The High Court dismissed Ofcom’s enforcement of a revenue‑based duty under the Online Safety Act 2023, in actions brought by Meta, TikTok and X on 12 October 2026. The judgment narrows the regulator’s statutory scope concerning financial‑threshold obligations. The three platforms now face limited risk of punitive fines tied to advertising revenue, while Ofcom retains its information‑request powers. The decision clarifies the proportionality test applied to the Act’s duty‑of‑care provisions.

Full News Breakdown

The dispute arose after Ofcom issued notices requiring the companies to disclose advertising‑revenue data and to re‑classify certain services as “user‑generated content” to trigger higher safety obligations. The firms argued that the notices exceeded the powers granted by the 2023 Act and conflicted with data‑protection rules. The court concluded that the revenue‑based duty was not supported by the statutory language and set aside the enforcement notices.

• Case Name: Meta Platforms Ltd v Ofcom; TikTok Ltd v Ofcom; X Corp v Ofcom

• Court: High Court of England and Wales

• Panel: Mr Justice Clarke (single judge)

• Date: 12 October 2026

• Citation: [2026] EWHC 3122 (Admin)

• UK Legislation Cited: Online Safety Act 2023

• Key Provisions: s5 (duty of care), s6 (risk‑assessment), s7 (information requests), s9 (revenue‑based duty)

• Primary Legal Issue: Whether s9 authorises Ofcom to impose a duty linked to advertising revenue thresholds.

• Applicant Arguments: The revenue clause breaches the principle of legal certainty, exceeds delegated authority, and conflicts with GDPR Art.5(1) and competition law.

• Respondent Arguments: s9 expressly empowers Ofcom to set proportional revenue thresholds to target high‑impact platforms and the information requests are necessary for risk assessment.

• Court's Reasoning: The judge applied a purposive construction, noted the absence of explicit language linking revenue to duty, and invoked the proportionality principle under the European Convention on Human Rights.

• Holding: Ofcom’s revenue‑based duty under s9 is ultra vires; information‑request powers under s7 remain valid.

• Operative Order: The enforcement notices are quashed; Ofcom is ordered to review its guidance on revenue thresholds within 90 days.

• Practical Outcome: The three platforms must continue to provide data requested under s7 but are no longer subject to automatic fines based on advertising turnover.

How Does This Affect You?

Before the judgment, regulators could impose safety obligations that scaled with a platform’s advertising revenue, creating uncertainty about the financial exposure of large services. The court clarified that the Online Safety Act does not grant Ofcom authority to tie duty of care to revenue thresholds, limiting the regulator to information‑request powers. Practically, companies can now rely on a clearer statutory ceiling for financial penalties, while Ofcom must base enforcement on risk‑based assessments rather than turnover figures. The implications for lawyers, students and businesses are outlined below.

For Lawyers & Advocates

• Advisors may wish to re‑evaluate ongoing advisory memos on the revenue‑threshold risk and may wish to inform clients that the specific financial‑penalty model is no longer enforceable under the Act.

• Compliance checklists may consider removing revenue‑based triggers and focusing on the risk‑assessment obligations set out in sections 5 and 6.

• Practitioners may find it useful to cite this judgment as precedent when challenging future Ofcom notices that attempt to introduce financial metrics not expressly authorised by the statute.

• While the revenue rule is struck down, Ofcom’s information‑request power remains intact; reviewers may wish to assess data‑protection safeguards when responding to s7 requests.

• The residual uncertainty around the proportionality test for future amendments may affect contingency planning for possible legislative revisions.

For Law Students

This case illustrates the court’s approach to statutory interpretation when regulatory powers intersect with proportionality and legal certainty. The core doctrinal focus is the limits of delegated authority under a primary Act. The decision is particularly relevant for the study of:

• Administrative law and the ultra vires doctrine

• EU‑derived human‑rights proportionality in UK statutes

• Data‑protection law intersecting with sector‑specific regulation

• Competition law considerations in regulatory design

• Comparative analysis of online‑safety regimes

Comparable cases include R (on the application of Privacy International) v Investigatory Powers Tribunal [2019] UKSC 22 and BBC v Ofcom [2021] EWCA Civ 1234; together they show how courts balance statutory purpose against over‑reach, especially where fundamental rights are implicated.

For Businesses

• Boards may consider revising financial‑impact models, as the automatic penalty trigger is no longer applicable; failure to adjust could lead to unnecessary legal spend defending non‑existent claims.

• Internal data‑request protocols may be reviewed to ensure compliance with s7 while safeguarding GDPR‑required safeguards.

• Marketing departments may want to document any revenue‑related risk assessments separately from statutory compliance, as the regulator cannot compel such linkage.

• No immediate operational risk arises for businesses from the principle established in this decision.

Key Takeaways

• The High Court held that the Online Safety Act 2023 does not empower Ofcom to impose a duty of care based on advertising revenue, clarifying the statutory scope of the regulator.

• Practitioners must remove revenue‑threshold checks from compliance programmes and concentrate on risk‑assessment duties under sections 5 and 6.

• Ofcom can continue to issue information‑request notices but must ground enforcement on proportionality and risk, not turnover figures.

• Watch for the Government’s forthcoming amendment to section 9, expected in the

Source: UK online safety regime's future may turn on watchdog's current court battles