How can a regulated provider challenge a decision taken by Ofcom under the Online Safety Act?

The implementation of the Online Safety Act (OSA) is gathering pace and 2025 is the year we can expect to see real action from Ofcom. Services potentially within the scope of the OSA may have already raised concerns with Ofcom at various junctures – such as when responding to a consultation or at specific opportunities to engage with the regulator. Whilst this is useful to address any concerns upfront and mitigate issues later down the line, it is essential for regulated providers (and those service providers who may be deemed to be in scope) to understand the options for challenging decisions or enforcement action taken by Ofcom.

At the heart of this are public law principles which (i) underpin how Ofcom should act and take decisions, and (ii) govern the grounds for any potential challenge.

In this chapter, we address key questions from a public law perspective to help you navigate what enforcement and challenges might look like under the OSA. In addition, we set out some top tips on engaging with Ofcom.

What decisions can be challenged under the OSA?

There will be numerous decisions taken by Ofcom in relation to the implementation of the OSA that could be open to challenge. For example, Ofcom's pending decision on the designation of in-scope services and its publication of the register of categorised services will apply significantly more stringent requirements to companies with a higher categorisation – and some regulated providers may disagree with the categorisation ultimately decided upon. It is worth noting that where certain decisions relating to the categorisation register are appealed, a regulated provider need not comply with specified duties relating to that categorisation until the determination or withdrawal of the appeal.

Relevant decisions or actions taken by other public bodies can also be challenged, such as the secondary legislation that governs categorisation.

In addition, with further obligations on services becoming enforceable in 2025, it is likely we will see more and more enforcement action initiated by Ofcom if it considers a regulated provider has failed to comply with its obligations under the OSA, which may also be challenged. Notably, Ofcom has already launched an enforcement programme and issued information notices in relation to illegal content risk assessments.

See our blog on Forecasting disputes under the Online Safety Act: what can we learn from proceedings under the Digital Services Act to date? for further detail.

What are the potential routes for challenge?

Under the OSA, certain Ofcom decisions can be appealed to the Upper Tribunal, including determinations related to the categorisation of services, confirmation decisions (i.e. decisions that there has been a contravention of the OSA) and penalty notices.

Challenges to all other decisions taken by Ofcom (or by other relevant public bodies in relation to the OSA eg secondary legislation), would mostly take the form of a 'judicial review' claim. This is a specific type of claim to be brought in the High Court which has its own rules on procedure (see 'What does a judicial review challenge look like and how is it different to a 'typical' High Court claim?' below).

Judicial review is concerned with the legality of the decision-making process and ultimate decision, rather than being an appeal on the merits against the original decision. Public law principles inform the grounds for any judicial review claim and the Upper Tribunal must apply those same principles in the appeals under the OSA mentioned above.

We explain these principles below and further information can also be found in our briefing under the section, Public law tips for engaging with Ofcom in consultation and other interactions.

What substantive grounds of challenge can you raise?

Three key public law principles which also form the main grounds for judicial review are 1) illegality, 2) irrationality/unreasonableness and 3) procedural unfairness. The first two grounds relate to 'substantive' concerns, whereas the third ground is procedural.

In relation to 'substantive' concerns, regulated providers may have complaints about the content of the codes and duties they must navigate and comply with or the substantive basis upon which Ofcom has taken an enforcement decision. This might include arguments relating to the proportionality of the measures in place or decision taken.

Click on the drop down headings below for further information on substantive grounds for challenge

What procedural concerns could be raised?

There are a range of process points that can be raised, including consultations (see below) and the fairness of the decision-making process.

Consultations are a key potential area of challenge. The requirements of an adequate and fair consultation depend on the specific context, but the key criteria are that:

For further detail, see our briefing guide on engaging with Ofcom.

It is worth noting that Ofcom's enforcement guidance sets out the procedure for investigations and enforcement processes in detail, including as to publicity at different stages, and when Ofcom might seek to use business disruption measures and the process for doing so. This guidance explains that procedural concerns/complaints relating to Ofcom investigations (such as deadlines for responding to information notices or issues relating to confidential information) can be raised with a Procedural Officer, who should be an independent member of Ofcom staff. The Procedural Officer will then make a decision in a fairly short timeframe, which is stated to be binding on both the complainant and the Ofcom investigation team/decision makers. The timeframe for raising a complaint with the Procedural Officer is extremely short – just five working days. Regulated providers subject to an investigation/information gathering process should bear this in mind and be prepared to move quickly to protect their position.

What does a judicial review challenge look like and how is it different to a 'typical' High Court claim?

A judicial review challenge, unlike private law proceedings, focuses on the legality and fairness of decisions by public bodies, rather than determining facts or resolving disputes between private parties. As set out above, it is not an appeal on the merits.  

Key differences include:

1. strict time limits to bring a challenge which require that challenges must be brought promptly and in any event within three months of a decision being made (with the emphasis on promptness meaning that sometimes proceedings must be launched within a matter of weeks);
2. there is a 'two stage' process in which the Court will first decide (typically on the papers) whether or not to grant the claim 'permission' to proceed to the second stage of a detailed defence and substantive hearing;
3. there is not usually live evidence/cross examination of witnesses or a lengthy disclosure process;
4. other appeal routes must be exhausted first as judicial review is a remedy of last resort;
5. for providers considering a challenge, it is worth noting that judicial review often requires the frontloading of evidence at the outset of a case. This might include considering whether expert evidence should be prepared in support of any challenge.

Typically in a judicial review, the court will assess the decision-maker's decision by reference to the information that it had before it at the time of making the decision. Therefore, it is worth putting time and effort into ensuring the strongest points and supporting evidence are put before Ofcom at the earliest possible stage (eg during consultation or when responding to an information notice), as it can be difficult to challenge decisions later using material that was not before the decision maker at the time of the final decision. For practical tips on engaging with regulators during consultation processes, see our briefing guide.

Note that appeals in the Upper Tribunal would be subject to their own procedure – for example, some appeals under the OSA may require the Upper Tribunal to give permission (or leave) for the appeal to be brought.

Who can bring a challenge?

In judicial review, there are specific rules on standing which differ depending on the route for challenge and the grounds of challenge.

Click on the drop down headings below for further information

What can be achieved through a challenge?

For successful judicial review claims, remedies are discretionary and will generally involve the quashing of the regulator's decision for it to be re-made. Damages are usually only available for a breach of the Human Rights Act.

In the Upper Tribunal, the tribunal can decide to dismiss the appeal or quash the decision challenged. If a decision is quashed, the tribunal will remit the decision to Ofcom for reconsideration with any directions that the tribunal considers appropriate.

Aside from the formal remedies available following a successful challenge, there are various other strategic considerations that may lead a service provider to consider bringing a challenge.

Is there anything else I should be thinking about when engaging with regulators?

When interacting with regulators you will obviously want to put your 'best foot forward', however, it is important to also be mindful of the risks when providing information to public bodies, like Ofcom.

Click on the drop down headings below for further information.