Three major social media companies went to court to stop Ofcom collecting detailed data on how they moderate content, and the regulator won. The judgment matters to anyone who uses these services, and to parents whose children do, because it shows how far the online safety regime can reach.
In this article we will discuss what the court decided and why, what Ofcom asked for, where reports differ on one detail, which related cases are still open, and what families and users can do in the meantime.
The Ruling and the Court Behind It
Who Decided, and Where
The judgment was handed down on 30 October 2026 by the Divisional Court of the King’s Bench Division, made up of Lord Justice Singh and Mrs Justice Collins Rice. It is reported under the name R (Meta Platforms and others) v Ofcom, with the citation [2026] EWHC 2779 (Admin). The details here come from reports published on 2 November by TechTimes and Verdict, so they are second-hand accounts of the judgment, not the judgment itself.
A caution applies to the first of those sources. TechTimes is a single secondary source and says several of its claims were not independently verified, which means the court details below should be treated as reported rather than confirmed. Anyone who needs the exact wording should read the judgment on the courts and tribunals judiciary website or in the legal databases.
Judicial Review in Plain Terms
The case was a judicial review, which is a way of asking a court to check whether a public body acted lawfully. It is not an appeal on the merits, and the judges were not asked whether Ofcom’s approach was wise or whether the platforms are safe. They were asked whether the regulator stayed within its legal powers, whether its demand was proportionate and whether it acted for a proper purpose.
A Divisional Court sits with more than one judge and is normally used for cases of some legal weight. That fits the way Verdict described the decision, as the first judicial review ruling on Ofcom’s information-gathering authority under the Online Safety Act 2023. That description is Verdict’s, and it matters because the first ruling on a power often becomes the reference point for later arguments.
The Outcome in One Line
All of the challenges were dismissed. The court refused permission on one ground as not reasonably arguable and heard another in full before rejecting it. The result is that the information notices Ofcom issued stand, and the companies remain under the obligation to respond to them, unless something further happens in the courts.
Information Notices Explained
An information notice is a formal legal demand from a regulator, requiring a named organisation to supply specified information by a set date. Under the Online Safety Act, Ofcom can issue them to the companies it oversees, and section 100 is the provision at the centre of this case. Failing to comply with a valid notice can itself lead to enforcement action, which is why the companies took the unusual step of challenging the notices in court rather than simply answering them.
According to Verdict, Ofcom issued the notices in February 2026 after several months of dialogue with the companies. That detail suggests the demand was not a surprise, and it is the sort of background a court looks at when it weighs whether a request was reasonable. The notices went to TikTok, X and WhatsApp, which is part of Meta.
Notices of this kind normally set out what must be supplied, in what form and by when, and they usually come after a period of discussion about what is feasible. Companies often raise concerns about commercially sensitive data, and regulators generally have rules about how such material is handled. The details of how Ofcom treats what it receives are matters for its published policies, and I would not assume anything beyond what the reports say.
What Ofcom Asked For
TechTimes lists the information Ofcom wanted, and it reads like a map of how content moderation works behind the scenes. Ofcom asked for the definitions each company uses when it removes or restricts content, the volumes of content and accounts moderated over set periods, and the numbers of posts removed or restricted. It also asked for exposure data, meaning how many UK users, including children, saw content that was later acted on, and for statistics on user appeals and reports.
Taken together, those items would let a regulator see how a platform draws its own lines, how much it acts on, how quickly harmful material is caught and how many people were exposed before it was. They are statistics about systems, as described in the reports, and not requests for private messages or individual user files.
Why Regulators Need Data
A safety regulator that cannot see the data is reduced to taking the company’s word for how well things are working. Information powers are the basic tool that lets it compare what a platform says in its policies with what happens in practice. They are also what allows a regulator to decide where to focus attention, which services to investigate and whether a safety measure is doing its job.
Ofcom made that point in reaction to the judgment, saying that gathering information is fundamental to its ability to do its job. Whatever one thinks of the regime, that is a fair description of how most regulators in most sectors operate.
