Regulatory Monitor

Cyberflashing on Dating Apps: What the Law Now Requires and How Platforms Respond

Cyberflashing became a priority offence in January 2026. What Ofcom now expects of dating apps, and what Bumble, Grindr and others have in place.

8 April 2026· / 15 min read·DII Editorial Team

Updated 17 October 2026. Since 8 January 2026 cyberflashing has been a priority offence under the Online Safety Act, which means dating apps must assess and reduce the risk of it rather than only respond to reports. In June 2026 Ofcom confirmed that dating apps must protect UK users from it, but its measures centre on reporting, moderation and user controls, not compulsory nudity detection, and only one major dating app, Bumble, publicly documents an automatic blurring tool.

First published 8 April 2026. This edition corrects errors in the original, including the date the offence came into force, and adds what has happened since; the changes are listed below.

What has changed since publication

Ofcom finalised its approach. After consulting from 24 March to 24 April 2026, Ofcom published its statement on 25 June 2026. Cyberflashing is now a separate kind of illegal harm that providers must risk-assess on its own, and Ofcom named dating apps among the services that must protect users from it (Ofcom). The code amendments still need to complete the parliamentary process.
Hash matching for intimate image abuse arrived. Ofcom code amendments recommending hash matching to detect non-consensual intimate images took effect on 30 September 2026 (Ofcom). This targets known images shared without consent, which is a different problem from cyberflashing.
Corrected. The offence came into force on 31 January 2024, not 1 January 2024. It does not turn on "consent" but on the sender's intent or recklessness. eHarmony is owned by ParshipMeet Group, not Match Group. The 41% figure for women aged 18 to 36 comes from a 2017 YouGov survey published in 2018, not a 2023 DCMS study, and it did not identify dating apps as the main channel. The UCL figure relates to 66 of 88 girls in focus groups (75%), not "76% of girls aged 12 to 18 in the UK". Match Group's 2024 revenue was $3.48 billion, not $3.19 billion.
Removed. We could not verify, and have withdrawn: a Bumble finding that one in three women receives an unsolicited nude within an hour of matching; a claim that research shows harm "equivalent to in-person assault"; the statement that Tinder launched detection in late 2024 and Hinge in early 2025; the estimate that 80% of smaller platforms have no protection; a Pew Research Center reference; and the claim that Bumble integrates with a "Cyber Tipline". We have also removed the compliance labels ("non-compliant", "reactive compliance") from the platform table: the law does not require any particular technology, so the absence of a detection tool is not by itself non-compliance. The original also described requests for comment and expert interviews for which DII could not produce records; quotes and conclusions that depended on them have been removed.
New data. Police in England and Wales recorded 3,961 cyberflashing offences between the offence's introduction and June 2025, according to Home Office figures. Grindr's published response to Ofcom sets out its position on explicit images for the first time.

Executive summary

Cyberflashing, sending an image of genitals to cause alarm, distress or humiliation, or for sexual gratification while reckless as to that, has been a criminal offence in England and Wales since 31 January 2024 (Sexual Offences Act 2003, s.66A). Since January 2026 it has also been a priority offence for platform regulation. The criminal and regulatory routes now both exist; neither has yet produced much visible enforcement against dating services.

Key findings

Recorded offences are in the thousands. Police recorded 3,961 cyberflashing offences in England and Wales between January 2024 and June 2025, according to Home Office figures reported in November 2025 (Express & Star).
Prevalence is high and gendered. 36% of women under 40 have received an unsolicited sexual photo from someone who was not a partner (YouGov, April 2024), and 32% of girls aged 12 to 18 in England, against 5% of boys (DSIT, citing YouGov).
The regulatory duty is now explicit. Cyberflashing became a priority offence on 8 January 2026 (DSIT), and Ofcom's June 2026 statement requires it to be risk-assessed as a separate harm.
Ofcom has not mandated nudity detection. Its finalised measures cover easy reporting, trained moderation, swift takedown and tools to block or mute other users (Ofcom). The government's own announcement had suggested automated detection as one option.
Bumble remains the documented exception. Its Private Detector, launched in 2019, blurs nude images and lets the recipient view, block or report (DSIT). Bumble claimed 98% accuracy at launch; that figure has not been independently verified (TechCrunch).
Grindr argues the harm does not arise on its service. In its response to Ofcom it says image exchange is "expected and indeed desired", relies on user settings for explicit photos, and opposes proactive scanning of private messages (Grindr).

