On a Monday morning, a message lands in your support queue. A woman explains that a video of her is circulating on your platform. Her former partner posted it, and she never agreed to it. She includes two links: the same video was re-uploaded from another account over the weekend.
You are the compliance lead, and this is not an ordinary ticket. The question is no longer just "should we remove it?". It becomes: how fast do you take it down, how do you stop it coming back, and can you prove it?
The short answer: in 2026, regulators set the pace. In the UK and the US alike, the rule is now to remove the content within 48 hours of a valid report. Copies must be dealt with too. Ofcom, the UK regulator, goes further for adult platforms. Since 30 September 2026, it expects detection using digital fingerprints (hash matching), or a measure that works just as well. The European Union is following: member states must apply a new directive by June 2027.
Why did this become a priority this autumn?
Because new laws and enforcement arrived at the same time.
In the UK, Ofcom launched an enforcement programme on non-consensual intimate images on 9 September 2026. It targets adult services and messaging services first, which it sees as especially exposed. The new measures in its illegal content codes of practice have applied since 30 September. Ofcom expects the services concerned to comply by that date, or to act soon after to get there.
In its October 2026 bulletin, Ofcom explains who it recommends hash matching for. This includes high-risk services that mainly host pornographic content, or that share and store files. It also includes services with more than 700,000 monthly active users in the UK. The Online Safety Act is the UK law on online safety. Fines under it can reach £18 million or 10% of global turnover.
At the same time, another UK law arrived: the Crime and Policing Act 2026, which received Royal Assent on 29 April 2026. It requires platforms to remove a non-consensual intimate image within 48 hours of a valid report. Platforms must also stop that content from coming back, whether identical or nearly identical. According to the government, senior managers could face criminal prosecution if they ignore an Ofcom decision. By the end of 2026, Ofcom will consult the industry on adding this duty to its codes, with a view to applying it in 2027.
Ofcom has been investigating X since Grok, the network's AI, was used to create sexualised images of real people. On 14 October, Ofcom moved this investigation to a new phase. It now covers how X handles illegal content and its reporting tools. In other words, Ofcom looks at your methods, not only the outcome.
In the US, the FTC (Federal Trade Commission, the consumer protection authority) has enforced the Take It Down Act since 19 May 2026. Platforms that mainly host content posted by their users must offer a clear, easy-to-find removal request process. They must then remove the content and known identical copies within 48 hours. The law also covers deepfakes, meaning faked images ("digital forgeries"). The civil penalty can reach $53,088 per violation.
In the European Union, the DSA (Digital Services Act, the EU regulation on digital services) already applies. Its Article 16 requires every hosting provider to offer a notice-and-action mechanism, then to decide quickly and explain its decision. Directive 2024/1385 deals with combating violence against women. Its Article 5 makes sharing intimate or faked images without consent a criminal offence, deepfakes included. Member states have until 14 June 2027 to write it into national law.
What must your platform be able to do, in practice?
These texts boil down to four capabilities. If you cannot demonstrate them, that is where to focus.
| Capability | The question to ask | The evidence expected |
|---|---|---|
| Receive | Can a victim without an account find the form in under a minute? | Documented process, accessible without logging in, a tracking number for each request |
| Decide fast | Is the reported content removed or blocked within 48 hours? | Exact time of the report, the decision and the removal |
| Prevent return | Is an identical copy blocked at upload? | Hash added to the blocklist, log of detected copies |
| Explain | Does the person know what was done and how to appeal? | Reply explaining the decision, route to appeal, turnaround statistics |
Many adult platforms have a reporting form designed for logged-in subscribers. Yet the person writing to you almost never has an account with you. The FTC also recommends giving each request a number and keeping the person informed of its progress.
Why is hash matching not enough on its own?
Hash matching compares a file's fingerprint against a list of content already identified as illegal. It works very well against re-uploads of a video that was already removed, like the weekend copy in our example. That is why Ofcom made it the reference measure.
But a fingerprint only detects what is already known. New content will get through the first time. An AI-generated image built from a real person's photo will get through too. Ofcom recognises this and accepts other measures that are just as effective.
The real protection happens before publication. On an adult platform, the best defence is knowing who appears in the content and whether each person said yes. The card networks already require this since Mastercard announcement AN 5196. This rule requires you to verify the identity and age of the creator and of every person on screen. It also requires you to keep a written record of consent and to moderate each piece of content before it goes live. Finally, it requires removal requests to be handled within seven business days. The new laws cut that deadline to 48 hours for non-consensual intimate images.
What about deepfakes?
This is the hardest case: the person shown was never filmed. Your co-performer checks will not catch it, because that person is not in your records.
