AC-2025-LON-001365 - [2025] EWHC 2086 (Admin)

The 2023 Act provides for a new regulatory framework to make the use of certain internet services safer for individuals: section 1(1). It does that by imposing duties on the providers of those services and by conferring functions and powers on Ofcom: section 1(2) and Part 7. Those powers include powers to gather information (including by way of powers of entry, inspection and audit): Chapter 4 of Part 7. The duties imposed by the Act seek to secure that such services are “safe by design” and are designed and operated in a way that protects users’ rights to freedom of expression: section 1(3)(a), (b)(ii).

One type of service that is regulated by the Act is a “user-to-user service.” That is a service by means of which content generated by one user may be encountered by another user: section 3(1). A user-to-user service is a regulated service, and a “Part 3 service”, if (subject to exceptions which do not matter for the purposes of this claim) it has a significant number of users in the United Kingdom: section 4(2), (3), (4), (5)(a) read with section 227(1)(a). With limited prescribed exceptions (such as emails and SMS messages), all user-generated content on a regulated user-to-user service is itself regulated: section 55(2).

The Act imposes duties on all regulated user-to-user services. These include duties to assess, mitigate and manage risks posed by certain types of illegal content, enabling users to report illegal content, the provision of a complaints procedure and duties to have regard to freedom of expression and privacy when implementing safety measures and policies: sections 9 – 10 and 20 – 23, read with section 59.

The Act applies additional duties to different categories of service. The most intensive duties and oversight apply to “Category 1” services. When the Bill was first introduced, it had separate provisions that were designed to protect adults from “legal but harmful” content. Those provisions were removed but were replaced by the duties that apply to “Category 1” providers. They include:

Many of the duties are couched in terms of proportionality. For example, the duty under section 17(2) to protect content of democratic importance is expressed as a “duty to operate a service using proportionate systems and processes designed to ensure that the importance of the free expression of content of democratic importance is taken into account when taking decisions about (a) how to treat such content… and (b) whether to take action against a user generating… such content.”

However, not all duties are couched in terms of proportionality. One which is not, and about which the first claimant is particularly concerned, is a duty to enable users to filter out content from non-verified users – see section 15(1), (9) and (10):

“15 User empowerment duties

(1)

This section sets out the duties to empower adult users which apply in relation to Category 1 services.

…

(9)

A duty to include in a service features which adult users may use or apply if they wish to filter out non-verified users.

(10)

The features referred to in subsection (9) are those which, if used or applied by a user, result in the use by the service of systems or processes designed to effectively—

(a)

prevent non-verified users from interacting with content which that user generates, uploads or shares on the service, and

(b)

reduce the likelihood of that user encountering content which non-verified users generate, upload or share on the service.”

The Secretary of State has the power to exempt content or services from the Act, including a power to provide for a description of user-to-user service to be exempt if the Secretary of State considers that the risk of harm is low: section 220(4).

Ofcom is required to prepare Codes of Practice which set out the measures that providers may take to comply with certain Category 1 duties: section 41. In doing so, it must consult persons with expertise in the right to freedom of expression: section 41(6)(f)(i). Category 1 duties do not apply until the applicable Code of Practice is in force: section 51. The measures prescribed by the Codes of Practice must be proportionate and technically feasible: paragraph 1 of schedule 4. They must incorporate safeguards for freedom of expression and privacy: paragraph 10 of schedule 4. If a service provider complies with the applicable Code of Practice they are deemed to have complied with the statutory duty: section 49(1). Ofcom must publish guidance in respect of those Category 1 duties which are not subject to a Code of Practice: section 52.

Ms Rowland says that Category 1 duties are aimed at securing freedom of expression by protecting certain types of content that are important to public discourse and securing that services are transparent and accountable. They are intended to apply to a range of different kinds of service, but the impact of the duties will vary. Thus, if a service does not host advertising it may not need to take any measures to protect users from fraudulent advertising.

The Act prescribes an elaborate step-by-step process for the making of regulations that specify the Category 1 threshold conditions and, thereafter, their implementation: sections 94 – 95 and schedule 11.

First, within six months of the Act coming into force, Ofcom was required to carry out research into (a) how easily, quickly and widely regulated user-generated content is disseminated by means of regulated user-to-user services, (b) the number of users and functionalities of the user-to-user part of such services, and (c) such other characteristics of that part of such services or factors relating to that part of such services as Ofcom considered to be relevant to specifying the Category 1 threshold conditions: schedule 11, paragraph 2(2). The concept of easy, quick and wide dissemination of regulated user-generated content by means of regulated user-to-user services may be seen as a codification of the well-known concept of user-generated content (particularly on social media) “going viral”. For shorthand, I will refer to this as “viral dissemination”. A “functionality” is a feature that enables interactions of any description between users, including, for example, features that enable users to create a profile or search for user-generated content or share content with others: section 233.

Second, Ofcom must then provide the Secretary of State with advice based on that research as to the provision which Ofcom consider it is appropriate for regulations prescribing the Category 1 conditions to make: schedule 11, paragraph 2(5).

Third, as soon as reasonably practicable after the provision of that advice, Ofcom must publish the advice: schedule 11, paragraph 2(7).

Fourth, as soon as reasonably practicable after the provision of that advice, the Secretary of State is required to lay a draft of the statutory instrument containing the proposed regulations before each House of Parliament: schedule 11, paragraph 2(7), and section 225(8).

Fifth, the Secretary of State is then required to make “the first regulations” under paragraph 1(1) of schedule 11: schedule 11, paragraph 2(7).

Sixth, Ofcom is then required to establish a register of Category 1 services as soon as is reasonably practicable: section 95(1).

Seventh, Ofcom is then required to publish Codes of Practice and guidance about the duties owed by providers under the Act, including duties owed by Category 1 providers: Chapter 6 of Part 3.

Eighth, from the point that the first regulations are made, Ofcom may conduct further research, whether on its own initiative or at the request of the Secretary of State, to assess whether to amend the regulations: schedule 11, paragraphs 3(1), (4).

The regulations that specify the conditions for qualifying as a Category 1 service must relate to (a) the number of users of the user-to-user part of the service, (b) functionalities of that part of the service, and (c) any other characteristics of that part of the service or factors relating to that part of the service that the Secretary of State considers relevant: schedule 11, paragraph 1(1). The regulations must specify the ways in which the Category 1 threshold conditions may be met, and they must provide that at least one specified condition about number of users or functionality must be met: schedule 11, paragraph 1(4).

Schedule 11, paragraph 1(5) is the foundation for the claimant’s first ground of claim. It states:

“In making [the] regulations… the Secretary of State must take into account the likely impact of the number of users of the user-to-user part of the service, and its functionalities, on how easily, quickly and widely regulated user-generated content is disseminated by means of the service.”