GRC

Meta takes Ofcom to High Court over global-revenue fine ceiling

Meta’s judicial review challenges Ofcom’s use of worldwide group revenue for Online Safety Act fines. Why it matters for UK cyber penalty regimes.

Scales of justice graphic with the headline Meta challenges Ofcom's worldwide revenue fine cap

Meta has asked the High Court to rule that Ofcom overstepped its powers by basing Online Safety Act fees and maximum fines on worldwide, group-wide revenue. The judgment will decide how big the penalty ceiling is, and it bears directly on the turnover-based penalties UK cyber regulation is now adopting.

What happened

Meta Platforms, which owns Facebook, Instagram and WhatsApp, took its judicial review against Ofcom to the High Court in London on Tuesday 13 October 2026, with argument continuing into Wednesday. The claim challenges the secondary legislation Ofcom uses to define “qualifying worldwide revenue”. That figure drives two things under the Online Safety Act 2023: the annual fees large platforms pay to fund the regime, and the maximum penalty Ofcom can impose. The cap is the greater of £18 million and 10% of that revenue figure.

Reuters reported that Meta’s case rests on two points. First, Meta says Ofcom should count only revenue from regulated services in the UK, not global earnings. Second, it disputes how Ofcom calculates a cap where several companies in the same group are found jointly liable for a breach. According to court filings reported by City AM, Meta argues that this lets non-regulated group revenue into the calculation and amounts to “double counting”.

Ofcom denies both points. It told the court that the revenue definition fixes only the upper limit of a possible fine, and that any penalty it actually imposes must be proportionate to the failure in question. It also said it struck a “careful balance” when drafting the rules. Judgment is expected to be handed down in writing at a later date.

The detail

The regulations at issue came into force in September 2025. Fees apply to providers with qualifying worldwide revenue above £250 million. Where Ofcom acts against a single entity, the cap is based on that entity’s revenue. Where it acts against several linked entities, such as a parent and its subsidiaries, the cap can be based on the group’s total revenue, including business lines the Act does not regulate.

The figures involved are very large. Meta reported revenue of about $201 billion for 2025, so 10% of a worldwide group figure produces a theoretical ceiling that TechTimes put at roughly £15 billion. Meta says its preferred basis, revenue from regulated services in the country concerned, would still leave room for record UK penalties. In court documents, Meta’s counsel, Monica Carss-Frisk KC, argued that Ofcom’s approach leaves a handful of firms carrying most of the regulator’s costs.

Ofcom’s position is that it has followed a plain reading of the statute, and that the scale of the theoretical maximum says nothing about the size of any real fine. TechTimes reports Online Safety Act fines so far total just over £7 million across eleven providers. The same outlet reports that the 5Rights Foundation was given permission to intervene in support of Ofcom, and that the trade body CCIA has said it intends to apply to intervene on Meta’s side. We could not confirm either elsewhere.

Meta also joined TikTok and X at a separate hearing the previous week over Ofcom’s information notices, and Ofcom is investigating Meta’s risk assessment for Instagram Instants. In September, Ofcom’s Oliver Griffiths told peers the regulator faced a “highly litigious environment”.

Flow diagram summarising the Online Safety Act fine cap, Meta's two arguments, Ofcom's response and the pending High Court judgment

Why it matters for UK organisations

Few readers run social media platforms, but turnover-based penalties are now the standard model in UK digital regulation, and this case tests how far a regulator can stretch the revenue base.

UK GDPR already caps the most serious fines at £17.5 million or 4% of total worldwide annual turnover. The Cyber Security and Resilience Bill, now heading for Lords report stage, follows the same pattern. As introduced, it set a standard maximum of £10 million or 2% of worldwide turnover and a higher maximum of £17 million or 4%. For failing to comply with national security directions, regulations could raise the cap to 10% of turnover. Commentators at Macfarlanes noted that neither the bill nor any regulations had yet defined “undertaking”, the term that determines whose turnover counts.

That is the same kind of question Meta has put to the High Court: whether a regulator, when writing its own rules, can define the revenue base as broadly as possible and pull in group companies outside the regulated activity. A ruling on how the Online Safety Act’s wording should be read will not bind the courts on a different statute. However, its reasoning on group aggregation, proportionality and the limits of delegated rule-making is likely to be quoted when the Cyber Security and Resilience Bill’s penalty regulations are drafted and, later, challenged. Managed service providers and data centre operators newly in scope should watch closely.

Expert view

In my experience, boards care far more about the maximum penalty than about the regulator’s average fine. The cap drives the risk register, insurance conversations and the security budget. If regulators can base that cap on a whole group’s worldwide revenue, a breach in a small regulated subsidiary becomes a group-level financial risk. That changes who in the organisation owns the problem.

There is a genuine policy tension here. A cap tied only to UK revenue may be small enough for a global firm to treat as a cost of doing business, which is the deterrence problem Parliament was trying to solve. Equally, a definition designed to produce the largest possible number invites exactly this kind of litigation. Litigation slows enforcement, which helps nobody. Ofcom’s argument that actual fines must be proportionate is the right principle, but organisations reasonably want to know where the outer limit sits before they plan around it.

Many groups run regulated services through separate legal entities without considering how a regulator would view joint liability. When we assess governance alongside technical controls, the gaps usually sit between entities: shared identity platforms, suppliers and incident response arrangements that nobody formally owns.

What to do now

  1. Map regulated entities to group structure. Record which legal entities provide services that fall under UK GDPR, NIS or the coming Cyber Security and Resilience Bill, and which group companies share systems with them.
  2. Model penalty exposure both ways. Give the board figures based on the regulated entity’s turnover and on worldwide group turnover, and update them when the High Court rules.
  3. Tighten shared controls. Joint liability is most likely where entities share infrastructure. Check that the Cyber Essentials basics of secure configuration, user access control, malware protection, security update management and firewalls are applied consistently across shared platforms, not only in the regulated unit.
  4. Document proportionality evidence. Regulators set real fines by reference to the seriousness of the failure. Keep dated records of risk assessments, control testing and remediation decisions so you can show reasonable conduct.

Bottom line

Meta and Ofcom have argued their positions, and the court has yet to rule. Whatever the outcome, it will shape how far UK regulators can push group-wide, worldwide revenue into penalty caps. Security and compliance leaders should treat it as an early signal for the Cyber Security and Resilience Bill and check now how their group structure would look to a regulator.

Sources

Related Posts