Instruments drawn to the special attention of the House
Draft Amendments to the Illegal Content Codes of Practice for Search Services and User-to-User Services 2026
Date laid: 1 June 2026
Parliamentary procedure: negative
These proposed changes to the Illegal Content Codes of Practice for Search Services and User-to-User Services (“the codes”) would introduce a new measure that relevant services can apply to prevent non-consensual intimate image (NCII) abuse. The new measure involves ‘hash-matching’ and related technical tools to identify and prevent the repeated uploading and sharing of known NCII. The aim is to reduce the reliance on victims having to report abuse repeatedly once such content has been identified. While these are technical changes, NCII abuse is a matter of public concern, and the changes complement other measures that have been introduced to address this particular form of online abuse. On request, the Department for Science, Innovation and Technology has provided information about these wider measures and further changes planned by Ofcom, the online safety regulator. We note that Ofcom is continuing to keep the operation of the codes under review and that further changes are planned to tackle online abuse and illegal content and activity.
The draft Amendments are drawn to the special attention of the House on the ground that they are politically or legally important or give rise to issues of public policy likely to be of interest to the House.
1.The proposed changes to the Illegal Content Codes of Practice for Search Services and User-to-User Services (“the codes”) would introduce a new measure that relevant services can apply to prevent non-consensual intimate image (NCII) abuse. NCII abuse occurs when intimate content is produced, published, or reproduced without consent, typically online. The new measure involves ‘hash-matching’ and related technical tools to identify and prevent the repeated uploading and sharing of known NCII. The aim is to reduce the reliance on victims having to report abuse repeatedly once such content has been identified.
Background
2.The Online Safety Act 2023 (“the OSA”) established a regulatory framework for user-to-user services and search services which imposes duties on providers of such services to take proportionate steps to protect UK-based users from illegal content and activity. These are referred to as “illegal content duties”. A user-to-user service describes an online service where content that is generated directly by users of the service may be encountered by another user (for example social media platforms, such as Instagram, or content-sharing services, such as YouTube). A search service describes an online service that is or includes a search engine (for example Google).
3.The OSA requires Ofcom, the online safety regulator, to issue codes of practice describing recommended measures that providers can apply to comply with their illegal content duties. The measures include user support, safety-by-design, additional protections for children, and content moderation or de-indexing (the removal of web pages from search engine results). The Department for Science, Innovation and Technology (DSIT) says that while the measures set out in the codes are not mandatory and providers may choose alternative measures, providers that take all relevant steps in a code will be considered compliant with their duties. Ofcom issued its first illegal content codes in March 2025.
What the proposed changes to the codes mean in practice
4.The proposed amendments to the illegal content codes would introduce a new measure specifically to tackle NCII abuse. The amendments recommend that relevant services use ‘hash-matching’ and related technical tools to identify and prevent the repeated uploading and sharing of known NCII.
5.Hash-matching is an automated process used by online services to identify previously known content. It works by generating a unique digital fingerprint (‘hash’) for an image or video and comparing that against a database of hashes of known content. Where there is a match, the service can treat the content as likely to be the same, or substantially similar, material and take appropriate action, for example removing or deprioritising it, without needing to manually review every item uploaded.
6.There are two basic forms of hash-matching, both of which may be applied under the proposed amendments to the codes:
- Cryptographic hash-matching only detects files that are an exact match. This means that perpetrators may slightly alter images to circumvent cryptographic hash-matching.
- Perceptual hash-matching determines whether a given file is similar to a hashed file by setting a threshold that is used to determine when there is sufficient similarity between the hashes to be considered a (near) match. This allows modifications from an original file to be detected.
7.The types of content that can be hashed include images, videos or files that are generated, uploaded to, or shared on, an online service. Perceptual hash-matching technology can detect known instances of content generated by artificial intelligence, such as deepfakes.
8.The DSIT says that the proposed measures would apply to services where the risk of NCII abuse is assessed as medium or high, with scope and application varying according to service type, size and risk profile. For user-to-user services, the measure is focused on services where users can upload or share images, while for search services it targets the repeated appearance of known abusive material through search results. Smaller services are in scope where the risk of harm is sufficiently high.
