Ofcom information notice: what a challenge needs
In short: On 30 October 2026 the High Court rejected the claims by Meta and WhatsApp, X and TikTok UK against the Ofcom information notices issued on 10 February 2026, refusing permission on most grounds and dismissing the proportionality and human rights grounds on their merits. A provider can challenge an Ofcom information notice under the Online Safety Act 2023 as disproportionate, but the court will look for evidence of the extra burden that the notice itself creates. The proportionality ground failed for want of that evidence, and the human rights ground failed for the same reasons.
A service that receives an Ofcom information notice for large volumes of data, and considers the demand too heavy, can ask the court to quash it. In refusing permission on the providers’ challenge to Ofcom’s need for the information, the High Court said that Ofcom decides what information it requires under the Online Safety Act 2023, subject to rationality review. The parties agreed that the court decides proportionality for itself, and the court decided it on evidence of the burden that each notice adds to what the provider already does. When Ofcom demands information from a telecoms provider under section 135 of the Communications Act 2003, it must meet a closely similar proportionality requirement (section 137(3)(b)).
Key points
- The High Court refused permission on Issues 1 to 7 and dismissed Issues 8 and 9, on proportionality and human rights, on their merits. Source: R (Meta Platforms Inc and WhatsApp LLC) v Office of Communications [2026] EWHC 2779 (Admin) [170].
- In refusing permission on Issue 2, the court said that whether Ofcom “requires” information is for Ofcom, and that the court asks only whether Ofcom’s view that it needs the information is rational. Source: [2026] EWHC 2779 (Admin) [57].
- The parties agreed that proportionality under section 100(4) uses the four-limb test the courts apply under the Human Rights Act 1998 and that the court decides it for itself, and the court applied the test on that basis. Source: [2026] EWHC 2779 (Admin) [131] to [132].
- The court looked for evidence of the specific and differential impact of each notice on the provider’s resources and on its current and prospective systems for meeting its duties under the Act. Source: [2026] EWHC 2779 (Admin) [138].
- The notices required data in three tranches, with deadlines of 15 June 2026, 22 September 2026 and 25 March 2027. Source: [2026] EWHC 2779 (Admin) [23].
| Requirement | Online safety notice (Online Safety Act 2023) | Telecoms notice (Communications Act 2003) |
|---|---|---|
| What Ofcom may demand | Information Ofcom require for any online safety function (s 100(1)) | Information Ofcom consider necessary for the listed functions (s 135(1)) |
| Proportionality test | Ofcom must exercise the power proportionately to the use to which the information is to be put (s 100(4)) | Ofcom may make a demand only where making it is proportionate to that use (s 137(3)(b)) |
| What the notice must say | The information, why Ofcom require it, form, timing and consequences (s 102(3)) | A description of the information and Ofcom’s reasons (s 137(3)(a)) |
| Limit on requests to find a breach | No equivalent limit in s 100 | Requests to ascertain a general condition contravention only through listed gateways (s 137(2)) |
| Court’s approach in this judgment | Rationality on need, in refusing permission ([57]); the court’s own view on proportionality, as the parties agreed ([131] to [132]) | Not decided in this judgment |
The notices and the claims
Ofcom issued information notices under section 100(1) of the Online Safety Act 2023 on 10 February 2026 to Meta and WhatsApp, X, TikTok UK and other regulated service providers. Section 100 allows Ofcom to require any information it needs to exercise, or decide whether to exercise, its online safety functions. The notices asked for data on user activity by age, content moderation, users’ exposure to content that the provider had acted on, appeals and user reports, in three tranches running from January 2024 to the end of 2026 ([22] to [23]). Ofcom said it needed the data for its monitoring and evaluation programme, for its codes of practice and for its research ([21]).
The three providers brought claims for judicial review, which the court heard on a rolled-up basis, deciding permission and the merits together. They argued that Ofcom had used the general power to avoid the limits of the transparency reporting regime in sections 77, 78 and 159, that it did not need the information, that it should have carried out an impact assessment, that it had not followed its own Online Safety Information Powers Guidance, and that the notices were disproportionate. Lord Justice Singh and Mrs Justice Collins Rice refused permission on all but the proportionality and human rights grounds, and dismissed those two on their merits ([170]).
Ofcom sets the purpose and the court tests its rationality
In refusing permission on the providers’ challenge to Ofcom’s need for the information, the court said that it is for Ofcom to decide whether it “requires” information under section 100(1). Ofcom sets out the purpose, the purpose shapes what is required, and the court asks only whether Ofcom’s assessment that it needs the information is rational ([57]). The list of purposes in section 100(6) is not exhaustive, and the power to require information for “deciding whether to exercise” a function does not depend on Ofcom having already decided to use a specific power ([70] to [71]).
The court can test proportionality under section 100(4) however broadly Ofcom states its purpose. The providers argued that, without a specific purpose, no proportionality exercise was possible. In refusing permission on Issue 2, the court rejected that argument, and said that it may be that the broader the stated purpose, the more the court may require to be persuaded that a notice is proportionate ([74]).
