Ofcom Information Notices: Meta, TikTok and X Lose High Court Challenge

This article explains what Ofcom asked for, why the platforms said it was unlawful, how the court answered each argument, and what the ruling means for any business regulated under the Act.

What Ofcom asked for

The notices were issued on 10 February 2026 under section 100 of the Online Safety Act 2023, which lets Ofcom require a person to provide, obtain or generate information it needs to exercise, or decide whether to exercise, its online safety functions. They were sent to the three claimants and to other regulated providers as part of Ofcom's Monitoring and Evaluation programme.

Each notice asked for six categories of data:

• the definitions each provider uses;
• the total volume of user activity on each service, split by age group;
• the volume of content and accounts subject to moderation action, the time taken and how much of it was content harmful to children;
• how far UK users, including children, were exposed to content that was later actioned;
• the outcomes of, and time taken to decide, user appeals; and
• the volumes and outcomes of reports filed by UK users.

The data reached back to 1 January 2024, before the Act's main duties began, so that Ofcom would have a baseline for measuring change. It was due in three tranches: 2024 and 2025 data by 15 June 2026, the first half of 2026 by 22 September 2026, and the second half of 2026 by 25 March 2027. Ofcom told the providers it expects to make such requests regularly and asked them to reflect that in their data retention policies.

Why Meta, TikTok and X objected

The three platforms brought separate claims, heard together over three days in early October. They were represented by leading counsel instructed by White & Case, Herbert Smith Freehills Kramer and Linklaters. Their objections were about burden as much as principle. According to The Next Web, X described its notice at an earlier hearing as the most demanding request it had ever received from a regulator, and Meta said Ofcom wanted extensive data across seven of its services without explaining clearly how it would use it.

The agreed issues fell into five groups:

• Circumvention: that the notices were unlawful because they sidestepped the Act's separate transparency regime in sections 77, 78 and 159, which comes with its own procedural safeguards.
• Purpose: that Ofcom did not truly "require" all the information for one of its online safety functions, as section 100(1) demands.
• Impact assessment: that Ofcom breached section 7 of the Communications Act 2003 by not carrying out, or explaining why it did not need, an impact assessment.
• Process: that the decision was apparently predetermined (TikTok only) and that Ofcom did not follow its own published policy.
• Proportionality and human rights: that the notices were disproportionate and interfered with the platforms' rights under Article 8 of the European Convention on Human Rights and Article 1 of Protocol 1.

How the court ruled on Ofcom information notices

The court refused permission on the first seven issues, holding them not reasonably arguable. It granted permission on proportionality and human rights, then dismissed those claims as well.

Ground	Platforms' argument	Court's answer
Circumvention	Section 100 was used to get round the transparency regime	Refused: the two powers serve different purposes
Purpose	Ofcom needed a specific task before it could demand data	Refused: "deciding whether to exercise" a function is enough
Impact assessment	Section 7 of the Communications Act required one	Refused: no different outcome would have resulted
Predetermination and policy	Ofcom had made up its mind and departed from its policy	Refused
Proportionality	The burden outweighed the benefit	Permission granted, claim dismissed
Human rights	Breach of Article 8 and Article 1 of Protocol 1	Permission granted, claim dismissed

The transparency regime argument

The platforms' central point was that the Act already sets out how Ofcom gets data about harmful content. Under section 77, Ofcom can require categorised services to publish transparency reports, subject to procedural protections. TikTok argued, relying on the Court of Appeal's decision in FCA v BlueCrest Capital Management, that a regulator cannot use a general power to achieve a result that a more specific power governs with its own safeguards.

The court accepted the principle but not its application. Its "short, but fundamental, answer" was that the transparency regime is about publishing information, whereas the notices sought data for Ofcom's own regulatory use, which might not lawfully be published at all. Because the two powers have different purposes, section 100 is not cut down by the transparency provisions. The court also rejected the idea that Ofcom could not ask for information until it had decided to use a specific power such as revising a code of practice. Section 100(1) expressly covers information needed for "deciding whether to exercise" a function, and the list of purposes in section 100(6) is not exhaustive.

The court did flag a limit. The broader and more general the stated purpose of a notice, the more the court may need persuading that it is proportionate. Ofcom's power is wide, but each notice must still pass the proportionality test in section 100(4).

Proportionality: where the platforms fell short

On proportionality, the court asked whether the notices struck a fair balance between the burden on each platform and the importance of Ofcom's objective. It accepted Ofcom's evidence on the importance of that objective, which was not seriously disputed. It noted that the notices were mandatory and partly retrospective, but said questions about repeat requests and sanctions for non-compliance were "for another day".

The decisive point was evidence. The court found that Ofcom had actively sought information from each platform about the burden of complying, and had worked with it professionally. Any gaps in that information were for the platforms to fill. Standing back, the judges said the striking feature was the lack of pertinent substance in the claimants' own evidence: it did not identify baselines or the actual resource impact. A general assertion that a less burdensome notice would have done, the court said, "will not do".

