Wikimedia Foundation & Anor v Secretary of State for Science, Innovation and Technology

The first claimant is a charitable foundation which hosts the online encyclopaedia, Wikipedia. The second claimant is a user and editor of Wikipedia. The claimants challenge the Secretary of State’s decision to make regulation 3 of the Online Safety Act 2023 (Category 1, Category 2A and Category 2B Threshold Conditions) Regulations 2025. That regulation prescribes the criteria for “Category 1” online services, which are made subject to many statutory duties.

The claimants say that the criteria are logically flawed. They were intended to capture large profitable social media companies where anonymous content can “go viral”. However, they were (say the claimants) drawn too broadly with the result that Wikipedia is likely to qualify as a Category 1 service even though that was never the policy intention. If Wikipedia is a Category 1 service, that will fundamentally change the way it operates. Either the number of people in the United Kingdom who access Wikipedia will have to be reduced by around three quarters, or important functionality corresponding to Category 1 threshold criteria must be disabled, or else the first claimant will have to comply with duties that are not reasonably manageable and which are incompatible with the way in which Wikipedia operates.

Allowing for the way in which the arguments were ultimately advanced (and slightly re-numbering and re-characterising the grounds accordingly), the claimants say that the decision to make the regulation was flawed on the grounds that:

There is a degree of urgency in these proceedings because they are, in effect, holding up part of a complex regulatory process that needs to be worked through before important parts of the Act take effect. For that reason, the claim was listed for hearing on an expedited basis for the court to consider both the question of whether permission should be granted to bring a claim for judicial review and, if so, whether the decision to make regulation 3 was flawed on one or more of the grounds asserted by the claimants.

BLN has filed a witness statement, as has Philippe Bradley-Schmieg who is the first claimant’s in-house lead counsel. The defendant has filed a statement from Talitha Rowland, Director, Security and Online Harms at the Department for Science, Innovation and Technology. Ms Rowland has been in her current post throughout the period when consideration was given to the making of the 2025 regulations. She provided senior civil servant sign off on all relevant Ministerial Submissions, and she engaged regularly with the policy team and with ministers and their officials throughout the decision-making process.

Mr Bradley-Schmieg explains how Wikipedia works.

Wikipedia is a free, public interest, non-profit, collaboratively edited encyclopaedia that is available to anyone with access to the internet anywhere in the world, save for a small number of countries or institutions that block access. There are over 300 different language versions. It is said to be the largest and most-read reference work in history. Over 5 billion pages on the English language version of Wikipedia are viewed by users each month. That includes 789 million pages that are viewed by users in the United Kingdom. It is accessed by around 26 million people in the United Kingdom each month.

Wikipedia was founded in January 2001 by Jimmy Wales and Larry Sanger. It is hosted by the first claimant, which provides the software for it to function as well as the necessary technical, administrative and legal infrastructure. It operates in a highly transparent and democratic manner. The underlying computer code is open-source and can be freely inspected on the internet. Its policies and guidelines are developed by its users and are, again, published. Wikipedia runs on software that enables visitors to its website to create and edit content. That in turn enables content to be modified, curated or deleted by users. The result is that with very limited exceptions (for example, removal of content required by a court order, and automatic removal of child sexual exploitation and abuse material) the content is entirely self-regulated by users.

Any user can add an article or amend an existing article. As soon as they do so, the new or amended article is (usually) instantly available to all other users, who can then, in turn, edit that new article. This also means that any one article may be the product of the work of many different users. For example, an article relating to Queen Elizabeth II has been edited over 18,000 times, and the first sentence alone is the product of edits made by 11 separate authors. Mr Bradley-Schmieg says this means that the user verification duties in the Act (under which users can choose only to encounter content from other users whose identity has been verified) are incompatible with the nature of Wikipedia as a collaboratively edited encyclopaedia. Content that has been generated by users whose identity has been verified cannot sensibly be isolated from content generated by anonymous users without rendering the service unusable: articles would, generally, not make sense.

The community of users sets the principles and policies that are applied to content on Wikipedia. They include neutrality of viewpoint and an obligation to provide references to reliable and publicly verifiable sources. If a user does not comply with Wikipedia’s principles and policies, then their edits are likely to be deleted by other users. This process of user-moderation works. Content that does not comply with Wikipedia’s principles and policies is rapidly removed. An independent study has shown that the median time for such content to be taken down is just 61 seconds. Harmful content is not typically encountered. In 2024, the first claimant received 664 requests to take down material (across all of its projects, not just Wikipedia), and it was required to do so in only 4 cases. By contrast, TikTok received 375,899 reports of illegal content in the same period and removed 63,723 items.

