How can a regulated provider challenge a decision taken by Ofcom under the Online Safety Act?

A version of this article was first published on 2 April 2025. 

The process for implementing the Online Safety Act (OSA) has been lengthy and complex. Services potentially within the scope of the OSA may have already raised concerns with Ofcom at various junctures – such as when responding to a consultation or at specific opportunities to engage with the regulator. Whilst this is useful to address any concerns upfront and mitigate issues later down the line, it is essential for regulated providers (and those service providers who may be deemed to be in scope) to understand the options for challenging decisions or enforcement action taken by Ofcom.

At the heart of this are public law principles which (i) underpin how Ofcom should act and take decisions, and (ii) govern the grounds for any potential challenge.

In this chapter, we address key questions from a public law perspective to help you navigate what enforcement and challenges might look like under the OSA. In addition, we set out some top tips on engaging with Ofcom.

What decisions can be challenged under the OSA?

There will be numerous decisions taken by Ofcom in relation to the implementation of the OSA that could be open to challenge and indeed some have already been subject to challenge. For example, Ofcom's decision on the designation of in-scope services and its publication of the register of categorised services, which will apply significantly more stringent requirements to companies with a higher categorisation, has been subject to appeal in the Upper Tribunal by a number of services and some of Ofcom’s decisions pursuant to the OSA have been subject to judicial review challenges. 

Relevant decisions or actions taken by other public bodies can also be challenged, such as secondary legislation that implements new proposals.

It is likely we will see more and more enforcement action initiated by Ofcom if it considers a regulated provider has failed to comply with its obligations under the OSA, which may also be challenged. Notably, Ofcom has shown willingness to issue information notices, impose fines on and open investigations into a broad range of services. 

What are the potential routes for challenge?

Under the OSA, certain Ofcom decisions can be appealed to the Upper Tribunal, including determinations related to the categorisation of services, confirmation decisions (i.e. decisions that there has been a contravention of the OSA) and penalty notices.

Challenges to all other decisions taken by Ofcom (or by other relevant public bodies in relation to the OSA eg secondary legislation), would mostly take the form of a 'judicial review' claim. This is a specific type of claim to be brought in the High Court which has its own rules on procedure (see 'What does a judicial review challenge look like and how is it different to a 'typical' High Court claim?' below).

Judicial review is concerned with the legality of the decision-making process and ultimate decision, rather than being an appeal on the merits against the original decision. Public law principles inform the grounds for any judicial review claim and the Upper Tribunal must apply those same principles in the appeals under the OSA mentioned above.

We explain these principles below and further information can also be found in our briefing under the section, Public law tips for engaging with Ofcom in consultation and other interactions.

What substantive grounds of challenge can you raise?

Three key public law principles which also form the main grounds for judicial review can be categorised into 1) illegality, 2) irrationality/unreasonableness and 3) procedural unfairness. The first two grounds broadly relate to 'substantive' concerns, whereas the third ground is procedural.

In relation to 'substantive' concerns, regulated providers may have complaints about the content of the codes and duties they must navigate and comply with or the substantive basis upon which Ofcom has taken an enforcement decision. This might include arguments relating to the proportionality of the measures in place or decision taken.

Click on the drop down headings below for further information on substantive grounds for challenge

What procedural concerns could be raised?

There are a range of process points that can be raised, including consultations (see below) and the fairness of the decision-making process.

Consultations are a key potential area of challenge. The requirements of an adequate and fair consultation depend on the specific context, but the key criteria are that:

For further detail, see our briefing guide on engaging with Ofcom.

It is worth noting that Ofcom's enforcement guidance sets out the procedure for investigations and enforcement processes in detail, including as to publicity at different stages, and when Ofcom might seek to use business disruption measures and the process for doing so. This guidance explains that procedural concerns/complaints relating to Ofcom investigations (such as deadlines for responding to information notices or issues relating to confidential information) can be raised with a Procedural Officer, who should be an independent member of Ofcom staff. The Procedural Officer will then make a decision in a fairly short timeframe, which is stated to be binding on both the complainant and the Ofcom investigation team/decision makers. The timeframe for raising a complaint with the Procedural Officer is extremely short – just five working days. Regulated providers subject to an investigation/information gathering process should bear this in mind and be prepared to move quickly to protect their position.

What does a judicial review challenge look like and how is it different to a 'typical' High Court claim?

A judicial review challenge, unlike private law proceedings, focuses on the legality and fairness of decisions by public bodies, rather than determining facts or resolving disputes between private parties. As set out above, it is not an appeal on the merits.  

Key differences include:

1. strict time limits to bring a challenge which require that challenges must be brought promptly and in any event within three months of a decision being made (with the emphasis on promptness meaning that sometimes proceedings must be launched within a matter of weeks);
2. there is a 'two stage' process in which the Court will first decide (typically on the papers) whether or not to grant the claim 'permission' to proceed to the second stage of a detailed defence and substantive hearing (although in some circumstances the court can deal with permission and the substantive stage together in a ‘rolled up’ hearing);
3. there is not usually live evidence/cross examination of witnesses or a lengthy disclosure process;
4. expert evidence is unusual, but can be permitted in certain circumstances;
5. other appeal routes must be exhausted first as judicial review is a remedy of last resort;
6. for providers considering a challenge, it is worth noting that judicial review requires the frontloading of evidence at the outset of a case.

Typically in a judicial review, the court will assess the decision-maker's decision by reference to the information that it had before it at the time of making the decision. Therefore, it is worth putting time and effort into ensuring the strongest points and supporting evidence are put before Ofcom at the earliest possible stage (eg during consultation or when responding to an information notice), as it can be difficult to challenge decisions later using material that was not before the decision maker at the time of the final decision. For practical tips on engaging with regulators during consultation processes, see our briefing guide.

Note that appeals in the Upper Tribunal are subject to their own procedure. Following consultation on the Upper Tribunal Procedure Rules to support new rights of appeal created by the OSA, on 21 August 2026, the Tribunal Procedure Committee’s response concluded that it would maintain a three month time limit for applications for permission to appeal by third parties (unless another time limit is prescribed by statute) and also that there was no reason to depart from the usual rule for costs in Tribunals (ie that costs should only be awarded where there has been unreasonable conduct).  

Who can bring a challenge?

In judicial review, there are specific rules on standing which differ depending on the route for challenge and the grounds of challenge.

Click on the drop down headings below for further information

What can be achieved through a challenge?

For successful judicial review claims, remedies are discretionary and will generally involve the quashing of the regulator's decision for it to be re-made. Damages are usually only available for a breach of the Human Rights Act.

In the Upper Tribunal, the tribunal can decide to dismiss the appeal or quash the decision challenged. If a decision is quashed, the tribunal will remit the decision to Ofcom for reconsideration with any directions that the tribunal considers appropriate.

Aside from the formal remedies available following a successful challenge, there are various other strategic considerations that may lead a service provider to consider bringing a challenge.

Is there anything else I should be thinking about when engaging with regulators?

When interacting with regulators you will obviously want to put your 'best foot forward', however, it is important to also be mindful of the risks when providing information to public bodies, like Ofcom.

Click on the drop down headings below for further information.