United Kingdom

• Providers of regulated user-to-user services.
• Providers of regulated search services, including combined services.
• Certain internet services publishing or displaying regulated provider pornography.
• Category 1 and Category 2A services for additional duties, including fraudulent advertising.
• Users and other persons can be affected by the Act’s content and communications offences, but the principal regulatory duties fall on providers.

Conduct and keep current illegal-content risk assessments and, where applicable, children’s risk assessments and children’s access assessments. Use proportionate systems and processes to prevent users encountering priority illegal content, mitigate risks of priority offences and other illegal-content harms, minimise the time illegal content remains available, and swiftly take down illegal content when alerted or otherwise aware. Maintain clear, accessible terms of service explaining protection from illegal content, apply those terms consistently, and describe relevant proactive technology, including its type, use and operation. Protect freedom of expression and privacy as required by the Act when implementing safety duties. Providers of services likely to be accessed by children must meet additional duties concerning content harmful to children, governance, reporting, design and safety measures. From 2026-06-29, when a qualifying intimate-image-content report is made, a regulated user-to-user provider must take down the reported content and substantially the same content as soon as reasonably practicable and no later than 48 hours, subject to the statutory exceptions.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Providers of in-scope internet services publishing or displaying regulated provider pornography. The duty can apply to a service even where the provider is not UK-established.

Use age verification, age estimation, or both, in a way that is highly effective at correctly determining whether a particular user is a child. Ensure children are not normally able to encounter regulated provider pornography. Keep an understandable written record of the age-assurance methods and how privacy was considered. Publish a summary of the record. A self-declaration of age, without more, is not age verification or age estimation under section 230. Ofcom’s 2026 report states that it does not regard age inference as highly effective for the relevant porn/minimum-age duties on the evidence described in the report.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Providers of regulated user-to-user services, including UK and non-UK providers meeting the OSA scope test. The reporting regulations allow for a provider or qualifying third-party provider to submit reports in the specified manner.

Operate systems and processes that secure, so far as possible, the reporting of detected and unreported CSEA content to the NCA. Register with the NCA reporting portal before reporting where required by the regulations. Submit reports in the required format, with required available information, within urgency-based time frames. Retain and handle information as required by the reporting regulations. Section 66 applies only to CSEA content detected on or after the provision comes into force.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Any person whose conduct satisfies the offence elements in the relevant jurisdiction. Platforms may separately be regulated under the OSA.

Section 66A covers intentionally sending a photograph or film of a person’s genitals to another person without consent and without a reasonable belief in consent, subject to statutory elements and exemptions. Section 66B covers sharing or threatening to share an intimate photograph or film without consent and without a reasonable belief in consent, including certain situations involving intent to cause alarm, distress or humiliation, obtaining a gain, or causing loss. The statutory language covers material that “shows or appears to show” a person in an intimate state. This can encompass some manipulated or synthetic material the legal question is the statutory definition and evidence, not whether a file is labelled a deepfake. Sections 66C–66D provide exemptions and interpretation rules.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Persons who intentionally create or request the creation of a purported intimate image of an adult without the subject’s consent and without a reasonable belief in consent. A request can be directed to a person or made generally available and can be committed whether or not the image is eventually created.

Section 66E criminalises intentionally creating a purported intimate image of another person where the person shown does not consent and the creator does not reasonably believe the person consents. A “purported intimate image” appears to be, or include, an image of the person, appears to be of an adult, and appears to show the person in an intimate state. It need not be, or be only, a photograph or film of the person. Section 66E includes a defence of reasonable excuse. Section 66F criminalises intentionally requesting creation, or requesting inclusion/exclusion of a particular feature, without consent or reasonable belief in consent. It includes requests made generally and applies whether or not creation occurs. Section 66F includes a defence of reasonable excuse. New section 66H allows prosecution within three years of the offence and within six months of sufficient evidence coming to the prosecutor’s knowledge, subject to the statutory wording.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Persons making, adapting, supplying or offering to supply things for use as purported-intimate-image generators.
• Providers of regulated services receiving qualifying intimate-image-content reports.
• Persons convicted of the specified intimate-image offences, for court-ordered deletion consequences.
• OSA providers subject to the new priority-offence consequences.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Controllers, processors, joint controllers, public bodies and organisations processing personal data, including developers, deployers, platforms, identity providers, biometric vendors and AI suppliers where their processing falls within scope.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• “Relevant persons” such as financial institutions, credit/financial institutions, certain cryptoasset businesses, professional firms and other businesses specified by the Regulations.

Apply customer due diligence when regulation 27 requires it. Identify and verify customers, understand beneficial ownership/control and apply ongoing monitoring. Use enhanced due diligence and monitoring in higher-risk situations, including certain non-face-to-face relationships without appropriate safeguards. Regulation 28(19) permits information to be regarded as from a reliable independent source where obtained through an electronic identification process that is secure from fraud and misuse and capable of providing the assurance necessary to manage and mitigate money-laundering and terrorist-financing risks. The Regulations do not mandate biometrics as the only KYC method. A firm remains responsible for a risk-based, adequate process.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Operators of essential services (OESs) in specified sectors and relevant digital service providers such as online marketplaces, online search engines and cloud-computing services within the statutory definitions. Banking and financial services were excluded where already covered by equivalent domestic regulation.

Take appropriate and proportionate technical and organisational measures to manage security risks. Prevent or minimise the impact of incidents on essential/digital services. Notify the competent authority of incidents with a significant impact on continuity. RDSPs must comply with applicable security, notification, registration and information duties.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Any person committing unauthorised access, unauthorised acts, serious-damage or tool-related offences within the statutory elements.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.