Proportionality depends on evidence of the extra burden
The parties agreed that the court should decide proportionality for itself, using the four-limb test from Bank Mellat v HM Treasury (No 2), and the court did so ([131] to [132]). The contest was over the last two limbs: whether a lighter notice would have done, and whether the burden outweighed the benefit ([133] to [134]). On both, the court looked for factual evidence of the specific and differential impact of each notice on the provider’s resources, systems and business model, and on its current and prospective systems for meeting its other duties under the Act ([138]).
The court did not accept that the scale of a platform, which X’s counsel emphasised, showed the extra burden of the notices. The court said that large traffic volumes create the risk Ofcom monitors, and that a new regime could be expected to ask more of the industry than it was used to ([146]). It accepted that Ofcom had sought information on burden from each provider and had worked with what it received, and that the providers had the opportunity and responsibility to address gaps in that information ([159]). It gave Ofcom a wide margin of appreciation, but did not rely on any significant degree of deference: the providers’ evidence did not identify a baseline or the differential resource impact of the notices, and could not tip the balance ([160] to [161]). The court left open how repeat requests and sanctions for non-compliance bear on proportionality ([158]). The human rights ground, brought by X and TikTok UK, failed for the same reasons ([164]).
Section 135 notices under the Communications Act 2003
Ofcom may also serve an information notice on a telecoms provider under a different statute, and the proportionality requirement there is closely similar. Under section 135(1) of the Communications Act 2003 Ofcom may require information it considers necessary for its functions under section 14(1), section 26 (so far as it relates to Chapter 1) and Chapter 1 of Part 2, and under section 137(3)(b) it may make the demand only if that is proportionate to the use to which the information is to be put. The online safety provision, section 102(3), and section 137(3)(a) both require Ofcom to describe the information and give its reasons. Under section 137(2) Ofcom may require information to find out whether a general condition has been contravened only through listed gateways, such as a complaint, a suspected contravention or an investigation Ofcom has decided to carry out. Section 100 of the Online Safety Act 2023 contains no equivalent limit.
The court did not construe section 135 or section 137, and we have found no judgment that decides a challenge to a served section 135 notice. The judgment is therefore not authority on the telecoms test. The court applied a proportionality method that the parties agreed for section 100(4), and section 137(3)(b) is in closely similar terms, although section 100(4) governs how Ofcom exercises the power and section 137(3)(b) is a condition of making the demand. On the text, Ofcom’s own judgment, subject to rationality review, also decides necessity under section 135(1) (information that Ofcom “consider necessary”), as it does under section 100(1) (information “that they require”), a reading the judgment does not test. Ofcom explains its approach to demands under the Communications Act 2003 in its General Policy on Information Gathering of 18 December 2024. For Ofcom’s remit more widely, see what Ofcom regulates.
Perspective
Ofcom’s information powers under the Online Safety Act are wide, and the court decides proportionality on the evidence the provider puts before it. The court gave weight to Ofcom’s engagement with each provider on the burden of the notices ([159]), which began in early 2025 and included a tabular assessment of each question in August 2025 ([28], [30]).
The court reserved one point for another case. It did not decide how repeated requests, or the sanctions behind a notice, bear on proportionality ([158]). Ofcom said in the notices that it intends to request the same information regularly ([21]), so the court may need to decide the point in a later case.
Frequently asked questions
Can a provider challenge an Ofcom information notice in court?
Yes, by judicial review. In [2026] EWHC 2779 (Admin) the High Court considered claims by three providers against Online Safety Act notices, granted permission only on proportionality and human rights, and dismissed both ([170]). The proportionality ground, brought by Meta and WhatsApp and X, failed because their evidence did not show the extra burden each notice created ([161] to [162]); the human rights ground, brought by X and TikTok UK, failed for the same reasons ([164]).
Who decides whether Ofcom needs the information?
Ofcom does, subject to rationality review. In refusing permission on this ground, the court said that under section 100(1) of the Online Safety Act 2023 Ofcom sets the purpose for which it requires the information, and the court asks only whether Ofcom’s assessment that it needs the information is rational ([57]).
What evidence did the court want on proportionality?
The court looked for factual evidence of the specific and differential impact of each notice on the provider’s resources and on its current and prospective systems for meeting its duties under the Act, measured against a baseline ([138], [161]). Evidence of the platform’s scale alone was not enough ([146]).
Does the judgment apply to section 135 notices to telecoms providers?
Not directly. The court decided the Online Safety Act provisions only. Section 137(3)(b) of the Communications Act 2003 is in closely similar terms to section 100(4), so the court’s approach to the evidence of burden is relevant, but we have found no judgment that decides a challenge to a served section 135 notice.
For advice on an information demand from Ofcom under the Online Safety Act 2023 or the Communications Act 2003, contact Rob Bratby at Bratby Law. Our investigations and enforcement support page covers how we work with providers on Ofcom demands and investigations.
This post was researched and drafted with the help of Claude, Anthropic’s AI model. Rob Bratby chose the topic and thesis, and reviewed and edited the final post. Rob takes full responsibility for its content.