Mr Bradley-Schmieg explains that Wikipedia is different from large social media companies in respect of its legal governance (as a non-profit charity), its (lack of a) business model, the fact that its users typically only encounter content that they seek out, the first claimant’s very limited role in moderation, and (partly as a result of those features) its low risk profile. Ofcom’s research indicates that of users who experienced online harm, 56% was due to social media, 9% was due to sites that host videos posted by other users, and 8% was due to webmail. Only 2% was due to a general “other” category (which includes Wikipedia).

Mr Bradley-Schmieg sets out the practical implications if Wikipedia is subject to the Category 1 conditions. Because of the way in which Wikipedia operates, it has little spare resource and it is already over-stretched because of existing regulatory burdens. The user verification duties alone would require Wikipedia to build new systems, data handling processes, functionality and tools. It would face huge challenges to meet the large technological and staffing needs that would have to be deployed to meet these statutory requirements. Other Category 1 duties would also have a significant impact. Mr Bradley-Schmieg “do[es] not see how the… duties could be reasonably manageable for [Wikipedia].” In practice, it is likely that Wikipedia would have to consider taking steps to ensure that it does not fall within the scope of a Category 1 service. That might involve preventing access once a monthly limit has been reached (in effect restricting access to just one quarter of those who currently use Wikipedia in the United Kingdom) or removing functionalities and characteristics that are important to the way that Wikipedia functions.

BLN is a user of Wikipedia. Initially, they used it to browse articles of interest. Eventually, they started editing articles by correcting the occasional typing error. With time and experience they began to make more substantial edits. BLN has now become a regular editor, to the point that they have made almost 140,000 edits, from correcting typing errors to adding references, contributing additional information and updating content. They also help other users. In 2007, BLN was elected by other Wikipedia editors to the role of administrator. There are currently 847 administrators. They are able, in accordance with detailed policies, to block users and IP addresses, delete pages that do not comply with Wikipedia’s policies, and protect pages from editing where there is a risk that edits will not comply with those policies. In 2017, BLN was selected by other users to act as a “checkuser”. There are currently 54 checkusers. They can access (subject to a non-disclosure agreement) technical data from Wikipedia’s servers that relate to individual users or IP addresses. The checkusers can establish if two or more accounts are being operated by a single person or group for malicious or forbidden reasons and can protect Wikipedia against disruptive or abusive behaviour.

BLN gives a practical example of the way in which users self-regulate Wikipedia’s content. Following the attack perpetrated by (as it turned out) Axel Radukubana in Southport on 29 July 2024, there was much speculation on social media as to the identity of the perpetrator. That is said to have contributed to subsequent public disorder. Some Wikipedia users edited a page about the attack to include what was (often wrongly) said to be information about the attack, including the perpetrator’s name, but without any cited authoritative source. When this happened, other Wikipedia users rapidly removed material that was not authoritatively sourced. After some instances of this, BLN temporarily applied “page protection” to the article to prevent it from being edited by inexperienced users. This was done on 30 July 2024. The page was then closely monitored by several editors to ensure the reliability of any changes. Also, a warning was applied to explain that it contained breaking news and should be approached with caution.

BLN says:

“Wikipedia [has always had] a bold and valuable ambition, to let members of the public come together to create a high-quality free global repository of knowledge. I firmly believe that more access to information allows individuals and societies to make better decisions. It also empowers individuals to pursue their goals and interests, whether that is through research in an educational or career setting, by sharing random facts with friends, or plain curiosity. Wikipedia also has an essential feature, which is that it is published under a free copyright licence, meaning that third parties are lawfully permitted to reuse both Wikipedia content and software, for free, under permissive intellectual property licenses. This prevents contributions and knowledge being restricted or monopolised, and allows maximum opportunity for content to develop, and then to be shared with others. Wikipedia is not only a free resource for facts. Through its policies of open participation and presenting multiple points of view, it is a gateway to learning and being critical about knowledge and different ways of thinking - both as a reader or as an active contributor.”

BLN gives detailed and compelling reasons for wishing to remain anonymous as a Wikipedia user. They provide extensive evidence of threats that are made to Wikipedia administrators, including to BLN personally, on websites that target Wikipedia administrators. They also explain the significant and detrimental effect on Wikipedia if Category 1 conditions applied. If a quota system were introduced to avoid the conditions then that would limit their (or others) ability to access an excellent source of information, reduce the quality of the information they could access, limit their ability to help with editing, moderation and administration, and effectively prevent them from participating in the life of the Wikipedia community to which they have invested so much time and energy over many years. If editors were required to verify their identity, then they would be faced with an invidious choice between providing their identity to Wikipedia (and thereby compromising their privacy and, potentially, safety in the event of a hack or data leak) or ceasing some of the important activities they perform to ensure that Wikipedia’s content complies with its policies.

