In Wikimedia Foundation v Secretary of State for Science, Innovation and Technology [2025] EWHC 2086 (Admin), the Administrative Court handed down its first judgment in a judicial review claim relating to the Online Safety Act 2023 (the "Act"). The claim, which was dismissed, challenged a regulation1 made under the Act which sets the conditions for an online service to be designated as "Category 1" ("Regulation 3"). Category 1 services will be subject to the most intensive duties imposed by the Act and the claimants argued this designation would have a significant adverse impact on Wikipedia.
Key points:
- The judgment raises important questions about how online platforms are categorised under the Act.
- Commentary and evidence in the decision offer insight into the complexities faced by the regulator (Ofcom) and the Secretary of State ("SoS") when regulating online safety, and the level of scrutiny the court will apply to decisions made in this context.
- The judgment also highlights the tension of balancing online safety with fundamental rights (see here for our related discussion on this).
- While the court upheld the SoS's decision to make Regulation 3, it left open the possibility of future challenges particularly if Ofcom determines that Wikipedia is a Category 1 service and the resulting obligations prove disproportionate.
Background
The Act imposes duties on certain providers of "user-to-user" services, with the intensity of obligations varying by how a service is categorised. Category 1 services face the most onerous duties including duties regarding user empowerment tools (e.g. filtering content from non-verified users), protecting freedom of expression and transparency reporting.
The Act prescribes what the court called an "elaborate" process for the SoS to make regulations that set out the threshold conditions for a Category 1 designation (and implementation thereafter). This process included Ofcom providing advice to the SoS on the conditions for Category 1 designations, based on research into viral dissemination and functionalities of services.
Following this process, the SoS made Regulation 3. This sets out that the conditions for a Category 1 designation are if a service:
- has an average number of monthly active UK users that exceed 34 million and uses a "content recommender system" (as defined); or
- has an average number of monthly active UK users that exceeds 7 million, uses a "content recommender system", and provides a functionality for users to forward or share regulated user-generated content.
Following the making of Regulation 3, Ofcom issued information notices to services it considers might meet the Category 1 conditions, including Wikipedia. The next step is for Ofcom identify which services in fact fall within the scope of Regulation 3.
The legal challenge
The claim was brought by the Wikimedia Foundation and a long-standing Wikipedia editor. Wikipedia is a free, non-profit, collaboratively edited encyclopaedia. The judgment outlined that while "viral dissemination is not a concept that obviously applies to Wikipedia", certain of Wikipedia's features could technically qualify as a "content recommender system" under Regulation 3 (depending on how the regulation is interpreted). Uncontested evidence from the claimants highlighted the "huge challenges" that Category 1 duties would pose to Wikipedia. These duties would require the platform to build new systems and tools, requiring significant resources. The alternative, to ensure it did not fall within Category 1, would potentially force Wikipedia to restrict user access by three quarters or remove core functionalities. Johnson J summarised the unchallenged evidence as showing that Wikipedia is a tool that provides significant value for freedom of speech and expression, without giving rise to any substantial threat to relevant public interests.
The claim was heard on an expedited basis due to its potential to delay the implementation of the Act (with the questions on both permission and the substantive decision on each ground of the claim being considered at the same time).
The judgment considered four separate grounds of challenge:
- Failure to comply with statutory duty under the Act: The claimants argued that the SoS failed to comply with paragraph 1(5) of Schedule 11 of the Act. This requires the SoS in making Regulation 3 to take into account the likely impact of user numbers and functionalities on viral dissemination. The claimants argued that Ofcom's advice (and the SoS's acceptance of it) wrongly assumed that all recommender systems and forward/share functionalities are always integral to an online service, and that they inter-operate to cause viral dissemination. This disregarded services like Wikipedia where such features are ancillary and do not give rise to the risk of viral dissemination.
- Irrationality: The claimants argued that the SoS's decision was based on flawed logic as Regulation 3 captures services with minimal risk of viral dissemination. They also argued that the SoS had failed to consider relevant metrics such as time spent on the platform.
- Incompatibility with articles 8, 10 and 11 of the European Convention on Human Rights ("ECHR") as incorporated by the Human Rights Act 1998: The claimants argued that applying Category 1 duties to Wikipedia would interfere with their rights to privacy, freedom of expression, and freedom of association under Articles 8, 10 and 11 of the ECHR respectively.
- Discrimination under article 14 of the ECHR: The claimants argued that treating Wikipedia in the same way as social media platforms i.e. taking a blanket approach that fails to distinguish between different types of online provider, was discriminatory.
