Regulatory Monitor

Dating Apps and the CSEA Reporting Duty: Where Compliance Stands Six Months On

Six months after the UK duty to report child sexual abuse content began, where dating apps stand on reporting, age checks and disclosure.

· / 17 min read·DII Editorial Team
Smartphone showing dating app with red warning overlay and shield icon

Updated 17 October 2026. Since 7 April 2026, every user-to-user service in scope of the UK Online Safety Act, dating apps included, has had a legal duty to report child sexual exploitation and abuse (CSEA) content it detects to the National Crime Agency. Six months on, DII has found no published Ofcom investigation or fine involving a dating service, but the largest operators still publish almost nothing about CSEA detection or reporting, and the evidence that offenders use dating platforms has not gone away.

First published 28 March 2026, ten days before the duty began. This edition corrects several errors in the original and adds what has happened since; the changes are listed below.

What has changed since publication

  • The deadline passed. The duty to report CSEA content to the NCA came into force on 7 April 2026 under the Online Safety (CSEA Content Reporting by Regulated User-to-User Service Providers) Regulations 2026. It is a duty to report what a service detects, not a free-standing duty to detect, which the original edition did not make clear.
  • Ofcom has enforced, but not against dating apps. By September 2026 Ofcom had fined 11 providers more than £7 million in total and had 40 formal investigations open, according to evidence it gave Parliament. None of the cases DII could identify involves a dating service.
  • Ofcom published guidance written for dating services on 18 May 2026, naming grooming, sextortion, romance fraud and stalking as the main risks.
  • Corrected figures. Match Group's 2024 revenue was $3.48 billion, not $3.19 billion. The Childlight finding comes from a self-report survey of about 5,000 men, not from criminal records. The National Crime Agency's 2016 figures describe a six-fold rise in reported rapes (33 to 184), not a "600% increase". The statutory penalty ceiling is set by Schedule 13 of the Act and is based on qualifying worldwide revenue, which is not the same as a group's total revenue.
  • Removed. We have withdrawn the claim that 16% of UK 13 to 17-year-olds have used a dating app (we could not trace it to Ofcom research), a reported 175% rise in dating-app-linked offences between 2017 and 2021 (no traceable source), a statement attributed to the Children's Commissioner, a claim about senior-manager criminal liability "for persistent non-compliance" that we could not match to the section of the Act it cited, and the tiered "readiness" assessment and product testing described in the original methodology, for which DII could not produce records.
  • New information. A US Senate Joint Economic Committee minority report published on 13 October 2026 adds detail on Match Group's trust and safety systems, and Ofcom's first statutory report on age assurance appeared in July 2026.
Infographic from the March 2026 edition showing three figures: 16% of UK teens used a dating app, a 600% increase in sexual assault cases and a $319M maximum penalty for Match Group. All three have been withdrawn or corrected in this update.
The infographic from the original March 2026 edition. Its three figures have since been withdrawn or corrected: see the list above and the financial exposure section below.

Executive summary

The Online Safety Act 2023 did not create one CSEA "deadline" so much as a sequence of duties. Illegal content risk assessments were due by 16 March 2025 and the illegal content codes came into force on 17 March 2025; the children's safety codes followed on 25 July 2025; and the duty to report detected CSEA content to the NCA began on 7 April 2026, according to Ofcom's compliance timetable. Dating apps are in scope of all three because they let users message each other.

