UK Trusted Flagger Rules for Intimate Image Reports Now in Force

The Intimate Image Reports (Trusted Flagger) Regulations 2026 came into force today, 12 November 2026. Made under paragraph 1(1) of Schedule 14 to the Crime and Policing Act 2026, SI 2026/1107 designates one charity to make intimate image reports to online providers. It imposes no new duty on those providers.

Information last verified on 12 November 2026. This is a developing story; we update it as the record changes.

Status: Made 20 October 2026; laid before Parliament 22 October 2026; came into force 12 November 2026. Extends to England and Wales, Scotland and Northern Ireland. We verified the underlying scheme: Schedule 14 to the Crime and Policing Act 2026, including paragraph 1, came into force on 29 June 2026 by virtue of SI 2026/689, reg. 2(1)(z10), and section 103 of the Act, which introduces that Schedule, came into force the same day by reg. 2(1)(k). The designation therefore operates under a commenced power, not a dormant one.

Jurisdiction and scope. Regulation 1(3) states that "These Regulations extend to England and Wales, Scotland and Northern Ireland." The instrument designates a reporter; it does not create, amend or extend any criminal offence, and it does not change what a platform must do with a report. The criminal offence that the relevant content definition keys into, section 66B of the Sexual Offences Act 2003, extends to England and Wales only; Scotland and Northern Ireland have their own separate offences.

What Happened

The Home Office made SI 2026/1107 on 20 October 2026 and laid it before Parliament on 22 October 2026. It was signed by Satvir Kaur, Parliamentary Under-Secretary of State at the Home Office, who is described in the explanatory memorandum as Minister for Safeguarding and Violence Against Women and Girls.

The instrument runs to two regulations. Regulation 1(2) provides that "These Regulations come into force on 12th November 2026." Regulation 1(3) sets the extent.

Regulation 2 does the substantive work:

"South West Grid for Learning Trust is designated as suitable to make intimate image reports to providers of internet services and providers of internet access services for the purpose specified in paragraph 1(1) of Schedule 14 to the Crime and Policing Act 2026."

South West Grid for Learning Trust is a registered charity in England and Wales, number 1120354, and in Scotland, number SC051351. The Scottish charity register records it under that name, registered from 19 October 2021 and known as SWGfL Scotland. The explanatory note to the instrument records that the Trust "operates a service called the Revenge Porn Helpline which will receive information from the public and make the reports". The Helpline's own site states that it "supports all adult victims of intimate image abuse in the UK".

One point worth stating plainly, because it is easy to get the wrong way round: the designation power is in the Crime and Policing Act 2026, not the Online Safety Act 2023. The Online Safety Act enters only through the definition of intimate image content in section 59(10A), which Schedule 14 borrows.

What the Law Actually Says

Paragraph 1(1) of Schedule 14 to the Crime and Policing Act 2026 lets the Secretary of State designate persons as suitable to make intimate image reports to providers of internet services and providers of internet access services, and it states the object of doing so: "for the purpose of assisting the providers to make judgments about whether content is intimate image content".

That purpose clause is the whole of the legal effect on providers. Paragraph 1 does not oblige a provider to receive a report, to prioritise it, to act on it or to answer it. It creates no safe harbour for a provider that acts on one, and no evidential presumption that reported content is what the report says it is. The Home Office explanatory memorandum states the position in terms: the instrument "does not amend the existing criminal offences or online platform duties relating to intimate image content", and "this instrument will not place specific duties on how online platforms handle reports from a 'trusted flagger'". The memorandum adds that no guidance accompanies the instrument because it "does not impose new duties or confer additional powers for online platforms in relation to reports submitted by a 'trusted flagger'".

Paragraph 1(2) defines what a report is. The explanatory note summarises it as including "a report identifying content which is a photograph or film showing, or appearing to show, a person in an intimate state where that person, or someone acting on their behalf, has informed the person making the report that they do not consent to the sharing of the photograph or film". Paragraph 1(5) ties the terms used in the first limb of that definition to their meaning in section 66B of the Sexual Offences Act 2003.

Designation was not optional. Paragraph 1(3) provides that "The Secretary of State must exercise the power in sub-paragraph (1) to designate at least one person." Paragraph 1(4) ends that duty if regulations are later made under paragraph 3, the intimate image register power.

The content definition sits in the Online Safety Act 2023. Section 59(10A), inserted on 29 June 2026 by section 100(8) of the Crime and Policing Act 2026 and commenced by SI 2026/689, reg. 2(1)(j), reads: ""Intimate image content" means content that amounts to an offence under section 66B(1), (2) or (3) of the Sexual Offences Act 2003 (sharing intimate image of a person without consent)." Offences under section 66B are listed as priority offences in paragraph 28A of Schedule 7 to the Online Safety Act 2023.

