Investigation into the provider of an adult content-sharing service and its compliance with duties to protect its users from illegal content

Background

Part 3 of the Online Safety Act imposes duties on providers of regulated user-to-user services to use proportionate:

a. measures to prevent individuals from encountering priority illegal content – including NCII – by means of the service;

b. measures to effectively mitigate and manage the risk of the service being used for priority offences or harm to individuals arising on the service as identified in the most recent ‘Illegal Content Risk Assessment’; and

c. systems and processes designed to minimise the length of time for which any priority illegal content is present and swiftly take it down when they are made aware of its presence.

Protecting women and girls from online harms is a key strategic priority for Ofcom. In November 2025, Ofcom published guidance aimed at online services to help make their platforms safer for women and girls’. In May 2026, we stated in Ofcom’s online safety priorities that we would build on enforcement action we are already taking in this area and take action against services that fail to ensure proactive protections are in place to identify and swiftly remove NCII. To achieve this, Ofcom also issued a statement in May 2026 in which we announced new measures in our Illegal Content Codes of Practice. These measures recommend that those service providers that fall within scope use hash matching technology to detect NCII, for the purpose of then making an illegal content judgement.

Enforcement programme

On 9 September 2026, Ofcom opened an enforcement programme to assess the measures being taken by services that present particular risks of harm to UK users to meet their Illegal Content Duties in respect of NCII. The programme focuses on services’ implementation of new hash matching measures recommended in the Codes of Practice, or any alternative measures implemented to comply with their duties.

Services in the adult and instant messaging sectors are at a particularly high risk of being used for the upload and dissemination of NCII and, so are the focus of this enforcement programme. We wrote to some relevant services prior to the opening of the Enforcement Programme and again once the programme was opened outlining the relevant measures, reminding them of their need to comply with the duties before 30 September 2026 and seeking information on what steps they were taking to ensure compliance. Some services engaged with us on this, while others did not.

Investigation

Today, 26 October 2026, Ofcom has opened an investigation into the provider of an adult content-sharing service into whether it has failed to comply with:

• Section 9 of the Act by not carrying out, and keeping up to date, a suitable and sufficient illegal content risk assessment; and
• Section 10 of the Act by not adopting the measures set out at ICU C14 of the Illegal Content Codes of Practice for user-to-user services or implementing any alternative measures.

Ofcom’s Online Safety Enforcement Guidance sets out how Ofcom will normally approach enforcement under the Act. This includes our approach to information gathering and analysis and the procedural steps we must take to fairly determine the outcome of the investigation.

Where we identify compliance failures, we can impose fines of up to £18m or 10% of qualifying worldwide revenue (whichever is greater). In the most serious cases of non-compliance, and where appropriate given risks of harm to individuals in the UK, we can seek a court order to require third parties to take action to disrupt the business of the provider. This may require third parties (such as providers of payment or advertising services, or Internet Service Providers) to withdraw services from, or block access to, a regulated service in the UK.

We will provide an update on this investigation in due course.