UK to require tech firms to remove nonconsensual intimate images within 48 hours or face fines

U.K. Prime Minister Keir Starmer said Thursday a new law will require tech companies to remove intimate images shared without consent within two days or face large fines and potentially have their services blocked.

Victims should only need to report such images once, a press release from the Department for Science, Innovation and Technology (DSIT) said, and images should be removed across multiple platforms simultaneously with new uploads being automatically deleted.

That goal would potentially be achieved through the use of digital markings that allow images to be flagged each time they are posted, according to the press release.

The government’s announcement comes about two months after xAI’s Grok chatbot began posting millions of “nudified” images of women and children in response to simple user prompts. 

On January 15, after weeks of worldwide outrage and negative headlines, Grok owner Elon Musk announced that the platform would block the chatbot from creating nudified images. That announcement came two days after Ofcom announced a probe.

Musk left open the possibility of using geoblocking to allow images of people in skimpy attire to be shared in jurisdictions where the creation of such content is not illegal.

In an opinion piece published in the Guardian, Starmer called the spread of nonconsensual intimate images a “national emergency.”

He emphasized his focus on ensuring that intimate images shared without consent be taken down everywhere after a single report of abuse.

“Victims have been left to fight alone – chasing takedown of harmful content site to site, reporting the same material again and again, only to see it reappear elsewhere hours later,” Starmer wrote. “That is not justice.”

“We are putting tech companies on notice,” he added. “The burden of tackling abuse must no longer fall on victims. It must fall on perpetrators – and on the companies that enable harm.”

The deadline will be imposed via an amendment to the country’s Crime and Policing Bill, DSIT said. In addition to having their service blocked in the U.K., firms that fail to meet the deadline could be fined up to 10% of their “qualifying” worldwide revenue.

DSIT plans to publish guidance for internet providers on how they should block hosting sites. That effort is meant to help providers target “rogue websites that may fall outside the reach of the Online Safety Act,” the agency said.

On Wednesday, Ofcom announced it will speed up its decision on whether to adopt a proposed new measure that would require firms use “proactive” technology to block illegal intimate images “at source.”

That proposal would require sites and apps to use “hash matching” or similar tech to find intimate images that are shared without consent, including sexual deepfakes.

Hash matching is a digital identification method that uses a fingerprint, or hash, derived from data to compare images against a trove of existing content.

Ofcom said it will announce its decision in May. The agency said it expects any changes to take effect as soon as this summer, pending approval by Parliament.

The government also has said it will make creating or sharing intimate images without consent a “priority offense” under the U.K.’s Online Safety Act. Such a designation would treat improper intimate image creation and sharing as harshly as child abuse images or terrorism content.