Ofcom's one power to scan privately sent messages cleared its last legal hurdle on 4 September 2026. Seven weeks on, its own tracker still calls that step pending, and its own evidence says no technology meets the bar.
Estimated reading time: 6 minutes
.jpg){kind=link}
In short. Section 121 of the Online Safety Act 2023 is, in Ofcom's own words, "the only provision in the Act which gives Ofcom the power to require the use of proactive technology to analyse content communicated privately" [1]. A Technology Notice under that section cannot be used until a technology is accredited against minimum standards of accuracy, which only the Secretary of State can approve [2]. Those standards were approved and came into force on 4 September 2026, almost three years after the Act received Royal Assent [2]. Checked live today, both of Ofcom's own public pages tracking this power still describe that approval as something the Secretary of State has yet to do [3] [4]. And Ofcom's own most recent statement on the subject records that "a Notice to develop or source technology may be appropriate where no suitable accredited technology currently exists" [1]. Two documented mistakes: four stars.
Most of what the Online Safety Act lets Ofcom demand of a platform applies to content anyone can see: what gets recommended, what gets left up, what a service must do about material posted in public. Section 121 is different. It lets Ofcom require a provider to use "accredited technology" to identify child sexual exploitation and abuse content "communicated publicly or privately", and for CSEA content specifically, that reaches private messaging [2]. Ofcom's own guidance is explicit that this makes section 121 unlike everything else in its toolkit: it cannot recommend scanning private content through its Codes of Practice, and it only gets this power through a Technology Notice issued to one named provider at a time [1].
That power has existed in statute since October 2023. It has never been usable, because the Act requires any technology Ofcom wants to compel be "accredited" against "minimum standards of accuracy" that only the Secretary of State can approve, following Ofcom's advice [2]. Ofcom consulted on what those standards should be in December 2024, drawing 810 responses, 782 of them part of a civil society campaign organised by Open Rights Group in support of end-to-end encryption [1]. Ofcom published its final advice in May 2026, setting out a scoring system: a technology needs at least 80 out of 100 on its core performance metric, at least 60 out of 100 on each of four principles (technical performance, fairness, robustness, maintainability), and an overall score of at least 60 [2]. The Secretary of State for the Department for Digital, Culture, Media and Sport approved and published that scoring system as the Minimum Standards, which "come into force on 04 September 2026" [2]. That is the last legal precondition. Once a technology clears that bar, Ofcom can start weighing whether to compel a specific provider to use it.
The claims, tested
| The record's own words | What checking it today shows | Verdict |
|---|---|---|
| Ofcom's own statement calls section 121 "the only provision in the Act which gives Ofcom the power to require the use of proactive technology to analyse content communicated privately" [1] | The gov.uk record confirms the scope: a CSEA Technology Notice can reach content "communicated publicly or privately", unlike anything else Ofcom can require under the Act [2] | Accurate. This is a genuinely unusual power, and both documents describe its reach the same way |
| Ofcom's consultation-technology-notices page says "it is for the Secretary of State to approve and publish minimum standards of accuracy", last updated 8 May 2026 [3]; Ofcom's roadmap-to-regulation page, last updated 28 July 2026, says the same [4] | The Secretary of State already approved and published those standards; they came into force on 4 September 2026 [2]. Both Ofcom pages were fetched live today, 24 October 2026, seven weeks after that date, and neither has been corrected | Ofcom's own public account of its own power is factually wrong about the one step that matters most, and has been for seven weeks |
| Ofcom's May 2026 statement says it "will consider the proportionality" of a Notice to develop or source technology "where no suitable accredited technology currently exists" [1] | No published record of any technology accredited against the Minimum Standards since 4 September 2026, and neither the gov.uk record nor Ofcom's own pages name an accreditor, an application process, or a date by which one will exist [2] | The legal gate just cleared is the easy half. By Ofcom's own account, the harder question, whether anything on the market can pass it, remains open with no timetable attached |
The mistakes, counted
Ofcom's own live public record is wrong about whether its most unusual power has been activated (1). Two separate Ofcom pages, checked fresh today, both still tell readers that minimum standards of accuracy "are" for the Secretary of State to approve, as a future step [3] [4]. Gov.uk's own record of the Secretary of State's decision shows that step was completed and the standards came into force seven weeks before either Ofcom page was checked [2]. A provider, researcher or journalist relying on either Ofcom page, both of which exist specifically to track this power's implementation, would be told the wrong legal position.
Clearing the gate came with no published timetable for what happens next (2). Ofcom's roadmap-to-regulation page carries dated commitments elsewhere in the same document, including charging-year deadlines running to March 2027 [4]. The step that follows accreditation standards coming into force, Ofcom or an appointed third party actually setting up a process to accredit technology against them, carries no equivalent date anywhere in the gov.uk record or Ofcom's own pages [2] [4]. Combined with Ofcom's own concession that suitable technology may not yet exist [1], the power could sit live but unused indefinitely with no public marker of progress.
Credit where due
The scoring system itself is specific and checkable: named objectives, named principles, numeric thresholds, and a published formula for combining them, not vague language about "appropriate" accuracy [2]. Ofcom's own statement is also candid, not evasive, about the limits of what accreditation would mean: it says plainly that meeting the Minimum Standards "does not guarantee" compliance with other law and does not mean Ofcom will actually require a technology's use [2]. And the admission that no suitable technology may currently exist is Ofcom's own, offered unprompted in its own statement rather than extracted under pressure [1]. The problem this piece documents is not that the standards are poorly designed. It is that Ofcom's own public account of where implementation stands has fallen out of date on the single fact that matters, and nobody has caught it in seven weeks.
Verdict
Four stars, two documented mistakes. The Online Safety Act's one power to reach privately sent content cleared its last legal precondition on 4 September 2026, a three-year wait since Royal Assent. Checked against Ofcom's own live tracking pages today, that fact has not caught up with the regulator's own public record, and by Ofcom's own account, the technology that would actually use the power may not exist yet either.
The star score counts two documented mistakes. First, Ofcom's consultation-technology-notices page (last updated 8 May 2026) and its roadmap-to-regulation page (last updated 28 July 2026) both still describe Secretary of State approval of the minimum standards of accuracy as a future step; gov.uk's own record shows that approval happened and the standards came into force on 4 September 2026, seven weeks before both Ofcom pages were checked live for this piece. Second, the step that follows, Ofcom or an appointed third party establishing a process to accredit technology against those standards, carries no published date anywhere in the gov.uk record or Ofcom's own pages, unlike other items on Ofcom's own implementation roadmap. Two mistakes in the 1 to 3 band: four stars; the bands are on the ratings page. This piece makes no finding about the conduct of any named individual at Ofcom or DCMS; the pages and documents checked are institutional publications, not any one official's decision. All sources below were fetched directly on 24 October 2026 and returned HTTP 200.
Sources
- Statement: Technology Notices (PDF), Ofcom, published 8 May 2026 ("only provision... communicated privately" and 810/782 consultation figures, page 7; "no suitable accredited technology currently exists", page 19, paragraph 3.46)
- Minimum standards of accuracy in the detection of terrorism and CSEA content, Department for Digital, Culture, Media and Sport, published 4 September 2026 (scope, paragraph 3; Secretary of State approval and in-force date, paragraphs 5 to 6; scoring thresholds, paragraphs 18 to 20)
- Statement: Technology Notices (consultation landing page), Ofcom, published 16 December 2024, last updated 8 May 2026
- Ofcom's approach to implementing the Online Safety Act (roadmap to regulation), Ofcom, published 26 October 2023, last updated 28 July 2026