasons outside those Parliament had authorized
X was the most vocal about the burden it claimed to face. A witness statement submitted by the company to the court described Ofcom’s request as the “most burdensome information request X has received from any regulator in any jurisdiction,” adding that compliance would cost it millions of pounds (approximately $1.34 million per £1 million at current rates).
The hearing ran for three days in early October 2026.
What the Court Actually Decided: Why the Permission Refusal Matters
The headline result — all grounds dismissed, all notices upheld — understates the significance of how the court reached that result.
In English judicial review, a claimant must first obtain “permission” from the court to bring a challenge. The permission stage threshold test asks whether the claimant’s argument is “reasonably arguable.” It is not a high bar. Permission is routinely granted for weak arguments. A refusal of permission signals that the court found the argument did not even cross that low threshold.
The court refused permission on ultra vires ground — finding that the platforms’ argument that Ofcom had exceeded its Section 100 powers was “not reasonably arguable.” That is a materially stronger ruling than simply losing on the merits after a full hearing. It means the court read Section 100 as so clearly authorizing the notices as issued that the argument to the contrary could not even generate a live legal question worth examining.
The practical consequence: any future platform challenging an Ofcom information notice cannot seriously re-run the ultra vires argument — that the power does not legally exist, or does not extend to this kind of demand. That ground has been foreclosed at the permission stage. Future challengers are left with proportionality alone, and the court’s reasoning on proportionality has now established the proportionality evidential standard they must meet.
On proportionality — which the court did allow to proceed to a full merits hearing before dismissing — the central finding was that the companies’ evidence did not establish that the burden of supplying the information outweighed Ofcom’s statutory objectives. The judges found that broad assertions about operational cost were not legally sufficient. To succeed on proportionality in a future challenge, a platform would need to produce granular, documented, operationally specific evidence of burden — not CEO witness statements asserting that compliance is expensive.
The improper purpose ground was also dismissed.
Reactions
Meta was the only claimant to issue a public statement immediately after the judgment. “We’re disappointed with the court’s decision,” a company spokesperson said, “but we and others across industry pursued this challenge because information-gathering of this scale goes beyond what is necessary or proportionate,” according to the Reuters Oct 30 report.
The language — “we and others across industry” — signals that Meta was advancing a position it sees as shared across the sector, not merely making an argument about its own compliance burden.
TikTok said it is “considering the judgment.” X did not immediately respond to requests for comment.
Ofcom, by contrast, was emphatic. An Ofcom spokesperson said that “gathering information is fundamental to our ability to do our job.”
Oliver Griffiths, Ofcom’s Group Director for Online Safety, had given highly litigious environment testimony to the House of Lords Communications and Digital Committee in September 2026, warning that Ofcom faces the risk of being “clobbered legally by deep-pocketed individuals and firms.” Thursday’s ruling provides the regulator’s first judicial validation of its information-gathering authority.
Outstanding Litigation: What the Ruling Does Not Settle
The October 30 judgment resolves one front in what is now a multi-pronged legal contest between Ofcom and the major platforms. Three other proceedings remain active:
The fees and fines case pending (AC-2025-LON-004500) remains active. This is a separate judicial review — also brought by Meta — challenging how Ofcom calculates the revenue base for supervision fees and maximum penalties. The hearing ran October 13-14, 2026; no judgment has been handed down. If Meta wins, every Category 1 provider sees its penalty ceiling fall sharply.
The Category 1 designation appeals — brought by WhatsApp and Instagram against their designation as Category 1 services, which triggers the most stringent OSA obligations — are pending at the Upper Tribunal. Category 1 designation determines the scope of a platform’s duty, so these appeals carry structural significance for the OSA’s regulatory architecture.
The Ofcom investigation into Instagram Instants — opened in early October 2026, Ofcom’s first formal OSA investigation into Meta — examines whether the company conducted adequate risk assessments before launching its Instagram Instants feature in May 2026. Meta has said it “conducted a risk analysis and briefed Ofcom about this feature on a number of occasions before launching it.”
A fourth proceeding also runs separately: Ofcom’s investigation of Meta under the Communications Act over WhatsApp Business information requests, which predates the OSA and is a distinct proceeding from Thursday’s ruling.
Ofcom has confirmed that the court ruling in Thursday’s case has not affected the timing of its parallel investigations.