None of the evidence of Mr Bradley-Schmieg or BLN was challenged. Nor was any evidence advanced that Wikipedia poses any form of threat to freedom of expression or informed public discourse or, specifically, the public interests that are protected by article 10(2) of the Convention (which can, in principle, justify a proportionate interference with free expression rights). The unchallenged evidence, therefore, is that Wikipedia is a tool that provides significant value for freedom of speech and expression, particularly the right “to receive and impart information and ideas without interference by public authority and regardless of frontiers” (to use the language of article 10(1) of the Convention) and that it does so without giving rise to any substantial threat to the public interests that are protected by article 10(2) of the Convention.

It follows that any decision by a public authority (including a decision to make (or not to amend) secondary legislation) that has a significant impact on Wikipedia’s ability to operate would, in the absence of justification, likely be unlawful as being contrary to section 6 of the Human Rights Act 1998 read with article 10 of the Convention.

The 2023 Act provides for a new regulatory framework to make the use of certain internet services safer for individuals: section 1(1). It does that by imposing duties on the providers of those services and by conferring functions and powers on Ofcom: section 1(2) and Part 7. Those powers include powers to gather information (including by way of powers of entry, inspection and audit): Chapter 4 of Part 7. The duties imposed by the Act seek to secure that such services are “safe by design” and are designed and operated in a way that protects users’ rights to freedom of expression: section 1(3)(a), (b)(ii).

One type of service that is regulated by the Act is a “user-to-user service.” That is a service by means of which content generated by one user may be encountered by another user: section 3(1). A user-to-user service is a regulated service, and a “Part 3 service”, if (subject to exceptions which do not matter for the purposes of this claim) it has a significant number of users in the United Kingdom: section 4(2), (3), (4), (5)(a) read with section 227(1)(a). With limited prescribed exceptions (such as emails and SMS messages), all user-generated content on a regulated user-to-user service is itself regulated: section 55(2).

The Act imposes duties on all regulated user-to-user services. These include duties to assess, mitigate and manage risks posed by certain types of illegal content, enabling users to report illegal content, the provision of a complaints procedure and duties to have regard to freedom of expression and privacy when implementing safety measures and policies: sections 9 – 10 and 20 – 23, read with section 59.

The Act applies additional duties to different categories of service. The most intensive duties and oversight apply to “Category 1” services. When the Bill was first introduced, it had separate provisions that were designed to protect adults from “legal but harmful” content. Those provisions were removed but were replaced by the duties that apply to “Category 1” providers. They include:

Many of the duties are couched in terms of proportionality. For example, the duty under section 17(2) to protect content of democratic importance is expressed as a “duty to operate a service using proportionate systems and processes designed to ensure that the importance of the free expression of content of democratic importance is taken into account when taking decisions about (a) how to treat such content… and (b) whether to take action against a user generating… such content.”

However, not all duties are couched in terms of proportionality. One which is not, and about which the first claimant is particularly concerned, is a duty to enable users to filter out content from non-verified users – see section 15(1), (9) and (10):

“15 User empowerment duties

(1)

This section sets out the duties to empower adult users which apply in relation to Category 1 services.

…

(9)

A duty to include in a service features which adult users may use or apply if they wish to filter out non-verified users.

(10)

The features referred to in subsection (9) are those which, if used or applied by a user, result in the use by the service of systems or processes designed to effectively—

(a)

prevent non-verified users from interacting with content which that user generates, uploads or shares on the service, and

(b)

reduce the likelihood of that user encountering content which non-verified users generate, upload or share on the service.”

The Secretary of State has the power to exempt content or services from the Act, including a power to provide for a description of user-to-user service to be exempt if the Secretary of State considers that the risk of harm is low: section 220(4).

Ofcom is required to prepare Codes of Practice which set out the measures that providers may take to comply with certain Category 1 duties: section 41. In doing so, it must consult persons with expertise in the right to freedom of expression: section 41(6)(f)(i). Category 1 duties do not apply until the applicable Code of Practice is in force: section 51. The measures prescribed by the Codes of Practice must be proportionate and technically feasible: paragraph 1 of schedule 4. They must incorporate safeguards for freedom of expression and privacy: paragraph 10 of schedule 4. If a service provider complies with the applicable Code of Practice they are deemed to have complied with the statutory duty: section 49(1). Ofcom must publish guidance in respect of those Category 1 duties which are not subject to a Code of Practice: section 52.