The duty that actually forces removal is a different provision, and it predates today. Section 10(3A) of the Online Safety Act 2023, inserted by section 100(2) of the Crime and Policing Act 2026 and in force since 29 June 2026, requires proportionate systems and processes designed to take down reported intimate image content and substantially similar content "as soon as reasonably practicable, and no later than 48 hours, after the provider receives the report". The trigger is an intimate image content report under section 20A(2), which must declare that the reporter is the subject of the content or a person acting on that person's behalf, that the report is made in good faith, and must give contact details. Section 10(3B) switches the duty off where the provider considers that the content is not intimate image content, or that the reporter is not the subject or their representative.

So two reporting routes now sit side by side. A victim's section 20A report starts the 48 hour clock. A trusted flagger report under Schedule 14 does not start that clock; the Home Office position is that it helps a provider reach the judgement the clock depends on. Both are separate again from the criminal process, which runs through the police and the courts under the offences summarised in our guide to intimate image abuse law across the UK.

What Happens Next

More designations are possible. The explanatory memorandum states that "More than one 'trusted flagger' can be designated for intimate image content, meaning that additional organisations or individuals could be designated in the future", and that the Government "will maintain ongoing consideration of potential new designations of 'trusted flaggers' by the Home Secretary, as well as periodically assess the suitability and continued appropriateness of organisations already designated as 'trusted flaggers'". There is no statutory review clause in the instrument.

Most of Schedule 14 remains unexercised. Paragraph 2 carries a power to amend the Online Safety Act 2023 to impose duties on providers of regulated services to supply intimate image information, in a specified form such as a hash code, to a designated person. Part 2 carries the powers for an intimate image register: a registrar, fees, guidance, duties to take down registered content, and enforcement with monetary penalties that "may not be more than £3 million". Those paragraphs are in force as powers; no regulations have been made under them.

The memorandum links the two. It says the designation "will be reviewed following the introduction of any further secondary legislation arising from work on the development of a central register of hashes of intimate image material, as informed by the Government's six-month scoping exercise", and that a designation "may be ended if such legislation is made". The Home Office factsheet on the Act says the scoping exercise is expected to take around six months. Any register regulations would also engage paragraph 1(4), which lifts the duty to keep at least one designated person.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The bottleneck in intimate image abuse has not mainly been the absence of a rule. It has been the question of who decides whether reported content really is non-consensual. The Home Office puts that squarely in the explanatory memorandum: for child sexual abuse material and terrorist content, illegality does not turn on consent, so platforms remove on identification, whereas "responses to NCII have depended on establishing whether consent to the sharing of the content was given, which can be difficult".

Read against section 10(3B), the design makes sense. That subsection gives a provider a lawful exit from the 48 hour duty where it considers the content is not intimate image content, or that the reporter is not the subject or their representative. A statutory designation does not close that exit, and nothing in Schedule 14 says it does. What it does is put government backing behind one organisation's assessment, which is aimed at the credibility question rather than at the removal duty. That is a narrower intervention than headlines about new takedown powers would suggest, and it is the correct reading of the text.

Concentrating the route through a single charity has a practical consequence worth naming. The explanatory memorandum says the Trust already operates StopNCII.org and that only content the Revenge Porn Helpline has assessed and verified is marked as verified in the hash list and so qualifies for a trusted flagger report; hashes submitted directly by individuals without Helpline involvement are treated as unverified and excluded. Verified reporting therefore depends on the Helpline's own assessment capacity. The memorandum records that reported cases to the Helpline grew from 500 in 2015 to over 24,000 in 2025, and assesses the impact of designation on the organisation as not significant because the systems already exist.

The last point is the one readers most often get wrong. The criminal track and the content-removal track are genuinely separate. The Home Office factsheet, answering whether the 48 hour duty replaces criminal enforcement, says "No. These are regulatory duties designed to ensure rapid removal of harmful content online. Criminal offences relating to intimate image abuse will continue to be enforced by the police and courts." Content can come down without any prosecution, and a prosecution can proceed while copies remain online. The United States reached a comparable split by a different legislative route, which we cover in our explainer on the federal TAKE IT DOWN Act.

How This Affects You

Nothing a reader has to do changed today. The instrument designates a reporter; it does not create a new form a member of the public fills in, and it does not alter the routes that already exist.

Those routes, in general terms, are three. A report to the platform itself under section 20A of the Online Safety Act 2023, made by the subject of the image or someone acting on their behalf, engages the 48 hour removal timetable in section 10(3A). A report to the police engages the criminal law: section 66B of the Sexual Offences Act 2003 in England and Wales, section 2 of the Abusive Behaviour and Sexual Harm (Scotland) Act 2016 in Scotland, and section 51 of the Justice Act (Northern Ireland) 2016 in Northern Ireland. A contact to the Revenge Porn Helpline is the route through which, from today, information from the public can reach a statutorily designated reporter.

