Wikipedia Challenges Online Safety Act Rules in UK High Court This Week
Wikipedia's operator will argue in London's High Court of Justice this week that upcoming provisions of the U.K. Online Safety Act (OSA) could classify the site incorrectly and hence threaten the privacy of those Wikipedia contributors who choose to remain anonymous.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
Filed in May, case AC-2025-LON-001365 centers on the OSA's categorization regulations. Wikipedia's operator, the nonprofit Wikimedia Foundation, contends that Wikipedia risks being classified as a Category 1 service under the OSA. The case will be heard Tuesday and Wednesday, the foundation announced July 17.
Wikipedia shouldn't be subject to the same rules that were crafted for the internet's "riskiest commercial sites," Wikimedia Foundation General Counsel Stephen LaPorte wrote July 17, arguing it's "the only top-ten website operated by a non-profit and one of the highest-quality datasets used in training Large Language Models."
Imposing Category 1 requirements could undermine the privacy and safety of some of Wikipedia's 260,000 volunteer contributors, expose the encyclopedia to manipulation and vandalism, and divert resources from protecting people and improving Wikipedia, the foundation added.
Specifically, it would mean having to verify the identity of many Wikipedia contributors, "undermining the privacy that is central to keeping Wikipedia volunteers safe," Wikimedia said. That could expose contributors to data breaches, stalking, lawsuits or imprisonment by authoritarian regimes, it said.
Regulated user-to-user services fall under Category 1 when they have more than an average of 34 million active U.K. users per month and utilize a content recommender system; or have an average number of active monthly U.K. users exceeding 7 million, use a content recommender system and provide a function that lets users forward or share regulated user-generated content with other users of the service.
The rules define a “content recommender system” as one used by a provider of a regulated service that uses algorithms which, by means of machine learning or other techniques, determine or affect how someone's user-generated content may be encountered by other users of the service.
There are important questions about how several Category 1 duties can be reconciled with fundamental rights laws around the world, including the General Data Protection Regulation, a foundation spokesperson emailed us. In this case, however, the foundation is "highlighting the challenged Regulations' interference with the right to privacy, freedom of expression and freedom of assembly under the Human Rights Act; the case is not about the GDPR itself."
The organizations Electronic Frontier Foundation and Article 19 are backing Wikimedia. They said they're concerned that the OSA threatens online privacy and free speech as companies like Bluesky roll out age-verification mechanisms (see 2507100067).
The U.K. Office of Communications (Ofcom) is responsible for enforcing the OSA. In a June 30 update to its online safety implementation plan, it said it's planning to publish a register of categorized services "this summer."
Ofcom noted, however, that legislation setting the thresholds for determining which services are categorized "is currently subject to legal challenge." Ofcom said it's monitoring the situation. The statement refers to Wikimedia's case, Ofcom told us.