Impact assessment

Crime and Policing Act: non consensual intimate image register impact assessment (accessible)

Updated 19 October 2026

Title: Intimate image content: reporting and registration

Type of measure: Domestic

Department or agency: Home Office

Type of Impact Assessment: Enactment

RPC reference number: N/A

Contact for enquiries: CrimeandPolicingBillTeam@homeoffice.gov.uk

Date: 13/04/2026

1.   Summary of proposal

1. The proposal will introduce a duty on the Secretary of State for the Home Department (SoS) to designate a Non-Consensual Intimate Image (NCII) register for the purposes of providing information about NCII, and power to make further provisions about the Register following a scoping exercise. This will support the reporting and removal of NCII and will act as a necessary interim step to improving support for Internet Service Providers (ISPs) to block NCII that is not removed by a platform. Any future provisions would be in line with the proactive prevention to NCII recommended by the Online Safety Act 2023 whereby the Act moves platforms away from “waiting until someone reports it” and towards preventing NCII from appearing or spreading in the first place and would also integrate with Ofcom’s forthcoming hash matching regime^{[footnote 1]} which proposes that businesses should use technology to block illegal intimate images at source.  

2.   Strategic case for proposed regulation

2. The government recognises that NCII abuse can have devastating and life-changing impacts on victims and survivors^{[footnote 2]}, who often have to track and re-report images across multiple platforms for them to removed. These proposed measures seek to ensure that victims of NCII only need to report an image once, and it is removed everywhere online^{[footnote 3]}.

3. There are currently barriers to consistently identifying, removing, and/or blocking NCII (hereafter ‘addressing NCII’), including that:

• ISPs do not have a general legal duty to block NCII at network level. A similar duty does exist for child sexual abuse material, but currently not NCII.
• Net neutrality laws impose that all lawful internet traffic must be treated equally. ISPs cannot easily determine whether specific images or videos (hereafter referred to as ‘images’) are NCII, and without this certainty ISPs risk breaching net neutrality through over-blocking.
• There is currently no register of NCII hashes that has statutory backing; there is no organisation with ‘trusted flagger’ status. Therefore, ISPs and social media platforms cannot verify if specific images are considered NCII and face challenges addressing NCII. As a result, victims must continually identify and report NCII across platforms, which can be a very distressing experience.
• The Revenge Porn Helpline operate the only NCII register, StopNCII.org, which is a tool that shares hashes of reported NCII with participating companies to remove and detect images. This database is voluntary and industry-led, meaning it is not required to be used by online platforms. Statutory backing for the register is required for the government to perform a scoping exercise to inform secondary legislation.
• Currently, there are no powers to designate a statutory NCII register, and there is no suite of powers to support use of these hashes or hash-sharing.

4. As a result, there are significant gaps in the current landscape in achieving the overall objective of addressing NCII. NCII carries high level of societal harms, especially emotional harms for victims who are predominantly women and girls.

3.   SMART objectives for intervention

5. The overarching policy objective is to improve the removal and reporting of NCII, and ensure victims only need to report once and their NCII is removed everywhere. Indicators of success may include a reduction in the sharing and re-sharing of NCII across platforms, an increase of ISPs blocking services which do not remove reported NCII content, and a reduction of reported NCII content being circulated online. Ideally, victims should only have to report NCII once before it is addressed which could be measured through engagement with charities such as Revenge Porn Helpline.

6. These objectives align with broader government objectives to explore routes to address NCII and to halve VAWG within a decade.

4.   Description of proposed intervention options and explanation of the logical change process whereby this achieves SMART objectives

7. The preferred option is to:

• Confer a duty for the Secretary of State for the Home Department (SoS) to give ‘trusted flagger’ status to an NCII database, giving government backing to a database of NCII hashes.
• Give the SoS power to make further provisions about the NCII register following a government scoping exercise. This exercise. This exercise will run for six months after Royal Assent and is necessary to determine how the register may most effectively operate, including considering technical capabilities and verification processes.

8. The proposed approach will utilise the Revenge Porn Helpline’s existing NCII database (StopNCII.org), granting statutory backing to enable a scoping exercise that will inform the scheme design. Secondly, the approach ensures that the government have the powers necessary to make future provisions for the usage of a NCII register.

