Ofcom Opens Enforcement Push on Illegal Intimate Images & AI Deepfakes

Key Takeaways

• Sept. 30 Deadline Approaches: Online platforms should have automated hash-matching technology in place by Sept. 30 to detect and prevent the sharing of illegal intimate images, including explicit AI-generated deepfakes, or demonstrate that other measures are equally effective.
• Enforcement Program Begins: Ofcom opened an enforcement program on Sept. 9 to monitor companies’ efforts to curb the spread of non-consensual intimate images, or NCII.
• Significant Penalties Are Possible: Companies that fail to comply with their legal duties could face penalties of up to 10% of their global annual revenue.
• 48-Hour Removal Requirement Ahead: Ofcom plans to consult by the end of 2026 on strengthening its Illegal Harms Codes of Practice to reflect changes to the law requiring platforms to remove reported non-consensual intimate image content within 48 hours.
• Broader Review Targets Harms to Women and Girls: Ofcom is seeking evidence through Nov. 6 on how effectively online services are addressing harms that disproportionately affect women and girls, with a report planned for next summer.

Deep Dive

Online platforms operating under the UK’s online safety regime have until the end of September to show they can stop illegal intimate images from spreading. Ofcom is no longer waiting for the deadline to find out whether they are ready.

The regulator opened an enforcement program on Sept. 9 to monitor how technology companies are addressing non-consensual intimate images, or NCII, including explicit deepfakes generated with artificial intelligence. By Sept. 30, platforms should have automated hash-matching technology in place to detect and prevent illegal intimate images from being shared. Those that do not will have to demonstrate that their own systems and processes are equally effective.

Ofcom is not prescribing a single product, but it is setting a standard companies will have to meet. With the deadline now measured in weeks, the regulator has made clear that inadequate controls can become an enforcement matter. Companies that fail to comply with their legal duties could ultimately face penalties of up to 10% of their global annual revenue.

“Technology companies now have a legal responsibility to put the right tools in place to stop this kind of deeply harmful content spreading on their services,” Almudena Lara, Ofcom’s online safety policy development director, said.

Lara said companies that ultimately fail to comply with their duties “can expect us to take robust action” under the enforcement program. Ofcom’s preferred tool is StopNCII.org, a hash-matching system operated by SWGfL, the organization behind the UK’s Revenge Porn Helpline. The regulator has formed a partnership with SWGfL to share information, expertise and evidence about effective approaches to combating intimate image abuse.

Hash matching allows an image to be identified through a digital fingerprint rather than by circulating the underlying file. With StopNCII, that fingerprint is created on the victim’s own device. The image itself does not leave their possession. The system can also be used for AI-generated deepfakes, an increasingly important part of the problem Ofcom is trying to address. Once the hash has been created, participating platforms can use it to identify and block matching material.

David Wright, chief executive of SWGfL, said research by the organization suggests more than 369,000 women in the UK experience intimate image abuse each year. Demand for its Revenge Porn Helpline, he said, continues to grow sharply.

“The infrastructure is already in place and ready for platforms to use,” Wright said.

That is part of what makes the Sept. 30 deadline consequential. The regulatory expectation is moving beyond having a process for dealing with an intimate image after someone reports it. Ofcom wants services to have systems capable of preventing illegal material from spreading in the first place.

Another deadline is coming behind it. By the end of this year, Ofcom plans to consult on strengthening its Illegal Harms Codes of Practice to reflect changes to UK law requiring platforms to remove non-consensual intimate image content within 48 hours of it being reported.

The regulator is also examining the broader treatment of women and girls online, where intimate image abuse is only one of the harms it has identified. Ofcom is seeking evidence from academics, survivor and victim support groups, and others about how women’s and girls’ experiences online may have changed since it published its Guidance for a Safer Life Online for Women and Girls last year.

The guidance called for action on the reach and spread of misogynistic abuse and sexual violence, coordinated pile-ons and harassment, privacy protections including limits on location-sharing features, and reporting and support tools for victims. Stakeholders have until Nov. 6, 2026, to respond.

Ofcom plans to use that evidence to inform a report next summer assessing the progress online services have made in reducing harms to women and girls. If the industry’s response falls short, the regulator said it will consider making formal recommendations to the UK government about where the Online Safety Act may need to be strengthened.

That leaves platforms facing scrutiny on two fronts. Ofcom will be looking at whether the protections already required of them are working while gathering evidence that could eventually shape what the law asks of them next.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.