What Thursday’s Ruling Changes for Platform Compliance
For technology and legal teams across the industry, the judgment has immediate operational significance that extends beyond the four named claimants.
Ofcom issued Year 2 risk assessment notices to more than 30 providers covering more than 40 services in April 2026 alone — the largest single wave of statutory data demands since the OSA came into force — requiring submission of Year 2 illegal-harms risk assessments and children’s risk assessments. Thursday’s ruling gives every notice in that wave a court-validated legal foundation.
The court’s proportionality reasoning creates a new compliance strategy imperative: platforms that receive an Ofcom information notice and believe it is disproportionate must build their objection from the ground up, with specific, documented evidence of operational burden before any legal challenge is filed — not after. A platform that waits until litigation to quantify its compliance cost, and then submits broad assertions, will face the same result as the four companies here.
Any penalty for a serious breach of the Online Safety Act can reach up to 10% of qualifying worldwide revenue — or £18 million (approximately $24.1 million USD), whichever is greater, per the Online Safety Act penalty provisions. For Meta — whose Meta 2025 full year revenue reached $201 billion — that ceiling is substantial.
TikTok’s Presence as a Named Party
One dimension of Thursday’s ruling warrants a brief contextual note for readers concerned about data security. TikTok is owned by ByteDance, headquartered in Beijing. China’s Chinese National Intelligence Law obligations (2017), Article 7, legally require all Chinese organizations and citizens to “support, assist, and cooperate with national intelligence work” — an obligation that applies to ByteDance regardless of where TikTok’s servers are located or what its stated privacy policies say. Any operational data that TikTok discloses to Ofcom about its moderation systems reflects capabilities that ByteDance could, under Chinese law, be required to disclose to Chinese intelligence services. Ofcom’s own data security practices in handling sensitive platform information are a separate question.
Currency conversions in this article are approximate, based on an exchange rate of £1 = $1.34 USD as of November 1, 2026.
Frequently Asked Questions
What did the court actually decide on October 30, 2026?
The Divisional Court dismissed all legal challenges brought by Meta, WhatsApp, X, and TikTok against Ofcom’s February 2026 information notices under the Online Safety Act 2023. The court refused even to grant a full hearing on the platforms’ claim that Ofcom had exceeded its statutory powers — a stronger rebuff than a simple loss on the merits. It then allowed, and dismissed on the merits, the platforms’ claims that the notices were disproportionate and served an improper purpose. All four platforms are now legally required to comply with the notices.
What powers does Ofcom have under the Online Safety Act, and what can it demand?
The Section 100 statutory text of the Online Safety Act 2023 allows Ofcom to issue information notices requiring any person to provide specified information — including documents, explanations, analysis, and data — for the purposes of Ofcom’s online safety functions. Platforms subject to those notices are legally obliged to comply. Thursday’s ruling confirmed that Ofcom can use this power to demand granular moderation data: definitions of moderation actions, volumes of removed or restricted content, and user-exposure statistics including data on children. Failure to comply or provision of false information can itself be a breach of the OSA, triggering enforcement.
Can platforms still challenge Ofcom’s information notices in future?
Yes, but the legal landscape has narrowed significantly. The court’s dismissal of the ultra vires ground at the permission stage — without granting a full hearing — makes it substantially harder for any future challenger to argue that Ofcom’s Section 100 power does not legally extend to the type of data it demanded. Future challenges will need to focus on proportionality, which requires platform legal teams to present granular, documented evidence of operational burden before bringing proceedings, not broad assertions of cost. The four companies that lost on Thursday may still seek permission to appeal; none has yet confirmed their intentions, according to the platforms considering appeal options reporting from Reuters.
What are the financial stakes if a platform fails to comply?
Serious breaches of the Online Safety Act can attract fines of up to 10% of a platform’s qualifying worldwide annual revenue — or £18 million (approximately $24.1 million USD), whichever is greater, per the OSA financial penalty provisions. For the largest platforms, the revenue-based ceiling dominates: Meta’s 2025 worldwide revenue of approximately $201 billion implies a theoretical OSA fine ceiling of roughly $20 billion under the current rules — though that ceiling remains subject to Meta’s separate pending court challenge over how Ofcom calculates the penalty base.
