Platforms have until 30 September to switch on deepfake nude detection
Ofcom has opened an enforcement programme with a date on it, three weeks after ministers said they would legislate to stop under-18s taking nude images at all.
On 9 September 2026 Ofcomopened an enforcement programme into how online platforms stop the spread of intimate images shared without consent, and gave them a deadline. “By 30 September, online platforms should have automated technology in place known as ‘hash matching’ to detect and prevent the sharing of illegal intimate images, including explicit AI-generated deepfakes,” the regulator said. A platform not using hash matching has to show its own systems work just as well. Failing the duty carries fines of up to 10% of global annual revenue.
Hash matching turns a known image into a digital fingerprint, so copies can be recognised on upload without anyone comparing pictures by hand. Ofcomadded it to its illegal content codes in May, citing “the urgent need to better protect women and girls online”. That is the framing throughout: Ofcom does not set out a separate figure for under-16s in this announcement.
The next step is bigger. Ofcom will consult by the end of this year on rewriting its codes to match a change to the law, announced in February as an amendment to the Crime and Policing Bill, requiring platforms totake a reported intimate image down within 48 hours. Creating or sharing one becomes a priority offence under the Online Safety Act, ranked with terrorism and child sexual abuse material. The government's stated aim is that a victim reports an image once, it comes off every platform at once, and it is blocked at every future upload.
Almudena Lara of Ofcom said technology companies “now have a legal responsibility to put the right tools in place to stop this kind of deeply harmful content spreading on their services”. Ofcom has also asked for evidence on how women's and girls' experiences online have changed, open until 6 November 2026, and will report on industry progress in summer 2027.
This is the other half of the story we covered on Tuesday. Thedevice-level law is meant to stop the image being made on a child's phone; this is about what happens once one exists. If an intimate image or a deepfake of your child is circulating, the practical route is still to report it to the platform, but from 30 September a platform is expected to have detection that catches the re-uploads, rather than leaving you to chase each copy. Report-once-removed-everywhere is the government's aim, not yet the live position.