9.The DSIT says that while the current illegal content codes already contain recommended measures for tackling illegal image-based abuse and for using proactive technology in relation to child sexual abuse material, they do not recommended a specific measure on hash-matching to detect NCII. The DSIT says that the proposed amendments seek to strengthen the existing regulatory framework by setting clearer expectations around the use of hash-matching tools to prevent repeated NCII uploads.
10.Ofcom has published a statement which provides further detail on the new measures, their intended implementation and expected impact, and on the feedback received during public consultation.1
Wider measures that have been introduced or are under consideration
11.The DSIT says that following the implementation of the first illegal content codes, Ofcom consulted on proposals for additional safety measures across both the illegal content codes and the children’s safety codes in June 2025, covering a range of interventions intended to strengthen protections against specific harms, including measures addressing NCII abuse. The DSIT says that in response to significant public and parliamentary interest in ensuring that service providers take effective action to tackle NCII abuse, the Prime Minister announced new measures and duties for online services in February 2026.2 This included a new duty on providers to take down abusive images within 48 hours, and Ofcom expediting the development of the specific NCII hash-matching measure taken forward by these proposed amendments to the codes.
12.Asked about the implementation of the wider measures announced by the Prime Minister, such as the possibility of service providers being fined up to 10% of their qualifying worldwide revenue or having services blocked in the UK for non-compliance, the DSIT provided the following update:
“The commitments referenced have now been implemented through a combination of the existing Online Safety Act (OSA) framework and targeted amendments being made to the OSA framework through the Crime and Policing Act [2026].
Removal of content (including 48-hour requirement):
- The Crime and Policing Act introduces a new, specific duty into the OSA [ … ] requiring providers to put in place systems and processes to enable the rapid removal of non-consensual intimate image content following a report.
- In particular, providers are required to remove such content as soon as reasonably practicable and, in any event, within 48 hours of receiving a valid report, subject to limited exceptions. The duties also extend to content that is the same as, or substantially the same as, the reported content, strengthening protections against re-uploads.
- This builds on the OSA’s broader requirement for services to act expeditiously on illegal content, by introducing a clear, time-bound legal obligation for this specific and highly harmful category.
Priority offence status:
- Sharing non-consensual intimate images (NCIIs) was already a ‘priority kind of illegal harm’ under the OSA framework.
- In addition to this, the Crime and Policing Act expands the OSA’s priority offences regime [ … ] to ensure that offences relating to the creation and solicitation of intimate images without consent (including the offences at ss.66E and 66F of the Sexual Offences Act 2003) are captured as priority offences.
- As a result, content amounting to these ‘creating and requesting NCII’ offences is treated as priority illegal content, meaning providers are subject to the OSA’s most stringent duties, including to proactively prevent users encountering such content and to minimise its presence on their services.
Enforcement (fines and service restriction):
- The enforcement powers referenced are provided for under the OSA. Ofcom may impose significant financial penalties (up to 10% of qualifying worldwide revenue) and, in the most serious cases, apply for business disruption measures, including restricting access to non-compliant services in the UK.
- In addition, amendments made through the Crime and Policing Act also strengthen the enforcement framework for non-consensual intimate image (NCII) content by extending the application of existing OSA senior management liability provisions in connection with the new duties, thereby reinforcing accountability at senior levels for compliance in this area.
Taken together, these measures give effect to the substance of the Prime Minister’s commitments, while operating within the OSA’s broader risk-based and systems-focused regulatory framework.”
13.We also asked what other changes to the online safety codes Ofcom is planning to take forward, and whether there is a timetable for these further actions. The DSIT told us:
“Ofcom is continuing to develop and refine its Codes of Practice, with further updates expected in the autumn.
- In June 2025, Ofcom published several proposed new measures for consultation.3
- These included the hash-matching measure discussed in the EM [Explanatory Memorandum].