Three Grounds of Challenge and How Each Failed
The claimants advanced three grounds, according to TechTimes. They said Ofcom had exceeded its powers, that the burden of complying was disproportionate, and that Ofcom’s purpose in issuing the notices was improper. The way the court dealt with them differed, and the differences tell you something about how strong each argument was.
Exceeding Its Powers
The legal term for acting beyond your powers is ultra vires. On this ground the court refused permission, describing it as not reasonably arguable. Permission is a filter at the start of a judicial review, designed to stop cases without a realistic chance from using up court time. Being refused at that stage means the judges did not think the argument was worth a full hearing.
Verdict adds that the court dismissed all the arguments as unarguable in law or on the facts. That is a strong form of words, and it suggests the judges saw little room for doubt about whether the Act gave Ofcom the power to ask for this kind of material. It does not say the platforms were wrong to try, since testing a new power in court is a normal use of judicial review.
Disproportionate Burden
Proportionality was the ground that got a full hearing, which ran for three days in early October 2026. The question was whether the cost and effort of answering the notices outweighed Ofcom’s objectives in asking. According to TechTimes, the court found that the companies’ evidence did not show that the burden outweighed those objectives.
Verdict quotes the court as saying that the claimants’ submission does not sufficiently identify the necessary baselines or differential resource impact. In ordinary language, that means the companies did not show clearly enough what the work would cost beyond what they already do, or how heavily it would fall on them compared with the normal costs of running a large platform. A court cannot weigh a burden it has not been shown how to measure.
Improper Purpose
The third ground was that Ofcom’s purpose was improper. The reports give no separate account of how the court handled this beyond the general statement that every challenge was dismissed. Without the judgment itself it would be wrong to guess at the reasoning, so the safe summary is that this argument was dismissed along with the other two.
Claimants, Reactions and a Detail Where Reports Differ
The reports disagree on who exactly the claimants were. Verdict names them as Meta, TikTok and X and does not list WhatsApp as a claimant. TechTimes lists WhatsApp among them. Verdict also says the notices were sent to TikTok, X and Meta’s WhatsApp, which would be consistent with WhatsApp being the notice recipient on the Meta side, but the reports do not settle it. Because the sources differ, the headline wording used here follows Verdict’s list, and readers who need the formal position should check the judgment’s title and parties.
It is worth saying that taking a regulator to court is a normal, lawful thing for a company to do. A new power tends to be tested in its early life, and a judgment, whichever way it goes, gives everyone including smaller firms a clearer idea of where the boundaries are. The loss for the companies here does not mean the challenge was improper, only that the court was not persuaded. The reactions came on the day the reports appeared, and they were short. The table sets out what was reported.
| Party | Reported response |
| Meta | Said it was disappointed with the court’s decision |
| TikTok | Said it is considering the judgment |
| X | Did not immediately respond to TechTimes; in court it called the request the most burdensome information request it has received from any regulator and estimated compliance costs in the millions of pounds |
| Ofcom | Said gathering information is fundamental to its ability to do its job |
The X estimate is worth handling with care. It was a submission made in the proceedings, and the court’s reported conclusion is that the companies’ evidence as a whole did not show the burden outweighed Ofcom’s objectives. A company’s own estimate of its costs is a claim, and the judges had to decide how much weight it carried against the regulator’s aims.
For ordinary users, the practical meaning of these quotes is modest. Disappointment and consideration are the standard language of companies that have lost a case, and neither tells you what they will do next. The more informative signal will be whether the data is supplied on time and whether any further legal step appears on the court record.
Nothing in the reports suggests any company has been found to have broken the law because of what happened here. The judgment concerns whether the notices were lawful, not whether any platform has failed in its duties. Keeping those two questions apart is the single most useful discipline when reading coverage of regulatory disputes.
Other Cases Still Running
The ruling is narrow, and several related matters carry on separately. All of the following come from TechTimes alone, so they should be read as reported, and none is affected by the information notice judgment.