9. Separately, the government is also taking forward a non-legislative approach of updating voluntary guidance for ISPs.

10. Table 1 presents a theory of change for the preferred option. This will help determine what is required for the successful operation of a NCII register and will enable timely implementation of any future measures around said register. The theory of change does not include the mechanisms by which secondary legislation will address NCII as the final scheme design will be informed by the scoping exercise.

Table 1: Theory of Change – Intimate image content: reporting and registration

Inputs: Public sector FTE.

Activities: Introduce a power for the SoS to designate a ‘trusted flagger’ for NCII and further provisions for a NCII register of hashes.

Outputs: Impact assessment in the public domain. Powers introduced.

Outcomes: The SoS could designate a NCII register and has the power to make further provisions.

Long-term outcomes: Signal a legislative approach to addressing NCII. Enables timely implementation of future legislation.

Impacts: Enables scoping exercise to inform effective scheme design. Enables government to address NCII.

5. Summary of long-list and alternatives

11. The long list includes 2 options; ‘Do nothing’ and confer a duty for the SoS to give ‘trusted flagger’ status to an NCII database and gave the SoS power to make further provisions about the NCII register. Non-legislative guidance is already being produced and therefore falls within the scope of the ‘Do nothing’ option.

12. There are no further options considered because statutory backing is a precondition to the scoping exercise that will inform secondary legislation and the final scheme design. Following the scoping exercise (and at the point of secondary legislation) additional options will be explored to achieve the stated objectives.

13. The detail of both options is set out in Section 6.

14. The shortlisted options have been assessed against HMT Green Book critical success factors (CSFs). Option 0 fails to meet the objectives of the scheme but is carried forward as a benchmark. Option 1 is taken forward as the preferred option.

Table 1: Options assessed against Critical Success Factors

CSF 1: Objectives and strategic fit

Option 0 – ‘Do nothing’, including providing non-legislative guidance to stakeholders:

The existing provision would be non-statutory and inconsistent. ISPs will continue to struggle to address NCII due to net neutrality principles, failing to reduce societal harms and not aligning with government priorities around NCII and reducing VAWG. The problem is exacerbated against a backdrop of growing AI-enabled NCII.

Option 1 - Confer a duty for the SoS to give ‘trusted flagger’ status to an NCII database and gave the SoS power to make further provisions about the NCII register:

The first part of this option, on the designation of a ‘trusted flagger’ of NCII, is necessary to provide government backing to a trusted source of NCII content while the scoping exercise is ongoing. This is designed to complement existing regulatory duties outlined in the Online Safety Act 2023.

The second part of this option, which provides the SoS with a power to make further provisions about the NCII register after a scoping exercise, is necessary to ensure the long-term success of a statutory NCII register. This will aid in the removal of such content across platforms.

This option is designed to support addressing NCII, which is line with the proactive prevention to NCII recommended by the Online Safety Act 2023. The full approach will be designed to integrate with Ofcom’s forthcoming hash matching regime.

This CSF is rated as amber because secondary legislation is needed to address NCII to meet the objectives. This option is an enabler, and the final scheme design depends on a scoping exercise meaning that there is a risk that future provisions fail to address NCII thereby failing to align with objectives and strategic fit. This risk contributes to an amber rating.

CSF 2: Value for money

Option 0 – ‘Do nothing’, including providing non-legislative guidance to stakeholders:

No financial costs identified. However, this option does not address existing barriers to addressing NCII including net neutrality rules, a lack of a trusted register, and voluntary-only engagement all of which drive an amber rating.

Option 1 - Confer a duty for the SoS to give ‘trusted flagger’ status to an NCII database and gave the SoS power to make further provisions about the NCII register:

The only cost is the administrative burden associated with introducing new powers which is a minimal cost. This enables the benefit of a scoping exercise which will inform the scheme design.

Another benefit could be realised once the potential scheme design is finalised as the powers introduced will support timely implementation. The scheme itself could incur compliance, administrative, and familiarisation costs as well as deliver the benefit of addressing NCII.

CSF 3: Supplier capability and capacity

Option 0 – ‘Do nothing’, including providing non-legislative guidance to stakeholders:

This option doesn’t require any supplier input from the government or businesses, but online platforms and ISPs will continue to face challenges in addressing NCII.

Option 1 - Confer a duty for the SoS to give ‘trusted flagger’ status to an NCII database and gave the SoS power to make further provisions about the NCII register:

This option requires minimal input from government to introduce powers which is considered business as usual.