- It also included consideration of a ‘crisis response’ measure. Under this, certain services would be expected to prepare and apply protocols to respond to exceptional events involving a significant increase in illegal content and/or content harmful to children, alongside maintaining dedicated channels for engagement with law enforcement. Ofcom on 9 June announced these new measures, which will be included in the Illegal Content Codes of Practice and Protection of Children Codes of Practice.4
- There were also several other proposals for new measures, and Ofcom has indicated it will reach final decisions about these in the Autumn. These include:
- Strengthening proactive systems and processes, including more effective use of automated detection tools (such as hash-matching) to identify known illegal content, coupled with clearer expectations around validation, accuracy, and human oversight where tools rely on external datasets or less certain signals;
- Enhancements to governance, assurance and risk assessment processes, including expectations that services maintain more robust internal oversight of safety systems, regularly test and review the effectiveness of their measures, and ensure that senior accountability arrangements support effective decisionmaking on safety risks;
- Further refinements to child safety and user protection measures, including more granular expectations around how services assess and mitigate risks arising from specific functionalities (such as recommendation systems, search and sharing features), and how those risks may evolve over time or in response to changes in user behaviour or emerging harms.
For these latter measures, final details will be set out in Ofcom’s (currently scheduled for) Autumn publications.”
14.We note that Ofcom is continuing to keep the operation of the codes under review and that further changes are planned to tackle online abuse and illegal content and activity.
National Savings (Remediation Scheme) Regulations 2026 (SI 2026/623)
Date laid: 11 June 2026
Parliamentary procedure: negative
These Regulations, along with a parallel instrument, establish a remediation scheme for an issue that has been discovered in National Savings and Investments (NS&I) whereby the estates of deceased customers were not always repaid deposits and other assets held. The remediation scheme will pay out on two bases: first, identifying and returning the funds actually held in NS&I accounts; and second, providing compensation over and above the return of funds. Compensation will include interest to recognise the delay in receiving funds, plus additional sums to recognise any administration and associated costs borne by the estate. Asked specifically about the potential refund of legal costs incurred to date by estates seeking to recover missing funds, HM Treasury (HMT) told us that the additional compensation will “include the cost of reasonable professional fees”.
We questioned HMT about how the compensation, as well as operational, costs of the scheme would be funded. HMT was unable to provide us with an unequivocal guarantee that no further support from the public purse would be needed, but said that “NS&I is expected to manage within existing budgets [so] as to ensure no additional taxpayer commitments arise from the scheme”. The House may wish to question further the likelihood of NS&I’s existing budgets covering all costs associated with the scheme. HMT also stated that no costs will be passed on to NS&I customers, for example through lower interest rates on current products.
HMT told us that NS&I is aiming to complete the remediation process by “the first half of 2027” and will provide quarterly public updates on progress.
The Regulations are drawn to the special attention of the House on the ground that they are politically or legally important or give rise to issues of public policy likely to be of interest to the House.
Background and purpose
15.As has been widely reported,5 National Savings and Investments (NS&I), the UK government-backed savings provider, has identified a longstanding issue whereby the estates of deceased customers were not always repaid deposits and other assets held with NS&I. NS&I has suggested that up to 34,000 estates with a total value of approximately £367 million are affected.6
16.These Regulations establish a remediation scheme for affected customers who held deposit-based savings accounts. HM Treasury (HMT) states that while existing powers allow NS&I to return the deposits and other funds held, they do not contain “express provision” for a “proactive” and “large-scale” remediation scheme of this kind, hence the need for this statutory instrument (SI). The scheme aims to proactively identify and remediate all holdings of £10 or more, although claims can still be made for smaller amounts.
17.A parallel SI was laid on the same day to apply the remediation scheme to the remaining affected NS&I products, such as bonds (including premium bonds) and savings certificates.7 That parallel SI is not subject to any further parliamentary procedure.
18.The Explanatory Memorandum (EM) states that the underlying issue was resolved for current and new bereavement claims and enquiries from January 2026, and operational processes have changed so that it does not reoccur.
What compensation will be available?
19.The remediation scheme will pay out on two bases: first, identifying and returning the funds actually held in the NS&I account; and second, compensation over and above the return of funds. These Regulations set out the eligibility criteria for compensating affected estates and the basis for calculating and paying compensation. The EM states that specifying the approach in legislation will provide NS&I with all necessary powers and a “consistent legal framework” to determine whether to compensate affected estates, and, if so, by how much.
20.Compensation will include interest payments to ensure that estates are not disadvantaged by the delay in receiving the funds. Interest will be calculated at the higher of (i) the contractual interest rate on the product, and (ii) the Bank of England base rate plus one percentage point. The EM says that this reflects the approach taken by the Financial Ombudsman Service in analogous situations.
