Ofcom opened its first two investigations under the UK’s leaked-nudes enforcement programme on 26 October, targeting an “adult image-hosting service” and an “adult content-sharing service” over their handling of non-consensual intimate images (NCII) — but it still won’t say which platforms they are.
Why it matters to you: this is the regulator actually testing the law that’s supposed to protect you, four weeks after a compliance deadline passed with no public action at all. It’s proof the duty has teeth, but the fact Ofcom is keeping the platforms’ names secret — and that some sites are simply geo-blocking the UK rather than complying — tells you the system still has real gaps you need to plan around.
What Ofcom actually opened a case on
The two investigations sit inside Ofcom’s wider NCII enforcement programme, launched on 9 September under sections 10(2) and 10(3) of the Online Safety Act 2023, which require platforms to take proportionate steps to stop users encountering illegal content — including leaked or deepfaked intimate images — and to remove it quickly once they know about it. Ofcom set a 30 September deadline for in-scope services to have “hash matching” detection tools in place, or an equally effective alternative, backed by fines of up to 10% of global annual revenue.
We reported three weeks after that deadline that Ofcom’s public case register still showed nothing filed. That changed on 26 October: Ofcom confirmed it has opened investigations into the providers of the two unnamed services to examine whether they’re meeting their duties under the Act. It’s a direct, if overdue, sequel to the separate 48-hour NCII takedown duty under the Crime and Policing Act 2026, which has been in force since 29 June.
Why won’t Ofcom name them?
Unusually for Ofcom, which has happily named fapello.com and Xgroovy.com in age-assurance fines, and opened separate, named probes into Aylo’s Pornhub and Bit Hive’s Eporner, the two services under investigation here haven’t been identified. UK internet law specialist Neil Brown noted the gap publicly, speculating that Ofcom may be following the same approach it took with a suicide-discussion forum it also declined to name — the logic being that identifying a site hosting non-consensual images risks sending more people looking for the content, or re-victimising the people depicted in it. Ofcom hasn’t confirmed that reasoning, and says only that it will provide updates “in due course.”
The geo-block workaround you should know about
The more useful detail buried in Ofcom’s update is what’s happening to the other platforms it’s been watching. Ofcom says it has engaged with 25 high-risk services as part of the programme: some have started implementing the StopNCII.org hash-matching system, but several have simply geo-blocked UK users instead of building compliance into their product, which Ofcom says it’s now monitoring. That matters practically: a site blocking UK IP addresses doesn’t make leaked content disappear, it just makes the platform someone’s local VPN away from being just as accessible as before, while sitting outside Ofcom’s effective reach. If you’re tracking where your own content turns up, a UK geo-block is not the same thing as a takedown.
Independent analysis site Tracked Changes, which fact-checks Ofcom’s own releases against their cited evidence, has flagged that the regulator has previously overstated its supporting statistics — its September announcement cited “over 369,000 women” affected annually, a figure that doesn’t actually appear in the Revenge Porn Helpline report it linked as the source (that report logged 1,890 contacts to the helpline in 2025). None of that undermines the law itself, but it’s a reminder to read Ofcom’s own framing carefully rather than taking every number at face value.
What to do now
- Don’t wait for Ofcom’s case register to move — create a case at StopNCII.org now if you haven’t, hashing your existing explicit content pre-emptively so it’s blocked automatically on partner platforms if it ever leaks.
- If your content is already circulating on an obscure forum or image board, report it to the host directly citing the 48-hour NCII duty, and separately submit it to StopNCII — don’t assume an investigation into “someone” covers your case.
- If a platform geo-blocks the UK rather than removing content you’ve reported, that’s not resolution — keep monitoring, since the material is often still live for anyone outside the block.
- Keep dated records of every report you make (screenshots, timestamps, reference numbers), in case you need to escalate non-compliance to Ofcom yourself.
- Watch Ofcom’s open cases register for updates — these two investigations are the first public test of whether the fines Ofcom has threatened actually land.
This is general information, not legal advice — speak to a qualified solicitor if you’re dealing with an active case of image-based abuse.
If you’re dealing with leaked or deepfaked content right now, the Revenge Porn Helpline (0345 6000 459) offers free, confidential support, and speaking to them doesn’t commit you to any further action.
