Introduction
On 30 October 2026 the Divisional Court dismissed judicial review challenges brought against Ofcom by Meta Platforms and WhatsApp, X and TikTok over information notices issued under the Online Safety Act 2023. The judgment, R (Meta, X and TikTok) v Ofcom [2026] EWHC 2779, is the first time a court has examined Ofcom’s power to compel information from regulated online services.
The claimants were four of the largest platforms in the world, but the reasoning has nothing to do with their size. The court addressed how the power is structured, how much latitude Ofcom has in deciding what it needs, and what a provider must prove to argue that a notice goes too far. Those questions arise identically for a marketplace with a review function, a SaaS product with a community forum, or a mid-sized app with user messaging. For any business within scope of the Act, this is the clearest indication yet of how little room there is to push back once a notice lands.
What has changed?
The law has not changed. Section 100 of the Online Safety Act 2023 has been in force throughout, and Ofcom has been using it. What has changed is that the power has been tested in court, and the ruling clarifies three key points.
First, Ofcom decides what information it “requires” and the court reviews only whether that assessment was rational.
Second, the court held that the Act’s separate transparency reporting regime for categorised services does not restrict Ofcom’s general power to request information. The claimants argued that Ofcom was using the general power to get information that Parliament meant to come through transparency reports. The court disagreed and held that the two regimes serve different purposes.
Third, and most important in practice, the court decides for itself whether a notice is proportionate under section 100(4), using the familiar four-stage test. But it will only do so on evidence. The claimants pointed to heavy compliance costs. The court found that this did not show the extra burden created by the notice itself, as opposed to the cost of obligations the providers already had under the Act. Without a baseline, and proof of the additional impact, general claims about cost and internal effort could not tip the balance. The court added that a service’s size is not in itself evidence of extra burden, because size is what creates the risks Ofcom monitors.
Procedurally, permission was refused on most grounds as unarguable, including the transparency-regime argument, the challenge to whether the information was needed, a complaint that Ofcom should have carried out an impact assessment, an argument that it had not followed its own published guidance, and an allegation of predetermination. Permission was granted on proportionality and the related human rights ground, both then dismissed on the merits. Two questions were left open: the cumulative effect of repeated requests, and how the sanctions behind a notice bear on proportionality.
Who is affected?
Section 100(5) sets out who can receive a notice, and the list is wider than most businesses expect. It includes providers of regulated user-to-user and search services, and providers of internet services that publish or display regulated provider pornographic content. It also includes providers of ancillary services and access facilities linked to a regulated service, anyone who used to fall into one of these groups, and anyone else who Ofcom believes has the information or could generate or obtain it.
This goes well beyond social media. A user-to-user service is any service that lets users encounter content created or shared by other users. That can bring in marketplaces with reviews or buyer-seller messaging, dating and gaming services, forums, and community features inside SaaS products, as long as the service has the necessary links with the UK. And because of the final category, suppliers, hosting and infrastructure providers, and commercial partners can receive notices in their own right about a service they support.
What are the key legal requirements?
Section 102 requires a notice to specify the information sought, explain why Ofcom requires it, state the form, manner and timing of the response, and describe the consequences of non-compliance. The recipient must act in accordance with the notice and ensure the information is accurate in all material respects. Several features of the power are easy to underestimate:
- It can require information you do not hold. Section 100(2) extends to requiring a person to obtain or generate information, so “we do not measure that” is not an answer.
- It can require access, not just documents. Section 100(3) allows Ofcom to require certain providers to permit an authorised person to view remotely, in real time, the operation of systems, processes and features, including functionalities and algorithms, and the results of required tests. At least seven days’ notice applies to those steps.
- It must be proportionate. Section 100(4) requires the power to be exercised in a way that is “proportionate to the use to which the information is to be put” in carrying out Ofcom’s functions. The judgment shows this is a real but evidence-hungry protection.
- There are limits. The power does not extend to material protected by legal professional privilege, or to requiring processing of personal data that would contravene data protection legislation.
- Individuals can be exposed. Under section 103, where a provider is an entity, Ofcom may require it to name an individual who may reasonably be expected to be in a position to ensure compliance, inform that individual, and explain the consequences for them. Section 110 then makes a named senior manager criminally liable where the entity commits an information offence under section 109 and the individual failed to take all reasonable steps to prevent it. The defences are narrow.
Under Schedule 13, Ofcom can impose fines of up to the greater of £18 million or 10% of qualifying worldwide revenue, with £18 million applying as a flat maximum to recipients who are not providers or have no complete accounting period. The information duty is actively enforced: on 13 October 2025 Ofcom issued a confirmation decision fining 4chan £20,000 for two breaches of the section 102(8)(a) duty to act in accordance with information notices, with a daily penalty of £100 capped at 60 days.
What does this mean for technology companies?
Conclusion
This judgment does not expand Ofcom’s powers, it just confirms how wide they already were, and makes clear that the practical protection for businesses lies in evidence and engagement rather than in challenge. For technology companies within scope of the Act, the useful work is preparatory: knowing what data the service holds, being able to produce it to a deadline, and being able to quantify the cost of doing so.
If you’d like to talk this through, book a 20-minute call with me.
Image by pressfoto on Magnific.
