Meta Appeals Ofcom's Category 1 Designation for WhatsApp and Instagram

Meta has opened another front in its legal dispute with Ofcom, filing an appeal against the UK regulator's decision to place WhatsApp and Instagram in Category 1 under the Online Safety Act. The designation is the most consequential in the regime, because it triggers the heaviest set of duties a platform can face.

Related reading: Meta Ordered to Pay $25 Billion in New Mexico Privacy Case · OpenAI, Anthropic, Google and Meta Testify Under Oath as New York Weighs Ten AI Bills.

Lawyers for the Facebook parent served notice of the appeal during the week ending 20 September 2026, and the Upper Tribunal has received the papers, according to the Financial Times report that first disclosed the move and was subsequently covered by The Guardian and Silicon UK. Meta is contesting the categorisation itself rather than the underlying legislation.

The company's argument is narrow and specific. It says the Category 1 duties were designed for large public platforms, where content spreads to strangers at scale, and that they do not map onto WhatsApp's private one-to-one and small-group messaging. In a statement, a Meta spokesperson said the company was joining other firms in challenging "specific aspects of implementation", adding that these are "not challenges to the law itself, but how Ofcom has interpreted it".

What Category 1 actually requires

Ofcom's Category 1 register, published in July 2026, currently lists Facebook, Instagram, WhatsApp, YouTube, TikTok, X, Reddit, Snapchat, Pinterest, Roblox and Quora. Messenger and Threads are among the services Ofcom has identified as potentially meeting the same thresholds.

The duties that come with Category 1 include greater transparency and accountability, stronger user controls, measures to protect users from fraudulent advertising, and more detailed recording of how illegal content is handled. Ofcom is also developing further obligations covering user choice, identity verification, complaints processes and terms of service. Those were set out in a consultation published in July 2026, which closes on 2 October, with a final statement planned for mid-2027.

A service qualifies for Category 1 if it has more than 34 million average monthly UK users and uses a content recommender system, or more than 7 million UK users with a recommender and a feature that lets users forward or share user-generated content. Those thresholds are why a messaging app can be caught alongside video platforms and social networks.

The second challenge in a busy year

This is not Meta's first legal action against Ofcom in 2026. In May the company brought a judicial review over the fees Ofcom charges to fund its online safety work, arguing that calculating them from qualifying worldwide revenue places a disproportionate burden on larger firms. That case has a substantive High Court hearing scheduled for 13-14 October.

Ofcom has said it is operating in a litigious environment and intends to defend its decisions. "Meta, X and TikTok are challenging our efforts to gather information from them. Meta is challenging us on our ability to set fees and maximum fines," an Ofcom spokesperson said, according to Medianama. "Separately, Roblox, WhatsApp, Instagram and Quora are appealing our decisions in July to designate them as category 1 services. On all these fronts, we will robustly defend our reasoning and decisions."

The pattern extends beyond Meta. Roblox and Quora have appealed their own Category 1 designations to the Upper Tribunal. TikTok and X are challenging Ofcom information requests, and Ofcom has also opened a separate investigation into whether Meta provided complete and accurate information about WhatsApp's role in UK business messaging, which is unrelated to the categorisation appeal.

Oliver Griffiths, Ofcom's group director for online safety, told a House of Lords committee in September that the regulator was "operating in a highly litigious environment" and warned that running unnecessary risks would leave it exposed to well-funded legal challenges. A Lords inquiry is examining how the Act is being implemented.

Why the messaging argument matters

The substance of Meta's case turns on a question the Act left to the regulator: whether a private messaging service should carry the same duties as a public feed. WhatsApp's content is largely invisible to the public and is protected by end-to-end encryption, which limits what the company can inspect. Category 1 duties built around transparency and the handling of illegal content assume a platform that can see and moderate what flows through it.

Meta is not arguing that WhatsApp should be unregulated. It is arguing that the same obligations should not apply in the same way. If the Upper Tribunal accepts that reading, it would narrow how Ofcom can apply Category 1 duties to private messaging, and potentially to other encrypted services. If it rejects the appeal, the duties stand and the question of how to apply them to encrypted messaging remains open.

The timing adds pressure. The Act has been coming into force in stages since April 2025 and is not expected to be fully in force until 2027. Government officials have criticised the volume of legal challenges as a strategy to slow implementation. Whether that is the intent or not, the effect is delay: each appeal consumes time before obligations bite, and Ofcom's own roadmap stretches into late 2027.

A regime being settled in court

The Online Safety Act gives Ofcom broad powers and leaves much of the detail to secondary legislation and codes of practice. That design makes litigation likely, because companies have an incentive to contest the regulator's interpretation before they build compliance systems around it. Meta's appeal is one of several moving parts that will determine what the Act means in practice.

The fees challenge is the clearest example. Ofcom funds its online safety work by charging regulated companies, and the amount is linked to qualifying worldwide revenue. Meta argues that using global revenue as the base places a disproportionate burden on the largest firms, because a company's UK activity may be a small share of its global business. A ruling in October could force Ofcom to rework its funding model, which would affect every company in scope, not just Meta.

Information requests are the second front. TikTok and X are challenging demands for data, arguing that some go beyond what the law allows or are not proportionate. Those cases test how far Ofcom can compel disclosure, which matters because the regulator's ability to enforce depends on what it can see. If the challenges succeed, Ofcom's investigations could slow across the board.

The categorisation appeals are the third and, for users, the most consequential. Category 1 status determines which services face the strictest duties, and the appeals by Meta, Roblox and Quora ask the Upper Tribunal to narrow how those duties are applied. Each successful appeal reduces the number of services under the heaviest obligations, or the range of obligations they face.

For WhatsApp specifically, the practical question is what compliance looks like for a service Ofcom cannot read. The Act's transparency and illegal-content duties assume a platform that can inspect content and act on it. End-to-end encryption prevents that, and neither the Act nor Ofcom's guidance has fully resolved how a messaging service can meet the spirit of the rules without breaking its security model. That unresolved tension sits underneath the appeal and will outlast it.

What to watch

The first milestone is the October hearing on fees, which will test how far Ofcom can shape its own funding through the Act. The categorisation appeal is a separate track and may take longer to resolve.

The second is how Ofcom applies Category 1 duties to encrypted services in practice. Even if the designation survives, the regulator still has to write guidance that works for a service it cannot read. That is the harder problem, and it will shape what compliance looks like for WhatsApp regardless of the tribunal's ruling.

The third is whether other platforms follow. With Roblox and Quora already appealing and TikTok and X fighting information requests, the Online Safety Act's implementation is being settled in courtrooms as much as in consultations. For UK users, the practical effect is that the strictest duties are arriving later and in narrower form than the legislation's supporters once expected.

Cover: Wikimedia Commons photo of Riverside House, Bankside, London, the headquarters of Ofcom, by Jim Linwood (CC BY 2.0).