The offence and how it is enforced

Section 66A of the Sexual Offences Act 2003 was inserted by section 187 of the Online Safety Act 2023 and came into force on 31 January 2024 (legislation.gov.uk). A person commits the offence if they intentionally send or give a photograph or film of any person's genitals to another person and either:

intend that the recipient will see the genitals and be caused alarm, distress or humiliation; or
send it to obtain sexual gratification and are reckless as to whether the recipient will be caused alarm, distress or humiliation.

The maximum sentence on indictment is two years' imprisonment. The test turns on the sender's state of mind, which matters for platforms: an image that is welcome in one conversation can be an offence in another, and software cannot see intent.

The first conviction came in March 2024, when Nicholas Hawkes, a registered sex offender from Basildon, was jailed for 66 weeks at Southend Crown Court (Kingsley Napley). Since then the volume of recorded offences has grown. Home Office figures show 3,961 offences recorded by police in England and Wales from the offence's introduction to June 2025 (Express & Star, 25 November 2025). The Office for National Statistics said that police recording of two new offences, cyberflashing and image-based sexual abuse, accounted for around 13,000 offences and more than half of the 11% rise in recorded sexual offences in the year to March 2025 (End Violence Against Women Coalition, reporting ONS).

Convictions are far fewer. A UCL news release in June 2025 was headlined "Fewer than 50 convictions for cyberflashing in a year", quoting Professor Jessica Ringrose on low awareness of the law (UCL). DII has not located official conviction totals for a later period. Neither the recorded-crime nor the conviction figures show how many offences began on a dating app.

How common it is

The survey evidence is consistent on scale and on who is affected, though it rarely isolates dating apps.

Population	Finding	Source and date
Women aged 18 to 36 (UK)	41% had been sent an unsolicited penis photo	YouGov, fieldwork July to September 2017, published February 2018
Women under 40 (UK)	36% had received an unsolicited sexual photo from a non-partner; about 1 in 12 in the past year. Most common channels: social media (67%), text or instant messaging (51%)	YouGov, April 2024
12 to 18-year-olds (England)	32% of girls and 5% of boys had received unsolicited images of male genitals	YouGov survey cited by DSIT, September 2025
Girls in school focus groups	66 of 88 (75%) had received an image of male genitals, mostly unwanted	Ringrose and Regehr (UCL and University of Kent), December 2021

Source: YouGov (2018); YouGov (2024); DSIT (29 September 2025); UCL Institute of Education (6 December 2021).

Ofcom's June 2026 announcement adds that women are nearly three times more likely than men to experience cyberflashing, citing a January 2026 briefing by Vera Gray and Clare McGlynn (Ofcom).

Reporting to platforms is low. In the 2021 UCL study, only 17% of the 106 young people who had received unwanted sexual content or had images shared reported it to the platform, and 51% did nothing (UCL). That matters for any approach that relies on user reports.

The original edition said dating apps were "the primary channel". The surveys above do not show that: the 2024 YouGov data points to social media and messaging. Bumble has said that users who send lewd images are 0.1% of its user base (TechCrunch, 2022). Dating apps are an obvious setting for unsolicited images, which is why Ofcom and the government name them, but the share of cyberflashing that happens on them is not published.

What the Online Safety Act now requires

Priority offence status

The government announced on 29 September 2025 that cyberflashing would become a priority offence, saying social media platforms and dating apps would have to take proactive steps to stop users seeing unsolicited nude images. It suggested automated systems that detect and hide images, moderation tools and stricter content policies as possible measures (DSIT). The designation took effect on 8 January 2026. The technology secretary, Liz Kendall, said the government had "cracked down on perpetrators of this vile crime" and was now "turning up the heat on tech firms" (DSIT, 8 January 2026).

Priority status means providers must assess the risk of cyberflashing on their service, take proportionate steps to prevent users encountering it, and remove it swiftly when they become aware of it. It does not require any particular technology.

Ofcom's June 2026 statement

Ofcom consulted on how to fold the new priority offences into its codes from 24 March to 24 April 2026 (Ofcom) and published its decisions on 25 June 2026 (Ofcom statement). The main points:

cyberflashing is a "new, and separate, kind of illegal harm", so providers must assess it on its own rather than within other sexual offences;
"dating, messaging and social media apps will have to protect UK users from cyberflashing";
services at risk should offer easy reporting, adequately resourced and trained moderation, swift takedown and tools to block or mute other users;
providers must take the measures in the codes "or use other effective measures";
the code amendments take effect only after completing the parliamentary process, and firms should review their risk assessments now.

Ofcom also revised its risk assessment guidance and Register of Risks at the same time. The statement does not require nudity detection or blurring.