Key findings

  • The reporting duty is live, and it applies to foreign apps too. UK-based providers must report all detected and unreported CSEA content to the NCA; providers based outside the UK must report UK-linked content (Ofcom). Content already reported to a body such as the US National Center for Missing and Exploited Children does not have to be reported again.
  • No dating service has been publicly sanctioned. Ofcom's published fines to date fall on pornography sites, file-sharing services, a suicide forum and 4chan (Ofcom, October 2025; Linklaters, July 2026). Ofcom's enforcement director told MPs in September that "realistically the majority" of fines have not been paid (The Register).
  • The offender evidence is survey-based but consistent. In Childlight's April 2025 survey of about 5,000 men in the UK, US and Australia, 66% of men who said they had sexually offended against children used dating platforms, and they were nearly four times as likely to use dating sites as other men (University of Edinburgh).
  • Disclosure remains thin. An investigation published in February 2025 by The Markup and the Pulitzer Center reported that Match Group promised a transparency report on harms in 2020 and had not released it; DII found no such report as of October 2026 (The Markup).
  • Age assurance is spreading, but Ofcom doubts some methods. Ofcom's July 2026 report recorded more than 69 million age checks across 32 services in the second half of 2025 and voiced "serious doubts" about some age inference models (Lewis Silkin summary).
  • The penalty ceiling is high but rarely reached. The maximum is £18 million or 10% of qualifying worldwide revenue, whichever is greater (Schedule 13). The largest fine so far is about £1.4 million.

Platforms discussed in this report

Match Group logoMatch Group
Bumble logoBumble
Tinder logoTinder
Hinge logoHinge
OkCupid logoOkCupid
Grindr logoGrindr
Feeld logoFeeld

The 7 April duty: what it requires

Section 66 of the Online Safety Act 2023 requires providers of regulated services to report detected and unreported CSEA content to the National Crime Agency. The practical rules are in SI 2026/268, which came into force for user-to-user services on 7 April 2026. Search services will follow at a date not yet set, according to Ofcom Ofcom's guidance page, first published on 12 March 2026 and last updated on 23 July 2026.

Four points matter for dating operators:

  • Scope follows UK links, not headquarters. A non-UK service is in scope if it has a significant number of UK users or targets the UK. Non-UK providers report UK-linked content; UK providers report everything they detect.
  • Registration comes first. Reports go through the NCA's CSEA Industry Reporting Portal, and services must register before they can submit. The regulations define both manual portal reports and API submissions.
  • Detection triggers the duty. As the law firm ZwillGen put it in May 2026, "the legal trigger is detection, not a standalone obligation to detect". Detection can come from user reports, child protection bodies, hash matching or other tools. The separate illegal content duties, in force since March 2025, are what require services to assess and reduce the risk of CSEA in the first place.
  • No double reporting. Content already reported to a qualifying foreign body such as NCMEC is not "unreported" and should not be sent to the NCA again. For US-headquartered groups that already report to NCMEC, this limits the additional volume.

CSEA content covers the offences in Schedule 6 of the Act, which include child sexual abuse material and grooming. For dating services, grooming is the more likely route: Ofcom's dating guidance cites a Thorn survey in which 11% of young people threatened with the exposure of sexual images had first interacted with the perpetrator through an online dating service (Ofcom, May 2026).

The wider Online Safety Act timetable

The original edition presented 7 April as the moment the industry first faced binding child safety duties. That was wrong. The reporting duty was the latest in a series.

DateMilestoneRelevance to dating services
16 March 2025Illegal content risk assessments dueEvery in-scope dating app must assess risks including grooming, CSEA, fraud and intimate image abuse
17 March 2025Illegal content codes of practice in forceBaseline measures: reporting tools, complaints handling, swift removal
16 April 2025Children's access assessments dueEach service must assess whether children can access it, which decides whether the children's duties apply
25 July 2025Protection of Children codes in forceChild safety duties for services likely to be accessed by children
8 January 2026Cyberflashing becomes a priority offenceSee DII's cyberflashing report
7 April 2026CSEA reporting duty to the NCA beginsAll in-scope user-to-user services
30 September 2026Code amendments on detecting intimate image abuse in forceHash matching recommended for certain services
October 2026Ofcom rapid assessment of age assurance for ParliamentWill shape expectations on age checks

Source: Ofcom, Important dates for online safety compliance (updated August 2026); DSIT, 8 January 2026; Ofcom, Statement: Detecting intimate image abuse. Ofcom notes that some dates may change.

Enforcement so far

The original edition predicted that Ofcom would move quickly against unprepared dating services after 7 April. Six months later, that has not happened in public.