Ms Rowland says that Category 1 duties are aimed at securing freedom of expression by protecting certain types of content that are important to public discourse and securing that services are transparent and accountable. They are intended to apply to a range of different kinds of service, but the impact of the duties will vary. Thus, if a service does not host advertising it may not need to take any measures to protect users from fraudulent advertising.

The Act prescribes an elaborate step-by-step process for the making of regulations that specify the Category 1 threshold conditions and, thereafter, their implementation: sections 94 – 95 and schedule 11.

First, within six months of the Act coming into force, Ofcom was required to carry out research into (a) how easily, quickly and widely regulated user-generated content is disseminated by means of regulated user-to-user services, (b) the number of users and functionalities of the user-to-user part of such services, and (c) such other characteristics of that part of such services or factors relating to that part of such services as Ofcom considered to be relevant to specifying the Category 1 threshold conditions: schedule 11, paragraph 2(2). The concept of easy, quick and wide dissemination of regulated user-generated content by means of regulated user-to-user services may be seen as a codification of the well-known concept of user-generated content (particularly on social media) “going viral”. For shorthand, I will refer to this as “viral dissemination”. A “functionality” is a feature that enables interactions of any description between users, including, for example, features that enable users to create a profile or search for user-generated content or share content with others: section 233.

Second, Ofcom must then provide the Secretary of State with advice based on that research as to the provision which Ofcom consider it is appropriate for regulations prescribing the Category 1 conditions to make: schedule 11, paragraph 2(5).

Third, as soon as reasonably practicable after the provision of that advice, Ofcom must publish the advice: schedule 11, paragraph 2(7).

Fourth, as soon as reasonably practicable after the provision of that advice, the Secretary of State is required to lay a draft of the statutory instrument containing the proposed regulations before each House of Parliament: schedule 11, paragraph 2(7), and section 225(8).

Fifth, the Secretary of State is then required to make “the first regulations” under paragraph 1(1) of schedule 11: schedule 11, paragraph 2(7).

Sixth, Ofcom is then required to establish a register of Category 1 services as soon as is reasonably practicable: section 95(1).

Seventh, Ofcom is then required to publish Codes of Practice and guidance about the duties owed by providers under the Act, including duties owed by Category 1 providers: Chapter 6 of Part 3.

Eighth, from the point that the first regulations are made, Ofcom may conduct further research, whether on its own initiative or at the request of the Secretary of State, to assess whether to amend the regulations: schedule 11, paragraphs 3(1), (4).

The regulations that specify the conditions for qualifying as a Category 1 service must relate to (a) the number of users of the user-to-user part of the service, (b) functionalities of that part of the service, and (c) any other characteristics of that part of the service or factors relating to that part of the service that the Secretary of State considers relevant: schedule 11, paragraph 1(1). The regulations must specify the ways in which the Category 1 threshold conditions may be met, and they must provide that at least one specified condition about number of users or functionality must be met: schedule 11, paragraph 1(4).

Schedule 11, paragraph 1(5) is the foundation for the claimant’s first ground of claim. It states:

“In making [the] regulations… the Secretary of State must take into account the likely impact of the number of users of the user-to-user part of the service, and its functionalities, on how easily, quickly and widely regulated user-generated content is disseminated by means of the service.”

The Act came into force on 26 October 2023. Ofcom was then required to conduct its research within 6 months. That was the first stage in the statutory process for making the regulations.

Ofcom’s research was informed by four themes: consistency (applying the same data sources and research for category 1 conditions as for other category conditions), objectivity (the underlying work was done in a “service-agnostic” way, in part by ensuring that data could not be linked to an identified service), scope (the aim was to use comprehensive and reliable data sources, recognising the lack of robust data on matters such as user numbers), and transparency (by publishing the data and additional research sources).

In conducting its research into viral dissemination, Ofcom paid particular attention to different functionalities (including different forms of livestreaming, different types of forwarding or re-sharing user-generated content, and in-livestream chat) which it considered facilitated users to disseminate material near-instantaneously, with the potential to reach multiple users at once. For these purposes, it treated “content recommender systems” as a functionality (albeit it says that they do not strictly meet the statutory definition of a functionality). It considered the operation of these functionalities across many different types of service, including social-media, information-sharing, pornography, marketplaces and video-sharing.

It summarised its research thus:

“Research: Our research findings indicate that the features of a service most relevant to content being disseminated easily, quickly and widely are:

• content recommender systems, because they are typically relied upon by services to amplify content to a wide set of users; and

• the ability for users to forward or re-share content, because this facilitates users sharing content instantaneously with others.

