What did the High Court rule in the Ofcom information notices case?
The UK High Court has dismissed a legal challenge by Meta, TikTok and X to the data demands Ofcom uses to police the Online Safety Act. In a judgment handed down on 30 October 2026, the Divisional Court refused to quash information notices issued to the companies in February.
Lord Justice Singh and Mrs Justice Collins Rice heard the case over three days in October. Their written ruling, cited as [2026] EWHC 2779 (Admin), rejects every ground the platforms advanced. Permission to proceed was refused on seven issues. Two further grounds were allowed through but failed on their merits.
The notices therefore stand. Reuters described the case as one of the first tests of how far Ofcom can reach into platform data under the Online Safety Act 2023. The Independent called it the first legal test of the regulator's power to demand information under the act.
The claims were brought by Meta Platforms and WhatsApp LLC, by X Internet Unlimited Company and by TikTok Information Technologies UK Ltd. They were heard together because the three applications overlapped. Each challenged a notice issued on 10 February 2026.
Ofcom welcomed the outcome. A spokesperson said: “Gathering information from companies is fundamental to our ability to do our job of assessing compliance with their duties.” Meta said it was disappointed, arguing that information-gathering “of this scale goes beyond what is necessary or proportionate”. TikTok said it was considering the judgment, while X did not immediately respond to Reuters.
The ruling is narrow in one sense. It decides how Ofcom may collect evidence, not whether any platform has broken the act. But it matters because the regulator's whole enforcement model depends on getting reliable numbers from companies that hold them.
What data does Ofcom want from Meta, TikTok and X?
Ofcom issued the notices under section 100 of the Online Safety Act. That provision lets the regulator require information for the purpose of exercising, or deciding whether to exercise, its online safety functions. The judgment records that the notices went to the three claimants and to other regulated service providers.
Each notice asked for six categories of information. The judgment summarises them as follows:
- •An explanation of the definitions each provider uses.
- •The total volume of user activity on each service, broken down by age group.
- •The volume of content and accounts moderated, the time taken, and how much of it concerned content harmful to children.
- •How many UK users, including children, were exposed to content that was actioned.
- •The number, outcomes and processing times of appeals against moderation decisions.
- •The volume and outcomes of reports filed by UK users, including through content moderation reporting tools.
How is the data collected, and when is it due?
The notices asked for data going back to 1 January 2024. Ofcom said it needed a period before the act's duties commenced to serve as a reference point for tracking change. The regulator also said it wanted to measure the scale of risk and whether online safety was improving or worsening.
The requests arrived in three tranches. The first covered 1 January 2024 to 31 December 2025 and was due by 15 June 2026. The second covered the first six months of 2026 and was due by 22 September 2026. The third covers the second half of 2026 and is due by 25 March 2027.
Ofcom described the exercise as part of its monitoring and evaluation programme. In the notices, it linked the requests to reviewing codes of practice, carrying out research and assessing compliance. The court accepted that codes of practice and research were lawful purposes under section 100.
The judgment notes two features that shaped the dispute. The notices are mandatory, and they contain a degree of retroactivity. Both points featured in the platforms' proportionality arguments, and both were acknowledged by the court.
Why did the platforms say the notices were unlawful?
The platforms attacked the notices from several directions. They argued that Ofcom was using a general power to bypass the act's specific transparency regime. They said the notices did not identify a sufficiently specific statutory purpose. They accused Ofcom of failing to consider an impact assessment and of breaching its own published guidance.
TikTok ran a separate argument that its notice was tainted by apparent predetermination. Meta and X focused heavily on proportionality. X and TikTok also brought human rights grounds, including interference with privacy and property rights.
The transparency argument rested on sections 77 and 78 of the act and its reporting framework. Those provisions impose limits: only certain providers are covered, reports are annual, and the information is ultimately published. The platforms said Ofcom could not use section 100 to demand the same material on a recurring basis without those safeguards.
The burden evidence was substantial, though the court later found it thinly explained. X's witness evidence put the cost at “millions of pounds” and estimated three or four months of work by specialist staff. It said the first stage had already consumed “hundreds of hours” across a group of ten people.
Meta said its partial response had involved up to 20 different teams. TikTok said the notice was one of the largest single regulatory information requests it had faced in the UK or EU. It already had more than a thousand employees across 80 teams working on UK compliance.
In public, Meta framed its challenge as a dispute about implementation rather than the law itself. A spokesperson told The Guardian: “These are not challenges to the law itself, but how Ofcom has interpreted it.” Ofcom's group director for online safety, Oliver Griffiths, told peers the regulator was “operating in a highly litigious environment”.
Why did the judges reject the platforms' arguments?
