UK Online Safety Rules and Age Checks: What They Mean for You as an Individual (2026 Update)

What are the new UK online safety rules?

They are the child protection duties under the Online Safety Act 2023, which came fully into force on 25 July 2025 and require services hosting pornography, or other content harmful to children, to use age checks that go well beyond a tick-box declaration. Services publishing their own pornographic content, known as Part 5 services, have been within the duty under section 81 since 17 January 2025, and services carrying user-generated content or search came within the child-safety duties under section 12 on 25 July 2025. Ofcom describes the combined effect as making UK access to online pornography harder than in any other OECD country.

Do these rules apply to me, or to the platforms?

To the platforms. The Act’s duties fall on service providers, not on the people who use their services. Ofcom regulates platforms and can fine a provider or pursue its senior managers; the police and the Crown Prosecution Service deal with individuals. None of that regulatory machinery is aimed at an individual user. Your own conduct is dealt with separately, through the criminal law: the communications offences in Part 10 of the Act, in force since 31 January 2024, and the sexual offences inserted into the Sexual Offences Act 2003. Both tracks can run at once on the same facts, one against the platform and one against a person who used it.

How do the age checks work?

The legal standard is “highly effective age assurance”. Ofcom did not fix an accuracy percentage, but a method must be technically accurate, robust, reliable and fair, and asking a user to tick a box or confirm they are over 18 does not meet it. Its non-exhaustive list of acceptable methods includes facial age estimation from a live image, photo-ID matching, open banking and credit card checks, mobile network operator checks, and digital identity wallets. On a dedicated pornography service the check sits at the front gate, so no content is visible before or during it, and because facial estimation carries a margin of around two years for teenagers and young adults, providers estimate against 23 or 25, which is why adults are still asked for ID.

Not every site checks in the same way. A service whose main purpose is pornography is expected to age-gate the whole site, while a general platform allowing some user-generated pornography must either age-check that content or genuinely prohibit and enforce a ban on it, and some operators have blocked UK users instead. By the end of January 2026, of the top 100 dedicated pornography services, Ofcom found 77 had age assurance in place and a further 7 had geoblocked the UK, and X, Reddit, Bluesky, Discord and dating apps had also introduced checks.

Mark’s Experience

Despite the implementation of age assurance, I have seen numerous instances where children and young people have been able to bypass these measures, sometimes with relative ease, and access illegal and harmful content.

What are the risks to you in handing over ID to an age-check provider?

Age checks concentrate identity documents and face scans with third-party providers, and those datasets have already been breached.

In October 2025, Discord confirmed that around 70,000 users globally may have had photo IDs exposed after an incident at a third-party provider. Campaign groups have also warned that criminals imitate age-check screens to harvest documents for phishing, blackmail and sextortion.

If your identity document or verification selfie has been exposed, there are usually two questions worth taking advice on: whether you have a claim or complaint arising from the way your data was handled, and how to respond if someone is using that material to threaten you. If you are being blackmailed, the position is straightforward. Do not pay, keep everything, and report it.

Which offences apply to an individual who shares an intimate image?

Sharing an intimate image of an adult without their consent is a criminal offence, and the prosecution does not have to prove you intended to cause distress.

Section 188 of the Online Safety Act repealed the old “revenge porn” provisions in sections 33 to 35 of the Criminal Justice and Courts Act 2015 and inserted new sections 66B, 66C and 66D into the Sexual Offences Act 2003. This created four distinct offences covering sharing and threatening to share intimate images.

The base offence needs only the sharing and the absence of consent or a reasonable belief in consent. Where the sharing was intended to cause alarm, distress or humiliation, or was for sexual gratification, the offence is more serious and carries a higher maximum. Deepfake and edited images are within scope.

Is creating a deepfake or using a “nudification” app a criminal offence?

Yes. Since 6 February 2026, it has been an offence to create, or to request the creation of, a purported intimate image of an adult without consent, even if the image is never shared with anyone.

That offence came in through section 138 of the Data (Use and Access) Act 2025, which inserted sections 66E and 66F into the Sexual Offences Act 2003. It followed the surge in AI “nudification” and bikini-style image requests on mainstream platforms in early 2026.

A second offence followed on 29 June 2026. Section 66I of the Sexual Offences Act 2003, inserted by the Crime and Policing Act 2026, criminalises making, adapting, supplying or offering to supply a purported intimate image generator, the tools commonly called nudification apps.

The practical consequence for individuals is significant. Liability now attaches at the point of creation and even at the point of the request, so a prompt typed into an image generator can be the offence. Requests of that kind are logged, and the material sits on the device.

What else did the Crime and Policing Act 2026 add?

It widened image-based abuse offences considerably and added new duties aimed at getting material taken down.

The Act, which received Royal Assent on 29 April 2026 with provisions commencing in stages, includes offences of taking intimate images without consent and installing equipment to do so, offences covering screenshotting and semen-defaced images, offences relating to child sexual abuse material image generators and instructions for producing such material, and liability for moderators and administrators of sites hosting it. It also allows courts to make deletion orders and imposes a duty on platforms to remove non-consensual intimate images within 48 hours. It adds a further set of possession offences, dealt with in the next section.

Is it a criminal offence to view this content?

