Wikimedia seeks judicial review of categorised services under the Online Safety Act

On 8 May 2025, the Wikimedia Foundation (Wikimedia) announced that it is seeking leave to apply for judicial review of The Online Safety Act 2023 (Category 1, Category 2A and Category 2B Threshold Conditions) Regulations 2025 (Categorisation Regulations). These Regulations came into force on 27 February 2025 as secondary enacting legislation of the concept of “categorised services” under the Online Safety Act 2023 (OSA).

The OSA requires Ofcom to categorise platforms according to certain thresholds, with those services meeting the required criteria facing more onerous obligations to keep users safe. The Categorisation Regulations set the thresholds above which services become “categorised” under the OSA as follows:

• Category 1 services – user to user services that either: (1) use a content recommender system and have more than 34 million UK users on the user-to-user service element (representing c.50% of the UK population); or (2) allow users to forward or share user-generated content, use a content recommender system and have more than 7 million UK users on the user-to-user service element (representing c.10% of the UK population);
• Category 2A services – horizontal search services with more than 7 million UK users (representing c.10% of the UK population); and
• Category 2B services – services which allow users to send direct messages and which have more than 3 million UK users on the user-to-user service element (representing c.5% of the UK population).

The aim of categorisation under the OSA is to tailor the extent of obligations faced by services depending on how likely users are to encounter harmful content, with Category 1 most obviously targeted at large social media platforms. While Ofcom has not yet confirmed which services will fall under each category, it has already requested further information from several services (including Wikipedia) and is expected to make its first categorisation decisions this summer.

Wikimedia, the non-profit that hosts Wikipedia, has argued that the Categorisation Regulations could “expose the encyclopaedia to manipulation and vandalism”. It is concerned there is “significant risk” that Wikipedia will be designated as a Category 1 service on the basis of the platform’s popularity and the nature of some of its features. For example, Wikipedia’s New Pages Feed may constitute a “content recommender system”, while its daily Featured Picture could be considered a type of content “forwarding or resharing” functionality.

If caught under Category 1, Wikipedia would be subject to the highest level of obligations under the OSA. Wikimedia has expressed fears about how this would affect its global community of volunteers who create and edit content. In particular, it is concerned about the implications of the Category 1 requirement for user verification (i.e. offering all adult users the option to verify their identity) and content filtering (i.e. providing tools for users to filter out unverified users or content). In addition to the obvious administrative burden of such requirements, Wikimedia believes that user verification and content filtering requirements could also expose users to data breaches, stalking, vexatious lawsuits or even imprisonment by authoritarian regimes.

Wikimedia has emphasised that it is only seeking judicial review of the Categorisation Regulations, and is not disputing the underlying concept of service categorisation as set out in the OSA. Nevertheless, if successful, Wikimedia’s challenge could have broader implications for other services facing additional obligations under the OSA. In particular, non-profits and services which purport to act in the public interest will be watching on with interest.