In our view, these two features each operate to increase dissemination of content easily, quickly and widely. Additionally, the effects of these features are likely to be increased further as the user base increases and when these features operate in combination. In essence, the higher the user base, the more content that is likely to be shared.”

The second stage was for Ofcom to provide advice to the Secretary of State. It did that on 29 February 2024. It provided the following summary of its advice:

“Advice: For these reasons, our advice is that category 1 thresholds should target services that fulfil either of the two following sets of conditions:

Condition 1:

• the use of a content recommender system on its service; and

• have more than 34 million UK users on the user-to-user part of the service, representing c.50% of the UK population.

Condition 2:

• have a functionality that offers users the ability to forward or re-share user-generated content with other users of the service; and

• the use of a content recommender system on its service; and

• have more than 7 million UK users on the user-to-user part of the service, representing c.10% of the UK population.”

In the body of its advice, it explained its rationale:

“3.18

We analysed each of the six functionalities and content recommender systems and have concluded that two, in particular, stand out from our research as playing a particularly significant role in the dissemination of regulated user-generated content. These are:

a)

the use of a content recommender system; and

b)

the ability to forward or re-share user-generated content with other users of the service.

3.19

Content recommender systems amplify the breadth, scale and speed of content dissemination on a service by proactively disseminating content to new users or groups of users. Content recommender systems therefore play a fundamental role in enabling content to be disseminated easily, quickly and widely. Forwarding or re-sharing existing content with other users of a service is another key component of content dissemination, as it allows for the movement of existing content to new users or groups of users, by specifically enabling users themselves to affect content dissemination. These two features allow both the service and the user to affect the dissemination of content.

…

3.23

…we judge that where services have a very large number of users, a content recommender system alone is sufficient for content to be disseminated easily, quickly and widely. This is because a service’s content recommendation system results, in and of itself, in the dissemination of content to a very large audience without the need for users themselves to further share content.

3.24

Where services have a lower but still considerable number of users, a content recommender system alone may not be sufficient to disseminate content quickly, easily and widely. We judge that the ability for users to forward or re-share existing content on the service operates in conjunction with a content recommender to increase the likelihood of quick, easy and wide content dissemination: this can occur both through active content dissemination, driven by users' own engagement with content, as well as via content dissemination driven by the service's own systems.

3.25

Based on our analysis above, we therefore consider it appropriate to recommend two sets of thresholds for category 1.

3.26

We are required to recommend a user number threshold to the Secretary of State. In doing so we have exercised our regulatory judgement having regard to our general duties under the Communications Act 2003 and the function we are carrying out.

3.27

Set one: Considering the quick, easy and wide dissemination of content, we judge that services with content recommender systems and very large user bases are relevant to category 1. Based on our analysis, we propose that a user number threshold of 34 million UK users of the user-to-user part of the service is appropriate for such services. This represents approximately 50% of the total UK population.

3.28

Set two: Considering the quick, easy and wide dissemination of content, we judge that services with content recommender systems, the ability for users to forward or re-share existing content on the service and large user bases are relevant to category 1. Based on our analysis, we propose that a user number threshold of 7 million UK users of the user-to-user part of the service is appropriate for such services. This represents approximately 10% of the total UK population.

3.29

Our preliminary indicative analysis suggests that approximately 12-16 services may meet one or both of these user number thresholds, when factoring in the impact of the functionality requirements described above. This estimated number of services in our view indicates that our recommended user number thresholds are likely to strike the right balance in terms of targeting those services where content is likely to be disseminated easily, quickly and widely, while ensuring that the duties apply to a sufficiently targeted number of services.”

The third stage was that Ofcom was required to publish its advice. This was to happen as soon as reasonably practicable after Ofcom advised. Ofcom published its advice on 25 March 2024 (the advice having been provided to the Secretary of State on 29 February 2024).

The fourth stage was for the Secretary of State to make draft regulations prescribing the Category 1 conditions. Again, this was to happen as soon as reasonably practicable after Ofcom advised.

Between March 2024 and February 2025 officials prepared 14 Ministerial Submissions in relation to the making of the regulations. During this period there was a change of Government. The General Election was called on 22 May 2024 and the new Government was formed on 7 July 2024. The new Government was not shown earlier Submissions, but the work that had been done by officials in the period between March and July 2024 informed the advice that was given to the new Government.

