Ofcom called the spread of non-consensual intimate images urgent in February and promised new rules by summer. The rules take effect on 30 September, seven months on, with formal enforcement waiting for a date Ofcom has not given.
Estimated reading time: 6 minutes
In short. On 18 February 2026 Ofcom said it was fast-tracking a decision on "hash matching" technology to stop non-consensual intimate images spreading online, calling the need "urgent" and expecting the rule in force "as soon as this Summer." By its own 18 May statement, summer had already become autumn. The amended codes were not formally issued until 9 September and come into force on 30 September, and Ofcom's own guidance says formal enforcement starts only "after" that date, with no date given for when. Two documented mistakes: four stars.
Some of the delay traces to a statutory clock Ofcom cannot skip: once a code amendment is issued, the Online Safety Act gives it a fixed 21 days before it can take effect, and 9 September plus 21 days is exactly 30 September [1]. What is not explained by any statute is why "as soon as this Summer" became "autumn" three months before that clock even started running, or why the one part of the process Ofcom fully controls, when it starts enforcing, is the one part left open.
Intimate image abuse is not a marginal problem. Ofcom's own statement records over 22,000 reports made to the Revenge Porn Helpline in 2024, a 26.9 per cent rise in recorded offences in England and Wales between the year to June 2022 and the year to June 2025, and 98 per cent of the images reported to the helpline showing women [2] (p.19). That is the evidence base Ofcom cited for urgency in February. The question this piece tests is whether its own timeline matched the urgency it claimed.
The claims, tested
| Ofcom's claim | What we found | Verdict |
|---|---|---|
| "Given the urgent need for better online protections for women and girls... we have decided to accelerate our timeline... we would expect any new Illegal Harms Code measures to come into effect as soon as this Summer" [3], 18 Feb 2026 | Ofcom's own next update on the same measure, published three months later, put it differently: "the draft amendments... will be published separately in Summer 2026. They are therefore not yet in force... we expect the draft amendments... to come into force in Autumn 2026" [[2]] (p.4, paras 1.7-1.8), repeated in the accompanying press release [4] | "This Summer" did not survive Ofcom's own next progress report, let alone reality |
| Amended codes "come into force on 30 September 2026 in accordance with section 43(4) of the Act" [5] (p.3), issued 9 Sep 2026 | Section 43(4)(b) of the Online Safety Act fixes a code's start date at 21 days after issue [[1]]. 9 September plus 21 days is 30 September exactly: the statutory floor, not a further discretionary delay | Credit where due: once issued, the code moved at the fastest speed the law allows |
| "Today we formally issue our amended codes... they will come into effect on 30 September. Any formal enforcement action will be launched after 30 September" [6], updated 9 Sep 2026 | No date, guidance document or commencement notice anywhere in Ofcom's published material on this measure says when "after 30 September" actually begins | The one stage in this process not fixed by statute is the only one left undated |
The mistakes, counted
A "this Summer" promise Ofcom itself abandoned before autumn arrived (1). The 18 February fast-track announcement was explicit about both urgency and timing: the decision was accelerated "given the urgent need for better online protections for women and girls," and Ofcom said it "would expect" the new code measures "to come into effect as soon as this Summer" [[3]]. By 18 May, its own statement on the same measure had already moved the goalposts, twice, in the same short passage: first noting the amendments "will be published separately in Summer 2026" and are "therefore not yet in force," then setting the actual in-force expectation at "Autumn 2026" [[2]] (p.4). The accompanying press release repeats the autumn date without acknowledging the earlier summer one [[4]]. Nothing in the May statement explains what changed between February and May; the promise simply moved, three months before the amended codes were even in their final form.
Formal enforcement has no date, and nothing in the Act requires one (2). Sections 43(2) to (4) of the Online Safety Act fix, to the day, how long a code amendment takes to reach force once issued: a 40-day period for Parliament to object, then, if it does not, 21 more days before the code is live [[1]]. Ofcom met that floor exactly, issuing on 9 September and landing on 30 September [[5]]. But the Act's fixed clock stops there. What happens after a code is in force, when and how Ofcom starts checking compliance and taking enforcement action, is a matter for Ofcom's own operational choice, not a statutory deadline. Its own page on the measure says formal enforcement action "will be launched after 30 September" [[6]], and neither that page nor the Statement, the Amendments notice or the May press release gives a date, a month, or even a season for when. Seven months after calling this urgent enough to fast-track, the one stage of the process Ofcom did not have to leave open is the one it has.
Credit where due
The 21-day gap between issuing a code and it taking force is not Ofcom slow-walking anything: it is the Online Safety Act's own design, and the amended codes reached force at the earliest point the law allowed once issued [[1]] [[5]]. The targeting is also genuinely proportionate rather than blanket: the new measure applies only to services at high risk of intimate image abuse whose principal purpose is hosting pornographic content, or that have more than 700,000 monthly UK users, or that are file-storage and file-sharing services, plus large services otherwise assessed at medium or high risk, not every regulated service by default [[5]] (p.4). And the evidence base behind the measure is real and cited with sources a reader can check: the Revenge Porn Helpline's own 2024 report, Refuge's research on charge rates, and Home Office-adjacent offence statistics all sit in the Statement's footnotes rather than being asserted without support [[2]] (p.19).
Verdict
Four stars, from two documented mistakes. Ofcom did not invent the urgency: the scale of non-consensual intimate image abuse in its own evidence base justifies acting fast, and the mechanism it chose, recommending hash matching against a StopNCII-standard database, reached force at the earliest point the law allowed once the paperwork was issued. What it has not done is match its February language to what actually happened. "As soon as this Summer" became "Autumn" in Ofcom's own account before the amended codes were even final, and "formal enforcement after 30 September" is a promise with no date attached, made by the one regulator in this story with the power to set one.
Sources
- Online Safety Act 2023, section 43, legislation.gov.uk
- Statement: Detecting intimate image abuse, Ofcom, 18 May 2026 (PDF)
- Ofcom fast-tracks decision on measures to block illegal intimate images, Ofcom, 18 February 2026
- Platforms should use detection technology to stop spread of illegal intimate images online, under strengthened Ofcom Codes, Ofcom, 18 May 2026
- Amendments to Illegal content Codes of Practice for user-to-user services, Ofcom, issued 9 September 2026 (PDF)
- Creating a safer life online for women and girls, Ofcom, updated 9 September 2026