Fees and Maximum Penalties
Meta has challenged how Ofcom calculates the revenue base used for fees and for maximum penalties. That challenge was heard on 13 and 14 October 2026, and no judgment has been reported yet. The point of the dispute is what counts as revenue for the purposes of the formulas, which matters because penalties under the Act are tied to a company’s turnover.
For serious breaches the maximum penalty is up to 10% of qualifying worldwide revenue or £18 million, whichever is greater. That is a ceiling set by law, not a forecast of what any company will pay. Because the figure depends on how revenue is defined, the outcome of the revenue base case could affect the arithmetic for every large service.
Category 1 Designation
WhatsApp and Instagram are appealing their Category 1 designation at the Upper Tribunal. Category 1 is the label for services Ofcom judges to be among the largest and most influential under the Act, and it brings additional duties beyond those that apply to every regulated service. The exact duties are set out in the legislation and in Ofcom’s guidance, and readers who run services should check the current position. An appeal to a tribunal is a different route from the judicial review decided on 30 October.
Taken together, these threads show that the regime is being tested on several fronts at once: what Ofcom may ask for, how fees and penalties are calculated, which services carry the heaviest duties and how the first formal investigations unfold. A reader trying to follow the story should expect more judgments, and should treat each as answering its own narrow question.
The Instagram Instants Investigation
Ofcom opened its first formal Online Safety Act investigation into Meta in early October 2026, concerning Instagram Instants. An investigation is a process of finding facts, and opening one is not a finding that anything has gone wrong. Readers should be cautious about treating it as evidence of a breach until Ofcom publishes a decision.
Online Safety Act Duties Behind the Dispute
Illegal Content and Child Safety
The Online Safety Act 2023 puts duties on services that host user-generated content, or that let people search, to assess and reduce risks. At its core are two groups of duties. One concerns illegal content, which platforms must assess for risk and take steps to prevent and remove, and the other concerns children, with additional protections where a service is likely to be accessed by under-18s.
In practice, this means platforms need written risk assessments, systems for users to report problems, complaints procedures and safety measures that match the risks they identify. Ofcom publishes codes of practice that describe recommended ways of meeting the duties, and a platform that takes a different approach has to be ready to show that it reaches an equivalent result. The information notices in this case sit upstream of all that, as the means by which the regulator checks the picture.
Child safety is where many parents will feel the stakes most directly. The duties around children include assessing whether young people are likely to use a service and, if so, taking steps appropriate to their age to reduce exposure to harmful material. The notices in this case asked for exposure data that included children, which shows why regulators want to know how often young users meet content that platforms later act on. The detail of the child safety measures is in Ofcom’s codes, and platforms are expected to follow them or show an equivalent approach.
What Transparency Data Could Show
Moderation statistics can do real work when they are consistent and well defined. Numbers on removals and restrictions can show whether a platform acts on harmful material quickly, and appeal figures can show how often its decisions are reversed. Exposure figures can show whether children are seeing content that the platform later judged unacceptable.
The catch is definitions. A removal on one service may not mean the same as a restriction on another, and raw totals are hard to compare when audiences differ in size. That is probably why Ofcom’s notices began by asking for the definitions each company uses. A rise in removals can mean a platform is catching more, or it can mean more is being posted, and the numbers alone cannot say which.
Limits, Privacy and Open Questions
The ruling does not make platforms safer on its own. It confirms that a regulator can demand information, and it removes an obstacle to Ofcom’s work, but turning data into action is a separate job. The regulator still has to analyse what it receives, decide what it shows and choose whether to open investigations or recommend changes.
What happens next is largely out of public view. Ofcom will presumably work through the material it receives and may use it to shape its priorities, but the reports do not describe any timetable. If the data eventually appears in published form, as transparency reports or regulator updates, it would give the public a rare comparable view of how large services handle harmful content, with all the caveats about definitions noted above.