21.However, the EM also states that the instrument confers “wide discretion” on NS&I to make further compensatory payments, for example owing to additional administration and associated costs borne by the estate. This, the EM says, reflects NS&I’s expectation that:
“Some estates will have consequential losses above and beyond compensatory interest. Due to the volume of estates affected, and the different types of potential financial losses, including unforeseen losses that an estate might incur, it is not possible to exhaustively prescribe the circumstances where compensatory losses can or should be paid.”
22.We specifically asked whether an estate that has already incurred legal costs attempting to recover missing money will have these costs refunded. HMT replied:
“NS&I will consider all losses to an estate that are attributable to the bereavement tracing issue, which would include the cost of reasonable professional fees whether already incurred or yet to be incurred.”
23.In response to our question about the overall costs of compensation, HMT said that “as NS&I is in the early phase of delivering the scheme, the expected costs [ … ] are uncertain at this stage, but these will be published in NS&I’s Annual Report in due course”.
Will taxpayers bear the costs of remediation?
24.As described above, the total value of the remediation scheme consists of the funds being returned plus additional compensation. In his statement to Parliament on the scheme on 26 March 2026, the Parliamentary Secretary to the Treasury, Torsten Bell MP, said that the funds being returned were held by NS&I and already belonged to the estates, and therefore would not give rise to any additional liability to the taxpayer.8
25.We questioned HMT in more detail about how the compensation, as well as operational, costs of the scheme would be funded. HMT explained that NS&I was expected to meet these costs from within its budgets as agreed at the last spending review. Those budgets were funded by taxpayers, so in that sense some taxpayer funding will go towards meeting operational and compensation costs. HMT was unable to provide us with an unequivocal guarantee that no further support from the public purse would be needed, but it said that “NS&I is expected to manage within existing budgets [so] as to ensure no additional taxpayer commitments arise from the scheme”. The House may wish to question further the likelihood of NS&I’s existing budgets covering all costs associated with the scheme.
26.HMT also said that while the expectation of meeting existing budgets could mean NS&I deprioritising or scaling back other work, no costs will be passed on to NS&I customers, for example through lower interest rates on current products, as such interest is funded separately from NS&I’s budgets.
Timing and updates on the remediation scheme
27.We asked about the expected timetable for completing the remediation work. HMT replied that “NS&I aims to return holdings to affected estates as swiftly as possible and expects to complete its remediation programme in the first half of 2027”. HMT also noted that NS&I has published a “delivery plan”.9 The plan includes further details about the scale of the issue and how the scheme will operate.
28.The EM also stated that NS&I will report publicly on progress on the remediation scheme on a quarterly basis, including on the monetary amount of compensation paid to date. HMT told us that each update will be published on NS&I’s website and will be accompanied by a press release.
Design of the scheme
29.The EM states that “extensive engagement” was carried out in designing the remediation scheme. We asked HMT for further details on what this involved and whether there have been any significant objections to the approach. HMT replied:
“NS&I was supported by independent external advisers when designing the scheme to ensure that it is effective, fair and meets regulatory standards. Although NS&I is not regulated by the Financial Conduct Authority, the Government expects it to meet the same standards as regulated deposit-taking banks. Since the scheme was announced by the Minister for Pensions and NS&I in May 2026, to the best of our knowledge there have been no objections. HM Treasury has also been closely involved in the scheme’s design.”
1 Ofcom, Statement: Detecting intimate image abuse Online Safety—Additional Safety Measures, 18 May 2026.
2 Prime Minister and Department for Science, Innovation and Technology, Press release: Tech firms will have to take down abusive images within 48 hours under new law to protect women and girls, 19 February 2026.
3 Ofcom, Consultation: Online Safety—Additional Safety Measures, consultation closed 20 October 2025.
4 Ofcom, Statement: Crisis response protocol, 9 June 2026.
5 For example: BBC News, NS&I boss replaced as savers left waiting for millions of pounds, 26 March 2026.
6 NS&I, NS&I Bereavement Claims—Delivery Plan, 19 May 2026.
7 National Savings (Remediation Scheme) (No. 2) Regulations 2026 (SI 2026/624).
8 HC Deb, 26 March 2026, cols 437–46.
9 NS&I, NS&I Bereavement Claims—Delivery Plan, 19 May 2026.