Ofcom's first fines targeted services that ignored information requests or had no age checks at all. In October 2025 it fined 4chan £20,000 for failing to provide its illegal harms risk assessment and revenue information (Ofcom). In February 2026 it fined pornography operator 8579 LLC about £1.4 million over age assurance and an information request, which Linklaters described as its largest fine to date (Linklaters; reports put the figure at between £1.35 million and £1.4 million). In May 2026 it announced a £950,000 fine against a suicide forum, and in April it opened an investigation into Telegram over reports of child sexual abuse material.

By mid-September 2026, Ofcom had fined 11 providers a total of more than £7 million and had 40 formal investigations and six enforcement programmes covering more than 100 services, it told a parliamentary committee (The Register, 17 September 2026). Suzanne Cater, Ofcom's enforcement director, said "realistically the majority have not been paid".

DII found no published Ofcom investigation, provisional decision or fine involving a dating service as of 17 October 2026. That does not mean dating services are not being supervised: Ofcom's timetable shows that services it formally notified had to submit illegal content and children's risk assessment records between April and July 2026, and much supervisory work is not announced.

The evidence on offenders and dating platforms

The strongest recent evidence comes from Childlight Childlight Global Child Safety Institute, which is hosted by the University of Edinburgh. Its April 2025 report, Swipe Wrong, drew on a self-report survey of about 5,000 men in the UK, the US and Australia. It found:

  • nearly two-thirds (66%) of men who said they had sexually offended against children used dating platforms;
  • 22% of that group used them daily;
  • those men were nearly four times more likely to use dating sites than men who did not report offending;
  • 11% of all respondents admitted sexual offences against minors (University of Edinburgh, 9 April 2025).

The study's concern was less that children use dating apps than that offenders use them to reach single parents and, through them, their children. Childlight also cited an Australian Institute of Criminology survey in which 12% of dating app users had received requests to facilitate child sexual exploitation, most often involving their own children. The authors recommended identity checks, tools to detect grooming language, and education for single parents.

Two caveats apply. The data is self-reported, and the published materials do not say how large the offending subgroup was. And the "four times" comparison describes an association, not a cause.

Older UK law enforcement data points the same way for adult victims. The National Crime Agency's Serious Crime Analysis Section reported in February 2016 that rapes following a first meeting arranged online rose from 33 in 2009 to 184 in 2014, which it described as a six-fold increase (Get Safe Online, reporting NCA figures). Those figures are a decade old and cover adult victims; they are not evidence about CSEA.

Match Group: transparency promised, not delivered

The most detailed public account of how Match Group handles serious harm comes from journalism, not from the company. An 18-month investigation by the Dating Apps Reporting Project, published by The Markup with the Pulitzer Center in February 2025 and co-published by The Guardian, reported that:

  • Match Group's central database, which company insiders called Sentinel, had recorded users reported for rape and assault across its apps since 2019, and by 2022 was "collecting hundreds of troubling incidents every week", according to insiders (the article also suggests the system may date from earlier);
  • the company promised in 2020 to publish a transparency report on harms, and had not done so by February 2025;
  • in 2024 the remaining employees of the central trust and safety team were let go and their jobs outsourced to overseas contractors, according to former staff;
  • reporters' own tests found that banned users could rejoin Tinder or other Match apps with largely the same details.

Match Group's response, quoted by The Markup, said: "We take every report of misconduct seriously" and "We will always work to invest in and improve our systems." It did not dispute that it had documented harm without publishing it. DII has found no Match Group transparency report of the kind promised in 2020 as of October 2026. DII has also covered shareholder litigation over the Sentinel data.

New detail arrived on 13 October 2026, when the minority staff of the US Joint Economic Committee, led by Senator Maggie Hassan, published Outmatched. It is about scams rather than CSEA, but it describes the state of Tinder's safety engineering: internal documents said that as of 2025 most of Tinder's machine learning models for spotting bad actors "have not been updated for years". The report also records fixes since September 2025, including Face Check facial verification, new detection models and AI moderation. It contains no UK-specific findings. DII's news report covers it in more detail.

