On 9 September 2026, Ofcom opened an enforcement programme under the United Kingdom's Online Safety Act 2023 targeting the spread of illegal intimate images and non-consensual deepfakes, with a hard compliance deadline of 30 September 2026 for in-scope platforms to deploy hash matching. Services that miss it face fines of up to 10% of their global annual revenue, and Ofcom can block non-compliant services from reaching UK users.
The illegal-content duties themselves have applied since 17 March 2025. What is new is the supervision: Ofcom is now actively enforcing against a specific harm category, with a measurable technical benchmark and a three-week deadline, backed by its first dedicated enforcement programme for non-consensual intimate image abuse (NCII).
Who must deploy hash matching, and by when?
Every user-to-user platform and search service with UK users must have automated hash matching in place by 30 September 2026 to detect and block illegal intimate images, including explicit AI-generated deepfakes. The duty covers the more than 100,000 services Ofcom supervises, and it applies regardless of where a company is based: a service available to people in the UK must comply with UK law even if it is headquartered entirely outside the country.
Platforms that do not deploy hash matching must prove that their own systems and processes curb the spread of NCII by other equally effective means. Ofcom recommends that platforms adopt StopNCII.org, the hash matching tool run by its delivery partner SWGfL, which lets a person fingerprint an intimate image, including a deepfake, on their own device so it can be blocked before it is ever shared, without the image itself leaving their possession.
What are the consequences of missing the deadline?
The enforcement programme launched on 9 September 2026 gives Ofcom the machinery to monitor compliance directly. Firms that fail to meet their legal duties face "robust action": fines of up to 10% of qualifying worldwide revenue, and ultimately service-blocking powers. Ofcom has already shown it will use them: on 4 September 2026 it fined an online porn provider GBP 730,000 for lacking age checks, a clear signal that the regulator is in active enforcement mode across online-safety obligations.
How does this fit with the new 48-hour removal law?
Separately, by the end of 2026 Ofcom will consult on strengthening its Illegal Harms Codes of Practice to reflect a change in the law that will require platforms to remove non-consensual intimate image content within 48 hours of it being reported. That layers a takedown standard on top of the proactive hash matching duty: platforms face both a detection obligation, to stop content uploading, and a removal obligation, to take reported material down within 48 hours.
What is the wider evidence track, and why does it matter?
Alongside enforcement, Ofcom has invited evidence from academics, survivor and victim support groups, and others on how women's and girls' experiences online have changed since its Guidance for a Safer Life Online for Women and Girls. Submissions close on 6 November 2026. The findings will feed a report due next summer on industry progress; if that progress falls short, Ofcom says it will make formal recommendations to Government on where the Online Safety Act itself may need strengthening.
The scale is not abstract: SWGfL's research indicates over 369,000 women in the UK experience intimate image abuse each year, and demand on the Revenge Porn Helpline continues to grow sharply.
| Obligation | Date |
|---|---|
| Hash matching, or proof of equivalent efficacy, in place | 30 September 2026 |
| Evidence call on women's and girls' online experiences closes | 6 November 2026 |
| Consultation on strengthened Illegal Harms Codes of Practice (48-hour removal) | By end of 2026 |
| Industry progress report on harms to women and girls | Summer 2027 |
Subscribe to the free newsletter
Before the deadline, compliance teams should do three things: confirm whether your service is in scope, since any user-to-user or search service reaching UK users counts; check whether hash matching is already integrated or StopNCII.org adoption is viable; and document an equivalent efficacy case now if you will not deploy hash matching, because the burden of proving equivalence falls on the platform. Track the 48-hour removal consultation opening later this year, as it will become a coded duty. Continuous, per-jurisdiction real-time monitoring surfaces an enforcement step like this the moment Ofcom publishes it, before the deadline compresses your response window.
