Open
Duties under the Online Safety Act 2023 (‘the Act’) to protect users from encountering and sharing non-consensual intimate imagery (‘NCII’)
9 September 2026
Ofcom has opened a programme of work, or ‘enforcement programme’, to assess the measures being taken by providers of services that present particular risks of harm to UK users from NCII to ensure users do not encounter or disseminate such content on their services. This programme will focus on hash matching measures.
Relevant Legal Provision: Sections 10(2) and 10(3) of the Online Safety Act 2023.
Ofcom has today opened investigations into the providers of two adult services. Due to the nature of these sites, we have decided not to name them or their provider. We are investigating whether these providers have failed/are failing to comply with their duties under the Online Safety Act 2023 (the 'Act’) to use proportionate:
a) measures to prevent individuals from encountering priority illegal content – including non-consensual intimate image abuse (‘NCII’) – by means of the service;
b) measures to effectively mitigate and manage the risk of the service being used for priority offences or harm to individuals arising on the service as identified in the most recent ‘Illegal Content Risk Assessment’; and
c) systems and processes designed to minimise the length of time for which any priority illegal content is present and swiftly take it down when they are made aware of its presence.
The bulletins for each investigation can be found below:
- Investigation into the provider of an adult image-hosting service
- Investigation into the provider of an adult content-sharing service
We will provide an update on these investigations in due course.
As noted upon opening the NCII Enforcement Programme on 9 September 2026, formal enforcement investigations form only one part of our broader strategy to drive compliance with the relevant duties under the Act in respect of NCII. To date, we have proactively engaged with 25 services that we consider to be at high-risk of NCII. Through that engagement, we have identified that several services have already taken steps to come into compliance and are in the process of implementing the StopNCII hash matching system.
We are also aware that several services have implemented a geo-block to prevent people in the UK accessing their services, which Ofcom continues to monitor.
We are continuing to engage with services through our supervisory function to further drive compliance and are prepared to open further investigations should we consider it appropriate. We will provide an update on our ongoing supervision engagement in due course.
We will build on this work by expanding our engagement to additional smaller, high-risk services to drive compliance, including by providing targeted resources to support the use of intimate image abuse hash matching.
Background
Part 3 of the Act imposes duties on providers of regulated user-to-user services to use proportionate:
- measures to prevent individuals from encountering priority illegal content – including NCII – by means of the service;
- measures to effectively mitigate and manage the risk of the service being used for priority offences or harm to individuals arising on the service as identified in the most recent ‘Illegal Content Risk Assessment’; and
- systems and processes designed to minimise the length of time for which any priority illegal content is present and swiftly take it down when they are made aware of its presence.
Protecting women and girls from online harms is a key strategic priority for Ofcom. In November 2025, Ofcom published guidance aimed at online services to help make their platforms safer for women and girls’. In May 2026, we stated in Ofcom’s online safety priorities that we would build on enforcement action we are already taking in this area and take action against services that fail to ensure proactive protections are in place to identify and swiftly remove NCII. To achieve this, Ofcom also issued a statement in May 2026 in which we announced new measures in our Illegal Content Codes of Practice. These measures recommend that those service providers that fall within scope use hash matching technology to detect NCII, for the purpose of then making an illegal content judgement. They come into force on 30 September 2026.
Services in the adult and instant messaging sectors are at a particularly high risk of being used for the upload and dissemination of NCII and, so they will be the focus of this enforcement programme. We have already written to some of these relevant services to outline the measures and remind them of their duties to comply when the duties come in.
Enforcement Programme
Today, 9 September 2026, Ofcom is opening an enforcement programme to assess the measures being taken by services that present particular risks of harm to UK users to meet their Illegal Content Duties in respect of NCII. The programme will focus on services’ implementation of new hash matching measures recommended in the Codes of Practice, or any alternative measures implemented to comply with their duties.
As part of the Programme, we will:
- identify services that present particular risks of harm to UK users through the presence or dissemination of NCII;
- assess the measures being taken by providers of such services to comply with the Illegal Content Duties in respect of NCII;
- drive compliance with these measures across the sector, by using a mix of supervision engagement, wider industry communications and formal enforcement investigations; and
- where potential non-compliance is identified, determine whether formal enforcement action may be appropriate
The new measures in the Illegal Content Codes of Practice will come into force on 30 September 2026, and we expect services in scope of the measures to have brought themselves into compliance by this date, or to be taking steps to come into compliance shortly thereafter.
Services who are not compliant, or are not taking steps to come into compliance, may be subject to formal enforcement action.
We will provide further updates in due course.