From 30 September 2026, the UK regulator OFCOM begins enforcing a strengthened set of duties on how online platforms handle non-consensual intimate images, or NCII. It is one of the most significant moments yet under the Online Safety Act, and for anyone who shares or hosts adult content in the UK it changes what responsible is legally required to look like. At Discretion it changes very little about how we operate, because verification, consent and rapid takedown were the foundations we built on, not features we added later. Here is what is happening, and what it means for you.
What OFCOM now expects
OFCOM has opened a dedicated enforcement programme covering every service that falls under the Online Safety Act. The core new expectation is technical. Relevant platforms are now expected to use perceptual hash-matching, or a demonstrably equivalent method, to identify and stop the re-uploading and spread of known non-consensual intimate images. Crucially, that includes intimate-image deepfakes, the AI-generated or altered content that has driven so much of the recent harm.
Hash-matching works by comparing a fingerprint of an image against a database of known abuse material, without a human needing to view the underlying content. OFCOM is working with StopNCII.org, which maintains the reference database that victims and platforms use to flag known non-consensual images.
The timeline matters. Platforms have until 30 September 2026 to have effective preventative measures in place. If a service is not using hash-matching, it has to prove its systems are equally effective. After that date, OFCOM can begin formal enforcement action. And this is only the first step. OFCOM has said it will consult before the end of 2026 on a further duty, drawn from section 100 of the Crime and Policing Act 2026, that will require services to remove reported NCII within 48 hours.
The stakes are real. Firms that fail to meet their duties can be fined up to 10 percent of global revenue, or 18 million pounds, whichever is greater, with accountability reaching platform leadership.
Why this is the right direction
None of this should be controversial for a platform that respects the people on it. Non-consensual intimate image abuse ruins lives, and deepfake tools have made it faster and crueller to inflict. A regime that expects platforms to stop known abuse material from circulating, and to remove reported material quickly, is exactly the standard the adult industry should have held itself to already. The question for any platform is simple. Were you built to make this easy, or does compliance mean bolting safety onto a product that never wanted it?
Where Discretion already stands
We built Discretion around a straightforward principle. No anonymous uploads, no unverified content, no consent left implicit. That principle maps almost exactly onto what OFCOM now requires.
Everyone is verified. Every account on Discretion, creators and members alike, completes identity and age verification at signup through Yoti. That means the person behind any upload is a known, verified individual, not an anonymous account. Verified-only uploading is the single most effective structural defence against NCII, because it removes the anonymity that image abuse depends on.
Consent is recorded, not assumed. Every piece of content on Discretion carries a consent record: who appears in it, the scope of what they agreed to, the version of the attestation they signed, and confirmation that their identity was verified at the moment consent was given. Consent can be revoked, and that revocation is tracked. When someone appears in content, there is a documented, identity-linked record that they agreed to it.
Hash-matching already runs. Discretion runs automated hash-matching on every upload and on live stream frames today, with detections logged for our moderation team and, where required, referred to the relevant authority. We are extending that same machinery to perceptual hash-matching aligned with StopNCII, so known non-consensual images and intimate-image deepfakes are caught before they spread, in line with the 30 September standard.
Deepfakes are banned outright. AI-generated and altered intimate content is prohibited on Discretion, and every profile and content page carries a dedicated reporting route for non-consensual content and for deepfakes specifically. Reports reach a trained moderation team, not a black hole.
Takedown is fast and accountable. When content is reported or detected, our team can remove it immediately, with the reason recorded in a moderation log and, where the law requires, referred to the appropriate authority. We already operate well inside the direction of the coming 48-hour removal duty.
What this means for creators
If you create on Discretion, these rules protect you. Verified-only accounts mean the person who might misuse your image cannot hide behind anonymity. Consent records mean your boundaries are documented and enforceable. Hash-matching and fast takedown mean that if something is shared without your consent, the platform is built to find it and remove it, not to shrug. This is friction pointed at bad actors, not at you.
What this means for members
For members, nothing about the experience changes except the confidence behind it. You are on a platform where everyone is verified, where the content you see was consented to by identifiable people, and where the tools regulators are now demanding across the industry are already part of how the service runs.
Our commitment
The 30 September deadline is a floor, not a ceiling. Discretion will meet it, and we intend to keep operating above it as the 48-hour removal duty and further measures arrive. Safety, consent and verification are not compliance costs we tolerate. They are the reason Discretion exists as a trusted place for adult content in the first place. If you ever need to report non-consensual content, you can do so from any profile or content page, or contact our safety team directly. We act on every report.
