Crime and Policing Act 2026

Schedule 14 Intimate image material: reporting and registration

Section 103 Part 1 Trusted flaggers Duty to designate trusted flagger 1 (1) The Secretary of State may by regulations designate persons as suitable to make intimate image reports to— (a) providers of internet services, and (b) providers of internet access services, for the purpose of assisting the providers to make judgments about whether content is intimate image content. (2) An intimate image report is— (a) a report that— (i) content identified in the report is a photograph or film which shows, or appears to show, a person (P) in an intimate state, and (ii) P, or a person acting on P’s behalf, has informed the person making the report that P does not consent to the sharing of the photograph or film, or (b) a report of information provided to the person making the report by virtue of regulations under paragraph 2. (3) The Secretary of State must exercise the power in sub-paragraph (1) to designate at least one person. (4) The duty in sub-paragraph (3) ceases to apply if Secretary of State makes regulations under paragraph 3. (5) Terms used in sub-paragraph (2)(a) and in section 66B of the Sexual Offences Act 2003 have the same meaning in sub-paragraph (2)(a) as in section 66B. Duties to report intimate image content to trusted flagger 2 (1) The Secretary of State may by regulations amend the Online Safety Act 2023 for, or in connection with, the imposition on providers of regulated services of duties relating to the provision of intimate image information to a person designated under paragraph 1. (2) In this paragraph “intimate image information” means information generated by the provider for the purposes of identifying content which the provider considers to be intimate image content. (3) The regulations may require intimate image information to be provided in a particular form (for example, a hash code). (4) The provisions of the Online Safety Act 2023 that may be amended by regulations under this paragraph include, but are not limited to, section 131(2) (enforceable requirements). Part 2 The intimate image register The intimate image register 3 (1) The Secretary of State may by regulations make provision for or in connection with a register of intimate image material (the “intimate image register”). (2) “Intimate image material” means material which— (a) is intimate image content, or (b) would be intimate image content if it were shared on an internet service. (3) In this Part of this Schedule “intimate image content” has the meaning given by section 59 of the Online Safety Act 2023, except that section 59 applies as if subsections (13) and (14) (“intimate image content” on user-to-user services limited to user-generated content) were omitted. The registrar 4 (1) The regulations may provide for the intimate image register to be maintained by— (a) a person specified in the regulations, (b) an individual appointed by the Secretary of State in accordance with the regulations, or (c) the Secretary of State. (2) Regulations under sub-paragraph (1)(b) may make provision about the terms on which an individual is appointed, including provision— (a) for the payment of remuneration, allowances and expenses by the Secretary of State; (b) for staff, accommodation and other facilities to be provided by the Secretary of State. (3) The person who maintains the intimate image register is referred to in this Schedule as the registrar. Operation of intimate image register 5 The regulations may make provision about— (a) the form in which information is to be recorded on the intimate image register (which may in particular include hash codes); (b) how material is to be reported to the registrar; (c) how the registrar is to make judgments about whether material is intimate image material (which may in particular include provision similar to section 192(5) and (6) of the Online Safety Act 2023); (d) how the registrar is to deal with reports that the registrar considers to be frivolous, vexatious or made in bad faith; (e) appeals against decisions of the registrar; (f) the sharing of information on the intimate image register with— (i) providers of internet services and internet access services, and (ii) other persons, for purposes specified in the regulations. Payment of fees to registrar 6 (1) The regulations may require providers of internet services and internet access services to pay fees to the registrar, as a means of recovering the costs incurred by the registrar in exercising functions under the regulations. (2) The regulations may in particular make provision— (a) for fees to be paid in respect of specified periods; (b) for different fees to be payable by different providers. Duties of providers of internet services and internet access services 7 (1) The regulations may make provision for or in connection with imposing on providers of internet services duties relating to— (a) the provision of intimate image information to the registrar; (b) taking down content recorded on the intimate image register; (c) preventing persons from encountering content recorded on the intimate image register. (2) The Secretary of State may by regulations make provision for or in connection with imposing on providers of internet access services duties relating to preventing access to content recorded on the intimate image register. (3) In this paragraph “intimate image information” means information generated by the provider for the purposes of identifying intimate image material. (4) Regulations under sub-paragraph (1)(a) may— (a) make provision about how a provider is to make judgments about whether material is intimate image material (which may in particular include provision similar to section 192(5) and (6) of