United KingdomOnline Safety Act 2023, 48-hour take-down of intimate image content
In force since .
A notice and action rule binding private bodies.
- Enforcement body
- Office of Communications (Ofcom)
As of .
What it requires
- If you run a user-to-user service with links to the United Kingdom, let users and affected persons easily report content as intimate image content, under Online Safety Act 2023 section 20A.
- Take down content reported to you as intimate image content by the person it shows or someone acting for them, and any content you identify as the same or substantially the same, as soon as reasonably practicable and no later than 48 hours after the report, unless you consider the content is not intimate image content or the reporter is neither the subject nor acting for them, under section 10(3A) and (3B).
- Say in your terms of service how you handle intimate image content reports and the 48-hour take-down, under section 10(5)(b).
If you get it wrong
Penalty structure
Online Safety Act 2023, Sch. 13 para. 4(1): the greater of 18 million pounds and 10 percent of the person's qualifying worldwide revenue for its most recent complete accounting period; 18 million pounds where the person has no accounting period (para. 4(2)).
- Rule
- Higher of
- As of
- Currency
- GBP
- Fixed cap
- 18,000,000
- Turnover percentage cap
- 10
What this law does
Since the provider of a regulated user-to-user service must let users and affected persons easily make an intimate image content report, and must operate proportionate systems and processes to take down the reported content, and any other content it identifies as the same or substantially the same, as soon as reasonably practicable and no later than 48 hours after receiving the report.
An intimate image content report declares that the content is intimate image content and that the report is made by the subject of the content or a person acting on their behalf, in good faith and true to the best of the reporter's knowledge and belief, and it identifies the content and gives the reporter's contact details.
The 48-hour duty does not apply where the provider considers that the content is not intimate image content or that the reporter is neither the subject nor acting on the subject's behalf.
Intimate image content is content amounting to the offence of sharing an intimate photograph or film without consent, and a photograph or film includes an image made or altered by computer graphics or in any other way that appears to be one, so an AI-generated intimate image reported by the person it depicts is within the duty. The provider's terms of service must address the duty.
The Crime and Policing Act 2026 inserted these provisions into section 10 and section 20A, so Ofcom enforces them as part of the illegal content safety duties, with the same penalty of up to the greater of 18 million pounds and 10 percent of qualifying worldwide revenue.
When LexLint raises it
When your app profile says your app operates a social platform.