Summary

  • Ofcom opened investigations on 26 October into two adult services, one for image hosting and one for content sharing. It has withheld the services' and providers' names.
  • Its wider programme has engaged 25 services considered high risk for non-consensual intimate imagery. The image-hosting case asks about a current risk assessment and protective measures; no outcome has been announced.

Ofcom has put two files on the public desk and left the nameplates blank. Its 26 October programme update says formal investigations have opened into the providers of an adult image-hosting service and an adult content-sharing service. The regulator chose not to identify either because of the nature of the sites. The public can see the date, the two service types and the questions under examination. It cannot yet connect either case to a provider it might use.

The move has a clear before and after. Ofcom opened a sector programme on 9 September, ahead of amended code measures taking effect on 30 September. It used supervision and direct contact as well as the prospect of formal enforcement. The new update says it has engaged 25 services it considers high risk. Several have begun compliance steps and are implementing StopNCII hash matching; several have blocked UK access, which Ofcom says it monitors. The update gives no count for those subsets. Twenty-five contacts are programme activity, not twenty-five case findings.

The two case bulletins put the same tests to two different kinds of service. In the image-hosting case and the content-sharing case alike, Ofcom asks whether the provider made and kept current a suitable illegal-content risk assessment under section 9 of the Online Safety Act, and whether it adopted code measure ICU C14 or alternative protective measures under section 10. The regulator says it will gather and analyse information before deciding. Two case openings, two identical questions, no finding yet.

Ofcom's October industry bulletin explains the measure's reach: high-risk user-to-user services principally hosting or spreading regulated pornography, file services, or those above 700,000 monthly UK users, plus large medium-risk services and large general search providers. The recommendation concerns matching digital fingerprints of intimate images, or taking alternative measures that meet the duty. The separate future 48-hour removal duty is slated for consultation with a view to 2027; it is not the question in these two files.

The possible end of the enforcement ladder is real. The case bulletins say a proven failure can bring a fine up to £18 million or 10% of qualifying worldwide revenue, whichever is higher. In the gravest cases Ofcom may ask a court to make payment, advertising or internet access providers withdraw service or block UK access. None has happened in these cases. Meanwhile, some providers in the wider programme have voluntarily geoblocked the UK. A private exit and a court-directed cut-off are different routes with different decision records. The next update should make clear which route each anonymous file actually takes.

Official sources