Ofcom opened a formal enforcement programme on 9 September requiring UK platforms to use “hash matching” technology to catch and block non-consensual intimate images (NCII), including AI deepfakes, with a compliance deadline of 30 September and fines of up to 10% of global annual revenue for firms that fail. By the end of this year it plans to consult on going further still: a hard legal requirement to remove any reported NCII within 48 hours. The catch, three weeks after that first deadline passed, is that Ofcom’s own public register of open cases does not list a single investigation under the programme.
Why it matters to you: if your real or AI-faked intimate images end up on a platform without your consent, there is now a specific, named legal duty forcing that platform to act fast, backed by one of the largest fines in UK regulatory law. You do not have to wait for Ofcom to test that duty in public to use it, or to use the free tool regulators are pointing platforms toward to stop re-uploads automatically.
What the law actually requires
Sections 100 and 101 of the Crime and Policing Act 2026, in force since 29 June, amend the Online Safety Act to create a standalone takedown duty for intimate image abuse. Once a platform receives a valid report from the person depicted, or someone acting for them, it must remove the content “as soon as is reasonably practicable and in any event within 48 hours”, and take steps to stop the same or substantially similar content reappearing. Ofcom enforces the duty and can fine non-compliant platforms; in the most serious cases, senior managers who ignore an Ofcom enforcement decision can face personal criminal liability. It is a close cousin of the US TAKE IT DOWN Act’s 48-hour rule, which American platforms have been living under since May.
The deadline that just passed
Separately, Ofcom’s 9 September enforcement programme told platforms they needed hash-matching tools, or an equally effective alternative, in place by 30 September to automatically detect and block illegal intimate images before they spread. Ofcom is partnering with SWGfL, the charity behind the StopNCII.org hashing tool and the Revenge Porn Helpline, to share evidence on what is and isn’t working. Almudena Lara, Ofcom’s online safety policy director, didn’t mince words in the announcement:
“Technology companies now have a legal responsibility to put the right tools in place,” and firms that fail to comply “can expect us to take robust action.”
That “robust action” can mean fines up to 10% of global annual revenue, or £18 million, whichever is greater, under the same Schedule 13 powers Ofcom has already used against porn sites for age-check failures — a track record we’ve covered before.
Is anyone actually being punished for it?
Not yet, at least not publicly. As of this week, Ofcom’s own open cases register shows nothing filed under the NCII programme, three weeks past the hash-matching deadline. That isn’t proof nothing is happening behind closed doors — Ofcom’s age-assurance enforcement programme took months to produce its first named case before the fines started landing. But it is a reminder that a new legal duty on paper and an active, named investigation are two different things, and creators dealing with leaked or deepfaked content today shouldn’t wait on either to protect themselves.
The tool you can use yourself, right now
StopNCII.org, the SWGfL-run service Ofcom is leaning on, lets anyone generate a “hash” — a digital fingerprint — of an intimate image or video without ever uploading the image itself. The hash gets shared with partner platforms, which automatically compare new uploads against it and block matches before they’re ever seen. Crucially, the list of partners already includes OnlyFans itself, alongside Meta’s apps, X, TikTok, Reddit, Patreon, Pornhub and REDGIFS. It also works on AI-generated deepfakes of you, not just real photos, and you can submit images pre-emptively, before anything has leaked, as a form of insurance. For a deeper breakdown of how deepfake protection tools fit together, see our creator’s guide to deepfakes and AI impersonation.
It has real limits: it only works on partner platforms, not the open web or encrypted messaging apps, and a cropped, filtered or re-encoded copy won’t match the original hash, so you’ll need to submit variants separately if you spot them circulating. One creator told Nude Newz what it was like to be leaked to revenge porn sites before any of this existed, and to be told by police there was nothing they could do — exactly the gap these tools and this law are supposed to close.
What to do now
- Create a case at StopNCII.org and hash your existing explicit content pre-emptively, even if nothing has leaked yet — save your case number and PIN somewhere safe, since they can’t be recovered if lost.
- If content is already circulating, report it directly to the hosting platform first, citing the 48-hour NCII takedown duty under the Online Safety Act, then submit the same material to StopNCII.org.
- Hash cropped, filtered or re-encoded versions separately — the system only reliably matches exact or near-exact copies.
- Keep dated records of your report (screenshots, timestamps, reference numbers) in case you need to escalate a platform’s non-compliance to Ofcom.
- If you’re under 18 in any of the images, StopNCII will direct you to TakeItDown.NCMEC.org instead — it isn’t the right tool for that situation.
This is general information, not legal advice — speak to a qualified solicitor if you’re dealing with an active case of image-based abuse.
If you’re dealing with leaked or deepfaked content right now and want to talk it through, the Revenge Porn Helpline (0345 6000 459) offers free, confidential support, and speaking to them doesn’t commit you to any further action.
