Leaked OnlyFans Content in the UK: The 48-Hour Takedown Law and Ofcom’s New Hash-Matching Rule

If you are a UK creator and your content shows up on a leak site, 2026 gave you two new levers. A new law makes platforms take down intimate images shared without consent within 48 hours of a valid report. And since 30 September 2026, Ofcom expects certain platforms to catch known images on upload with hash matching.

Both are real progress. Neither one is a magic delete button for paid content, and there is a legal catch most coverage skips. Here is what each one does, where it falls short for OnlyFans creators, and the order we work through a leak in.

What changed in 2026

• 29 April 2026: the Crime and Policing Act 2026 received Royal Assent (Osborne Clarke). It adds the 48-hour takedown duty to the Online Safety Act, bans nudification tools and creates new intimate image offences.
• 18 May 2026: Ofcom confirmed it would recommend hash matching to detect intimate image abuse (Ofcom).
• 30 September 2026: Ofcom’s amended Illegal Content Codes, including the hash-matching measure, came into force (Ofcom statement).

The 48-hour takedown duty

Under the Crime and Policing Act, regulated online platforms have to remove reported content “as soon as is reasonably practicable and in any event within 48 hours of receiving a valid report”. Search services must make sure people can no longer find it in the same window.

Three details matter:

• Who reports. The report has to come from the person in the image or someone acting for them.
• What it covers. Only content that amounts to an offence under section 66B of the Sexual Offences Act 2003, which is sharing an intimate photo or film without consent.
• The teeth. Ofcom enforces it. If a platform ignores an Ofcom decision on these takedowns, senior managers can face criminal liability in serious cases.

The government factsheet does not give a start date for the duty, so check whether it is in force before you rely on it in a report. Source: GOV.UK.

Ofcom’s hash-matching rule

Hash matching turns an image into a digital fingerprint and checks new uploads against a database of fingerprints, including slightly altered versions of the same image. Ofcom now recommends that certain sites and apps use a hash database “equivalent to or better than” StopNCII, which it calls the leading one.

The upside for creators is that it works before anyone reports anything. Once an image is in the database, a platform that follows the code should block it on upload instead of waiting for a takedown. Ofcom says some providers already do this and that it “is an effective tool for detecting intimate images that have been shared without consent.” Source: Ofcom.

The limit: Ofcom only says “certain” services. Small leak sites hosted outside the UK are exactly the ones least likely to follow a UK code.

The catch for paid content

Both levers are built around images shared without consent. Leaked OnlyFans content is awkward here, because you did consent to sharing it, just with paying subscribers and not with the whole internet.

The law has an exemption that matters. Under section 66C(3) of the Sexual Offences Act 2003, it is not an offence to share an image that had been “previously publicly shared” if the person in it consented to that earlier sharing. Whether a paywalled page counts as publicly shared is not settled. If it does, a leak of your paid content may fall outside section 66B, and so outside the 48-hour duty.

So treat the new rules as an extra route, not your main one. For content you made to sell, copyright is still the strongest tool: you own it, and hosts, search engines and payment providers act on copyright notices every day. For a case that matters, talk to a UK solicitor.

Where the new rules clearly help

• Private images. Anything you sent one person privately, or never published, is the clear case for section 66B and the 48-hour report.
• Copies of disappearing messages. The Act creates an offence of copying an intimate image that was only shared temporarily, without consent.
• Deepfakes and nudified images. Creating or requesting a deepfake intimate image is already an offence under the Data (Use and Access) Act 2025, and making or supplying nudification tools now carries up to 3 years in prison.
• Threats. Threatening to share an intimate image is covered too. If someone is blackmailing you, go to the police.

Source: GOV.UK factsheet.

What to do when your content leaks in the UK

This is the order we work in for UK creators:

• 1. Document first. Save every URL, a screenshot with the date and the page that links to it. Do not contact the uploader.
• 2. Send copyright takedowns. To the host, the site and the search engines. Our DMCA notice generator writes them for you. This works for paid content, whatever the consent question.
• 3. Report it as intimate image abuse where it fits. Private images, deepfakes and anything you never put behind a paywall are the clear cases for a platform report under the new duty.
• 4. Hash it. For images that fit, StopNCII lets you create hashes on your own device without uploading the image. Check on their site whether your case is eligible.
• 5. Get it out of search. Ask Google and Bing to remove the URLs. Under the new law, search services have the same 48-hour window once the duty applies.
• 6. Police for threats or deepfakes. Blackmail, threats to share and deepfakes are criminal offences in their own right.

More detail on each step is in our leak and DMCA guide.

How we handle it for UK creators

Leak protection is part of full management at no extra charge. We monitor, document and send most takedown notices within 24 hours of finding a leak, and we pick the route that fits each URL: copyright notice, platform report or search removal. How our leak protection works.

Sources

Ofcom quotes are Ofcom copyright, reproduced under Ofcom’s copyright and re-use terms from Statement: Detecting intimate image abuse and Platforms should use detection technology to stop spread of illegal intimate images online, under strengthened Ofcom Codes (both Ofcom, 18 May 2026). The takedown duty, offences and penalties come from the Crime and Policing Act 2026: intimate image abuse factsheet (GOV.UK, contains public sector information licensed under the Open Government Licence v3.0). The Royal Assent date is from Osborne Clarke. This is our summary, not legal advice, and Ofcom has not reviewed or endorsed it.

Questions creators ask