Social media giants must provide ‘vast’ amounts of data to Ofcom, court rules

Three social media giants must provide “vast quantitative data” about moderation of harmful content including to children after losing a High Court challenge in the first legal test of the regulator’s new power to issue data requests under the Online Safety Act.

TikTok, X and Meta, which owns Instagram, Facebook and WhatsApp, took the UK communications regulator to court over requests made for data under the Online Safety Act 2023 about content moderation.

The social media companies argued the requests were unlawful, but in a written judgment on Friday Lord Justice Singh and Mrs Justice Collins Rice ruled in Ofcom’s favour and refused to quash the information notices.

The companies will now be required to provide data including on user activity by age group and moderation of harmful content to children.

The Online Safety Act made Ofcom the regulator of online safety and gave it new powers over social media companies operating in the UK.

Lawyers for the companies told a hearing earlier this month that the requests were unlawful and the most burdensome they had ever received, arguing the data would cost “millions of pounds” to collect.

But the judges said in their ruling that the social media companies had not sufficiently explained why the notices would be onerous and rejected the submission that the notices were “irrational”.

They said: “We accept Ofcom’s evidence as to the importance of the objective it pursued.”

They added: “The Online Safety Act conferred on Ofcom a substantial new regulatory function in connection with online safety, which itself had emerged from a context of acute public and political concern to make the online environment, and specifically the use of search and social media functions, a safer space for individuals in the UK, particularly children.”

The judges said it was “clear from the legislative history of the Online Safety Act that Parliament intended Ofcom to implement a new and ambitious scheme for regulating online safety”.

The companies must provide data on the total volume of user activity, data on the volume of content and accounts that have been subject to moderation, data on the exposure of users, including children, to actioned content, outcomes of appeals against actioned content and the time taken, and data on the volume and outcomes of “reports” filed by UK users.

Ofcom said the data was necessary to review codes of practice for the companies to ensure they comply with legal duties to prevent users from encountering illegal and harmful content.

It said the data would assist in assessing the scale of risk to social media users and whether the amount of harmful content is reducing.

An Ofcom spokesperson said: “We welcome the High Court’s decision to dismiss the challenges brought by Meta, X and TikTok against our efforts to gather information from them.

“Under the Online Safety Act, Parliament has charged us with the job of regulating an industry that’s been unaccountable for more than 20 years.

“Gathering information from companies is fundamental to our ability to do our job of assessing compliance with their duties, and we’ll continue to use our powers to create a safer life online for people in the UK.”

At the trial earlier this month, Javan Herberg KC, for Ofcom, said the regulator is responsible for ensuring the effectiveness of the Act, which sought to make the UK “the safest place in the world to go online”.

Victoria Wakefield KC, representing TikTok, said the notice required the company to provide “vast quantitative data” on content moderation processes across a three-year period.

In written submissions, Ms Wakefield said: “They are exceptionally onerous, and in the case of TikTok UK, Meta and X, represent either the largest, or one of the largest, production exercises required of them by any regulator.”

Amy Rogers KC, for X, said in written submissions that the request would require X “to construct and conduct complex analytic and processing operations over vast datasets”, which are not “needed or desired” for X’s own business.

She said the process would take months and lead to “serious civil and criminal consequences” if X does not respond appropriately.

In written submissions for Meta, Christopher Knight KC said Ofcom was not acting within the limits of its legal powers, and the requests for information were not proportionate.