What Does the UK Online Safety Act Say About Deepfakes?

What are the UK Online Safety Act deepfake duties for platforms?

The Online Safety Act 2023 applies to user-to-user services, such as social networks, forums, messaging and video sharing, and to search services with links to the UK. Section 10 sets the illegal content safety duties for user-to-user services: take proportionate measures to prevent users encountering priority illegal content, minimise how long illegal content is present, and swiftly take it down when the service becomes aware of it. Each service must first carry out an illegal content risk assessment. Ofcom, the regulator, sets out recommended measures in codes of practice, and its first illegal-content codes took effect on 17 March 2025.

Deepfakes enter through the underlying offences. A synthetic intimate image of a real person, a deepfake video used in an investment scam, a voice clone used for fraud, or synthetic child sexual abuse material can all be illegal content, and several of the relevant offences are priority offences under Schedule 7, which raises the bar for what services must do proactively. Satirical or clearly labelled synthetic media that breaks no law is not illegal content, although services may still restrict it under their own terms. Ofcom can fine non-compliant services up to £18 million or 10% of qualifying worldwide revenue, whichever is greater.

How does UK law treat deepfake intimate images?

Intimate image abuse is where UK law has moved fastest on deepfakes. Section 66B of the Sexual Offences Act 2003, inserted by the Online Safety Act, makes it an offence to share a photograph or film that shows, or appears to show, another person in an intimate state without consent. The words "appears to show" bring AI-generated and manipulated images inside the offence, and these offences are priority illegal content for platforms. Ofcom also notes that Parliament has made it an offence to make or supply AI tools that can create intimate images.

The platform duties then tightened in two steps in 2026. Section 100 of the Crime and Policing Act 2026 amended the Online Safety Act to add a statutory intimate-image reporting process, with duties to take down the reported content and substantially similar content as soon as reasonably practicable and no later than 48 hours, subject to dispute conditions. Ofcom's statement on detecting intimate image abuse, first published on 18 May 2026, recommends that certain services use hash matching against a database equivalent to or better than StopNCII.org; the code amendments came into force on 30 September 2026, with separate guidance on the proportion of human review.

Where does deepfake detection fit under the Online Safety Act?

Hash matching finds copies of images that have already been reported and hashed. It does not find a newly generated deepfake, or a known one that has been cropped, filtered or re-rendered enough to change its hash. Ofcom's own analysis points out that generative AI is driving an increase in intimate image abuse, which means a growing share of harmful material will be new. Deepfake detection analyses the content itself and can flag synthetic material that no database has seen, which helps with substantially similar content, proactive moderation under a service's risk assessment, and triage of user reports.

Detection does not decide legality. Whether an image is an intimate image of a real person shared without consent, or whether a video is a fraudulent promotion, depends on facts a model cannot see. Ofcom's July 2024 discussion paper, Deepfake Defences, surveyed measures across the supply chain, including watermarking, detection classifiers and content filtering, and found almost half of respondents aged 8 to 15 and 16 and over believed they had seen a deepfake in the previous six months. It treats detection as one layer, and so should service providers.

How should UK organisations prepare for deepfake-enabled fraud?

The Online Safety Act puts duties on platforms, but most UK businesses meet deepfakes as fraud targets: a cloned voice calling the finance team, a synthetic video call with a fake executive, a face swap in a remote account opening, or a fake ad using the company's brand. Preparation needs to cover governance, channels and evidence.

• Name an owner for deepfake-enabled fraud risk and add it to the fraud risk assessment, covering phone, video, onboarding and social channels.
• Require out-of-band verification, such as a callback on a known number, before payments, payee changes or credential resets requested by voice or video.
• Add media-level deepfake checks to remote onboarding and account recovery alongside liveness, face matching and device signals.
• Monitor ad platforms and social media for synthetic impersonation of executives and brand, and use platform reporting routes that the Online Safety Act now strengthens.
• Train staff with realistic examples, and give them a no-blame route to pause unusual requests.
• Preserve suspect media, call records and payment data, and report fraud to Action Fraud or Report Fraud and to your bank promptly.

How can NeuroDetect and NeuroVerify support Online Safety Act compliance?

For trust and safety teams handling reports, NeuroDetect is Neural Defend's forensic media workspace. A moderator or investigator uploads an authorized image, video or audio file into a case, sees heatmaps and attention views down to regions, frames and audio segments, and gets an LLM-assisted summary linked to the evidence. The downloadable forensic report records observations, uncertainty, provenance, model context and analyst notes, which supports dispute handling under the 48-hour regime and records for Ofcom. The reviewer makes the final call.

For scale, NeuroVerify takes an image, video or audio in one API call and returns one unified risk score with signal-level evidence from six signals, including Visual Safety Screening, Face Manipulation Detection and AI Generative Model Analysis. Eligible image requests return in under 200 ms at p95 under defined test conditions, so it can sit beside hash matching to catch novel synthetic material in upload and report queues. On the public VendorBench-100 benchmark of 100 adversarial still images, Neural Defend ranked first of 36 systems with an MCC of 0.876. For UK businesses facing voice fraud, NeuroCall (Beta) adds synthetic voice detection.

Because intimate and personal media is sensitive, Neural Defend deploys as a managed cloud API, in a private cloud or VPC, as a secure container, on-premises or air-gapped, and holds ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001 and SOC 2 Type II certifications.