Ofcom warned platforms that missing its 30 September deadline on intimate image abuse could cost 10% of global revenue. Three days on, no platform is under investigation, and the harm figure in its press release is not in the report it cites.
Estimated reading time: 6 minutes
In short. On 9 September 2026 Ofcom announced it was "opening an enforcement programme" and warned that online platforms had until 30 September to put hash-matching technology in place to stop illegal intimate images and deepfakes spreading, or prove an equally effective alternative, on pain of fines up to 10% of global annual revenue [1]. Three days after that deadline, Ofcom's own published enforcement case list still shows only the programme's 9 September opening entry, with no platform named [2]. A second, separate duty the same release mentions, the 48-hour non-consensual intimate image takedown requirement, has been law since 29 June 2026, three months before Ofcom's own Code of Practice on it had even been promised a consultation date [6]. And the one statistic in the release presented as backed by "the latest statistics," 369,000 women a year, does not appear anywhere in the report Ofcom links to support it [3]. Three documented mistakes: four stars.
This site tore down Ofcom's hash-matching timeline two weeks ago: a promise of rules "as soon as this Summer" that slipped to autumn before the amended Illegal Content Code was even final, with "formal enforcement after 30 September" left as a promise with no date attached. That piece used four Ofcom documents spanning February to 9 September. A fifth, published the same day as the last of those but not among them, turns out to matter more now that 30 September has actually been and gone.
The claims, tested
| Ofcom's claim | What we found | Verdict |
|---|---|---|
| "Today the regulator is opening an enforcement programme to monitor their efforts... firms that ultimately fail to comply with their duties can expect us to take robust action under our enforcement programme, launched today," Almudena Lara, Ofcom's online safety policy development director, 9 September 2026 [[1]] | Ofcom's own enforcement case list, fetched directly, carries one entry for this programme: "Enforcement programme into measures being taken by services to prevent users from encountering or sharing non-consensual intimate imagery (NCII)," published 9 September 2026, with no later update and no named platform [[2]] | Three days after the deadline, the "robust action" promised is still a programme description, not a case |
| "Separately, we will, by the end of this year, consult on strengthening our Illegal Harms Codes of Practice to reflect changes to the law requiring platforms to remove non-consensual intimate image content within 48 hours of it being reported" [[1]] | The underlying duty is sections 100 and 101 of the Crime and Policing Act 2026, which legislation.gov.uk's own commencement record shows came into force on 29 June 2026, under S.I. 2026/689 [6] [7] | A legal duty more than three months old, with Ofcom's own implementing code still at the "we will consult" stage, not even a published draft |
| David Wright, Chief Executive of SWGfL: "our research suggesting over 369,000 women in the UK experience this abuse annually," with the release directly below linking "the latest statistics on the prevalence of intimate image abuse" to SWGfL's Revenge Porn Helpline Annual Report 2025 [[1]] | That 20-page report, text-extracted directly, records 1,890 women contacting the Helpline in 2025 (43.1% of clients) and 85,000 reports taken in total across eleven years, 2015 to 2025; the figure 369,000 does not appear anywhere in it [[3]] (p.4, p.8) | The one number in the release pointed to "the latest statistics" is not in the statistics it points to |
A programme, not yet a case
The 9 September release does not pretend the 30 September date was Ofcom's choice alone: platforms had been told since February this was coming, and the amended Code reached force at the statutory-minimum 21 days after issue, a point this site credited Ofcom with in its last piece on this subject. What the release adds is a named mechanism, an "enforcement programme," and a specific warning attached to a specific date: miss it, and "expect us to take robust action" [[1]]. Ofcom publishes its open enforcement cases and programmes on a single page, used elsewhere on this site to check other claims against reality [[2]]. Checked directly on 3 October, three days after the deadline, that page's only text mentioning "intimate" or "NCII" is the original 9 September programme-opening entry. No platform appears under it. That does not mean nothing is happening behind the scenes; Ofcom's other enforcement programmes, including the one into age-assurance compliance, took months between opening and a first named case. It does mean that the specific, dated warning in the 9 September release has, three days on, nothing public behind it yet.