The court's central answer on the transparency regime was that the two powers serve different purposes. The transparency regime is about publishing information. The section 100 notices are mainly for Ofcom's own use, and the material may not lawfully be published at all.
The judges also stressed timing. The transparency regime was not yet operating when the notices were issued. The categorisation register was published on 30 June 2026, and reporting duties were still being brought into force. Parliament, the court said, cannot have intended section 100 to sit idle until the newer regime was ready.
The court rejected the idea that section 100 contains no safeguards. It pointed to the proportionality requirement in section 100(4) as an important check. It also suggested that, once information has been published under the transparency regime, it would be “difficult if not impossible” for Ofcom to justify demanding the same data again.
On purpose, the judges held that section 100(1) expressly covers deciding whether to exercise a function. The list of purposes in section 100(6) is non-exhaustive. The question for the court was whether Ofcom's assessment that it required the information was rational, not whether the court would have reached the same view.
The impact assessment ground failed because the court thought it reasonably open to Ofcom to treat the notices as individual decisions. On that view, there was no “important” proposal triggering section 7 of the Communications Act 2003. The court added that, even if it were wrong, the outcome would not have been substantially different, which engages section 31(3D) of the Senior Courts Act 1981.
TikTok's predetermination claim fared no better. The judges found a long consultation, repeated revisions and a decision-maker, Robin Finer, acting in an executive rather than quasi-judicial role. They concluded: “The possibility of predetermination that it sets out is unreal.”
The guidance ground also failed. The court found that, in substance, Ofcom had considered the factors in paragraph 3.12 of its information powers guidance. It again held that any error would not have changed the outcome.
Proportionality was the ground the court examined most closely. The judges gave some weight to the mandatory and partly retrospective nature of the notices. But they found the platforms' evidence lacked the baselines and differential costings needed to show that the burden was disproportionate.
The judgment points to the relative lack of “pertinent substance” in the claimants' evidence. It notes that Ofcom consulted from early 2025, assessed proportionality in August 2025 and revised the notices. X's own April 2025 note had said it saw nothing unduly concerning in the draft. The court also accepted Ofcom's evidence about the importance of its objective.
On human rights, Ofcom conceded that the notices interfered with Article 8(1) privacy rights. The court held that any interference was lawful and proportionate. It rejected the argument that the notices deprived X or TikTok of property, and described any control over the use of their information as minimal.
What does the ruling mean for Online Safety Act enforcement?
The judgment gives Ofcom room to use its information power broadly, including for research and for deciding whether to act. It also confirms that courts will not easily substitute their own view of what a regulator needs. That is a meaningful advantage for an organisation still building its evidence base.
It is not a blank cheque. The court treated proportionality as a real test and examined the burden evidence in detail. Future challenges may succeed if a platform can show a clear baseline, a specific marginal cost and why a particular question is unnecessary. General complaints about scale will not be enough.
The reasoning is not confined to three companies. The judgment records that notices went to other regulated providers as well. Its interpretation of section 100 and its analysis of the transparency regime will shape how those providers respond and how Ofcom drafts future notices.
The ruling also sketches how the two regimes should fit together. Once transparency reporting is fully operational, duplicate demands for published data will be harder to defend. Until then, section 100 remains the main route for collecting moderation metrics.
Separately, the decision does not resolve the fight over money. Breaches of the act can be punished by fines of up to 10% of qualifying worldwide revenue or £18m, whichever is higher, according to The Guardian. Meta is challenging how Ofcom calculates fees and potential fines, and Reuters reports that a ruling in that separate case is awaited.
Nor does it settle how WhatsApp and Instagram are categorised under the act. Meta is contesting the additional duties that follow from that classification. Those disputes concern the scope of obligations, while this case concerned the evidence Ofcom can demand to check compliance.
What happens next for Ofcom and the platforms?
None of the three companies said it would appeal after the ruling. TikTok said it was considering the judgment. X did not respond to Reuters. Meta said it was disappointed but did not announce further legal steps.
Compliance work continues regardless. The third tranche of data, covering the second half of 2026, is due by 25 March 2027. Ofcom is expected to use the material in its monitoring, research and code reviews, and the notices ask providers to factor the requests into their data retention policies.
Other fronts remain active. Ofcom opened an investigation in October into whether Meta carried out adequate risk assessments before launching Instagram's Instants feature, the BBC reported. Meta denies breaching its duties and says it analysed the risks before launch.
The fees case remains the bigger financial question. A ruling on how Ofcom calculates charges and potential penalties could affect every large provider, not just the three in this case. Meta's categorisation challenge could reshape which duties apply to WhatsApp and Instagram.
For now, the practical effect is that Ofcom's demand for moderation metrics has survived its first major court test. The next phase will show whether the data changes how the regulator writes codes, prioritises investigations and measures whether the Online Safety Act is working.