UK online safety / Rules explained
What Are the New Ofcom Deepfake and Intimate Image Rules?
What platforms must do now, and what still lies ahead.
The short answer
Ofcom’s new codes tell certain online services to detect known illegal intimate images, including AI deepfakes, through hash matching or an equally effective method. The measure starts today; who it covers and how it works need a closer look.
01 / The new platform measure
What does Ofcom now expect platforms to do?
The new measure sits inside Ofcom’s Illegal Content Codes of Practice under the Online Safety Act. It applies to defined image-capable user-to-user services according to their risk and size, and to large general search services. The user-to-user code includes high-risk adult, file-sharing and other qualifying services, as well as large services assessed at medium or high risk. It is not a blanket requirement for every small website or for every private message.
- Find known abuse
- Use effective hash matching where the code recommends it and it is technically feasible. The tool compares an image or video with a database of digital fingerprints of known abusive content.
- Make a judgement
- A match can trigger review or removal under the code’s conditions. The code includes human-review and quality safeguards to reduce mistaken decisions.
- Stop recirculation
- Analyse relevant existing content within a reasonable time and new relevant material before, or as soon as practicable after, UK users can encounter it.
How a known-image match works
- A fingerprint existsAn image has a digital hash in a suitable reference set.
- The service comparesRelevant uploads or search imagery are checked for a match.
- Review or actThe service assesses the result and swiftly removes illegal content when appropriate.
Ofcom recommends databases equivalent to or better than StopNCII.org. The tool allows an adult to create a digital fingerprint on their own device without uploading the image itself to StopNCII. Hash matching can help recognise known images, including altered versions when perceptual matching works, but it cannot guarantee detection of every new deepfake. Ofcom says services without the recommended measure must demonstrate another equally effective way to curb the spread of illegal intimate imagery.
02 / Three distinct legal tracks
Deepfake offences, platform duties and the 48-hour law
The word deepfake describes how some images are made; the legal issues here centre on intimate content and consent. The Crown Prosecution Service says sharing or threatening to share intimate images without consent is an offence, including material that only appears to show a person in an intimate state. Separate adult deepfake-creation offences came into force on 6 February 2026, while offences concerning the making or supply of purported intimate image generators took effect on 29 June.
Individual conduct
Criminal law addresses people who share or threaten to share intimate imagery without consent and, under separate provisions, those who create or request an adult purported intimate image without consent or reasonable belief in it. Supplying certain nudification tools is another offence. These are not the same as Ofcom’s platform code.
Platform systems
The Online Safety Act makes regulated services assess and reduce the risk of priority illegal content. The new Ofcom code gives a recommended technical measure for identifying and limiting intimate image abuse. Services can choose a different effective method to meet their duties, but Ofcom can investigate failures.
48-hour removal
The Crime and Policing Act 2026 added a duty to remove qualifying non-consensual intimate images as soon as reasonably practicable and within 48 hours after a valid report by the person shown or someone acting for them. Parliament was told that, although the provision commenced on 29 June, the duty applies to platforms once its relevant codes come into force. Ofcom said on 9 September that it would consult on those codes by the end of 2026.
Why the dates matter: the 30 September hash-matching code is in force. Do not confuse it with the 48-hour removal timetable, which has a separate implementation step. Existing duties to act swiftly against illegal content still apply.
The EU has a separate deepfake disclosure rule about telling viewers when media is synthetic. The UK measure here deals with illegal intimate imagery and platform systems to limit its spread.
03 / Enforcement and practical help
What happens if a platform fails to act?
Ofcom opened an enforcement programme on 9 September to examine higher-risk services, with particular attention to adult and instant-messaging sectors. It says it will assess hash matching or alternative measures, engage with providers and consider formal enforcement where it finds possible non-compliance. A code is a recommended route to complying with the Act; the underlying legal duties are what Ofcom enforces. Serious failures can lead to substantial financial penalties, including up to 10% of qualifying worldwide revenue.
The code covers relevant content UK users can encounter publicly on a service and relevant visual search results. Its safeguards require attention to false positives, human review, privacy and freedom of expression. It does not mean Ofcom has ordered a universal scan of everyone’s private photos or that every image match is automatically a criminal finding.
If an image concerns you
The short version
The new Ofcom codes take effect on 30 September 2026: relevant services should detect known illegal intimate images, including explicit deepfakes, through hash matching or an equally effective approach. Criminal offences concerning non-consensual imagery already exist. The separate 48-hour reported-image removal duty still awaits its own codes before it applies to platforms.
Ofcom deepfake rules FAQs
What changed on 30 September 2026?
Ofcom’s strengthened Illegal Content Codes came into force. They recommend that specified higher-risk user-to-user services and large general search services use hash matching to detect known illegal intimate images, including explicit deepfakes, or demonstrate an equally effective alternative.
Do the rules cover AI-generated intimate images?
Yes. A non-consensual intimate image can be real or AI-generated. The platform measure concerns known illegal intimate-image content; separate criminal offences cover non-consensual sharing, threats and the creation or request for creation of adult purported intimate images.
Must every website use hash matching?
No. The code measure applies to defined services according to risk, size and type, including certain image-capable user-to-user services and large general search services. A provider can use other equally effective measures to meet its legal duties.
Is the 48-hour removal deadline in force today?
No. The 48-hour duty was added to the Online Safety Act in 2026, but Parliament said it applies to platforms when the relevant codes take effect. Ofcom plans to consult on those codes by the end of 2026. Existing illegal-content duties still require swift action.
Hasnaat Mahmood
Broadband & Technology Expert
Hasnaat covers UK connectivity, Ofcom decisions and internet policy for FindCheapBroadband.