Encryption lawsUnited Kingdom
The Online Safety Act and end-to-end encryption
Section 121 lets Ofcom require a service to use accredited technology to find child sexual abuse content, "whether communicated publicly or privately". It can only require technology accredited against standards the government has yet to publish.1, 2, 3
Checked 28 October 2026 against the sources. This page describes the law. It is not legal advice.
What a section 121 notice can require
Online Safety Act 2023, sections 121 to 125, in force since 10 January 2024.1, 2
| When | If Ofcom consider it "necessary and proportionate", for a regulated user-to-user or search service.1 |
|---|---|
| Child sexual abuse content | Use accredited technology to identify it, "whether communicated publicly or privately", and swiftly take it down, or to prevent people from encountering it.1 |
| Terrorism content | The same, but only for content "communicated publicly".1 |
| Or instead | Use "best endeavours to develop or source technology" for the child sexual abuse purposes, meeting the government's published standards.1 |
| Changes to the service | A notice to use accredited technology is taken to require "such changes to the design or operation of the service as are necessary" for it to be used effectively.2Section 125(5). |
| How long | Up to 36 months after the compliance period ends.2 |
| Before a notice | A report from a skilled person appointed by Ofcom, and a warning notice.1, 4 |
Accredited technology, and where it stands
Technology is "accredited" if it meets minimum standards of accuracy that the Secretary of State approves and publishes, following advice from Ofcom.2
- The Online Safety Act 2023 receives Royal Assent.1
- Sections 121, 122 and 125 come into force.1, 2, 4
- Ofcom consults on technology notices; the consultation closes on 10 March 2025.3
- Ofcom publishes its advice to the Secretary of State on minimum standards of accuracy, and its guidance on how it proposes to use the power "when we are able to do so".3
Next, the Secretary of State approves and publishes the standards, and then Ofcom sets up a process to accredit technologies. We found no published approval as of 28 October 2026.
What it means for encrypted services
Section 121 does not mention encryption. It reaches content sent privately, and a notice can require the design changes needed for the technology to work.1, 2 On an end-to-end encrypted service the provider's servers do not see message content, so detection would have to happen where content is readable, which is what is called client-side scanning.
This power is about detection by the service itself. Access for police and intelligence agencies is a separate law: the Investigatory Powers Act and its technical capability notices.
Questions people ask
Does the Online Safety Act ban end-to-end encryption?
Has Ofcom issued a technology notice?
Ofcom says it will use the power when it is able to, after the government sets the standards and accreditation begins. We found no notice as of 28 October 2026.3
Can a notice be appealed?
Yes. A notice must contain details of the rights of appeal under section 168.2
Sources 4
- Online Safety Act 2023, section 121: notices to deal with terrorism content or CSEA content, legislation.gov.uk, The National Archives. Read 28 October 2026.
- Online Safety Act 2023, section 125: notices, supplementary, legislation.gov.uk, The National Archives. Read 28 October 2026.
- Statement: technology notices, published 8 May 2026, Ofcom. Read 28 October 2026 from the Internet Archive copy of 13 August 2026.
- Online Safety Act 2023, section 122: requirement to obtain skilled person's report, legislation.gov.uk, The National Archives. Read 28 October 2026.
We read the law itself, and every status has a date. How we check