A duty already in force, a code still unconsulted
The release's second promise is easy to read past: a future consultation on Code strengthening, filed under "separately." But the law it refers to is not future at all. The Crime and Policing Act 2026 received Royal Assent on 29 April 2026, and its sections 100 and 101, which insert the 48-hour NCII takedown duty into the Online Safety Act's enforcement and penalty provisions, came into force on 29 June 2026 under the third commencement order made since [[6]] [[7]]. GOV.UK's own factsheet on the measure confirms the substance: platforms must "take down non-consensual intimate images (NCII) as soon as reasonably practical and no later than 48 hours after receiving a report," with senior managers facing potential criminal liability in the most serious non-compliance cases [4]. That duty has applied to every regulated platform for more than three months. Ofcom's own operational guidance on how it will assess compliance, the Code of Practice amendment the 9 September release promises, has not yet reached a consultation document, only a plan to "consult... by the end of this year" [[1]]. A reporting victim today has a legal 48-hour clock running in their favour with no published Ofcom Code explaining how compliance will be checked.
A statistic with no home in its own source
The clearest-cut of the three findings is also the simplest to check. Immediately under David Wright's quote citing "over 369,000 women in the UK" experiencing this abuse "annually," the release states in bold: "For the latest statistics on the prevalence of intimate image abuse," linking SWGfL's Revenge Porn Helpline Annual Report 2025 [[1]]. That report is a real, detailed document: 20 pages, text-extracted directly rather than summarised, covering eleven years of Helpline data. Its actual 2025 figures are two to three orders of magnitude smaller than the quoted claim: 1,890 women and 1,615 men contacted the Helpline in 2025, out of 85,000 reports taken since 2015 and over 450,000 images reported for removal in that period [[3]] (p.4, p.8). Nowhere in the report's 20 pages does a figure of 369,000, or any annual national prevalence estimate, appear. SWGfL may have other research behind that number; this report, the one Ofcom's own release names as the source for "the latest statistics," is not it.
Credit where due
The underlying problem is real and not overstated by exaggeration here: even on the Helpline's own smaller figures, reports of voyeurism "more than quadrupl[ed] between 2023 and 2024, with similar numbers in 2025," and 98.9% of images reported for removal in 2025 were of women [[3]] (p.8, p.12). The hash-matching deadline itself reached force at the fastest point the Online Safety Act's 21-day clock allowed, as this site has already credited Ofcom with once. The penalty regime the release describes, fines up to the greater of £18 million or 10% of qualifying worldwide revenue, is exactly what Schedule 13 of the Online Safety Act provides, verified directly against the statute, not inflated for effect [5]. And three days is a short window: enforcement programmes elsewhere on Ofcom's own list have taken months to produce a first named case, so silence this soon is not itself proof of inaction.
Verdict
Four stars, three mistakes. None of them is that Ofcom invented a problem or dodges the law it operates under. What the government's and regulator's own published record shows is a specific, dated warning with nothing public behind it three days later; a legal duty that has quietly applied to every regulated platform since June with no implementing Code even at consultation stage; and a headline statistic attributed to "the latest statistics" in a report that, read in full, does not contain it.
The star score counts three documented mistakes against Ofcom's own and the government's published record: its enforcement case list, checked directly on 3 October 2026, names no platform under the NCII programme three days after the 30 September deadline despite an explicit "robust action" warning; the Crime and Policing Act 2026's 48-hour NCII takedown duty (sections 100 to 101) has been in force since 29 June 2026 with Ofcom's own Code of Practice amendment on it still only promised a consultation "by the end of this year"; and the 369,000-women-annually figure Ofcom's 9 September release attributes to "the latest statistics" does not appear in the 20-page SWGfL report it links as that source. Three falls in the 1 to 3 band: four stars; the bands are on the ratings page. This piece makes no finding on whether Ofcom is investigating any platform privately, only on what its own public case list showed on the day checked, and makes no finding that the 369,000 figure is wrong, only that the cited report does not contain it. Checked against the Ofcom enforcement case list, the 9 September press release, the SWGfL Revenge Porn Helpline Annual Report 2025 and legislation.gov.uk, all current to 3 October 2026.
Sources
- Ofcom to crack down on spread of illegal intimate images and deepfakes, boosting protections for women and girls online, Ofcom, 9 September 2026
- Enforcement, Ofcom case and programme list, checked 3 October 2026
- Revenge Porn Helpline Annual Report 2025, SWGfL, 2025 (PDF)
- Crime and Policing Act 2026: intimate image abuse factsheet, GOV.UK, Home Office
- Online Safety Act 2023, Schedule 13, paragraph 4, legislation.gov.uk
- Crime and Policing Act 2026, section 100, legislation.gov.uk, commencement information
- Crime and Policing Act 2026, section 101, legislation.gov.uk, commencement information