The High Court has rejected Wikipedia’s challenge to a key aspect of the Online Safety Act 2023 which it argued would put the website’s continuing operation in jeopardy.

The case centred on regulation 3 of the Online Safety Act, which sets the criteria for Category 1 online services. These are services to which the most intensive duties and oversight apply under the Act, largely due to their size and particular functionalities. 

The Wikimedia Foundation (the charitable foundation that hosts Wikipedia) – along with one of the site’s editors – sought to challenge the criteria set by the Secretary of State for regulation 3 on the basis that they were drawn too broadly and would likely catch Wikipedia itself. If this were the case, they argued, the site would change fundamentally for users in the UK: either the number of people who could access it would have to be reduced by three quarters (to fall below the relevant threshold for a Category 1 service) or the site would have to comply with the duties applicable to Category 1 services, which, they said, were unmanageable and incompatible with the way it operates. 

One particular element of the Category 1 duties was brought to the court’s attention: the so called ‘user empowerment duties’ in section 15 of the Act. These include a duty to “include in a service features which adult users may use or apply if they wish to filter out non-verified users”. It was argued that the introduction of such a feature on Wikipedia was incompatible with its nature as a ‘collaboratively edited encyclopaedia’. Pages are routinely updated and collaborated upon by verified and non-verified users (and the court accepted that there were compelling reasons why an editor might wish to remain anonymous). Consequently, as the judgment put it, “content that has been generated by users whose identity has been verified cannot sensibly be isolated from content generated by anonymous users without rendering the service unusable: articles would, generally, not make sense”. 

Importantly, Wikipedia has not been listed as a Category 1 service – the process for establishing a register of such services has not yet begun, not least because of this case being before the court. However, it was because Wikipedia anticipated that the regulation as drafted would likely apply to it that it challenged the Secretary of State’s decision.  

Wikipedia did so on four grounds: (1) that the Secretary of State breached paragraph 1(5) of Schedule 11 of the Act which required him to take into account a range of factors, including the likely impact of the number of users and functionalities on viral dissemination of content; (2) that the decision was irrational because it was based on flawed reasoning; (3) that the decision was incompatible with articles 8, 10 and 11 of the European Convention on Human Rights; and (4) that the decision was incompatible with article 14 of the Convention because it failed to distinguish between different types of online providers. 

Mr Justice Johnson considered each ground in turn. 

On the question of whether the Secretary of State breached paragraph 1(5) of schedule 11 of the Act, which required him to take account of the likely impact of the number of users of a service and its functionalities on viral dissemination. The Secretary of State accepted Ofcom’s advice that, for large services, content recommender systems and a functionality to forward user-generated content had an impact on viral dissemination, and therefore agreed that these should form part of the threshold conditions of a Category 1 service under Regulation 3.  

For their part, the Claimants argued that the Secretary failed adequately to take into account the likely impact of a service’s functionalities on viral dissemination, because he did not distinguish between those services for which such functionalities were ‘integral’, and those for which they weren’t. In the case of Wikipedia, such functionalities were not integral, and largely only encountered by moderators. As such, they were unlikely to result in viral dissemination.  

The judge disagreed, finding that “nothing in paragraph 1(5) requires the Secretary of State to draw that distinction or undertake that level of analysis. The obligation is pitched at an altogether higher level… The advice that the Secretary of State was given was that further advice would be required to undertake a more granular analysis, but that until the first regulations had been made it was unclear that Ofcom had a statutory power to provide such advice. It is thus unclear how the Secretary of State could, in practice, have distinguished between the effect on viral dissemination of integral and non-integral functionalities, or how he could have undertaken anything other than the high level and general assessment that is required by paragraph 1(5).” 

A similar argument was raised in relation to the Claimants’ second ground, namely that the decision to make regulation 3 was irrational. Again, the argument was made that if the concern was viral dissemination of content, the criteria could be limited to content recommender systems and forward/share functionalities that are ‘integral’ to a system, or that user numbers could be defined in a way that takes account of the time that users spend on a service.  

The judge, however, was unconvinced. As he explained, the criteria are not perfect, and could capture some services where there was no real risk of viral dissemination. However, “neither Ofcom nor the Secretary of State were acting under a misapprehension that the criteria were perfect in the sense that they would capture all services that give rise to viral dissemination and would not capture any services that do not do so.” He posited that if there were some obvious alternative criteria that were ‘perfect’ then it might have been irrational to follow Ofcom’s advice. However, no alternative criteria were advanced. As such, he concluded that “the fact that the criteria may capture some services that do not give rise to viral dissemination does not mean that they are irrational”.  

Turning to arguments that relied on the Convention, the Claimants argued that regulation 3 was incompatible with articles 8, 10, and 11. Furthermore, in failing to distinguish between non-profit making charities like Wikipedia and major profitable tech companies (which, they argued, were the target of the Act), the Claimants argued that the regulation was incompatible with Article 14.  

The challenge the Claimants faced, however, was that they needed to establish that they were ‘victims’ of these apparently unlawful acts for the purposes of the Convention. As the judge explained, the Claimants did not contend that Wikipedia was captured by regulation 3, but only that it might be. As such, it followed that they were not victims. It is possible to achieve the status of victim because of a risk of a future violation of the Convention, but the court explained that this is “only in highly exceptional circumstances” which did not arise here. On the Article 14 point, the judge also found that there was nothing in the legislation to suggest that its focus was limited to any particular type of company. 

As a result, the Claimants’ case failed. However, the door was not closed entirely: the judge pointed out that the decision as to which services fall within Category 1 is a public law decision and potentially amenable to review by the court. Therefore, “if Ofcom impermissibly concludes that Wikipedia is a Category 1 service, the claimants have a remedy by way of judicial review”. Furthermore, even if Ofcom fairly reached that conclusion, the judgment points out that “the Secretary of State may be obliged to consider whether to amend the regulations or to exempt categories of service from the Act. In doing so, he would have to act compatibly with the Convention. Any failure to do so could also be subject to further challenge. Such a challenge would not be prevented by the outcome of this claim.” 

To read the judgment in full, click here.