Britain's High Court upheld Ofcom's power to demand three years of content-moderation data from Meta, WhatsApp, TikTok and X, rejecting arguments that the regulator must name a specific investigation before issuing sweeping information notices under the Online Safety Act.
The judicial review, heard in October and published on 30 October, is the first to test how far Ofcom can reach into platform logs before deciding whether to open a formal case or rewrite its codes of practice. The companies asked judges to require Ofcom to spell out exactly how each data field would be used. The court declined, ruling that broad purposes such as research into online safety and reviewing rulebooks were lawful under Section 100 of the act.
What the notices demanded
Ofcom's February orders sought figures stretching back to January 2024, before several platform duties took effect. The list included counts of moderated posts, response times, British user exposure—including children—to harmful material, outcomes of user reports, and appeal results. Witness statements filed during litigation explained field-by-field uses, and judges said reissuing narrower notices would make no practical difference because the regulator had already documented its reasoning.
Platforms argued that without a defined project, the requests amounted to fishing. The court answered that Parliament intended Ofcom to gather evidence both to exercise existing powers and to decide whether new ones were needed. That distinction matters for future sectors beyond social video: any company designated under the act faces similar exposure if Ofcom believes aggregate data could inform safety policy.
Implications for compliance teams
UK-based policy staff at the named firms must now preserve historical moderation metrics in formats suitable for regulatory export. Engineering teams that previously treated moderation dashboards as internal-only must align retention schedules with Ofcom's lookback windows. Privacy officers will weigh the ruling against UK GDPR minimisation principles; the court did not strike the notices on privacy grounds, placing the burden on firms to challenge specific fields in future disputes rather than the framework itself.
October's judgment is the first judicial review of Ofcom's information powers under the Online Safety Act.What comes next in Whitehall
Ofcom can cite the victory when issuing similar notices to smaller platforms entering the regulator's risk register. Parliament's Science, Innovation and Technology Committee may still call for clearer statutory limits, but until legislation changes, compliance budgets will treat moderation telemetry as reportable on demand. For British users, the near-term effect is indirect: regulators gain better baselines to judge whether safety codes work, while platforms continue moderating under existing terms of service.
Smaller platforms awaiting Ofcom risk classification will read the judgment as precedent. Messaging apps with encryption features argued that moderation metrics cannot be exported in the same format as public posts; the court did not carve out that exception. Legal teams are therefore mapping which statistical categories can be produced from encrypted systems without breaking product architecture promises.