On 7 March 2024, the then Secretary of State was asked to decide whether to accept Ofcom’s recommended thresholds, so that work could commence on drafting the relevant secondary legislation. Officials recommended that she do so. Initially, the Secretary of State was not content with the advice. She was particularly concerned that “the likes of Amazon was likely to be captured by Category 1… but not Pornhub… [and that] small but risky services are not covered.”

On 18 March 2024, the Secretary of State was provided with a Submission which made it clear that Category 1 duties were not primarily aimed at pornographic content or the protection of children (which were dealt with by other parts of the Act). Rather, the aim of Category 1 was to capture services that have a significant influence over public discourse. The submission offered, as a possible option, requesting information from Ofcom as to how content recommender systems function on different types of service. It was envisaged that this might indicate that that there were differing levels of impact on viral dissemination, and that could be used to carve out certain content recommender systems from the ambit of the regulation.

Officials then spoke to Ofcom policy directors who advised that there was very little information available on how content recommender systems work across different types of service, and that it would be extremely difficult to make robust regulations that differentiated between different types of service. On 21 March 2024, a further submission was put before the Secretary of State in which it was said that Ofcom did not have additional information about how content recommenders work on different services, so that would require additional work which would impact on the timeline for laying regulations. It was therefore suggested that the Secretary of State should not ask for more information about this.

On 9 April 2024, the Secretary of State received a letter from “the Mid Size Platform Group”. This is a group that comprised seven (subsequently eight) online services, including the first claimant. The letter captured what, in these proceedings, the first claimant say is a key problem with regulation 3(2):

“Definition of recommender systems: …the proposed definition is too broad and will encompass essentially any platform in the sector which organises content in any way. Content recommender systems are diverse in their design and application. While we recognise some content recommender systems are designed to encourage users to chase sitewide virality, which may lead to negative outcomes, others are designed for safety reasons, for marketplace efficiency, or are simply an ancillary part of the service. For example, they can be used to ensure that content deemed safe, age appropriate, or produced by a user with a positive safety track record is more visible to users. In addition, it would catch services that allow users to access recommended content but do not force them to use an algorithmic feed if they prefer not to. We therefore recommend that the definition of recommender system is made more detailed and nuanced, rather than simply the presence of the functionality, to avoid catching a high number of less risky platforms in Category 1. For example, systems with a safety component, systems merely reflecting past purchase history, as well as systems that are a minor and ancillary component of the service, should be exempted.”

On 22 May 2024 (the day on which the general election was called), departmental officials held a workshop with Ofcom. By this point, the Secretary of State had indicated that she agreed with officials that she should follow Ofcom’s advice. A paper circulated in advance of the workshop said that the proposed definition of a content recommender system had been criticised for being too broad. It raised the following, among other, questions:

“• Are there any recommender systems that Ofcom would discount in line with the definition?

• Wikimedia raised concerns that the broadness of the definition would capture systems such as this [the Wikipedia “New Pages Feed”] - does Ofcom agree with this?”

The record of the discussion that took place at the workshop does not directly address this issue. However, during the election period, officials considered the concern that the definition of a content recommender system was too broad. Options were discussed which would exclude Wikipedia. They included excluding charitable services, excluding services without paid-for advertising, narrowing the definition of a content recommender system to only include systems that are “integral” to the operation of the service, amending the definition of “users” to include only those that interact with the content recommender system, and commissioning further research from Ofcom. Officials concluded that introducing a change without commissioning further research from Ofcom could lead to unintended outcomes. In particular, the opacity of content recommender systems meant that narrowing the definition could lead to the exclusion of services that ought to be included, and commissioning further research would lead to significant delay. Also, the pace of technological developments was such that any further research would require continual reassessment.

On 5 July 2024, a new Government was formed. Ms Rowland says that the work that had been conducted up to that point fed into the material that was provided to the new Secretary of State. She says he was extremely engaged with the setting of the Category 1 thresholds and that she had a number of discussions with him and/or his Special Advisors about the issues.

On 18 July 2024, the new Secretary of State was first provided with a formal Ministerial Submission in relation to the regulations. He was told that Ofcom’s recommendations were “broadly in line with… expectations… in terms of the number and type of services in scope” and that “[w]hilst there are some outliers [and elsewhere in the document Wikipedia was identified as an outlier]… the services likely to be in scope are largely justifiable…” He was informed that some companies, including Wikipedia, had criticised the thresholds and believed that the recommendations were too broad, and that many parliamentarians were particularly concerned about Wikipedia being in scope. It was then said, “Wikipedia has content of democratic important and journalistic content…” Officials recommended following Ofcom’s advice. The Secretary of State was given a list of services that were likely to be captured by the proposed category 1 thresholds, and also a list of services “which could possibly be captured”. Wikipedia was in the latter list. Officials advised that they had not expected Wikipedia to be in scope, but it had raised the possibility that it could be due to the proposed definition of a content recommender system.

