Ofcom's enforcement guidance says naming a company under investigation is the default. Its two newest cases, opened this week over non-consensual intimate images, are anonymous, unlike every comparable case before them.
Estimated reading time: 7 minutes
In short. On 26 October 2026 Ofcom opened two new cases under its non-consensual intimate image (NCII) enforcement programme, against "the provider of an adult image-hosting service" and "the provider of an adult content-sharing service" [2] [3]. Both bulletins give the identical, one-line reason for withholding the provider's name: "Due to the nature of this site, we have decided not to name them or their provider" [[2]] [[3]]. Ofcom's own Online Safety Enforcement Guidance, published December 2024, says a case opening announcement "will typically include... the identity of the subject," reserving anonymity for "certain exceptional cases" that are "particularly sensitive" or where publicity "could have a detrimental impact on third parties" (paras 5.16, 5.21) [4]. Neither bulletin says which exception applies, or why. And on Ofcom's own consolidated enforcement case list, comparable adult sites investigated under a parallel Online Safety Act duty are named routinely, no exception claimed: "the provider of www.porntrex.com ('Porntrex')," "the provider of Xgroovy.com," among others [5] [6]. Two documented mistakes: four stars.
This is the third time this site has tested Ofcom's NCII enforcement programme against its own record. In September, a "summer" promise on hash-matching rules slipped to an autumn deadline with no enforcement date attached [8]. Three days after that 30 September deadline passed, Ofcom's public case list named no platform at all, despite a press release warning of "robust action" [9]. Almost four weeks later, the silence broke: two cases, opened the same day, both anonymous. The question this piece tests is not whether Ofcom acted, but whether its reason for hiding who it acted against holds up against its own rules.
The claims, tested
| Ofcom's claim | What we found | Verdict |
|---|---|---|
| "Ofcom has opened an investigation into the provider's compliance with its duties under the Act to ensure users do not encounter or disseminate NCII on its service. Due to the nature of this site, we have decided not to name them or their provider" (both 26 Oct 2026 bulletins, identical wording) [[2]] [[3]] | Ofcom's own Enforcement Guidance sets naming as the default: "The case opening announcement will typically include the following details: a) the identity of the subject" (para 5.16), narrowed only by "certain exceptional cases which we consider it would be inappropriate to publicise, for example because they are particularly sensitive or where publicity could have a detrimental impact on third parties" (para 5.21) [[4]] | The stated reason restates the exception's name without saying which limb applies or why these two sites meet it |
| The implicit premise that an "adult" site's nature can justify withholding its identity | Ofcom's own enforcement case list names multiple adult sites investigated under the Online Safety Act's parallel age-assurance duty (section 12), with no sensitivity exception invoked: "We are investigating whether the provider of www.porntrex.com ('Porntrex') has failed, or is failing, to comply with its duties" [[6]], and a separate case naming "the provider of Xgroovy.com" [7], both on the same public list as the two anonymous NCII cases [[5]] | The same regulator applies different disclosure standards to the same category of site, under the same Act, on the same page, with no stated reason for the difference |
A rule with an exception, and an exception with no stated reason
Ofcom's Enforcement Guidance is not vague about what normally happens when a case opens. Paragraph 5.16 lists what a case-opening announcement "will typically include": the identity of the subject, the scope of the investigation, and the identity of any complainant, "if appropriate" [[4]]. Paragraph 5.21 carves out the departure: "There may be certain exceptional cases which we consider it would be inappropriate to publicise, for example because they are particularly sensitive or where publicity could have a detrimental impact on third parties. We would inform the subject and any complainant if we intend to take this approach to an investigation" [[4]]. That is a real, bounded exception, not a blank cheque: it names two triggers, sensitivity and third-party harm, and promises the subject advance notice that the unusual route is being taken.
Measured against that, the two 26 October bulletins say less than the guidance they are supposed to follow. "Due to the nature of this site" could, in principle, gesture at either trigger. It does not say which. It does not explain what about these two sites, specifically, crosses the line that the dozens of other adult-sector cases on Ofcom's own list did not. A reader is left to take the departure from Ofcom's own default on trust, in a document whose entire purpose is to record why a departure happened.
