On 2 April 2025 we published our FAQs titled “How can a regulated provider challenge a decision by Ofcom under the Online Safety Act 2023 (OSA)?”
Eighteen months later, further aspects of the OSA have been implemented and we have seen significant activity on the “enforcement” front by Ofcom, which describes itself as the most active of any international regulator in this space. We are also seeing challenges being brought by regulated services, with options for proactive litigation remaining of direct relevance to services who fall within the wide reach of the OSA. This of course unfolds against a backdrop where online safety has continued to be a focus of political and public attention.
This all means Ofcom’s ‘to do list’ shows little sign of shortening – particularly as it looks ahead to additional responsibilities including in relation to the proposed social media ban for under-16s in the UK.
In this ever-evolving landscape, we have taken the opportunity to update our FAQs which provide an overview on challenges under the OSA – see our update here.
What challenges have we seen / are we seeing under the OSA?
In Ofcom’s own words in its recent evidence on the OSA to the House of Lords Communications and Digital Committee (Ofcom’s Committee Evidence), it is “operating in a highly litigious environment.” With a number of challenges ongoing at various stages, judicial review and statutory appeals are important tools in holding Ofcom to account and clearly delineating the boundaries of Ofcom’s lawful decision-making and the legislation itself.
The first challenge under the OSA was brought by the Wikimedia Foundation which brought a judicial review claim in relation to Wikipedia's potential Category 1 status – see our previous blog post for further detail. While Wikimedia’s challenge was dismissed, the judgment included commentary which may have given the regulator food for thought in relation to how to approach categorisation. Subsequently, Ofcom confirmed in July 2026 that Wikipedia does not currently qualify as a Category 1 service (although it is on a "watch list" of services that could be reassessed in the future). The challenge serves as a helpful reminder of the potential utility in bringing challenges at an early stage of Ofcom’s decision-making.
Following on from the Wikimedia judgment, Ofcom is now subject to multiple appeals of its decisions to designate various services. These appeals will take place before the Upper Tribunal in the first instance. There are also judicial review challenges ongoing in the Administrative Court which attack aspects of the regime, including fees and charges under the OSA and Ofcom's approach to its information-gathering powers.
The challenges already before the court and Upper Tribunal highlight that there are live questions regarding the OSA to grapple with. It is unlikely that these will be the last challenges under this regime, as the landscape continues to develop at pace and regulated services look at opportunities for proactive challenge in a context where the regulator is testing the limits of its powers.
Looking ahead what might we expect from Ofcom?
Ofcom has opened 40 formal investigations over the past 18 months covering more than 100 different services and has imposed £7 million in penalties to date. Investigations are now open into a range of services, including some of the largest platforms. At the same time, Ofcom has faced obstacles in enforcement (for example, Ofcom’s Committee Evidence indicated that the majority of the £7 million in penalties have not yet been paid).
However, Ofcom’s Committee Evidence indicates its intent to “use our teeth”. It appears from that evidence that Ofcom has been seriously considering how to use the more severe enforcement powers at its disposal such as its powers regarding senior management liability. In addition, it appears to be pursuing ways to strengthen its enforcement toolkit further including how it might be able to more easily use its business disruption powers, compel the use of proactive technology by services to detect online harms before users encounter them, and also exploring what a “duty of care” obligation on services might look like.
Amidst all this, implementation of the OSA will continue and the next year (when duties on categorised services are expected to come fully into force) will be a critical period for regulated providers to assess their legal exposure, engage proactively with Ofcom, and, where necessary, consider their options for challenging particular decisions.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