Related: detecting intimate image abuse

Separately, on 18 May 2026 Ofcom recommended that certain services use hash matching, for example against the StopNCII database, to detect intimate images shared without consent, including explicit deepfakes (Ofcom). The code amendments took effect on 30 September 2026 (Ofcom). Hash matching finds copies of images already reported; it cannot catch a new photo sent for the first time, which is what most cyberflashing involves.

Penalties

Ofcom can fine a provider up to £18 million or 10% of qualifying worldwide revenue, whichever is greater (Schedule 13). Qualifying worldwide revenue is revenue referable to the regulated service; a group's total revenue is used only where group companies are made jointly liable (CMS). For scale, Match Group reported 2025 revenue of $3,487.2 million and Bumble $965.7 million (Match Group; Bumble). By September 2026 Ofcom had fined 11 providers a total of more than £7 million under the Act, none of them dating services and none for cyberflashing (The Register).

What dating platforms have in place

The table sets out what DII could verify from public sources in October 2026. It describes documented features, not compliance: Ofcom's codes do not require automated detection, and a platform without it may still meet its duties through reporting, moderation and user controls.

Platform	Automated nudity blurring (documented)	Other documented controls	Notes
Bumble	Yes, since 2019	Recipient can view, block or report a blurred image	Private Detector; 98% accuracy claimed by Bumble at launch; open-sourced in 2022
Tinder	Not confirmed in sources reviewed	Face Check facial verification (identity, not image content)	The original edition's statement that Tinder launched detection in late 2024 has been withdrawn pending verification
Hinge	Not confirmed in sources reviewed	Not set out in sources reviewed	Owned by Match Group. The early-2025 launch date in the original edition has been withdrawn pending verification
Grindr	No (Grindr opposes proactive scanning of private messages)	Per-user setting for explicit photos ("Yes", "Not at first", "Never"); blocking; reporting; all UK users age-assured	Argues cyberflashing harm "does not occur on Grindr" because image exchange is expected
Feeld	Not confirmed in sources reviewed	Not set out in sources reviewed	No public statement found
OkCupid	Not confirmed in sources reviewed	Not set out in sources reviewed	Owned by Match Group
eHarmony	Not confirmed in sources reviewed	Not set out in sources reviewed	Owned by ParshipMeet Group

Source: DSIT (8 January 2026); TechCrunch (24 October 2022); Grindr response to Ofcom (2026); Match Group Q4 2025 results; DII company records. "Not confirmed" means DII did not find public documentation in the sources reviewed for this update; it does not mean a feature is absent.

Bumble's Private Detector

Bumble launched Private Detector in 2019. It uses an AI model to detect nude images sent in chats and blurs them; the recipient decides whether to view the image, and can block or report the sender (DSIT). Bumble claimed 98% accuracy when it introduced the tool and released a refined version as open source in October 2022, available for commercial use (TechCrunch). Bumble has not published independent validation of the accuracy figure or separate false positive and false negative rates.

The original edition described Private Detector as a warning to the sender before an image is sent. The public descriptions DII reviewed describe recipient-side blurring; we have corrected the account.

Grindr's position

Grindr's response to Ofcom's consultation is the clearest public statement by any dating operator on cyberflashing. It agrees that cyberflashing belongs in Ofcom's risk profiles but argues that the proposed risk factors would wrongly rate it as high risk, because they treat consensual and non-consensual image sharing alike. "On Grindr, the contextual baseline is that image exchange is expected and indeed desired," it wrote, and "the harm that the cyberflashing offense is designed to prevent does not occur on Grindr." It asks Ofcom to confirm that a genital image alone is not enough to make content illegal under section 66A, and argues that proactive scanning of private messages would be disproportionate (Grindr).

Its controls are user-set: each profile chooses whether to receive explicit photos ("Yes", "Not at first" or "Never"), users can block instantly, and reports go to moderators. Grindr publishes no figures on reports or volumes. Ofcom's final statement does not say whether it accepted Grindr's argument, but its emphasis on reporting and user controls rather than mandatory scanning is closer to Grindr's position than to a blanket detection requirement.

The original "compliance divide"

The original edition presented a split between compliant market leaders and non-compliant niche apps. On the evidence now available, that framing does not hold. The law requires a risk assessment and proportionate measures, not a specific tool. Only Bumble documents automated blurring; DII could not confirm the launch dates it previously reported for Tinder and Hinge; and Grindr has set out a reasoned, if contestable, case for a different approach. What can be said is that public disclosure is thin across the sector: none of the operators reviewed publishes data on cyberflashing reports or outcomes.

What detection technology can and cannot do

Automated nudity detection classifies an image as it arrives. It can be run on the device or on the platform's servers. Blurring on arrival, as Bumble does, leaves the decision with the recipient, which suits services where explicit images are sometimes welcome.

