Ofcom decided in June that cyberflashing and encouraging serious self-harm should become priority offences under its enforcement codes. Four months on, the codes that actually bind platforms still do not mention either.
Estimated reading time: 5 minutes
In short. Cyberflashing and encouraging or assisting serious self-harm became priority offences under the Online Safety Act on 8 January 2026 [2] [3]. On 25 June 2026 Ofcom published a Statement deciding to add both to its Illegal Content Codes of Practice, but said the amendments "will be implemented separately" once they complete "the Parliamentary process" [1]. A full-text search of the current, in-force Code, amended as recently as 9 September 2026, finds no mention of cyberflashing or self-harm anywhere across its 86 pages [5]. One documented mistake: four stars.
Parliament moved first. The Online Safety Act 2023 (Priority Offences) (Amendment) Regulations 2025, made on 18 December 2025, came into force on 8 January 2026 and inserted two new entries into Schedule 7 of the Act: cyberflashing, defined by reference to sections 66A and 66B of the Sexual Offences Act 2003, and encouraging or assisting serious self-harm, an offence under section 184 of the Online Safety Act itself [4]. Both are now, in law, priority offences, the category that triggers Ofcom's strongest duties on platforms: assess the risk, take measures to mitigate it, remove the content swiftly when it appears.
What Ofcom decided, in its own words
Ofcom consulted on how to fold the two new offences into its Illegal Content Codes of Practice between 24 March and 24 April 2026, then published its decision on 25 June 2026 in a document titled "Statement: New priority offences - serious self-harm and cyberflashing". The Statement is direct about what it does and does not settle: "This statement sets out our decisions to combine the offence of encouraging or assisting suicide and the offence of encouraging or assisting serious self-harm into a single kind of illegal harm, 'suicide and self-harm', and to include cyberflashing as a new, and separate, kind of illegal harm" [1]. It then draws a line between two different kinds of duty: providers must act immediately on risk assessments, but "the amendments to the Codes will be implemented separately. Subject to them completing the Parliamentary process, providers will need to take the safety measures set out in the Codes or use other effective measures to protect users from illegal content and activity" [1].
The document Ofcom itself links as the "Draft consolidated version of U2U Code" alongside that Statement is blunter still. Its cover page carries a standing banner: "VERSION NOT IN FORCE: This version incorporates amendments submitted to the Secretary of State on 15 May and 12 June 2026, and further amendments that Ofcom intends to submit, but which are not in force. For the current version of the Codes of Practice, see here" [6]. As of the Statement's own publication date, some of the underlying amendments were still only something Ofcom "intends to submit".
What the live Code actually contains
Section 43(1) of the Online Safety Act requires Code amendments to be submitted to the Secretary of State and laid before Parliament before they bind anyone. The current, in-force Illegal Content Code of Practice for user-to-user services, the version Ofcom's own regulatory documents page lists as current, carries its own cover note: "Incorporates amendments issued: 9 September 2026. Incorporates amendments in force: 30 September 2026." A full-text search of all 86 pages of that document, the rulebook platforms are actually required to follow today, returns zero matches for "cyberflashing" and zero matches for "self-harm" [5]. The only Code amendment to reach the statute book since June addressed a different Statement entirely, on detecting intimate image abuse. Cyberflashing and self-harm are not in it.
A comparable process moved faster
The intimate image abuse amendment is a useful control, because it ran through the identical section 43(1) mechanism on a near-identical timetable. Ofcom published that Statement on 18 May 2026, five weeks before the new priority offences Statement, and its Code amendments were issued 9 September and in force by 30 September, a little over four months start to finish [5]. The new priority offences Statement, published five weeks later still, has now had almost four months and has not reached that point: no issued date, no in-force date, nothing beyond a draft marked not in force and amendments Ofcom described as merely intended. Whatever is holding this one back, it is not simply that the parliamentary mechanism is slow. A near-identical process cleared it in time for the one that started first.
Credit where due
Ofcom's Statement does not pretend the Code amendments are already binding. It separates the immediate risk-assessment duty from the Code measures explicitly, and says plainly that the latter await a further process, rather than implying the whole package took effect on 25 June. That is the right way to describe an incomplete process. What is missing is not honesty about the gap, but any public marker of how long it is expected to last.
The claims, tested
| The document's own words | What the record shows | Verdict |
|---|---|---|
| Ofcom's 25 June Statement: Code amendments for cyberflashing and self-harm "will be implemented separately. Subject to them completing the Parliamentary process, providers will need to take the safety measures" [1] | The current, in-force Code, amended 9 September 2026, contains no mention of either offence across 86 pages [5] | The promised measures are not in the rulebook platforms must follow today |
| The detecting intimate image abuse Statement, published 18 May 2026, five weeks earlier, on the same section 43(1) mechanism [5] | That Statement's Code amendments were issued 9 September and in force by 30 September, about four months start to finish [5] | A comparable process completed on a comparable timetable; this one has not |
Verdict
Four stars, one documented mistake. Parliament created these two priority offences in December 2025. Ofcom decided in June how its Codes should reflect them. Four months on, the Code that platforms must actually comply with today says nothing about either, and the draft Ofcom has published remains formally marked not in force. A comparable amendment, decided five weeks earlier through the same process, is already law. Nothing on Ofcom's site explains the gap, or says when it will close.
The star score counts one documented mistake: Ofcom's 25 June 2026 Statement decided to add cyberflashing and encouraging or assisting serious self-harm to its Illegal Content Codes of Practice, but a full-text search of the current, in-force Code (amendments issued 9 September 2026) finds no mention of either offence, and Ofcom's own published draft remains marked "VERSION NOT IN FORCE", with no issued or in-force date set anywhere in Ofcom's published regulatory documents list. One fall in the 1 to 3 band: four stars; the bands are on the ratings page. This piece makes no finding about the conduct of any named individual; the comparison with the intimate image abuse Code amendment describes two regulatory processes, not any person's performance. All sources below were fetched directly on 13 October 2026 and returned HTTP 200; the Code PDF was checked by a full-text search of all 86 pages for "cyberflashing" and "self-harm".
Sources
- Statement: New priority offences - serious self-harm and cyberflashing, Ofcom, published 25 June 2026
- Online Safety Act 2023, Schedule 7, paragraph 2A, legislation.gov.uk, inserted 8 January 2026
- Online Safety Act 2023, Schedule 7, paragraph 28A, legislation.gov.uk, substituted 8 January 2026
- The Online Safety Act 2023 (Priority Offences) (Amendment) Regulations 2025, legislation.gov.uk, made 18 December 2025
- Illegal content Codes of Practice for user-to-user services (PDF), Ofcom, amendments issued 9 September 2026, in force 30 September 2026
- Draft consolidated version of U2U Code (PDF), Ofcom, published 25 June 2026