The Hinge and OkCupid apps sit within the same group systems. None of the documents reviewed for this update sets out how Match Group registers with, or reports to, the NCA.

Age assurance: progress and Ofcom's doubts

Age checks are a foundation, not a CSEA strategy. They keep children off adult services; they do nothing about adult offenders who use those services to reach parents, or about grooming that continues off-platform.

Ofcom's first statutory report on age assurance, published in July 2026, found that the share of children who met highly effective age checks when asked to verify their age rose from 25% to 43% between July 2025 and January 2026, and that more than 69 million checks were completed across 32 services in the second half of 2025. It noted greater use of age assurance on dating as well as pornography, social media and gaming services, but published no dating-specific findings. Ofcom said it had "serious doubts" about some age inference models, which may miss significant numbers of children (Lewis Silkin, 16 July 2026).

For dating services, Ofcom's May 2026 guidance makes one expectation explicit: services that allow pornographic content, including in profiles or direct messages, must use highly effective age assurance to stop under-18s encountering it (Ofcom).

What operators have said publicly:

  • Grindr introduced age verification for UK users in July 2025 (Attitude) and told Ofcom in a 2026 consultation response that "all UK users are age-assured" (Grindr response to Ofcom).
  • Match Group says Tinder's Face Check facial verification led to a more than 50% reduction in interactions with bad actors in the markets where it was rolled out (Q4 2025 results, February 2026). Face Check confirms that a profile belongs to a real person; it is not, by itself, an age check. DII has reported on its extension to UK users.
  • Bumble and Feeld: DII did not find, in the sources reviewed for this update, a public statement of their UK age assurance methods. The original edition's statement that Bumble introduced selfie-based age estimation in 2025 could not be verified and has been removed.

What the main operators disclose

The table records what DII could verify from public sources in October 2026. A blank in the public record is not evidence that a company lacks a system; it is evidence that outsiders cannot check.

OperatorUK age assurance (public)CSEA detection described publiclyNCA reporting arrangements publishedHarm transparency data
Match Group (Tinder, Hinge, OkCupid)Face Check on Tinder (identity, not age); age checks not set out in sources reviewedNot described in sources reviewedNoPromised 2020; not published (The Markup)
BumbleNot set out in sources reviewedNudity blurring (Private Detector) described by DSIT; CSEA detection not describedNoNo
GrindrAll UK users age-assured (Grindr to Ofcom)Not described in sources reviewedNoNo
FeeldNot set out in sources reviewedNot described in sources reviewedNoNo

Source: DII review of company results releases, Ofcom consultation responses, DSIT and press reporting, October 2026. See sources list.

Financial exposure, correctly stated

Under Schedule 13 of the Act, the maximum penalty is the greater of £18 million and 10% of a provider's qualifying worldwide revenue (QWR) for its most recent complete accounting period. Where a provider and other group companies are made jointly and severally liable, the 10% is calculated on the QWR of the whole group.

QWR is not simply total revenue. Ofcom's June 2025 policy statement defines it as revenue referable to the relevant parts of a regulated service, aggregated across a provider's regulated services and including amounts received by group companies; total group revenue is used only where group entities are held jointly liable (CMS summary of Ofcom's statement). Meta has challenged the QWR Regulations in a judicial review, with a hearing listed for October 2026 (Linklaters).

CompanyFY2024 revenueFY2025 revenue10% of FY2025 revenue (illustrative ceiling)
Match Group$3,479.4m$3,487.2mabout $349m
Bumble Inc.$1,071.6m$965.7mabout $97m

Source: Match Group Q4 2025 results (3 February 2026); Bumble Q4 2025 results. The ceiling column assumes the whole group's revenue counts as QWR, which applies only in a joint liability case; DII's calculation.