Not where the content is lawful adult material. Viewing pornography behind an age check is not an offence, and the Online Safety Act does not make it one. The exposure arises where the material itself is unlawful, and in that situation viewing and possession are themselves the offence.

The longest-standing example is indecent images of children. Possession is an offence under section 160 of the Criminal Justice Act 1988, and under section 1 of the Protection of Children Act 1978 the act of downloading or opening an image can itself amount to “making” it, which is charged more seriously. No sharing is required, which is the point most people do not expect. Possession of extreme pornographic images under section 63 of the Criminal Justice and Immigration Act 2008 works on the same principle.

The Crime and Policing Act 2026 extends that pattern significantly. It creates possession and publication offences covering pornographic images of strangulation or suffocation (section 67A of the 2008 Act, inserted by section 104), pornographic images of sex between relatives, and pornography portraying an adult as being under 16. These are framed as possession offences, so a person who has never uploaded anything can be within scope. Commencement is staged, and these provisions were not in force at Royal Assent.

This is where the two halves of the regime meet. Age assurance means services and third-party providers now hold identifiable records of who accessed what, and in cases like this, the device is the principal evidence. The rules were written to keep children out. Their by-product is a far clearer documentary trail for the adults who stay in.

What about cyberflashing, threats and false communications?

These are the Part 10 offences, in force since 31 January 2024, and they catch everyday online conduct rather than anything technical.

Section 187 of the Act inserted section 66A into the Sexual Offences Act 2003, creating the cyberflashing offence: sending or giving an image of genitals with intent to cause alarm, distress or humiliation, or for sexual gratification while reckless as to that effect. Sections 179, 181, 183 and 184 cover false communications, threatening communications, sending flashing images intended to harm a person with epilepsy, and encouraging or assisting serious self-harm.

Maximum sentences are for England and Wales and should be checked against current sentencing guidance before you rely on them.

What happens if the police contact you about online content?

The usual first step is an invitation to a voluntary interview under caution, and it is a mistake to treat that as an informal chat.

An interview under caution is evidence-gathering, whether or not you have been arrested. In these cases, devices are commonly seized and examined, which can take months, during which you may be released under investigation or on bail with conditions. Employment, professional regulators and, where children are involved, social services can all become engaged well before any charging decision.

Three points are worth knowing. You are entitled to free independent legal advice at the police station, whatever the allegation. The pre-charge stage is where representations to the police and the Crown Prosecution Service have the greatest effect, because the question at that point is still whether to charge at all. And on conviction for some of these offences, notification requirements and a sexual harm prevention order can follow, so the consequences extend beyond any sentence.

What can you do if you are the one who has been targeted?

You have three routes that can run at the same time: removal, a criminal complaint, and a civil claim.

On removal, platforms in scope now have a duty to take down non-consensual intimate images within 48 hours of a report, and the courts can make deletion orders. Reporting through the platform’s own process, and through the specialist services that operate hash-matching to prevent re-uploads, is usually the fastest practical step.

On the criminal side, the offences above are reported to the police ordinarily, and complainants in these offences have protections around anonymity that are worth understanding early.

On the civil side, harassment, misuse of private information, breach of confidence and data protection claims can all be available, and injunctive relief can move quickly where material is still circulating. Which route to lead with depends on what you most need, which is often removal and containment rather than a conviction.

Is any of this being enforced?

Yes, and increasingly so, though enforcement against operators based outside the UK remains the weak point.

Ofcom’s penalties now run into seven figures, including a record £1.35 million against 8579 LLC in February 2026 for failing to operate highly effective age assurance, and £800,000 against Kick Online Entertainment. Two decisions against the messageboard 4chan, totalling a £520,000 package, are being contested in the US courts on the basis that the service is operated from outside the UK.

Mark’s Experience

Ofcom are moving more into enforcement mode. That said, enforcing financial penalties on those platforms outside of the UK remains an issue. Ofcom imposed a £950,000 penalty on an online suicide forum, yet they refused to pay. Access to the site was then blocked in the UK, but those with a VPN could easily bypass this. This underlines the need for effective enforcement, rather than headline-grabbing.

Where is this heading in 2026 and 2027?

The regime is expanding, and the direction of travel is towards more age assurance for more people, not less.

On 15 June 2026, the Government announced a ban on social media for under-16s, using powers inserted into the Online Safety Act by the Children’s Wellbeing and Schools Act 2026. The first regulations are expected before the end of 2026, with implementation in spring 2027, and Ofcom was asked to report by the end of October 2026 on how age can reliably be verified at 16, a harder technical question than verifying whether someone is over 18. The Government published its full consultation response in July 2026.

For individuals, two consequences follow. More services will hold more identity data about more adults. And the offences that have expanded fastest are the ones aimed at individuals, particularly around creating and requesting synthetic images, which is where prosecutions are now beginning to appear.

What this means for you

The platform duties get the headlines. The individual exposure is what actually reaches people, and it has widened sharply in the last twelve months.

If you have been contacted by the police about images, messages or online content, take specialist advice before the interview rather than after it. If images of you have been taken, faked or shared, the removal and legal routes are more effective when they are used together and used early. In either position, the first conversation matters more than most people expect.