This option doesn’t require any input from businesses, but online platforms and ISPs will continue to face challenges in addressing NCII.

Depending on the final scheme design there may be additional supplier constraints associated with compliance. Additionally, the government may require additional capacity to design a NCII register and ensure effective implementation. This uncertainty contributes to an amber rating.

CSF 4: Affordability

Option 0 – ‘Do nothing’, including providing non-legislative guidance to stakeholders:

No additional spend required.

Option 1 - Confer a duty for the SoS to give ‘trusted flagger’ status to an NCII database and gave the SoS power to make further provisions about the NCII register:

Cost associated with introducing powers and the scoping exercise are minimal. Once the scheme design is finalised and introduced via secondary legislation the government may face costs associated with enforcement and administration. There is a risk of the scheme design resulting in large levels of costs for government which drives the amber rating.

CSF 5: Achievability

Option 0 – ‘Do nothing’, including providing non-legislative guidance to stakeholders:

Work is underway to deliver best-practice voluntary guidance to ISPs. However, this guidance will not achieve change in how NCII is currently removed or blocked online.

Option 1 - Confer a duty for the SoS to give ‘trusted flagger’ status to an NCII database and gave the SoS power to make further provisions about the NCII register:

This option would be in line proactive prevention to NCII recommended by the Online Safety Act 2023. The full approach will integrate with Ofcom’s forthcoming hash matching regime.

Achievability of the entire scheme cannot be assessed at this point as the scheme design is not finalised, however the introduction of powers is achievable and non-contentious.

Rating against Critical Success Factors

CSF 1: Objectives and strategic fit

Option 0 – ‘Do nothing’, including providing non-legislative guidance to stakeholders: Red

Option 1 - Confer a duty for the SoS to give ‘trusted flagger’ status to an NCII database and give the SoS power to make further provisions about the NCII register: Amber

CSF 2: Value for money

Option 0 – ‘Do nothing’, including providing non-legislative guidance to stakeholders: Amber

Option 1 - Confer a duty for the SoS to give ‘trusted flagger’ status to an NCII database and give the SoS power to make further provisions about the NCII register: Green

CSF 3: Supplier capability and capacity

Option 0 – ‘Do nothing’, including providing non-legislative guidance to stakeholders: Amber

Option 1 - Confer a duty for the SoS to give ‘trusted flagger’ status to an NCII database and give the SoS power to make further provisions about the NCII register: Amber

CSF 4: Affordability

Option 0 – ‘Do nothing’, including providing non-legislative guidance to stakeholders: Green

Option 1 - Confer a duty for the SoS to give ‘trusted flagger’ status to an NCII database and give the SoS power to make further provisions about the NCII register: Amber

CSF 5: Achievability

Option 0 – ‘Do nothing’, including providing non-legislative guidance to stakeholders: Green

Option 1 - Confer a duty for the SoS to give ‘trusted flagger’ status to an NCII database and give the SoS power to make further provisions about the NCII register: Green

RAG key

Green = fit for purpose (meets the critical success factor).

Amber = partially fit for purpose (partially meets the critical success factor; issues/risks to address).

Red = not fit for purpose (does not meet the critical success factor).

6. Description of shortlisted policy options carried forward

15. Following the consideration of the options at the long list stage, the options shortlisted for assessment in this IA are:

• Option 0: Business as usual (‘Do nothing’)

• Option 1: Confer a duty for the SoS to give ‘trusted flagger’ status to an NCII database and give the SoS power to make further provisions about the NCII register. Give the SoS power to make further provisions about the NCII register following a government scoping exercise. This exercise will run for six months after Royal Assent and is necessary to determine how the register may most effectively operate, including considering technical capabilities and verification processes.  This is the government’s preferred option.

SaMBA and medium-sized business impact

16. The main stakeholders include large businesses such as ISPs and online platforms, including social media platforms. At this stage, the preferred option does not generate any costs or compliance burdens to the private sector as it only introduces powers. Upon secondary legislation, compliance burdens, administrative costs, and familiarisation costs will be placed upon businesses. The largest cost is likely to be compliance burdens as the final policy design is likely to require businesses to address NCII proactively. These costs are likely to fall to large businesses such as ISPs and online platforms.

