Report it. And keep a record of what was posted.

Which offence applies, and where

The United Kingdom does not have one intimate image offence. England and Wales, Scotland and Northern Ireland each have their own, prosecuted under their own criminal procedure, so the first question is where the conduct happened.

England and Wales: section 66B of the Sexual Offences Act 2003

Section 66B is now the governing provision in England and Wales. It was inserted by section 188 of the Online Safety Act 2023 and commenced on 31 January 2024 under S.I. 2024/31. The same commencement order brought into force the repeal of sections 33 to 35 of the Criminal Justice and Courts Act 2015, the old offence of disclosing private sexual photographs, which the Crown Prosecution Service says "remains available for offences committed prior to the commencement of Part 10 OSA 2023 on 31 January 2024". Section 66B covers both sharing and threatening to share.

"A person (A) commits an offence if (a) A intentionally shares a photograph or film which shows, or appears to show, another person (B) in an intimate state, (b) B does not consent to the sharing of the photograph or film, and (c) A does not reasonably believe that B consents."

Section 66B(1), Sexual Offences Act 2003, as inserted by the Online Safety Act 2023 (legislation.gov.uk)

Note the words "or appears to show". Section 66B(4) creates the separate threat offence, committed where someone threatens to share an intimate photograph or film intending that you, or someone who knows you, will fear that the threat will be carried out, or being reckless as to whether such fear will be caused. That is the provision that fits most sextortion messages, and it does not require the image ever to have been shared.

Sexually explicit deepfakes: sections 66E and 66F, in force since 6 February 2026

A sexually explicit deepfake is a purported intimate image, and creating one of an adult without consent is a separate offence in England and Wales. Section 138 of the Data (Use and Access) Act 2025 inserted sections 66E to 66H into the Sexual Offences Act 2003, and regulation 2 of S.I. 2026/31 provides that "section 138 of the Data (Use and Access) Act 2025 (creating, or requesting the creation of, purported intimate image of adult) comes into force on 6th February 2026". Section 66E covers creating the image; section 66F covers requesting its creation. This is worth checking rather than taking on trust, because it was announced long before it commenced.

Scotland and Northern Ireland

The section 66B offences apply to England and Wales only. In Scotland, disclosing or threatening to disclose an intimate image is an offence under section 2 of the Abusive Behaviour and Sexual Harm (Scotland) Act 2016, prosecuted by the Crown Office and Procurator Fiscal Service, carrying a maximum of five years' imprisonment on conviction on indictment. In Northern Ireland, disclosing a private sexual photograph or film with intent to cause distress is an offence under section 51 of the Justice Act (Northern Ireland) 2016, carrying a maximum of two years' imprisonment on conviction on indictment. Do not assume an England and Wales section number applies to a Scottish or Northern Irish case.

The Online Safety Act 2023 and what Ofcom actually does

Ofcom published its Illegal Harms Statement and the first edition of its Codes of Practice on 16 December 2024. Services had until 16 March 2025 to complete an illegal content risk assessment, and the safety duties took effect on 17 March 2025 once the Codes cleared the parliamentary process. Ofcom enforces those duties against providers and has issued fines, including a penalty of £950,000 against an online suicide forum announced by Ofcom in 2026, and it has named protecting women and girls from intimate image abuse among its 2026 priorities. What Ofcom does not do is deal with your individual takedown request, so treat it as a regulator of platforms rather than a route for your own case.

Does a qualified timestamp count in a UK court?

Yes, and the reason is UK domestic law rather than EU law. The United Kingdom is not in the European Union, but the trust services chapter of Regulation (EU) No 910/2014 was kept on the UK statute book at the end of the transition period, and since 1 January 2024 that body of law is described as assimilated law rather than retained EU law. Article 24A was inserted into the assimilated Regulation by the Electronic Identification and Trust Services for Electronic Transactions (Amendment etc.) (EU Exit) Regulations 2019, S.I. 2019/89, and it lists Article 41(2) among the provisions for which an EU qualified service is treated as qualified here.

"A qualified electronic time stamp shall enjoy the presumption of the accuracy of the date and the time it indicates and the integrity of the data to which the date and time are bound."

Article 41(2), assimilated Regulation (EU) No 910/2014 (legislation.gov.uk)

Applied to a ProofSnap package, Article 41(2) means the date on the manifest is presumed accurate unless the other side rebuts it, rather than being something you have to prove from scratch.

The honest caveat: section 131 of the Data (Use and Access) Act 2025 confers a power to amend or revoke Article 24A. That power exists, so recognition could be narrowed in future. As at the date on this page, it has not been, and the presumption stands.

ProofSnap's qualified timestamps are issued by Disig a.s., a Qualified Trust Service Provider on the EU Trusted List. The timestamp is only part of the picture. What a UK court weighs is whether a record can be shown to be what it claims to be, which is why the package also carries the SHA-256 hashes, the signed manifest and the independent blockchain anchor rather than relying on the timestamp alone. There is a fuller explanation on our page about qualified timestamps for UK courts.