From Wikimedia to the wider web: What the High Court’s judgment means for the Online Safety Act 2023

On 11 August 2025, the High Court handed down its decision in Wikimedia Foundation and Another v Secretary of State for Science, Innovation and Technology ([2025] EWHC 2086 (Admin)).

This case marks one of the first significant legal challenges to the Online Safety Act 2023 (“OSA 2023”), a statute that has already provoked widespread debate among online service providers (“OSPs”), civil society and regulators.

The claimants argued that the statutory framework for designating Category 1 services risked capturing Wikipedia, a non-profit collaborative online encyclopaedia, within the same onerous regulatory category as large commercial social media platforms.

Under the OSA 2023, regulated services are grouped by scale and function. Category 1 applies to the largest user-to-user services, Category 2A to the largest search services, and Category 2B to smaller but still regulated user-to-user services. Category 1 attracts the most stringent obligations under the OSA 2023, including extensive risk assessments, detailed transparency reporting, robust user empowerment tools, and proactive systems to address both illegal and harmful content.

While these categories aim to focus regulation on the highest risk services, the Wikimedia case demonstrates how their application can give rise to several public law issues.

The judgment

The pivotal passage of the judgment makes clear that Ofcom and the Secretary of State do not have a “green light” to implement a regime that would significantly impede Wikipedia’s operations without a proportionate justification. As the Court stressed:

“If they were to do so, that would have to be justified as proportionate if it were not to amount to a breach of the right to freedom of expression under article 10 of the Convention (and, potentially, a breach also of articles 8 and 11). It is, however, premature to rule on that now. Neither party has sought a ruling as to whether Wikipedia is a Category 1 service. Both parties say that decision must, for the moment, be left to Ofcom… Ofcom’s decision as to which services fall within Category 1 is a public law decision which is potentially amenable to the court’s review on grounds of public law error (including incompatibility with a Convention right).”[1]

This statement is important for two reasons:

1. It affirms that Category 1 designation decisions are public law acts, meaning they are open to judicial review if flawed in process, substance or incompatible with human rights;
2. It frames proportionality (which itself is a hard to define legal concept) as a decisive legal standard for assessing future Ofcom decisions.

Ofcom’s designation powers

The judgment provides judicial confirmation of concerns long voiced by OSPs: Ofcom’s discretion under the OSA 2023, particularly in relation to Category 1 designation, is extensive and potentially unpredictable. Category 1 status triggers the most demanding compliance duties, and if the designation process is applied inconsistently or without regard to an OSP’s function, it risks capturing OSPs that were never the intended targets of the Act.

Wikimedia’s challenge was prompted in part by the risk that Category 1 compliance duties could undermine Wikipedia’s model of anonymous volunteer editing. While the Act does not expressly require OSPs to disclose contributor identities to Ofcom, the regulator’s powers to issue information notices and set detailed requirements through codes of practice mean that, in practice, a service could be compelled to provide identifying information about its content creators in order to demonstrate compliance.

For Wikipedia, whose editors often contribute anonymously, such demands would conflict with core operational principles. Wikimedia has publicly indicated that this could force it either to compromise contributor anonymity or, if that is incompatible with its mission, to block or restrict access to the site in the UK altogether.[2]

The Court’s emphasis on proportionality means Ofcom should ensure regulation corresponds to the actual nature and risk of a service. A commercial social network that promotes viral content poses different risks from a non-profit online encyclopaedia like Wikipedia. Treating both the same could be disproportionate, and open to challenge on public law or human rights grounds.

Freedom of expression

The Wikimedia case crystallises concerns about the OSA’s impact on lawful speech. Wikipedia, by design, facilitates the collaborative creation of factual, sourced articles. Subjecting it to the same duties as platforms that algorithmically amplify viral content risks undermining the free exchange of knowledge, a consequence the Court signalled would require strong justification under Article 10 ECHR.

This aligns with broader criticisms of the OSA’s vague definitions of “harmful content” and the chilling effect of over-moderation. Since the child safety duties in the OSA 2023 took effect on 25 July 2025, there have been reports of over-censorship, including blocked access to support pages for addiction and child abuse survivors, as well as conflict-related content about the humanitarian crisis in Gaza and the war in Ukraine.[3]

The concern is that, in seeking to avoid liability, platforms may remove or restrict lawful but contentious material, to the detriment of public debate.

Privacy and compliance risks

While the Court did not rule directly on privacy-related obligations, its proportionality analysis is equally relevant to them. Category 1 duties can require intrusive measures, such as robust age verification, content scanning, and detailed algorithmic impact assessments.

Each of these measures engages the UK GDPR, particularly the principles of data minimisation and purpose limitation and could be vulnerable to challenge if imposed without clear necessity.[4]

For example, age assurance systems relying on biometric data or official identification risk excessive data collection and heightened cybersecurity vulnerabilities. Similarly, proactive monitoring obligations could undermine end-to-end encryption, raising concerns under both Article 8 ECHR and data protection law.[5]

Conclusion

The Wikimedia judgment is best understood as a warning shot. Although the question of Category 1 designation remains unresolved, the judgment makes clear that compliance with fundamental rights, adherence to proportionality, and recognition of functional differences between OSPs are essential to applying the OSA 2023 lawfully. The judgment underlines how difficult the regulatory environment now is, both for OSPs to adhere to, and also for Ofcom to apply.

For OSPs, the strategic priorities are clear: engage early with Ofcom during consultation processes, document how your service differs from high-risk platforms, and be prepared to defend decision making if designated inappropriately.

The Court has confirmed that such decisions are reviewable, meaning this will not be the last judicial word on the scope of the OSA’s reach.

Our team has significant experience in advising regulated businesses on the application of regulatory frameworks, including where there is tension between those frameworks and human rights (including freedom of expression, and other ECHR rights).

If you would like any advice or assistance in relation to the issues raised in this article, please contact us at gmclellan@sharpepritchard.co.uk; cwatkins@sharpepritchard.co.uk; or odickie@sharpepritchard.co.uk.

[1] Wikimedia Foundation and Another v Secretary of State for Science, Innovation and Technology [2025] EWHC 2086 (Admin) [135-136].

[2] Reuters, ‘Wikipedia operator loses UK court challenge over online safety law’ (11 August 2025) <https://www.reuters.com/sustainability/society-equity/wikipedia-operator-loses-court-challenge-regulations-under-uk-online-safety-act-2025-08-11/> accessed 12 August 2025.

[3] Ned Davies, Shayan Sardarizadeh and Matt Murphy, ‘Tech giants blocking some Ukraine and Gaza posts under new online rules’ (BBC Verify, 1 August 2025) <https://www.bbc.co.uk/news/articles/cj3l0e4vr0ko> accessed 7 August 2025.

[4] UK General Data Protection Regulation (UK GDPR), Art 5(1)(c).

[5] Internet Society, Written evidence submitted to the Public Bill Committee on the Online Safety Bill (OSB109) (UK Parliament, 2022) <https://bills.parliament.uk/publications/49135/documents/2650> accessed 7 August 2025.