Ofcom has decided that two of the planet’s most-used messaging apps deserve a spot on a list. Apple’s iMessage and Meta’s Messenger now sit on the UK speech regulator’s roll of “emerging Category 1 services,” a label that sounds bureaucratic and harmless right up until you read what Category 1 actually demands.
The Online Safety Act sorts regulated services into tiers, and Category 1 is the top shelf, reserved for the largest platforms and stacked with the heaviest obligations.
Ofcom’s freshly published register hands full Category 1 status to eleven services. Facebook, Instagram, Pinterest, Quora, Reddit, Roblox, Snapchat, TikTok, WhatsApp, X, and YouTube all made the top tier. iMessage and Messenger didn’t make that cut. They landed on the emerging list instead, next to Threads and Wikipedia, which means they sit close to the threshold and can be reclassified whenever Ofcom fancies another look.
An emerging Category 1 service, by Ofcom’s own account, need not actually resemble a Category 1 service. The regulator’s FAQ says apps can be listed “because they have a large UK user base,” even if they lack the “relevant functionalities and characteristics required.” The definition folds in on itself. A service gets flagged as nearly-Category-1 while missing the exact features that would qualify it as Category 1 in the first place.
What waits at the top of that ladder is what should worry anyone who likes sending a message without first surrendering a passport. Category 1 services can be required to offer users optional identity verification.
Ofcom leans on the word “optional” as though it ends the debate. It doesn’t. The Wikimedia Foundation already exposed the flaw. Combine optional ID checks with the parallel duty to let users block anyone who hasn’t verified, and you get a trap.
On Wikipedia, editors could block every unverified user from touching content they post, which would herd volunteers toward verifying their identities just to keep doing unpaid work. The same trap fits other collaborative platforms. Apply the logic to X, and users could block unverified accounts from adding or editing Community Notes on their posts.
Identity checks are only the opening act. Category 1 platforms also have to assess how likely adult users are to run into content that is perfectly legal yet officially unwelcome.
The Act’s definition of this “relevant content” covers material that is “abusive” on the grounds of “race,” “religion,” “sex,” “sexual orientation,” “disability,” or “gender reassignment,” along with content that “incites hatred against people…of a particular race, religion, sex or sexual orientation.” Lawful speech, catalogued and risk-assessed by order of the state.
From there the duties multiply, adding optional tools to filter that legal content, an enhanced complaints system, and consistent enforcement of terms of service.
Then, with a straight face, the Act asks these platforms to publish assessments of how all this safety machinery affects users’ freedom of expression and privacy. A regime that mandates identity verification and speech monitoring now wants the companies carrying out that work to grade their own damage to free expression.
Wikimedia dragged Ofcom’s categorization rules into court in 2025, warning they stretched wide enough to rope in a nonprofit encyclopedia. The High Court dismissed the case in August 2025, though the judge left a door ajar, saying Wikimedia could return if Ofcom “(impermissibly) concludes that Wikipedia is a Category 1 service.”
He added that the ruling “does not give Ofcom and the Secretary of State a green light to implement a regime that would significantly impede Wikipedia’s operations.”
On July 10, 2026, Ofcom told Wikimedia that Wikipedia is not, for now, a Category 1 service. The reprieve arrived with Wikipedia parked on the same watch list as iMessage and Messenger.
Wikimedia described that roster as a “‘watch list’ of platforms that do not currently qualify as Category 1 services, but that could become Category 1 at any point in the future, should Ofcom choose to reassess its decision.”
The clock is already running for everyone named on these lists. Services on the full register get one month to appeal to the Upper Tribunal, and lodging an appeal suspends the relevant duties until the case resolves. Services on the emerging list get three months to bring a judicial review to the High Court.
For now, iMessage and Messenger carry no extra obligations. They sit on a government list, waiting to learn whether their own popularity becomes the reason a regulator asks for your identity before you say hello.