The human rights claims fell with proportionality. It was common ground that the notices interfered with the platforms' rights under Article 8, but the court held that interference was lawful and proportionate. It also found that the notices did not deprive X or TikTok of any property: they keep their data, it remains confidential, and they are not required to publish it.

How the parties reacted

Ofcom welcomed the decision, saying that gathering information is fundamental to its ability to do its job and that it will keep using its powers, City AM reported. Meta said it was disappointed, maintained that the scale of the data gathering went beyond what was necessary or proportionate, and said it was reviewing the judgment while remaining committed to working with Ofcom. TikTok said it was considering the ruling. No party had announced an appeal at the time of writing.

The wider fight between Ofcom and the platforms

This is not the only dispute. Meta has brought a separate judicial review challenging how Ofcom calculates fees and penalties under the Act, arguing the methods are disproportionate and unlawful. Ofcom is also investigating whether Meta carried out suitable and sufficient risk assessments before launching Instants, an Instagram feature for disappearing content; Ofcom has said the litigation over the information notices has not affected the timing of that investigation. Our earlier analysis of how Ofcom enforces the Online Safety Act covers that case and the regulator's wider toolkit.

The stakes are high. Under the Act, Ofcom can fine a provider up to £18 million or 10% of qualifying worldwide revenue, whichever is greater. Failing to comply with an information notice is itself an enforceable breach, so the ruling strengthens Ofcom's hand in every investigation that depends on data from the platforms.

The UK is not alone in pressing platforms for data. In the EU, the European Commission has used the Digital Services Act to pursue X, as our report on why the European Commission is fining X explains.

What the ruling means for regulated businesses

The judgment matters well beyond the three claimants. Any service in scope of the Online Safety Act, from social media and search to forums, marketplaces and gaming platforms, can receive an information notice. The practical lessons are:

• Expect broad demands. Ofcom does not need a specific project in mind; information needed to decide whether to act, to review codes of practice or to carry out research is enough.
• Retain data. Ofcom has said it will ask for monitoring data regularly, including historical data. Data retention policies should allow for that.
• Engage early and with evidence. The platforms lost on proportionality largely because they did not quantify the burden. Businesses that think a notice is too onerous should raise it during Ofcom's consultation on the draft notice, with figures on cost, time and engineering effort.
• Do not rely on the transparency regime as a shield. The court has confirmed that section 100 and the transparency provisions run side by side.
• Watch the fees challenge. Meta's separate case on fees and penalties could still change the cost of compliance.

Businesses facing an Ofcom notice or investigation can find a technology, media and telecoms adviser or a regulatory specialist in the Corporate INTL directory. For contentious matters, see our dispute resolution experts.

Frequently asked questions

What are Ofcom information notices?

They are formal demands for information issued under section 100 of the Online Safety Act 2023. Ofcom can require a provider to provide, obtain or generate information it needs to exercise, or decide whether to exercise, its online safety functions.

Who challenged Ofcom and who won?

Meta and WhatsApp, X and TikTok challenged notices issued on 10 February 2026. On 30 October 2026 the Divisional Court refused permission on most grounds and dismissed the rest, so Ofcom won.

Why did the transparency regime argument fail?

The court held that the transparency regime is about publishing information, while the notices sought data for Ofcom's own regulatory use. Because the powers have different purposes, Ofcom was not circumventing the transparency safeguards.

Do platforms have to publish the data they give Ofcom?

No. The court noted that the providers keep their data, it stays confidential and the notices do not require them to publish it.

What happens if a company ignores an information notice?

Failing to comply is an enforceable breach of the Act. Ofcom can impose penalties of up to £18 million or 10% of qualifying worldwide revenue, whichever is greater.

Will Meta, TikTok or X appeal?

Meta and TikTok said they were reviewing the judgment. No appeal had been announced at the time of writing.

Sources

1. R (Meta Platforms Inc and WhatsApp LLC) v Office of Communications [2026] EWHC 2779 (Admin), 30 October 2026: Find Case Law
2. Online Safety Act 2023, section 100: legislation.gov.uk
3. Online Safety Act 2023, section 77: legislation.gov.uk
4. Communications Act 2003, section 7: legislation.gov.uk
5. City AM, Meta and TikTok lose High Court battle against Ofcom's regulatory data demands, 30 October 2026: cityam.com
6. City AM, Meta court battle will not delay Instagram probe, Ofcom says, 6 October 2026: cityam.com
7. The Next Web, Meta, TikTok and X reportedly lose UK court fight over Ofcom data demands, 30 October 2026: thenextweb.com

About this article

Researched and written by The Corporate INTL Newsroom from the published judgment, legislation and contemporaneous reporting. It is general information, not legal advice. Last reviewed 31 October 2026. For more analysis visit our newsroom or subscribe to our newsletter.