17. The scheme design is not finalised therefore the impact upon SaMBA or medium-sized businesses is unknown. On the one hand, the secondary legislation could enforce a proactive approach to addressing NCII which would generate compliance burdens, administration costs, and familiarisation costs for SaMBA and medium-sized businesses that host images. On the other hand, the secondary legislation could be opt-in or targeted only at large firms meaning that SaMBA and medium-sized businesses are exempt. This shall be explored further in an additional impact assessment once the scheme design is finalised.

7.   Regulatory scorecard for preferred option

A. Part A: Overall and stakeholder impacts

(1) Overall impacts on total welfare

Description of overall expected impact

This scorecard relates only to the direct impacts of the change in primary legislation, impacts of secondary legislation will be assessed following the scoping exercise.

The overall impact is expected to be positive due to the signalling benefit to ISPs and social media platforms that the government is coordinating a legislative centralised approach to addressing NCII and a potential positive reputational impact for government as the amendment signals a commitment to contribute to the broader commitments around NCII and to halve VAWG within a decade. .

Directional rating: Positive

Monetised impacts

It has not been possible to monetise any of the direct impacts associated with the amendment to primary legislation due to a lack of data.

Directional rating: Uncertain

Non-monetised impacts

Introduction of powers may have a small positive impact as the legislation aligns with broader commitments around NCII and VAWG and a coordinated legislative approach to addressing NCII to households and businesses.

The only cost identified in introducing the primary legislation change is a minimal opportunity cost of the administrative burden to government whilst developing and implementing the change.

Directional rating: Positive

Any significant or adverse distributional impacts?

The primary legislation change is not expected to cause any significant or adverse distributional impacts. Distributional impacts will be assessed again prior to implementing any secondary legislation.

Directional rating: Neutral

(2) Expected impacts on businesses

Description of overall business impact

As the primary legislation change does not impose any new duties/restrictions on businesses the overall impact is a positive non-monetised benefit associated with signalling of greater legal certainty for ISPs and online platforms.

Directional rating: Positive

Monetised impacts

It has not been possible to monetised benefits to business due to difficulty in measuring benefits around an increase in legal certainty.

Directional rating: Uncertain

Non-monetised impacts

There are no non-monetised costs associated with the primary legislation change. The main non-monetised benefit is the signalling of greater legal certainty for ISPs and online platforms therefore the directional rating is positive.

Directional rating: Positive

Any significant or adverse distributional impacts?

The primary legislation change is not expected to cause any significant or adverse distributional impacts to businesses. Distributional impacts will be assessed again prior to implementing any secondary legislation.

Directional rating: Neutral

(3) Expected impacts on households

Description of overall household impact

There are no costs to households as a result of the primary legislation change. There is a potential small benefit in increased trust in the government, therefore the directional rating is positive.

Directional rating: Positive

Monetised impacts

It has not been possible to monetise any of the direct impacts associated with the amendment to primary legislation due to a lack of data surrounding trust in the government.

Directional rating: Uncertain

Non-monetised impacts

A non-monetised impact of introducing the changes to primary legislation is the signalling of a coordinated legislative approach to addressing NCII. It is unknown whether this is a meaningful benefit to households but may have some benefit to victims.
Since there are potential benefits but no non-monetised costs to households the directional rating is positive.

Directional rating: Positive

Any significant or adverse distributional impacts?

Directional rating: The primary legislation change is not expected to cause any significant or adverse distributional impacts to households. Distributional impacts will be assessed again prior to implementing any secondary legislation.

Directional rating: Neutral

B. Part B: Impacts on wider government priorities

Business environment: Does the measure impact on the ease of doing business in the UK?

Description of impact: This change to primary legislation will enable the beginning of a mechanism for addressing NCII in the UK, potentially boosting international competitiveness in the policy area in the future.

Directional rating: Supports

International Considerations: Does the measure support international trade and investment?

Description of impact: The relative attractiveness and foreign investment implications of changes to primary legislation are expected to be negligible as the primary legislation impacts are mostly signalling impacts relating to future secondary legislative changes. Impact on trade and investment will be reassessed when potential secondary legislation is implemented.

Directional rating: Neutral

Natural capital and Decarbonisation: Does the measure support commitments to improve the environment and decarbonise?

Description of impact: There is no expected impact on the state of UK natural capital and no expected impact upon decarbonisation.