Its limits are well understood in principle:

It cannot judge intent. The offence depends on the sender's purpose or recklessness. A classifier sees only the image.
Accuracy figures need context. A single "accuracy" number can hide different false positive and false negative rates. No dating operator publishes both.
Hash matching is a different tool. It matches known images and is suited to non-consensual sharing of images already reported, not to new images.
It does not replace reporting. Ofcom's measures assume users can report easily and moderators act quickly, and the UCL data shows how few young people report at all.

What it means for operators

Update the risk assessment now. Ofcom has told firms to review their risk assessments to cover cyberflashing as a separate harm. Record the evidence used, including how often explicit images are sent and reported on your service.
Make reporting of unwanted images easy. A specific reporting option for unwanted sexual images, visible in the chat, addresses the measure Ofcom puts first.
Give users control over what they receive. Settings such as Grindr's explicit-photo preference, or blurring by default with a choice to view, both reduce unwanted exposure. Decide which fits your service and write down why.
Resource and train moderators for this harm. Ofcom's statement refers to adequately resourced and trained moderation. Guidance should explain the intent and recklessness test.
Consider hash matching for intimate image abuse. The 30 September 2026 code amendments recommend it for certain services. Check whether your service falls within scope.
Publish basic figures. Report volumes and response times would let users and regulators judge measures that currently cannot be compared.

What to watch next

Parliamentary approval of the cyberflashing code amendments, after which the measures in Ofcom's June 2026 statement take effect. No date has been set.
Autumn 2026: Ofcom's statement on additional safety measures, subject to Parliament.
Official conviction data for section 66A for 2025, which would show whether prosecutions are rising with recorded offences.
Any first Ofcom case on cyberflashing. None has been announced as of 17 October 2026.

Methodology

This report was first published on 8 April 2026 and revised in October 2026. For the revision, DII checked each figure, date and claim in the original against legislation, Ofcom and government publications, company materials and the original surveys, corrected what was wrong and removed what could not be verified. Platform features were checked against public company statements, government releases and consultation responses; DII did not test the apps for this update.

Limitations. No source publishes the share of cyberflashing that occurs on dating apps. Police-recorded figures for England and Wales cover January 2024 to June 2025 and come from Home Office data as reported in the press. Absence of public documentation of a feature is not proof the feature does not exist. The original edition referred to requests for comment and expert interviews; DII could not locate records of them and has removed content that depended on them.

First published 8 April 2026. Updated 17 October 2026.

Sources

Questions readers ask

Is cyberflashing illegal in the UK?+

Yes, in England and Wales. Section 66A of the Sexual Offences Act 2003, inserted by the Online Safety Act 2023, came into force on 31 January 2024. It is an offence to send an image of genitals intending to cause alarm, distress or humiliation, or for sexual gratification while reckless as to that. The maximum sentence is two years' imprisonment.

What must dating apps do about cyberflashing?+

Cyberflashing became a priority offence under the Online Safety Act on 8 January 2026. Ofcom's June 2026 statement says dating apps must protect UK users from it and must risk-assess it as a separate harm. Expected measures include easy reporting, trained moderation, swift takedown and tools to block or mute users. The code amendments still need parliamentary approval.

Do dating apps have to use nudity detection?+

No. The government suggested automated detection as one option, but Ofcom's finalised measures do not require nudity detection or blurring. Providers must take the measures in the codes or use other effective measures. Bumble's Private Detector, which blurs nude images and lets recipients view, block or report, is the main documented example on a dating app.

How common is cyberflashing?+

YouGov found in 2024 that 36% of women under 40 had received an unsolicited sexual photo from someone who was not a partner, about one in 12 in the past year. A YouGov survey cited by the government found 32% of girls aged 12 to 18 in England had received unsolicited images of male genitals. Police recorded 3,961 offences from January 2024 to June 2025.

How accurate is Bumble's Private Detector?+

Bumble claimed 98% accuracy when it launched Private Detector in 2019, and released a refined version as open source in 2022. The figure has not been independently verified, and Bumble does not publish separate false positive and false negative rates. The tool blurs images on arrival and leaves the recipient to decide whether to view them.

Get the DII Briefing

The dating industry's deals, rules and results. Tuesdays and Fridays at 9:30am UK. Free.

Includes a free DII account so you can comment. One click to leave. Privacy. Or follow on WhatsApp.

DII Editorial Team

Published 8 April 2026 · Updated 2026-10-17

DatingIndustryInsights.com is an independent B2B intelligence platform covering the global online dating industry. It publishes original research, financial analysis, regulatory tracking, and investigative reporting. It operates with no advertising from the companies it covers.