United Kingdom: Online Safety (CSEA Content Reporting by Regulated User-to-User Service Providers) (Revocation) Regulations 2025 enter into force

On 2 November 2025, the Online Safety (CSEA Content Reporting by Regulated User-to-User Service Providers) (Revocation) Regulations 2025 under the Online Safety Act 2023 entered into force. The rules required online platforms to detect and report child sexual exploitation and abuse (CSEA) content to the National Crime Agency (NCA). They applied to UK and non-UK user-to-user service providers, including social media and messaging platforms. Providers were required to appoint a senior manager to register with the NCA, authorise staff to report CSEA content, and ensure compliance by third-party moderators. It also specified that reporters must include user and content details, technical data, and be submitted securely through the NCA’s online portal, with urgency levels assigned. Providers were also required to retain reported data for up to five years and follow United Kingdom's General Data Protection Regulation security rules.