There are also open questions that reasonable people see differently. Supporters of strong information powers say that without them the regime would be hollow. Others tend to raise concerns about how much sensitive data flows to regulators and how it is protected. As described in the reports, the categories requested are aggregate statistics and definitions rather than users’ private messages, which narrows the privacy question, though it does not remove it. Anyone worried about data handling can look at how Ofcom says it stores and uses what it collects.
A further question is cost. X told the court that compliance would run into the millions of pounds, and while the court was not persuaded on the evidence it saw, the issue of how information demands affect smaller services remains live. A large platform has teams to answer a notice. A small forum run by volunteers does not, and Ofcom’s approach to proportionality for smaller services will be watched closely.
Finally, the case is not necessarily over for the claimants. TikTok said it is considering the judgment, and Meta said it was disappointed, but the reports do not say whether any of the companies will seek to appeal. If you want to know, the place to check is the courts’ published records and the companies’ own statements in the coming weeks.
Final Thoughts: Practical Steps for Families and Users
Use the Reporting Tools on the Platform Itself
Every regulated service is expected to offer a way to report harmful or illegal content. Find the report option on the post, profile or message, choose the category that fits best and give a short, factual explanation. Keep a screenshot of what you reported, with the date, so that you can follow it up if the platform does not respond.
If you see a post that threatens violence or shows serious criminal activity, do not wait for a platform to act. Contact the police, and use the emergency route if someone is in immediate danger. Platform reports are for takedowns, not for emergencies.
Reporting to Ofcom
Ofcom publishes guidance on how to complain about a service and on what it does with complaints. As a general matter, a regulator of this kind tends to use reports to build a picture of where problems are, and it does not usually resolve individual disputes, so the first step is nearly always the platform. Check Ofcom’s website for the current route and for what happens after you submit something.
Parental Controls and Age Settings
For children, the most useful measures are practical ones. Set up the parental controls offered by the device and by each app, check that the age on the account is correct, and review who can message the child and who can see their posts. Talk with them about what to do if something upsetting appears, and make it clear that they will not be in trouble for telling you.
Block, mute and restrict tools are a quieter but useful part of the picture. Blocking an account stops it contacting you, muting hides it without the other person knowing, and restricting limits who can comment or reply. Teach teenagers where these controls are, and show them how to turn off location sharing and limit who can find their profile. Make a habit of revisiting these settings after apps update, since defaults can change.
Keep Expectations Realistic
Court rulings and regulator powers change how companies are held to account, but they do not remove the need for everyday habits. Check settings from time to time, because they change when apps update. Be sceptical of viral claims, and treat statistics about platform safety, including those in this article, as pieces of a picture that may shift as the cases above reach conclusions.
Frequently Asked Questions
When Did the Court Rule on Ofcom’s Information Notices?
The judgment was handed down on 30 October 2026 by the Divisional Court of the King’s Bench Division. Reports of it appeared on 2 November. The court dismissed all of the challenges.
Can Meta, TikTok or X Appeal the High Court Decision?
The reports do not say whether an appeal will be made. TikTok said it is considering the judgment, and Meta said it was disappointed. Check the courts’ records and the companies’ statements for developments.
How Much Can Ofcom Fine a Platform Under the Online Safety Act?
According to TechTimes, penalties for serious breaches can reach up to 10% of qualifying worldwide revenue or £18 million, whichever is greater. That is the legal maximum, not a typical penalty. This ruling concerned information notices and did not involve any fine.
Does the Ruling Change What I See on Social Media?
Not directly. The case decided that Ofcom’s request for moderation data was lawful, and it did not order any platform to remove or restrict anything. Any effect on feeds would come later, through what Ofcom learns and decides to do with it.
How Do I Report Harmful Content to a Platform or to Ofcom?
Start with the report tool on the post, profile or message, and keep a screenshot. Then look at Ofcom’s website for its guidance on complaints about online services. For immediate danger, contact the police.
Is WhatsApp Part of the Case?
The reports differ. TechTimes lists WhatsApp among the claimants, while Verdict names Meta, TikTok and X as the claimants and says the notices were sent to TikTok, X and Meta’s WhatsApp. The judgment’s title and parties will settle the point.