The same regulator, the same sector, named every time
The second finding is the sharper one, because it does not require guessing at Ofcom's internal reasoning: its own public record settles it. The enforcement case list carries, alongside the two new anonymous NCII cases, an active roster of named age-assurance investigations against adult sites: porntrex.com, Xgroovy.com, and others this site has already covered, including Web Prime Inc and First Time Videos LLC [[5]]. Those cases run under section 12 of the Online Safety Act, a different duty from the NCII cases' sections 9 and 10, but the subject matter, adult content sites, the regulator, and the public-facing case list are identical [[2]] [[6]] [[7]]. None of those bulletins claims a sensitivity exception. None withholds the provider's name. If "the nature of" an adult site were, by itself, the kind of fact that triggers paragraph 5.21, it would have applied to all of them. It has been applied to exactly two, opened on the same day, with the same four words standing in for an explanation.
Credit where due
This piece makes no finding that Ofcom was wrong to open these two cases, or that the underlying conduct under investigation is anything other than serious: non-consensual intimate image abuse is the subject Ofcom itself has called a "key strategic priority," citing work to protect women and girls online [1]. Unlike the state of play this site found three days after the 30 September deadline, Ofcom has now moved from a programme description to two live cases, with specific legal provisions cited and a case-opening date given [[2]] [[3]]. And the guidance Ofcom is measured against here is its own: a regulator that publishes the rule it is departing from, even imperfectly applied, has published more than many bodies that make no such commitment at all.
Verdict
Four stars, two documented mistakes. Ofcom's own enforcement guidance makes naming the default and anonymity the exception, with two specific triggers and a promise of advance notice to the subject. Two new cases, opened the same day over the same alleged conduct, invoke that exception with a single unexplained sentence, while Ofcom's own case list shows the same regulator naming comparable adult sites under a parallel duty without hesitation. Neither bulletin, nor the guidance it should be read against, explains the difference.
The star score counts two documented mistakes. First, the 26 October case bulletins state "due to the nature of this site, we have decided not to name them or their provider" without identifying which of the two stated exceptions in paragraph 5.21 of Ofcom's own Online Safety Enforcement Guidance (particularly sensitive cases, or detrimental third-party impact) applies, or why. Second, that reasoning is applied inconsistently with Ofcom's own practice: its public enforcement case list names comparable adult sites investigated under a parallel Online Safety Act duty, including the providers of porntrex.com and Xgroovy.com, with no sensitivity exception claimed in either case. Two falls in the 1 to 3 band: four stars; the bands are on the ratings page. This piece makes no finding on whether Ofcom's decision to anonymise these two cases was itself wrong on the facts, which are not public; the finding is that the stated reason is unexplained and inconsistently applied against Ofcom's own published rule and its own prior practice. Checked directly against both 26 October case bulletins, Ofcom's December 2024 Enforcement Guidance, and the live enforcement case list, all fetched 30 October 2026.
Sources
- Enforcement programme into measures being taken by services to prevent users from encountering or sharing non-consensual intimate imagery (NCII), Ofcom, opened 9 September 2026, updated 26 October 2026
- Investigation into the provider of an adult image-hosting service and its compliance with duties to protect its users from illegal content, Ofcom, case opened 26 October 2026
- Investigation into the provider of an adult content-sharing service, Ofcom, case opened 26 October 2026
- Online Safety Enforcement Guidance, Ofcom, published 16 December 2024 (PDF)
- Enforcement, Ofcom case and programme list, checked 30 October 2026
- Investigation into the provider of www.porntrex.com's compliance with the duty to prevent children from encountering pornographic content through the use of age assurance, Ofcom, case opened 19 November 2025
- Investigation into the provider of Xgroovy.com's compliance with the duty to prevent children from encountering pornographic content through the use of age assurance, Ofcom, case opened 11 September 2025
- Ofcom called the spread of non-consensual intimate images urgent in February and promised new rules by summer, Tracked Changes, 23 September 2026
- Ofcom warned platforms that missing its 30 September deadline on intimate image abuse could cost 10% of global revenue, Tracked Changes, 3 October 2026