These are statutory maxima, not forecasts. The largest Online Safety Act fine to date is about £1.4 million. Ofcom can also require remedial action and apply to the courts for business disruption measures (Ofcom). For smaller operators, the £18 million floor is the relevant figure and would exceed the annual revenue of most of them.

What it means for operators

  • Register with the NCA now if you have not. A service cannot meet the reporting duty without registering on the CSEA Industry Reporting Portal. Decide whether to report manually or by API, and name the senior manager responsible.
  • Map your detection sources. The duty is triggered by detection, so write down every route by which CSEA content can reach your team: user reports, moderator review, automated tools, law enforcement contacts. Each needs a path to the NCA, or to NCMEC if you already report there.
  • Treat grooming of parents as a named risk. The Childlight findings and Ofcom's dating guidance both point to offenders using adult dating to reach children. Your illegal content risk assessment should address it, with moderator guidance on recognising it.
  • Keep records that show your reasoning. Ofcom's early enforcement has focused on failures to produce risk assessments or answer information requests. Those are the cheapest failures to avoid.
  • Check your age assurance against Ofcom's doubts. If you rely on inference or self-declaration and allow explicit images in messages, Ofcom's dating guidance expects highly effective age assurance.
  • Publish something. No law yet requires a dating app to publish CSEA volumes, but a short, factual account of detection and reporting arrangements would distinguish an operator from peers who disclose nothing.

What to watch next

  • October 2026: Ofcom's rapid assessment of age assurance for Parliament; the judicial review of the QWR Regulations; risk assessment records due from Category 1 and 2A services, subject to the categorisation register.
  • Autumn 2026: Ofcom's statement on additional safety measures, subject to the parliamentary process.
  • November 2026: publication of risk assessment summaries by categorised services, subject to the register.
  • January 2027: Ofcom's statutory report on app stores, which may shift some age assurance onto app stores and operating systems.
  • To be confirmed: the date the CSEA reporting duty extends to search services.

Related DII analysis: cyberflashing and the Online Safety Act, romance fraud on dating apps and subscription practices under the DMCC Act.

Methodology

This report was first published on 28 March 2026 and revised in October 2026. For the revision, DII checked every figure, date and quotation in the original against primary or reputable secondary sources, corrected or removed what could not be verified, and added developments to 17 October 2026.

  • Law and regulation: the Online Safety Act 2023, SI 2026/268, and Ofcom's guidance, timetable and enforcement announcements.
  • Enforcement: Ofcom announcements, supplemented by law firm summaries and press reports of Ofcom's evidence to Parliament where Ofcom's own pages were not available.
  • Company information: Match Group and Bumble results filed with the US SEC, Grindr's published response to an Ofcom consultation, and the US Joint Economic Committee minority report.
  • Research: Childlight's Swipe Wrong report as published by the University of Edinburgh and Childlight, and NCA figures as reported in 2016.

Limitations. Ofcom does not publish all supervisory activity, so the absence of a public case is not proof that no dating service is under scrutiny. Company disclosures are voluntary and uneven. The Childlight figures are self-reported. The original edition described a compliance readiness assessment and direct product testing carried out between January and March 2026; DII could not locate records of that work and has removed the conclusions that depended on it.

First published 28 March 2026. Updated 17 October 2026. This analysis was not commissioned, funded or reviewed by any dating platform, technology company or regulator. DatingIndustryInsights.com carries no advertising from the companies it covers.

