Member Update: New CSEA Reporting Regulations Now in Force
The Online Safety (CSEA Content Reporting by Regulated User-to-User Service Providers) Regulations 2026 came into force on 7 April 2026, introducing new legal requirements for service providers in scope of the Online Safety Act.
Under the Regulations, regulated user-to-user service providers must report all Child Sexual Exploitation and Abuse (CSEA) material detected on their services to the National Crime Agency (NCA). The requirements also apply to service providers based outside the UK where the CSEA content has a UK link.
To support compliance, the NCA has launched a dedicated reporting portal that provides a secure mechanism for sharing CSEA material with law enforcement. Members are encouraged to register and familiarise themselves with the new reporting process. Link here
Key Requirements
Retention Periods (Section 8)
Following submission of a report, service providers will receive a Unique Reference Number (URN), which must be retained for a period of five years. Providers must also retain the reported CSEA content, together with relevant associated information, for a minimum of one year.
Priority Levels and Reporting Timeframes (Section 6)
The Regulations establish three priority levels for CSEA material and set out the corresponding reporting timeframes. Members should review these requirements carefully to ensure reports are submitted within the prescribed deadlines.
Information Required (Schedule 1)
Schedule 1 details the information that must be included in reports submitted to the NCA. Ensuring all required information is provided will help facilitate effective law enforcement action and support compliance with the Regulations.
Further Guidance
Ofcom has published additional guidance to help service providers understand and comply with their reporting obligations.
Members should also be aware that enforcement penalties remain aligned with those under the Online Safety Act, with fines of up to 10% of qualifying worldwide revenue or £18 million, whichever is greater.
ODDA Position
The ODDA welcomes these Regulations, which provide much-needed clarity regarding the reporting of CSEA material and establish a clear, secure reporting route through the NCA. The new framework represents a significant improvement on the previous reporting arrangements, and we strongly encourage all relevant members to register for the portal and review the new requirements.
As these Regulations are now in force, the ODDA has withdrawn the interim guidance note previously available in the Members Area.