Directional rating: Neutral

8.    Monitoring and evaluation of preferred option

18. The preferred option introduces a power for the SoS to designate a ‘trusted flagger’ for NCII and further provisions for a NCII register of hashes. The latter will only come into effect once the government has undertaken a scoping exercise to determine how a NCII register could be most effective and to shape future policy design and the secondary legislation.

19. Monitoring and evaluation of further provisions will be determined after the six-month scoping exercise, meaning the Home Office are unable to determine the details at this stage without risk of pre-empting findings. However, it is likely that a monitoring and evaluation plan will be needed following the scoping exercise (potentially in early 2027) to determine the long-term operation and success of a NCII register.

20. The Revenge Porn Helpline, who operate StopNCII.org, are intended to be designated as the ‘trusted flagger’ under this option. The Home Office continues to engage with Revenge Porn Helpline and intends to continue this as part of the scoping exercises.

21. This option is intended to complement Ofcom’s hash matching regime (set to be published in May 2026), which may have some impact on the final operational design of the policy and secondary legislation. The Home Office will engage with Ofcom to ensure alignment.

9.   Minimising administrative and compliance costs for preferred option

22. The initial introduction of powers has no compliance burden to businesses and households. There is a minimal administrative burden to government associated with introducing powers for the SoS. This cost is negligible, and the introduction of powers is considered business as usual for government.

23. Separate from this option, the government intends to produce non-regulatory best-practice voluntary guidance regardless of the preferred option of choice. Therefore, familiarisation costs associated with this guidance are not applicable to this IA.

24. Secondary legislation is likely to introduce costs for businesses, including compliance costs for ISPs and online platforms as well as administrative costs associated with implementing the measure and familiarisation costs. The magnitude of these costs will depend on the scheme design which is currently uncertain. It is likely that the largest costs will be compliance costs to large businesses such as ISPs and social media platforms who will be responsible for proactively addressing NCII.

25. A post-implementation review monitoring plan will be developed alongside the scoping exercise. This will enable the likely scheme design and metrics for success to be defined ahead of the full implementation at the point of secondary legislation.

10. Main assumptions / sensitivities and economic / analytical risks

26. The main risk is a dependency; the broad policy objective of addressing NCII and main benefits will only be realised once secondary amendments are made. The operational design must not conflict with Online Safety Act 2023 guidance and Ofcom’s forthcoming hash matching regime (May 2026).

27. Similarly, as the policy design is not finalised the magnitude of impacts is unknown. There are likely be costs to business associated with compliance and could be costs to government associated with administrating the scheme. The magnitude of any benefits remains uncertain and will be driven by the scale of harm associated with NCII and the reductions in NCII (through deterrents and faster removal of this content).

28. All costs and benefits associated with just introducing powers remain non-monetised due to lack of data/understanding of the potential secondary legislation.

29. At this stage, the benefit of the preferred option is the duty enables the statutory backing of a NCII register which will allow for the scoping exercise to begin. Additional powers aim to reduce the regulatory burden of implementation once this exercise is completed.

Declaration

Department: Home Office

Contact details for enquiries: CrimeandPolicingBillTeam@homeoffice.gov.uk

Minister responsible: Minister Kaur

I have read the Impact Assessment and I am satisfied that, given the available evidence, it represents a reasonable view of the likely costs, benefits and impact of the leading options.

Signed:

Date: 13/10/2026

Summary: Analysis and evidence

Price base year:  2026/27

PV base year: 2026/27

Table 2: Summary table - Intimate image content: reporting and registration

Costs (£m)

(Distinguish between setup and ongoing costs, as well as private/public costs)

Option 0 – ‘Do nothing’ Business as usual (baseline):

Low: N/A

High: N/A

Best: N/A

No monetised costs due to an absence of data and significant uncertainty in scope of the secondary legislation.

Option 1 – Confer a duty for the SoS to give ‘trusted flagger’ status to an NCII database and give the SoS power to make further provisions about the register (preferred)

Low:

High: N/A

Best: N/A

No monetised costs due to an absence of data and significant uncertainty in scope of the secondary legislation.

Benefits (£m)

(Distinguish between setup and ongoing benefits, as well as private/public benefits

Option 0 – ‘Do nothing’ Business as usual (baseline)

Low: N/A

High: N/A

Best: N/A

No monetised benefits due to an absence of data and significant uncertainty in scope of the secondary legislation.