What we would do in your place:
- State clearly in your terms of service that synthetic content is banned when it shows a real person without their consent. Make it clear that posting it leads to a ban.
- Treat a deepfake report like an intimate image report, with the same 48-hour deadline. The UK and US laws explicitly cover faked or generated images.
- Combine AI analysis with identity verification. A face may match no verified creator or co-performer on the account. In that case, someone on your team must review the content before publication.
- Make the ban stick. An account closed for a deepfake that returns two days later with a new email address: that is exactly what you do not want to explain to a regulator. The ban must follow the person's verified identity, not the account.
What we would do if we were the compliance lead today
Measure before you promise. Calculate your real turnaround times over six months: from report to first action, then from report to removal. The median is often good, but Friday-night reports wait until Monday. And the 48 hours keep running over the weekend.
Create a dedicated queue. A non-consensual image report should not land in the general support queue. It needs priority, a trained team and on-call cover. First step: hide the content before the full review is done.
Link takedown and hashing. Every removal on these grounds should automatically add the content's hash to your list. The next copy is then blocked at upload, instead of being reported three days later.
Prepare your file. One day, Ofcom, Arcom (the French digital regulator) or your PSP will ask you questions. Your PSP is the provider that lets you accept card payments. You must then provide, within minutes, your written procedure, your turnaround statistics and anonymised examples. Add proof that the people shown in the content at issue had given their consent. The 2026 sanctions made it clear: answering an information request badly is already a breach.
Talk to your PSP before it talks to you. For an acquiring bank, a badly handled case threatens its reputation and its standing with the card networks. Show it your procedure and your turnaround times now: your file will come out stronger.
How Pleenk Approve can help
Pleenk Approve works upstream, and on evidence. The core of Pleenk is a single digital identity. The creator and every co-performer are verified with a liveness check before publication. Their identity is encrypted by Pleenk and stored in a single wallet (a digital identity wallet): your platform receives proof, never the ID document. Their consents and any bans are linked to this wallet. So a ban follows the person, not the account. Pleenk also manages the right to withdraw consent. It measures how long it takes you to remove content once consent is withdrawn. Your moderation stays yours: Pleenk connects to your AI moderation tool and keeps proof that the checks were done. Pleenk does not replace your takedown procedure or your hash matching tool. Reviewing your notice-and-takedown procedure ahead of Ofcom's consultations? Write to us at contact@pleenk.com.
This article is for information only and does not constitute legal advice. The texts cited are evolving, and how they apply depends on your service and your markets. Have your choices reviewed by your lawyer.
Sources
- Ofcom – Enforcement programme on non-consensual intimate images (9 September 2026): https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/Enforcement-programme-into-measures-being-taken-by-services-to-prevent-users-from-encountering-or-sharing-non-consensual-intimate-imagery-NCII
- Ofcom – Online Safety industry bulletin, October 2026 (15 October 2026): https://www.ofcom.org.uk/online-safety/protecting-children/online-safety-industry-bulletin-october-2026
- GOV.UK – Crime and Policing Act 2026: intimate image abuse factsheet (29 September 2026): https://www.gov.uk/government/publications/crime-and-policing-act-2026-factsheets/crime-and-policing-act-2026-intimate-image-abuse-factsheet
- Kingsley Napley – Deepfakes and the Crime and Policing Act 2026 (May 2026): https://www.kingsleynapley.co.uk/our-insights/articles/deepfakes-to-deletion-orders-tackling-technology-enabled-sexual-offending-in-the-crime-and-policing-act-2026/
- BusinessDay / Reuters – Ofcom and X's handling of illegal content (14 October 2026): https://www.businessday.co.za/world/2026-10-14-concerns-persist-over-xs-handling-of-illegal-content-uk-media-regulator/
- FTC – Take It Down Act enforcement starts now (May 2026): https://www.ftc.gov/business-guidance/blog/2026/05/take-it-down-act-enforcement-starts-now-what-know-about-ftc-tida
- FTC – Complying With the Take It Down Act: https://www.ftc.gov/business-guidance/resources/complying-take-it-down-act
- EUR-Lex – Regulation (EU) 2022/2065 (Digital Services Act): https://eur-lex.europa.eu/eli/reg/2022/2065/oj
- EUR-Lex – Directive (EU) 2024/1385 on combating violence against women: https://eur-lex.europa.eu/eli/dir/2024/1385/oj
- Age Verification Providers Association – Mastercard requirements for adult content merchants: https://avpassociation.com/thought-leadership/mastercard-specialty-merchant-requirements-drive-age-verification/