UK Online Safety Law Changes 2026: What's in Force and What's Coming

Two Acts that received Royal Assent on 29 April 2026, the Crime and Policing Act 2026 and the Children's Wellbeing and Schools Act 2026, changed UK law on children's online safety. Passing an Act does not always make it law straight away. Many parts of the Crime and Policing Act 2026 only start when the government makes commencement regulations, so some offences described in the news are not yet in force.

The table below covers selected changes that affect children and families. It separates what is in force, what is an enabling power in force (where the rules made under it are not yet in force), what is partly in force, what has a start date set and what is not yet in force. Checked against legislation.gov.uk and GOV.UK on 5 November 2026. Of the changes in this table that are not yet in force, regulations made before that date have set future start dates for only two: section 107 (6 November 2026) and section 75 (24 November 2026).

The tracker: what is in force and what is not

Fake nude images and “nudify” apps

The Crime and Policing Act 2026 does not use the word “nudify”. Its section 99 offence is about making or supplying a thing for use as a generator of “purported intimate images”, and GOV.UK says it covers tools often known as nudification apps, websites, bots on social media channels such as Telegram, and AI models. It has applied in England and Wales since 29 June 2026. The offence covers images that appear to be of an adult. Separately, since 6 February 2026 it has been an offence in England and Wales to create, or ask someone to create, a deepfake intimate image of an adult without consent.

Where the person shown appears to be under 18, our understanding of the law in England and Wales is that a fake sexual image can be treated as an indecent image of a child: section 7 of the Protection of Children Act 1978 treats a computer-generated “pseudo-photograph” that gives the impression of showing a child as showing a child. DfE's relationships and sex education guidance tells schools to teach that keeping or forwarding indecent images of someone under 18 is a crime even if AI was used. The new offence for tools that create child sexual abuse images (section 72) is not yet in force. See Deepfake Nudes & Intimate-Image Abuse and AI-generated child sexual abuse material.

If your child is affected

• •Reassure them it is not their fault. Do not forward or save the image. Note where it is and who shared it.
• •Do not delete the messages or the account yet, as they may be needed as evidence.
• •Report it to the platform. Since 29 June 2026, user-to-user services must run systems designed to take down reported intimate image content within 48 hours. They can refuse if they consider it is not intimate image content, so keep a note of your report and use the platform's complaints route if nothing happens.
• •For an image of someone under 18, use Report Remove (Childline and the Internet Watch Foundation).
• •Report to the police on 101, or 999 if there is immediate risk, and tell the school's Designated Safeguarding Lead. If an adult is involved, report to CEOP (ceop.police.uk). More steps are in our content removal guide.

Phones in schools (England)

The DfE “Mobile phones in schools” guidance became statutory on 29 June 2026, and schools were not expected to follow it until September 2026. Under section 36 of the Children's Wellbeing and Schools Act 2026, the head teacher (in community, foundation and voluntary schools, community and foundation special schools, maintained nursery schools and pupil referral units) or the proprietor (for example in academies and independent schools) must have regard to the guidance. That is a duty to have regard, not a flat legal ban. The government's July 2026 response describes the effect as a clear legal expectation that schools follow the guidance unless there is a legally justifiable reason not to.

The guidance says schools should be mobile phone-free by default, with anything else by exception only. DfE expects pupils to have no access to their phone throughout the school day, including lessons, the time between lessons, breaktimes and lunchtime. It also covers other smart technology with similar functions. How to do this is for each school. The guidance names lockers and handing phones to staff at the start of the day as examples.

The guidance expects flexibility for some pupils, for example where a phone is a reasonable adjustment for a disability, where it helps manage a medical condition, or for caring responsibilities. Pupils should also be able to get to their phone where necessary to raise an online concern with a teacher. It applies to maintained schools, academies, free schools, non-maintained special schools and independent schools, but not to 16 to 19 academies and free schools, further education or sixth-form colleges.

For parents: schools should publish their phone policy and make sure parents know how it works. Parents who need to reach a child during the day should be directed to the school office, which can pass on an emergency message. For school staff: sanctions can include confiscation and detentions, and Ofsted has said it will check school mobile phone policy on every inspection. See our KCSIE hub.