the Online Safety Act 2023); (b) require intimate image information to be provided in a particular form (for example, a hash code). Enforcement 8 (1) The regulations may make provision for or in connection with the enforcement of requirements imposed on providers of internet services and internet access services (“providers”) by or under the regulations. (2) The regulations may include provision conferring functions on one or more persons specified in the regulations (each of whom is an “enforcement authority”). (3) The persons who may be specified in the regulations include the registrar and the Secretary of State. (4) The functions which may be conferred on an enforcement authority include— (a) powers to require providers to provide information to the enforcement authority; (b) powers to impose monetary penalties on providers for failure to comply with requirements; (c) powers to issue notices (“compliance notices”) requiring providers to take steps specified in the notice for the purposes of complying with, or remedying a failure to comply with, a requirement. (5) If the regulations provide for the imposition of monetary penalties they must provide— (a) that a penalty (or, where more than one penalty is imposed in respect of a failure, those penalties taken together) may not exceed a maximum amount specified in the regulations (which may not be more than £3 million); (b) for the amount of a penalty imposed on a provider to be appropriate and proportionate, having regard to— (i) the failure to comply in respect of which it is imposed; (ii) any penalties previously imposed on the provider in respect of that failure or other failures; (iii) the size and financial resources of the provider. (6) The regulations may provide for requirements imposed by a compliance notice to be enforceable, on the application of the enforcement authority, by injunction. (7) The regulations— (a) must make provision for appeals against the imposition of a monetary penalty and the issue of a compliance notice (if they provide for those things); (b) may make provision for appeals against other decisions of an enforcement authority. Payment of fees to enforcement authority 9 (1) The regulations may require providers of internet services and internet access services to pay fees to enforcement authorities, as a means of recovering the costs incurred by enforcement authorities in exercising their functions under the regulations. (2) The regulations may in particular make provision— (a) for fees to be paid in respect of specified periods; (b) for different fees to be payable by different providers. Guidance 10 The regulations may provide for the issue of guidance by— (a) the registrar; (b) enforcement authorities; (c) the Secretary of State. Duties of OFCOM 11 The regulations may require OFCOM to have regard to the intimate image register when— (a) preparing a code of practice under section 41 of the Online Safety Act 2023; (b) exercising its functions under Article 5(1) of Regulation (EU) 2015/2120 of the European Parliament and of the Council of 25 November 2015 laying down measures concerning open internet access and retail charges for regulated intra-EU communications and amending Directive 2002/22/EC and Regulation (EU) No 531/2012, and the regulations may amend that Act or that Regulation for or in connection with that purpose. Part 3 Intimate image register: power to amend Online Safety Act 2023 12 (1) The Secretary of State may by regulations amend the Online Safety Act 2023 for or in connection with the imposition on providers of regulated services of duties relating to— (a) the provision of intimate image information to the registrar; (b) taking down content recorded on the intimate image register; (c) preventing persons from encountering content recorded on the intimate image register. (2) In this paragraph “intimate image information” means information generated by the provider for the purposes of identifying intimate image content. (3) Regulations under sub-paragraph (1)(a) may require intimate image information to be provided in a particular form (for example, a hash code). (4) The provisions of the Online Safety Act 2023 that may be amended by regulations under this paragraph include, but are not limited to, section 131(2) (enforceable requirements). Part 4 Supplementary provision Extra-territoriality 13 (1) References in this Schedule to an internet service include an internet service provided from outside the United Kingdom— (a) which has a significant number of United Kingdom users, or (b) one of the target markets of which (or the only target market of which) is United Kingdom users. (2) A user of an internet service is a “United Kingdom user” if— (a) where the user is an individual, the individual is in the United Kingdom; (b) where the user is an entity, the entity is incorporated or formed under the law of any part of the United Kingdom. Interpretation 14 (1) This paragraph applies for the interpretation of this Schedule. (2) The following terms have the same meaning as in the Online Safety Act 2023— “content” (see section 236 of that Act); “internet service” (see section 228 of that Act); “intimate image content” (see section 59 of that Act), except in Part 2 of this Schedule (see paragraph 3(3)); “provider”, in relation to an internet service of any kind (see section 226 of that Act); “regulated service” (see section 4(4) of that Act). (3) “Internet access service” means a service that provides access to virtually all (or just some) end points of the internet. (4) The following terms have the meaning given by the specified provision of this Schedule— enforcement authority | paragraph 8 intimate image register | paragraph 3 intimate image material | paragraph 3 the registrar | paragraph 4