A judge can now order an internet address or domain blocked for a year, with no duty to say how often it happens. The child-protection duty this site found dark in September still has no date, five orders after Royal Assent.
Estimated reading time: 7 minutes
In short. The Crime and Policing Act 2026 (Commencement No. 5) Regulations 2026, made 3 November 2026, switches on section 170 [2] and Schedule 18 of the Act from 30 November: a power letting police, the National Crime Agency, HMRC, the FCA and Gambling Commission enforcement officers apply to a Crown Court judge, or in Scotland a sheriff, for an order forcing an internet provider to block an address, or a domain registry to suspend a name, for up to 12 months [4] [3]. The government's own serious crime factsheet says the power carries "multiple safeguards" and expects it to be rarely used against domestic providers, but does not mention that applications may be made in secret, that an order can gag the person it is made against with no statutory limit on how long, or that nothing in the Act requires anyone to report how often any of this happens [7]. The same commencement order leaves a child-protection duty this site found enacted but dark in September still with no date, five commencement orders after Royal Assent. Two documented mistakes: four stars.
This is the third piece this site has published on the Crime and Policing Act 2026's [1] commencement programme since 14 September, when a teardown of the Online Safety Act found the newer Act had inserted three priority pornography offences and a coroner-to-Ofcom child-death alert duty into it, none of them switched on [8]. A follow-up on 24 October found a different provision, a victim's right to escalate a rejected anti-social behaviour case review, pulled from its own commencement date five days before it was due to start, with no reason given [9].
Commencement No. 4, made 15 October 2026 and taking effect 6 November, closes two of the three September gaps: sections 104, 106 and 107, creating the strangulation, incest and under-16 apparent-pornography offences, come into force that day, each carrying a fresh cross-reference into the Online Safety Act's Schedule 7 so platforms must treat the new offences as priority content [5]. Section 247, the duty requiring a senior coroner to notify Ofcom within five working days when a deceased child's online activity may be relevant, appears in neither No. 4 nor No. 5. Only the narrowest limb of section 247, a drafting footnote about referencing a document "as amended from time to time", has ever commenced, on 29 June 2026 [6]. Across five numbered commencement orders and a sixth instrument amending the third, the substantive duty to tell Ofcom when a child has died remains exactly where it was in September: enacted, and switched off.
The claims, tested
| The factsheet's own words | What the Act's own text says | Verdict |
|---|---|---|
| "The UK currently utilises strong public/private partnerships where industry will, in the vast majority of cases, voluntarily suspend domain names and IP addresses which are facilitating criminal activity in the domestic market... they will continue to be the first port of call", with court orders needed because "most domain name registries and registrars are situated outside of the UK" [7] | Schedule 18's own conditions authorise a domestic order with no requirement to attempt voluntary cooperation first: a judge may grant one where "the IP address is allocated to a device located in the United Kingdom", or where a UK person is using the address or is a victim of the crime it facilitates (paragraph 2(3)) [3] | The factsheet frames the power as a backstop for uncooperative foreign registries; the statute it describes authorises the same order against a purely domestic address with nothing written in requiring the voluntary route to be tried first |
| "There are multiple safeguards built in to ensure the IP address and domain name provision is used proportionately": senior officer authorisation, a court necessity-and-proportionality test, and an industry right to "apply to the court to have the order varied or discharged" [7] | Schedule 18 also allows an application "to be made without notice to a judge in chambers" (paragraph 10(1)), lets an order impose a non-disclosure requirement on the person it is made against that need only "specify or describe when" it expires, with no cap stated anywhere in the Schedule (paragraph 6(3)), and contains no duty, to Parliament or anyone else, to report how many applications are made, granted or refused (paragraphs 1 to 21 in full) [3] | The safeguards named in the factsheet are real but partial; the gap between a hearing the subject never knows about and a gagging order with no statutory end date goes unmentioned in the document meant to reassure the public using those exact words |
A backstop that does not read like one
Schedule 18 defines "serious crime" with two alternative tests. The first needs an offence for which an adult with no previous convictions "could reasonably be expected to be sentenced to imprisonment for a term of 3 years or more" (paragraph 19(2)(a)). The second needs no sentencing threshold at all: conduct that "involves the use of violence, results in substantial financial gain or is conduct by a large number of persons in pursuit of a common purpose" also counts (paragraph 19(2)(b)) [3]. "Substantial financial gain" and "a large number of persons" are not defined anywhere in the Schedule or, on a full-text search of the Act, anywhere else in it.