The Secretary of State was informed that he was required to take into account the likely impact of the number of users of the service, and its functionalities, on viral dissemination, as well as any other characteristics or factors that the Secretary of State considered relevant. He was told that Ofcom had concluded that content recommender systems played a particularly significant role in the dissemination of content because they are typically relied on by services to amplify content to a wide set of users, and that:

“Ofcom judged that where services have a very large number of users, a content recommender system alone is sufficient for content to be disseminated easily, quickly and widely. This is because a service’s content recommendation system results, in and of itself, in the dissemination of content to a very large audience without the need for users themselves to further share content.”

Attention was drawn to limitations on the evidence and research that informed Ofcom’s advice. Attention was also drawn to the concerns expressed by the Mid-Size Platform Group, but it was said that it would be difficult to tailor the thresholds to meet its concerns. It was pointed out that Ofcom had not been able to provide more granular detail about how different content recommender systems worked in the context of different services, that they were often opaque and that they changed frequently, that Ofcom wanted to do further work to understand that better, but that it would need to use its information gathering powers to do that.

A Departmental Minister, Baroness Jones, asked for a meeting to discuss the Submission with officials. That took place on 25 July 2024. Baroness Jones expressed concern that certain “outliers” might fall within the scope of Category 1 services, particularly Google Maps, Google Photos, Amazon and eBay (but was apparently less concerned about the potential inclusion of Wikipedia). Following that meeting, officials considered options for excluding certain “outlier” services, including Wikipedia.

On 31 July 2024, a further Ministerial Submission recommended following Ofcom’s advice. Options were put forward which could potentially have the effect of excluding certain outlier services (including online encyclopaedias). Officials advised that these options were not recommended because of the risk (in the absence of further research) of inadvertently creating loopholes. It was recognised that further research could be conducted into viral dissemination and to understand more about content recommender systems. However, Ofcom had indicated that they did not have a statutory power to conduct such further research (but that they would be able to do so once the first regulations were in force). It was also said that there were policy reasons why online encyclopaedias should be within the scope of Category 1, and that Wikipedia held content of democratic importance and journalistic content. The options that were presented included amending the definition of a content recommender system, but it was said that it was difficult to do this in a way that was objective, and evidence based, and which did not create any risk of loopholes. In providing this advice, officials drew on the work that had been done, including engagement with Ofcom, over the previous months.

On the same day, the Minister responded, “I reluctantly agree with the proposals in the submission as I recognise that our hands are largely tied by the constraints of the Act.” The Minister also directed officials to undertake stakeholder liaison.

A meeting then took place on 12 August 2024, attended by the Secretary of State, the Minister and officials. The Secretary of State considered the question of online encyclopaedias but was content not to seek further advice. He indicated that he was broadly content to accept Ofcom’s recommendations, subject to an issue concerning suicide forums. That issue was addressed in a further Submission. On 17 September 2024, the Secretary of State agreed with the recommendation to approve Ofcom’s proposed conditions.

Ms Rowland correctly observes that Ofcom did not provide advice about the specific impact of each functionality or characteristic of each service on that service’s dissemination of content. Its research was undertaken at a higher level of generality and considered how different functionalities and characteristics worked across a range of different types of service, and their impact – across that range – on viral dissemination. Its advice was provided on that same basis, and that was how the Secretary of State understood it. He was not, therefore, under a misapprehension that content recommender systems worked in the same way across different types of service, or that they affected viral dissemination to the same degree. He was advised that they operated in an opaque manner that was subject to rapid change, but there was a limit to the advice that could be provided without Ofcom exercising its information gathering powers.

A draft of the regulations was laid before Parliament on 16 December 2024. It was approved by a resolution of each House of Parliament, as required by section 225(8) of the Act. The Secretary of State then made the regulations on 26 February 2025. They came into force the following day.

Regulation 3 states:

“3 Category 1 threshold conditions

(1)

The Category 1 threshold conditions are met by a regulated user-to-user service where, in respect of the user-to-user part of that service, it—

(a)

(i)

has an average number of monthly active United Kingdom users that exceeds 34 million, and

(ii)

uses a content recommender system, or

(b)

(i)

has an average number of monthly active United Kingdom users that exceeds 7 million,

(ii)

uses a content recommender system, and

(iii)

provides a functionality for users to forward or share regulated user-generated content on the service with other users of that service.