Option 1 – Confer a duty for the SoS to give ‘trusted flagger’ status to an NCII database and give the SoS power to make further provisions about the register (preferred)

Low: N/A

High: N/A

Best: N/A

No monetised benefits due to an absence of data and significant uncertainty in scope of the secondary legislation.

Net present social value (£m)

Option 0 – ‘Do nothing’ Business as usual (baseline)

Low: N/A

High: N/A

Best: N/A

Option 1 – Confer a duty for the SoS to give ‘trusted flagger’ status to an NCII database and give the SoS power to make further provisions about the register (preferred)

Low: N/A

High: N/A

Best: N/A

Public sector financial costs

(with brief description, including ranges)

Option 0 – ‘Do nothing’ Business as usual (baseline)

N/A – no public sector financial costs identified

Option 1 – Confer a duty for the SoS to give ‘trusted flagger’ status to an NCII database and give the SoS power to make further provisions about the register (preferred)

N/A – no public sector financial costs identified

Significant un-quantified benefits and costs

(description, with scale where possible)

Option 0 – ‘Do nothing’ Business as usual (baseline)

N/A – no significant un-quantified benefits or costs

Option 1 – Confer a duty for the SoS to give ‘trusted flagger’ status to an NCII database and give the SoS power to make further provisions about the register (preferred)

N/A – no significant un-quantified benefits or costs

Key risks

(and risk costs, and optimism bias, where relevant)

Option 0 – ‘Do nothing’ Business as usual (baseline)

Doing nothing would not address the barriers ISPs face to addressing NCII due to net neutrality laws. This option would also not improve the ability for ISPs and social media platforms to detect NCII. This option fails to align with wider government goals around NCII and VAWG, presenting a safeguarding risk.

Option 1 – Confer a duty for the SoS to give ‘trusted flagger’ status to an NCII database and give the SoS power to make further provisions about the register (preferred)

The wider policy objective and benefits will only be realised once secondary amendments are made following a scoping exercise. The scheme design must be made to comply with Ofcom’s forthcoming hash matching.

Results of sensitivity analysis

Option 0 – ‘Do nothing’ Business as usual (baseline)

Broad measures such as the Online Safety Act 2023 and Ofcom’s forthcoming hash-matching regime may address the safeguarding market failure if ISPs alongside active approaches from social media platforms. However, net neutrality would continue to be a barrier for ISPs and addressing NCII would be voluntary.

Option 1 – Confer a duty for the SoS to give ‘trusted flagger’ status to an NCII database and give the SoS power to make further provisions about the register (preferred)

The scoping exercise could suggest that a NCII register is ineffective or is incompatible with Ofcom’s hash matching regime. The policy would likely be discontinued, failing to deliver any benefits, but the level of cost incurred at this stage would also be minimal

Evidence base

A. Strategic objective and overview

1. NCII is increasing and is thought to be vastly underreported^{[footnote 4]}. The prevalence of NCII is expected to rise alongside the improvement of AI tools^{[footnote 5]}.

2. Revenge Porn Helpline’s “StopNCII.org” database is the only existing register for NCII. Individuals can submit images, and a hash is then generated. This hash is then shared with participating platforms, who may choose to remove the image. The Revenge Porn Helpline’s existing hash database is voluntary and has no statutory backing

3. A similar hash-based mechanism is run by the Internet Watch Foundation (IWF), a charity funded in part by the technology industry, which runs an established database for child sexual abuse material (CSAM). Unlike StopNCII.org, the IWF can verify that content is CSAM, which lends the confidence to ISPs and platforms to take an active approach in addressing this material.

4. This government amendment will:

   • Confer a duty on the SoS for the Home Department to designate a trusted flagger for NCII.  The SoS may also make regulations requiring platforms to share hashes with the person designated as a trusted flagger.
   • Confer a power on the SoS for the Home Department to make further provision about the Register, which can be exercised after the government has undertaken its scoping exercise on the technicalities of operating a Register.
   • This IA only covers the introduction of the powers rather than any implementation. The policy design will be finalised after a scoping exercise.

B. Problem under consideration, with business as usual, and rationale for intervention

5. The Revenge Porn Helpline’s existing hash database (StopNCII.org) is voluntary and has no statutory backing. There is currently no power for the SoS to make provision to designate an NCII register.