Judgment
Grounds 1 and 2: Alleged failure to comply with statutory duty and irrationality
Permission was granted on these grounds but both were ultimately dismissed.
The court's decision on these grounds relied heavily on the steps taken by Ofcom and the SoS, and content of the advice provided/considered. It found that Ofcom's advice was based on closely researched analysis as to the criteria that would broadly capture services that give rise to viral dissemination. Ofcom had acknowledged limitations in its data on different recommender systems and advised officials that "it would be extremely difficult to make robust regulations that differentiated between different types of service". This advice had been understood to be general in nature by the SoS who was aware of the complexities and the possibility that the advice might produce unintended outcomes. Officials had explored options to exclude "outlier" services like Wikipedia but concluded that doing so without further research risked creating loopholes.
In this context, the court found that the SoS had complied with its statutory duty under Schedule 11, paragraph 1(5) of the Act, despite acknowledging that it was "no doubt correct that the SoS did not consider all the different ways in which content recommender systems (or forward and share functionalities) might operate, and the impact which each different mode of operation might have on content dissemination". The court held that the duty under paragraph 1(5) was pitched at a high level of generality and that it was "unclear how the SoS could in practice... undertake anything other than the high level and general assessment that is required."
On irrationality, the court acknowledged the "highly complex and technical policy area which requires difficult evaluative regulatory assessments" and the impossibility of knowing the precise impact on individual services, but emphasised that this does not immunise the decision from the court's review. It gave weight to the involvement of the regulator and officials, and noted that although the criteria were not perfect, both Ofcom and the SoS appreciated that they were not perfect and no better alternative formulation had been proposed by the claimants. In addition, Parliament had opted for the legislation to provide for objective criteria rather than bespoke determinations and it was relevant that there was an opportunity to amend the regulation, or to exempt particular types of service, if it turned out that the regulation had undesirable consequences.
Grounds 3 and 4: ECHR rights and discrimination
Permission was refused on both grounds.
The court held that the claimants had not shown they were "victims", which is a requirement for bringing a challenge based on ECHR rights. They had not positively argued that Wikipedia was captured by Regulation 3, nor had they asked the court to determine that question, preferring instead to leave the question for Ofcom to determine in due course. On the evidence Johnson J did not accept that it was "likely" that Wikipedia was a Category 1 service.
However, the court acknowledged the "powerful case" advanced by the claimants that applying Category 1 duties to Wikipedia could be incompatible with "at least" Article 10. It noted that there may be more than one way to interpret Regulation 3 compatibly with ECHR rights, potentially excluding Wikipedia. Ultimately, if services are included that the SoS considers should not be included, it is open to the SoS to amend the regulations. The court went so far as to say that "arguably, the SoS would be under a statutory duty to do so if that were necessary to avoid a breach of Convention rights".
On discrimination, the court found no evidence that the legislation was intended to target only profit-making entities. The regulatory framework applies broadly to services that influence public discourse.
Comment
The judgment provides insight into the process undertaken by Ofcom and the SoS in making Regulation 3, and the constraints posed by the legislative framework and the information available to the regulator regarding different systems operated by different services.
Importantly, the judgment does not determine whether Wikipedia is a Category 1 service. That decision lies with Ofcom, which must now interpret Regulation 3 compatibly with ECHR rights and establish a register of Category 1 services. Indeed, the judgment provides the regulator with food for thought, setting out questions or issues that Ofcom will need to grapple with when interpretating the conditions set out in Regulation 3 and the definition of a "content recommender system". Johnson J stressed that this decision "does not give Ofcom and the SoS a green light to implement a regime that would significantly impede Wikipedia's operations".
While the claim was dismissed, the judgment therefore leaves open the possibility of future legal challenges such as under Article 10 of the ECHR, particularly if Ofcom determines that Wikipedia is in scope and the resulting obligations prove disproportionate. It is also notable that the SoS retains the power to exempt services from the Act if the risk of harm is low.
For other user-to-user services, this case underscores the importance of engaging with Ofcom as it considers categorisation. This is particularly the case in light of other recent developments under the Act. These include Ofcom's investigations into compliance with age assurance rules for pornographic content and the forthcoming regulations regarding "super-complaints"2which are due to come into force on 31 December 2025. These regulations are designed to enable eligible entities to raise systemic concerns about regulated services directly with Ofcom and could result in further enforcement activity by the regulator. For more tips on engaging with regulators, see here.
Footnotes
1. Regulation 3 of the Online Safety Act 2023 (Category 1, Category 2A and Category 2B Threshold Conditions) Regulations 2025.
2. Online Safety Super-Complaints (Eligibility and Procedural Matters) Regulations 2025
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