Two things remain unchanged and are worth knowing. A platform can still decline to treat content as intimate image content under section 10(3B). The Home Office factsheet states that services must "operate expedited complaints procedures where reported content is not removed", and that "Ofcom will oversee compliance with these duties as part of its enforcement role under the Online Safety Act". And data protection law sits alongside all of this, not inside it; our explainer on the UK right to erasure covers that separate route. Broader context on offences and procedure across the three legal systems is in our overview of criminal law in England, Scotland and Northern Ireland.

This article is information, not legal advice. It describes the law as recorded on legislation.gov.uk and in Home Office publications as at 12 November 2026. It is not advice about any individual situation, and reading it does not create a solicitor or client relationship. Anyone dealing with intimate image abuse should take advice from a qualified lawyer in the relevant jurisdiction or contact the police.

Related articles

• Revenge porn and intimate image abuse laws in the UK
• What the Online Safety Act 2023 requires, and who you can complain to
• When an abusive message becomes a criminal offence
• UK criminal law and your rights across England, Scotland and Northern Ireland
• How the US TAKE IT DOWN Act handles non-consensual intimate images

Last updated: 2026-11-12. This is a developing story; details verified as of 2026-11-12.

Frequently Asked Questions

What is a trusted flagger?

The Home Office explanatory memorandum for SI 2026/1107 describes a trusted flagger as "an accredited person or organisation that has recognised expertise in detecting certain types of illegal or harmful content online", whose reports are "often treated as priority by online platforms". In UK law the term now has a statutory anchor: paragraph 1(1) of Schedule 14 to the Crime and Policing Act 2026 lets the Secretary of State designate persons as suitable to make intimate image reports to internet service providers and internet access service providers.

Who can make an intimate image report under the new regulations?

Regulation 2 of SI 2026/1107 designates one organisation, South West Grid for Learning Trust. The Home Office explanatory memorandum records that "More than one 'trusted flagger' can be designated for intimate image content, meaning that additional organisations or individuals could be designated in the future." Members of the public do not become designated reporters; the memorandum explains that the Trust receives information from the public through the Revenge Porn Helpline and makes the reports itself.

Does a platform have to remove intimate images in the UK?

Yes, but under the Online Safety Act 2023 rather than under this instrument. Section 10(3A) of that Act, inserted by the Crime and Policing Act 2026 and in force since 29 June 2026, requires proportionate systems and processes designed to take down reported content "as soon as reasonably practicable, and no later than 48 hours, after the provider receives the report". Section 10(3B) disapplies that where the provider considers the content is not intimate image content or that the reporter is not the subject or a person acting on their behalf.

Does the trusted flagger designation force platforms to act on a report?

No. Schedule 14 paragraph 1(1) frames the designation as being "for the purpose of assisting the providers to make judgments about whether content is intimate image content". The Home Office explanatory memorandum is explicit that "this instrument will not place specific duties on how online platforms handle reports from a 'trusted flagger'", and that it "does not amend the existing criminal offences or online platform duties relating to intimate image content".

What is the Revenge Porn Helpline?

It is a service operated by South West Grid for Learning Trust. Its own site states that it "supports all adult victims of intimate image abuse in the UK". The Home Office explanatory memorandum calls it "the only dedicated helpline for victims of intimate image abuse in England and Wales" and notes that it is recognised across the devolved governments. The Trust is a registered charity in England and Wales (number 1120354) and in Scotland (number SC051351).

Is sharing intimate images without consent a crime in the UK?

Yes, though the offence differs by nation. In England and Wales, section 66B of the Sexual Offences Act 2003, inserted on 31 January 2024 by the Online Safety Act 2023, covers sharing or threatening to share an intimate photograph or film. The older offence in section 33 of the Criminal Justice and Courts Act 2015 was repealed on the same date. Scotland has section 2 of the Abusive Behaviour and Sexual Harm (Scotland) Act 2016, in force since 3 July 2017, and Northern Ireland has section 51 of the Justice Act (Northern Ireland) 2016.

Where does the Online Safety Act 2023 come into this?

Only through definitions and duties, not through the designation power. Section 59(10A) of the Online Safety Act 2023 supplies the meaning of intimate image content that Schedule 14 reports are aimed at, and offences under section 66B of the Sexual Offences Act 2003 are listed as priority offences in Schedule 7 to that Act. The designation power itself sits in the Crime and Policing Act 2026.

Does this instrument create a register of intimate images?

No. Part 2 of Schedule 14 contains powers to make regulations for an intimate image register, including provision for a registrar, fees and enforcement with monetary penalties capped at £3 million. Those are powers, not a register. The Home Office explanatory memorandum says a scoping exercise will inform any further secondary legislation, and the Home Office factsheet states that the exercise is expected to take around six months.

Which parts of the UK does SI 2026/1107 cover?

Regulation 1(3) provides that "These Regulations extend to England and Wales, Scotland and Northern Ireland." The explanatory memorandum records the same territorial application and notes that designating a trusted flagger relates to internet services, "which is a reserved matter under all three devolution settlements".