6. NCII is treated differently to CSAM due to differing legal positions. The proposed intervention will confer ‘trusted flagger’ status onto StopNCII.org, assisting them in their existing work to remove NCII content online and safeguard victims.

7. Where NCII content is not taken down by a platform, ISPs are unable to block content due to net neutrality principles and because the material itself is not illegal: it is the sharing/creating/taking or threat to share without consent that constitutes the offences. This means that there is not a legal basis for them to do so. This differs from approach currently used to removal CSAM content online.

8. The relevant powers are necessary for frictionless implementation. By preparing the measures in advance, the government puts itself in a position to introduce the necessary arrangements for a successful NCII register after a scoping exercise is completed. These powers will also allow the government to align with Ofcom regulations around hash matching which are expected to be published in May 2026.

C. Policy objective

9. Intended outcomes will include:

• Give statutory backing to Revenge Porn Helpline’s existing StopNCII.org database.
• Enable further provisions around an NCII register by having prepared the necessary powers for the SoS.

D. Description of options considered

Option 0: ‘Do nothing’ - Business as Usual

10. The government is taking forward the non-legislative option of updating voluntary guidance for ISPs. However, due to existing legal principles of net neutrality, ISPs are clear that they are unable to block NCII content without a statutory framework for its removal. The existing provision would be non-statutory and inconsistent.

11. This option would mean that NCII content would continue to circulate online, with ISPs remaining unable to block such content where it is not taken down by platforms. Current provision would continue to be provided by StopNCII.org but would remain a voluntary hashing tool. Whilst a number of platforms are signed up to use the hash database provided by the tool, this is not statutory, less established than the Internet Watch Foundation (who provide a hash database for known CSAM), used by fewer services, and not all content is verified.

12. This provision would remain insufficient and there is a risk of growing harms as NCII becomes easier to generate but support provision remains static. This does not align with the government’s commitment to halving VAWG within a decade which includes a specific focus on NCII.

Option 1: Confer a duty for the SoS to give ‘trusted flagger’ status to an NCII database and give the SoS power to make further provisions about the NCII register (preferred)

13. This option confers a duty for the SoS to designate a NCII register for the purposes of providing information about NCII, and the ability to make further provision about the register following a scoping exercise. This option is an enabler for further provisions to support reporting and removal of NCII which would be in line with the proactive prevention to NCII recommended by the Online Safety Act 2023. The full approach also integrates with Ofcom’s forthcoming hash matching regime.

E. NPSV: monetised and non-monetised costs and benefits of each shortlist option (including administrative burden)

Costs

14. The cost associated with introducing powers is a minimal opportunity cost of the administrative burden to government whilst developing and implementing the power, in particular ensuring consistency with Ofcom’s hash-matching regime. It is expected that there will be no familiarisation costs whilst introducing powers as there are no operational changes to ISPs, social media platforms, or law enforcement at this stage.

15. Secondary legislation may introduce compliance costs, administrative costs, and familiarisation costs to businesses. It is expected that compliance costs will be the largest as the scheme will require ISPs and social media platform to take a proactive approach to addressing NCII. The government may also face administrative costs associated with setting up a NCII register and designing the scheme implementation to be in line with Ofcom’s hash matching regime and the Online Safety Act 2023. The magnitude of this government cost depends on the final scheme design following the scoping exercise.

Benefits

16. The powers enable the statutory backing of an NCII register to create the conditions for a scoping exercise. The introduction of powers also allows for timely implementation of the final scheme once it has been designed. The benefit of powers is that they enable future regulations. This is non-monetised as it is a small benefit in efficiency.

17. Other benefits of introducing powers include the signalling benefit for ISPs and social media platforms; signalling that the government is coordinating a legislative centralised approach to addressing NCII which could reduce costs for these businesses as they will not have to generate own in-house approaches to addressing NCII.

18. A small positive reputational impact for government may be realised as the amendment is in line with the broader commitments around NCII and to halve VAWG within a decade, as well as a potential small increase in feelings of trust in the government for households.

19. Upon secondary legislation, the largest potential benefit expected to be associated with the legislation is reducing the prevalence and harms of NCII. This will depend on the scale of NCII harm and a measure of the NCII harm avoided (through deterrence or removal) – both of which remain uncertain therefore this is currently non-monetised.