Sources

  1. Ofcom: Duty to report child sexual exploitation and abuse (CSEA) content (12 March 2026, updated 23 July 2026)
  2. legislation.gov.uk: The Online Safety (CSEA Content Reporting by Regulated User-to-User Service Providers) Regulations 2026, SI 2026/268
  3. ZwillGen: New UK CSEA reporting rule takes effect for user-to-user services (5 May 2026)
  4. Ofcom: Important dates for online safety compliance (updated August 2026)
  5. legislation.gov.uk: Online Safety Act 2023
  6. legislation.gov.uk: Online Safety Act 2023, Schedule 13 (penalties)
  7. CMS: Ofcom publishes policy statement on fees and penalties (June 2025)
  8. Ofcom: Dating and social discovery, know the online safety risks, rules and how to comply (18 May 2026)
  9. Ofcom: Ofcom issues update on Online Safety Act investigations (13 October 2025)
  10. Linklaters: The UK's Online Safety Act heats up (July 2026)
  11. The Register: Ofcom discovers issuing Online Safety Act fines is easier than collecting them (17 September 2026)
  12. Lewis Silkin: Ofcom warns that tougher action is needed on age assurance (16 July 2026)
  13. University of Edinburgh: Report spotlights a sinister side to dating apps (9 April 2025)
  14. Childlight: When dating apps turn dangerous (9 April 2025)
  15. Get Safe Online: Increase in online first date sexual assaults, reporting National Crime Agency figures (7 February 2016)
  16. The Markup: Dating app cover-up, how Tinder, Hinge and their corporate owner keep rape under wraps (13 February 2025)
  17. US Joint Economic Committee minority staff: Outmatched, Tinder, scammers and Match Group's efforts to catch up (13 October 2026)
  18. Match Group: Fourth quarter and full-year 2025 results, Form 8-K exhibit 99.1 (3 February 2026)
  19. Bumble Inc.: Fourth quarter and full year 2025 results, Form 8-K exhibit 99.1 (2026)
  20. Grindr: Response to Ofcom consultation on new priority offences (2026)
  21. Attitude: Grindr and other platforms implement age verification checks under new Ofcom rules (25 July 2025)
  22. DSIT: Stronger laws for tech firms to ensure you don't see unsolicited nudes (8 January 2026)
  23. Ofcom: Statement, detecting intimate image abuse (18 May 2026, updated 9 September 2026)

Questions readers ask

What is the CSEA reporting duty for dating apps?+

Since 7 April 2026, in-scope user-to-user services, including dating apps, must report child sexual exploitation and abuse content they detect to the National Crime Agency, under SI 2026/268. UK providers report all detected and unreported content; non-UK providers report UK-linked content. Services must register with the NCA's reporting portal. Content already reported to bodies such as NCMEC need not be reported again.

Do dating apps have to scan for CSEA content?+

The reporting duty is triggered by detection; it is not itself a duty to detect. However, the Online Safety Act's illegal content duties, in force since 17 March 2025, require every in-scope service to assess the risk of CSEA and other illegal content and to take proportionate measures, such as accessible reporting tools and quick removal of illegal content.

Has Ofcom fined a dating app under the Online Safety Act?+

DII found no published Ofcom investigation, provisional decision or fine involving a dating service as of 17 October 2026. By September 2026 Ofcom had fined 11 providers a total of more than £7 million, mainly pornography sites, file-sharing services, a suicide forum and 4chan, and had 40 formal investigations open.

What are the penalties under the Online Safety Act?+

Ofcom can impose fines of up to £18 million or 10% of qualifying worldwide revenue, whichever is greater. Qualifying worldwide revenue is revenue referable to the regulated service; a group's total revenue applies only where group companies are jointly liable. Ofcom can also require remedial action and seek court-ordered business disruption measures. The largest fine so far is about £1.4 million.

What does research say about child sex offenders using dating apps?+

In Childlight's 2025 self-report survey of about 5,000 men in the UK, US and Australia, 66% of men who said they had sexually offended against children used dating platforms, and they were nearly four times more likely to use dating sites than other men. The researchers warned that offenders target single parents to reach their children.

Get the DII Briefing

The dating industry's deals, rules and results. Tuesdays and Fridays at 9:30am UK. Free.

Includes a free DII account so you can comment. One click to leave. Privacy. Or follow on WhatsApp.

DII Editorial Team

Published · Updated

DatingIndustryInsights.com is an independent B2B intelligence platform covering the global online dating industry. It publishes original research, financial analysis, regulatory tracking, and investigative reporting. It operates with no advertising from the companies it covers.