Britain’s online safety regulator just won the right to look inside the moderation machinery of three of the country’s biggest apps, yet the public may never see what it finds. On Friday, October 30, the High Court rejected challenges from Meta, TikTok and X and upheld the Ofcom data demands made under the Online Safety Act. The ruling is the first court test of Ofcom’s power to compel information. However, the 171-paragraph judgment says more than the headline does about cost, secrecy and what comes next.
Lord Justice Singh and Mrs Justice Collins Rice dismissed every ground the companies raised. The judges refused permission on most of them as unarguable. Only the proportionality argument, and a linked human rights point, reached a full hearing, and the court rejected both on the merits, according to the court’s published judgment and press summary.
What the Ofcom data demands actually cover
Ofcom sent the information notices in February 2026 under section 100 of the Act. That section lets the regulator require “any information” it needs for its online safety functions, as long as the request is proportionate. The notices went to Meta and WhatsApp, X, and TikTok’s UK arm, after roughly a year of drafts and meetings.
Each notice asks for six kinds of information:
- How each company defines the terms it reports on
- Total user activity on each service, broken down by age group
- How much content and how many accounts faced moderation, how long that took, and how much involved material harmful to children
- How many UK users, including children, saw content before it was actioned
- Outcomes of appeals against moderation decisions, and how long appeals took
- The volume and outcomes of reports filed by UK users
Put simply, the regulator wants a measured baseline of how much harmful material UK users see, how fast platforms act, and how often their decisions survive an appeal. Ofcom told the court it was unlikely to manage that with public information alone. The data starts on January 1, 2024, so the regulator can compare today with the period before the Act’s duties took effect.
Three tranches, two deadlines already gone
The Ofcom data demands are not a one-off. Instead, the notices split the data into three periods, each with its own due date. Notably, the court’s account shows that two of those deadlines passed while the legal fight was still running.
| Tranche | Period covered | Deadline set in the notice |
|---|---|---|
| 1 | January 1, 2024 to December 31, 2025 | June 15, 2026 |
| 2 | January to June 2026 | September 22, 2026 |
| 3 | July to December 2026 | March 25, 2027 |
The schedule matters because the companies did not simply refuse to engage. Meta’s own evidence referred to a partial response it had already made. Meanwhile, Ofcom agreed to extend X’s timetable during the consultation. The notices also included a line that should worry anyone hoping this is a single exercise: Ofcom wrote that it expects “to request this information under the M&E programme on a regular basis.”
What the platforms claimed, and what the judges saw
All three companies told the court the Ofcom data demands were among the heaviest any regulator had put on them. The judges did not dispute that the work was real. Instead, they found the evidence too thin to weigh.
| Company | What it told the court | What the judges noted |
|---|---|---|
| X | Compliance would cost “millions of pounds” and need three or four months of specialist work; the first stage alone took “hundreds of hours of work across a group of ten people” | The figures were not “materially further quantified, explained or contextualised” against X’s wider resources |
| Meta and WhatsApp | A partial response had already involved “up to 20 different teams”; WhatsApp called it a “major project management undertaking” | Meta accepted that Ofcom’s changes had reduced the burden; the evidence was not significantly particularised |
| TikTok UK | One of the largest single regulatory information requests it has faced in the UK or EU | TikTok already had more than 1,000 staff across 80 teams on UK compliance, but had not yet assessed the extra resource needed |
The court’s central criticism was blunt. The companies’ evidence, the judges wrote, “does not sufficiently identify the necessary baselines or differential resource impact.” In other words, saying a task costs millions means little unless a court can compare it with the company’s existing systems and duties. The judges also noted that huge platforms generate huge risk, so a bigger measuring job is not automatically unfair.
Why the Ofcom data demands stay out of public view
The companies’ first argument was that Ofcom was sidestepping the Act’s separate transparency regime. Under that regime, Ofcom can order larger “categorised” services to produce transparency reports, at most once a year, and Ofcom then publishes its own reports based on them. That regime only became possible after Ofcom published its categorisation register on June 30, 2026, and the judges said it is not yet in operation.
The court rejected the argument because the two tools have different jobs. Transparency reports exist so the public can read them. By contrast, the section 100 data is for Ofcom’s own regulatory use, and the judges said “it may well be that it could not lawfully be published.” That is the quiet trade-off in this ruling. The regulator gains a detailed, confidential dataset, while parents, researchers and creators get no new public numbers from it.
There is a limit, though. The judges added that once platforms publish information through the transparency regime, it “would be difficult if not impossible” for Ofcom to call a duplicate section 100 demand proportionate. Therefore, the two systems should eventually overlap less, not more.
The EU paperwork X once pointed to
One detail from the court record cuts against the platforms’ case. A note of an April 2025 meeting records X saying it saw nothing unduly concerning in the early draft. According to that note, part of the reason was that the draft significantly replicated requests X already faced under the equivalent EU regime. X raised its proportionality concerns later, as the detail grew.
The EU comparison deserves attention, because it shapes how heavy the Ofcom data demands really are. Large platforms already file regular moderation reports in Europe. If much of the UK request repeats that work, the extra cost should be smaller than the companies’ headline claims suggest. On the other hand, the UK notices ask for data split by age group and focused on harm to children, which is narrower and possibly harder to produce.
Where UK users and creators feel the Ofcom data demands
For ordinary users, nothing in the app changes this week; the effect is slower and indirect. Two of the six data categories cover user reports and appeals, which are the parts of moderation that people actually touch. Ofcom will now see how often reports lead to action, how long appeals take, and how many removals are reversed.
That matters to creators in particular. A creator who loses a video or account to a mistaken moderation call depends on the appeal route working quickly. Our coverage of YouTube’s 30-day lock for spam-flagged channels showed how much a platform’s appeal timing can decide a channel’s fate. With the Ofcom data demands upheld, slow or one-sided appeal systems at these three services become measurable for the first time.
Similarly, the age-group data ties into wider UK pressure on teen use, from local efforts such as Bradford’s trial limiting teenagers’ social media time to state lawsuits abroad, including New York’s case over TikTok’s Algo Refresh tool. Britain’s courts have now confirmed that its regulator can demand the underlying numbers.
Questions the judges left for another day
The ruling does not settle every question about the Ofcom data demands. The judges said the weight of possible repeat requests, and of penalties for non-compliance, in the proportionality balance is a matter “for another day,” to be considered if and when those issues arise. That leaves the “regular basis” language untested in court.
Reactions split along predictable lines. An Ofcom spokesperson said “gathering information from companies is fundamental to our ability to do our job,” as Reuters reported. Meta said it was disappointed and argued that information-gathering “of this scale goes beyond what is necessary or proportionate.” TikTok said it was considering the judgment, and X did not immediately comment.
Several separate fights remain open. Reuters noted that a ruling on Meta’s challenge to how Ofcom calculates fees and potential fines is still pending, and that Meta is also contesting how WhatsApp is categorised. Under the Act, the most serious breaches can draw fines of up to 10% of global turnover. According to The Independent, the companies must now hand over the data. Whether they appeal is the next thing to watch.