20. SaMBA and medium-sized businesses may benefit from the final scheme design as they will not be required to develop costly in-house tools for addressing NCII. Third sector organisations, such as Revenge Porn Helpline, may benefit from fewer cases as prevalence decreases. Finally, the government will benefit from a positive reputational impact in addressing NCII.

NPSV, BNPV and EANDCB

21. N/A – all costs and benefits are non-monetised.

Impact on small and micro-businesses

22. The main stakeholders are large businesses (ISPs and social media platforms). Small and micro-businesses may benefit from secondary legislation as they can rely on an approach backed by government to address NCII, rather than having to develop in-house tools which may be costly and require a high level of expertise.

F. Costs and benefits to business calculations

23. There are no costs to business associated with the introduction of powers.

24. Secondary legislation may introduce compliance, administrative, and familiarisation costs for businesses. Compliance costs are expected to be the largest component and affect large businesses such as ISPs and social media platforms.

G. Impacts on small and micro businesses

25. There are no impacts to small and micro businesses associated with the introduction of powers.

26. Secondary legislation may benefit small and micro businesses in the image hosting sector by setting out an established approach to addressing NCII. This will reduce the administrative burden of these businesses having to set up their own safeguarding measures.

H. Costs and benefits to households’ calculations

27. There is no expected impact upon households associated with introducing powers.

28. There are no expected costs to households, including when the scheme design is finalised and implemented.

29. Secondary legislation could provide support for households who are victims or would be victims of NCII and therefore have a positive impact, although the nature of the scheme remains uncertain. Households also stand to benefit from a reduction in NCII prevalence which carries societal harms. This is expected to be the largest benefit but is unquantified due to uncertainties around the scheme design and efficacy.

I. Business environment

30. The introduction of powers signals a coordinated approach to tackling NCII which may increase the attractiveness of the UK market as a safe, well-understood environment for hosting images. However, the relative attractiveness and foreign investment implications are negligible and depend on the approach taken by international partners.

31. There is a risk of crowding out the market for safeguarding; ISPs and social media platforms may neglect to develop their own NCII detection and deletion tools and rely on the NCII register. However, the current laws around net neutrality pose a barrier to ISPs addressing NCII and due to high levels of societal harm the government should prioritise safeguarding over the risk of crowding out investment into safeguarding.

J. Trade implications

32. There is no expected impact upon trade and investment.

K. Environment: Natural capital impact and decarbonisation

33. There are no expected impacts upon the environment.

L. Other wider impacts (consider the impacts of your proposals)

34. There are no expected wider impacts including regional effects and income and wealth distribution effects.

M. Risks and assumptions

35. Costs and benefits of this legislation are negligible and non-monetised meaning there are few risks and assumptions.

36. There are no additional risks beyond those outlined in Section 10 which are summarised here:

• The programmes benefits depend upon secondary legislation and must be compatible with other government programmes.
• There will be familiarisation costs and compliance burdens upon secondary legislation.
• Costs and benefits remain non-monetised due to data availability and proportionality.

Annex

Mandatory specific impact test - Statutory Equalities Duties

Direct discrimination: The proposed action does not subject any person to less favourable treatment than any other person and therefore no direct discrimination arises.

Indirect discrimination: There could be positive impacts on people with protected characteristics who may be victims/survivors of NCII, predominantly women. No particular disadvantage has been identified in relation to the protected characteristics of gender reassignment, religion or belief or sexual orientation.

Advancing equality of opportunity between people who share a protected characteristic and people who do not share it: Evidence indicates that women are disproportionately impacted by NCII. The above proposal meets these needs without jeopardising the equality or opportunity of other others, including those of other sexes, as the proposal is available to all victims of NCII.

Fostering good relations between people who share a protected characteristic and persons who do not share it: The proposed policy will not result in negative impacts on relations between people who share a protected characteristic and people who do not share it.

The SRO has agreed these summary findings.

Complete: Yes

1. Ofcom fast-tracks decision on measures to block illegal intimate images. ↩

2. Tackling non-consensual intimate image abuse: Government response. Fourth special report of the Session 2024/25. Page 1. ↩

3. Tech firms will have to take down abusive images within 48 hours under new law to protect women and girls. Gov.uk press release. ↩

4. The Scale of Non-Consensual Intimate Image (NCII) Abuse: A Data-Driven Global Analysis, South-West Grid for learning. ↩

5. Keeping police one step ahead of criminals using AI, gov.uk. ↩