What do you do when you want to know how many posts people make on social media, how many of those are seen by children, how many get reported and taken down, and how fast – and you want this data broken down by age group, on an ongoing basis?
You are Ofcom, Britain's communications regulator, and you ask the platforms to hand it over, because, well, you can. And if anyone asks why, you say: we'll know it when we see it.
And if the companies ask why – the court will say, as the UK High Court did on October 30, that you don't actually have to have a reason. At least, not one you can share with the likes of Meta, WhatsApp, X, and TikTok.
"We reject the submission that there has to be a specific task that OFCOM has in mind before it can require information under s.100," Lord Justice Singh and Mrs Justice Collins Rice said in their ruling.
The February notices Ofcom sent to the four companies were not the only ones – as of February 26, 2026, the regulator had issued 197 such requests to American companies alone, seeking information about their operations in the UK.
In this case, the data Ofcom wanted was the following: user activity on each service, broken down by age group; the amount of content and accounts removed or restricted, and how fast; the number of UK users who had seen content before it was taken down, including children; the number of appeals against removals, and the outcome; and the number of reports made by users.
The four companies challenged this on several grounds, but the court rejected all of them.
One was that the data Ofcom sought was not covered by section 100 of the Online Safety Act censorship law, which the regulator was invoking. The section states that the regulator can demand "any information that they require for the purpose of exercising, or deciding whether to exercise, any of their online safety functions."
This is a very broad definition, and even includes "deciding whether to exercise" - i.e., not actually doing it, just considering it.
The same section also allows Ofcom to ask for information about "the use of a service by a named individual," and to view "in real time the operation of systems, processes or features, including functionalities and algorithms."
The notice Ofcom sent to the four companies said that the regulator expects to ask for this data "on a regular basis," and told them, "we therefore ask you to consider this as part of any data retention policies you have."
In other words, the regulator was nudging the companies to make sure they store this data, so it can be handed over when asked for.
The companies pointed out that Ofcom's own evidence described the data as "helpful" and "nice to have" – and that this was for "horizon scanning," i.e., looking for future, potential risks.
TikTok said in its submission that Ofcom "first decided that it wished to gather large quantities of data...and then sought to identify statutory functions which could provide an ostensible justification."
The court, however, saw nothing wrong with this. Instead, it found that the companies did not provide enough evidence to prove that complying with the request would be a burden.
The regulator was not required to say what it would do with the data, or why it was needed, but the companies were expected to explain, in detail, why they thought complying would be difficult.
In fact, the court said, X's estimate that it would cost "millions of pounds" and require "hundreds of hours of work across a group of ten people" was not good enough because it was not "materially further quantified, explained or contextualized."
In other words, the regulator was free to make a vague request, but the companies were expected to go into every detail to prove their case.
The double standard is evident in the way the court treated Ofcom and the companies.
The regulator did not have to have a purpose, or at least, did not have to disclose it. But the companies had to prove that complying with the request would be a burden – and their evidence was rejected as not detailed enough.
But what's striking is the amount of power the court has given to Ofcom, and the lack of detail in the reasoning behind the ruling.
Ofcom can fine companies up to 10% of their global revenue, and can block their services in the UK if they don't comply with its rules.
In September, an Ofcom executive told British peers that the regulator was "operating in a highly litigious environment" - meaning, many of its decisions end up in court.
At the time, Reclaim The Net observed that while Ofcom was making this complaint, there was a hearing in the High Court, where the regulator was trying to make sure it could get even more power - and that users whose posts get removed from social media had no seat in that courtroom.
Now, the court has given Ofcom what it wanted: the power to collect a vast amount of data from social media platforms, with no apparent limit to what it can do with it, and no obligation to explain why it wants it in the first place.
The regulator can do all this on a "regular basis," and can view data in real-time.
The four companies involved in the case are no friends of free speech, but on this particular point, they were right: a regulator should have to explain what it wants data for before it gets it.
What the High Court has given Ofcom is essentially a standing license to collect a running record of the online speech of people in Britain, broken down by age, and to do it on its own word that it might need it at some point.
There is no reason to think that the next request will not be even more extensive - and now there is nothing to stop it.