Other nations. Wales: the Welsh Government is consulting on draft guidance, and says the new guidance will be published in early 2027. Scotland: updated guidance published on 30 June 2026 is non-statutory, and the Scottish Government has said it will legislate (consultation closing date 17 November 2026). Northern Ireland: Department of Education Circular 2026/16 (27 August 2026) is guidance saying schools should be phone-free by default, and it is consulting, until 19 November 2026, on whether to introduce legislation.

AI chatbots

The government's July 2026 response says the majority of chatbots most used by children are already within scope of the Online Safety Act, but some are not because of the way they function. To close that gap, sections 248 and 249 of the Crime and Policing Act 2026, in force since 29 April 2026, give the government a power to bring AI services, including chatbots, within the Act's illegal-content duties by regulations. As at 5 November 2026 we have not seen confirmation that any such regulations have been laid, so we are not aware of new chatbot rules in force under that power. The government says it has taken powers and will act swiftly to close what it calls a loophole.

Announced plans, not law, include stopping under-18s accessing chatbot services that primarily offer sexualised content, stopping other chatbots offering children features that enable sexually explicit or sexual role-playing content, and mandatory breaks for all under-18s using chatbots. The government's July 2026 response gives no in-force date for these chatbot measures. Its “spring 2027” date is for the first regulations on social media for under-16s. See AI companion attachment for what parents can do now.

Apple and Google device-level nudity protection

On 8 June 2026 the government said that if Apple and Google did not act within three months to activate technology to detect and block nude images for children on devices, it would bring forward legislation. On 8 September 2026 the Culture Secretary told the Commons the government is committing to introduce primary legislation to require major tech platforms to build in device-level protections for children. The related press release (9 September) says there had been progress that does not meet the scale of the government's ambition, and that if companies implement solutions themselves it will reassess whether legislation is necessary.

This is a commitment, not yet law. We have not found a bill introduced. Legislation requiring apps children use to prevent access to and sharing of nudity is still being explored.

Child criminal exploitation, spiking and mandatory reporting: not in force yet

These are in the Crime and Policing Act 2026 but are not yet in force. The new child criminal exploitation offence (section 48) and the single spiking offence (section 134) have no start date. Child criminal exploitation prevention orders (sections 50 to 63) are only partly in force, from 21 September 2026, and the orders themselves are not yet available. The mandatory reporting duty (sections 85 to 95) has no start date, and none of the five commencement regulations made so far names those sections.

NSPCC Learning (updated 20 May 2026) says guidance will be published ahead of implementation, but gives no date. In the meantime, if you are worried about a child, contact the police, the NSPCC Helpline on 0808 800 5000, or your local safeguarding team. Schools' existing duties under KCSIE 2026 are in force (see below).

For schools: KCSIE 2026, Working Together 2026 and RSHE

Keeping children safe in education (KCSIE) 2026 was first published on 7 July 2026 and came into force on 1 September 2026, replacing the September 2025 version. It adds a new “Mobile phone policy” section saying all schools should be mobile phone-free environments by default.

Not every item listed below is new in 2026. These are some of the online-safety points in the 2026 edition.

• •Updated definitions of online risk categories, and guidance and resources on safe and effective use of generative AI in education.
• •The “contact” risk includes harmful interaction with generative AI applications that simulate other users, and the “conduct” risk names explicit images, including those generated using AI.
• •A section on “nudes and semi-nudes”, noting they may be digitally altered or wholly AI-generated, and replacing older “sexting” terminology.
• •Governing bodies and proprietors should have filtering and monitoring in place and review its effectiveness at least once every academic year.

Working together to safeguard children 2026 was published on 18 March 2026. DfE's summary of changes says new references in Chapter 3 address online harms and group-based exploitation. The text expects practitioners to understand online harm and grooming and to be aware of emerging technologies such as AI. It applies in its entirety to schools and colleges in England and should be complied with unless exceptional circumstances arise. We have not found a separate start date.

Relationships, sex and health education (RSHE). The revised statutory guidance was published on 15 July 2025 and came into effect on 1 September 2026. Schools must have regard to it. In secondary schools it covers deepfakes, AI chatbots that can create fake intimacy or offer harmful advice, sextortion, and the fact that keeping or forwarding indecent images of under-18s is a crime even if AI-generated. Parents can ask to see RSHE curriculum materials. More: KCSIE hub.