The factsheet's international framing rests on a true fact: most domain registries sit outside the UK and will not act without a court order, so the power genuinely is needed there [7]. What it does not say is that the same paragraph of the same Schedule gives a judge exactly the same power over an address "allocated to a device located in the United Kingdom", with the same conditions, the same non-disclosure option and the same absence of a requirement to show voluntary cooperation was tried and failed first (paragraph 2(3)(d)) [3]. "We expect orders against domestic providers to be rarely needed" is the factsheet's own description of that gap, twice, in its FAQ [7]. An expectation is not a limit written into the Act a reader could check later.
A gagging order with no end date in the statute
Paragraph 5 of Schedule 18 lets an appropriate officer apply for a suspension order without the person it targets ever being told the application happened, and paragraph 10(1) confirms the application itself can be made "without notice to a judge in chambers" [3]. If the judge grants it, paragraph 6 lets the order carry a non-disclosure requirement barring the subject from telling anyone it exists. The only statutory limit on how long that silence lasts is procedural, not temporal: the order "must specify or describe when the requirement is to expire" (paragraph 6(3)) [3]. Nothing in the Schedule caps that figure, in contrast to the suspension order itself, which cannot exceed 12 months and can only be extended by a fresh application a judge must separately approve (paragraphs 1(3) and 8) [3].
A full-text search of the Crime and Policing Act 2026 for the words "report", "annual" or "transparency" in connection with Schedule 18 or section 170 returns nothing: no duty on the Secretary of State, the senior officers who authorise applications, or the courts that grant them, to publish how many suspension orders have been sought, granted, refused, varied or allowed to lapse. The factsheet's own "safeguards" answer does not claim one exists either; it stops at senior authorisation, the court test and the industry right to challenge an order already made [7]. A member of the public reading that answer has no way to learn, now or after the power has been used for years, how often a judge has ordered part of the internet switched off.
Two documented mistakes, four stars. (1) The government's own serious crime factsheet frames the IP address and domain name suspension power as a backstop for foreign registries that will not cooperate voluntarily, without disclosing that Schedule 18's own conditions authorise identical orders against purely domestic addresses, with no requirement to show the voluntary route was tried first. (2) The same factsheet lists "multiple safeguards" for the power without mentioning that applications can be made without notice to the subject, that an order can carry a non-disclosure requirement with no statutory maximum duration, and that no provision in the Act requires anyone to report how often the power is used.
Credit where due
The safeguards the factsheet does claim are real and verifiable in the statute, not invented. Senior authorisation is a genuine precondition: in England and Wales or Northern Ireland an application must come from, or be authorised by, an officer "of at least the rank of superintendent" or an equivalent grade at the National Crime Agency, HMRC, the FCA or the Gambling Commission (paragraph 14(2)) [3]. The necessary-and-proportionate test is written into the conditions a judge must apply, not left to administrative discretion (paragraph 2(4)) [3]. The 12-month cap on the order itself, and the right of "any person affected" to apply for its discharge or variation at any time, are both in the Schedule's own text, not asserted only in the factsheet (paragraphs 1(3) and 7(1)) [3]. And on the September findings, the government has moved: two of the three priority pornography offences flagged dark then commence in two days, under an order made three weeks before this one.
Verdict
Four stars, from two documented mistakes. Parliament gave this power real limits: a judge's sign-off, a necessity test, a 12-month ceiling, a right to challenge. What it did not give the public is a way to check how often any of that machinery is actually used, and the document written to reassure people about the power does not mention the gap. Five commencement orders into this Act, the duty to tell Ofcom when a child has died is still switched off, while the government found three weeks to switch on a wider power to take parts of the internet offline.
Sources
- Crime and Policing Act 2026, legislation.gov.uk.
- Crime and Policing Act 2026, section 170, legislation.gov.uk.
- Crime and Policing Act 2026, Schedule 18, legislation.gov.uk.
- The Crime and Policing Act 2026 (Commencement No. 5) Regulations 2026, legislation.gov.uk, made 3 November 2026.
- The Crime and Policing Act 2026 (Commencement No. 4) Regulations 2026, legislation.gov.uk, made 15 October 2026.
- Crime and Policing Act 2026, section 247, legislation.gov.uk.
- Crime and Policing Act 2026: serious crime factsheet, GOV.UK, updated 30 September 2026.
- Parliament gave the Online Safety Act three new crimes to police and a way to flag a dead child's phone use to Ofcom, trackedchanges.co.uk, 14 September 2026.
- Victims were five days from a new right to challenge a rejected anti-social behaviour case review when the Home Office quietly cancelled it, trackedchanges.co.uk, 24 October 2026.