(2)

In paragraph (1), a “content recommender system” means a system, used by the provider of a regulated user-to-user service in respect of the user-to-user part of that service, that uses algorithms which by means of machine learning or other techniques determines, or otherwise affects, the way in which regulated user-generated content of a user, whether alone or with other content, may be encountered by other users of the service.”

The next step is for Ofcom to establish a register of Category 1 services. To do this, it must identify which services fall within the scope of regulation 3. In doing so, it must (so far as possible) read and give effect to regulation 3 in a way which is compatible with Convention rights: section 3(1) of the Human Rights Act 1998.

In order to determine which services meet the Category 1 criteria, Ofcom has issued information notices to providers of services that it considers might do so. One such notice was issued to the first claimant on 27 March 2025 (a draft having been sent in January 2025). It asks the first claimant to provide the mean number of monthly active United Kingdom users for Wikipedia, how it determines whether a person is an active United Kingdom user, and whether Wikipedia uses a content recommender system and whether it provides a functionality for users to forward or share regulated user-generated content with other users. The first claimant responded on 16 May 2025. It contended that Wikipedia did not fall to be categorised as a Category 1 service. It pointed out that insofar as Wikipedia has a content recommender system and forward/share functionality, this is not typically used to serve content to large numbers of users in any significant way, it is not integral to the user “journey”, and it is primarily used for ancillary purposes such as content moderation. Ofcom has not yet determined whether Wikipedia is a Category 1 service.

Once Ofcom has published the register of Category 1 services, it will issue draft transparency notices “within a few weeks” and will then issue final transparency notices “soon thereafter”. It will then publish draft Codes of Practice. Ms Rowland, in her witness statement, said that would be “no later than 2026”. I was told that the Codes of Practice would not be in force before 2027.

The Secretary of State may, at any stage, amend the regulations (subject to certain procedural requirements, including taking further advice from Ofcom). In particular, he may do so once Ofcom has established its register of Category 1 services. Thus if, at that point, services are included that the Secretary of State considers should not be included, it is open to the Secretary of State to amend the regulations. Arguably, the Secretary of State would be under a statutory duty to do so if that were necessary to avoid a breach of Convention rights. Ms Rowland, in her witness statement, says that when the Secretary of State made regulation 3 he took account of his power to amend them in the light of subsequent developments when the impact of imposing Category 1 duties would be better understood. He also took account of the relatively long lead-in time to the implementation of Category 1 duties.

Viral dissemination is not a concept that obviously applies to Wikipedia. The typical Wikipedia user only encounters content that they seek out. Nevertheless, depending on the correct interpretation of regulation 3, some features of Wikipedia might be considered to amount to a content recommender system or a forward/share functionality. That may mean that Wikipedia amounts to a Category 1 service within the meaning of the regulation. That is so even though these features are, for the most part, not available to general users and are only available to a tiny subset (such as moderators), and even though it might be thought that none of them have the effect of causing viral dissemination in the way that can be a feature of some social media sites.

It is sufficient to mention just one such feature: the New Pages Feed. The overwhelming majority of Wikipedia users will never encounter the New Pages Feed. It is a moderation tool. It helps moderators identify new pages so that they can be reviewed for accuracy and clarity to limit the spread of poor-quality content. The New Pages Feed involves the operation of algorithms, including code to identify and present a list of newly created pages, code to filter or sort the list, code that predicts the quality of the page, and code that applies a “tag” to different types of page (eg pages that are just a few words long (“stubs”), or which are not linked to any other articles (“orphans”) or which have no sources (“no citations”)).

A question that then arises is whether the New Pages Feed is a “content recommender system” within the meaning of regulation 3(2). That may raise the following further questions:

Neither party seeks a finding on these questions, nor on the ultimate question of whether Wikipedia meets the Category 1 conditions. It is common ground that Wikipedia might do so, and that it will be for Ofcom to determine whether it does do so, giving a Convention compliant reading and effect to the regulation, so far as that is possible.

For its part, the first claimant’s litigation position in these proceedings (notwithstanding its response to Ofcom on 16 May 2025) is that it is “likely” that it meets the Category 1 conditions (and, on that basis, it contends that it is a “victim” for the purposes of the Convention). Conversely, Ms Rowland acknowledges that the Secretary of State was advised that it was “possible” that Wikipedia would qualify as a Category 1 service, but says that “because there are a number of technical issues which will need to be addressed by Ofcom when applying the Regulations concerning functionalities, systems and user numbers” the issue is necessarily uncertain.

More broadly, the issues that Ofcom will need to address before determining whether Wikipedia is a Category 1 service include: