Online Safety Act 2023
Royal Assent β In force, enforcement liveWhat it does: Requires social media platforms to protect UK users from illegal content, scams, and fraudulent advertising. Platforms must proactively remove scam ads, fake profiles, and fraudulent content or face fines up to 10% of global turnover. New priority offences added: cyber-flashing and encouraging serious self-harm.
Impact on you: Major. Ofcom enforcement is now active β first fines already issued: 4chan Β£520,000, an unnamed suicide forum Β£950,000, a porn site Β£600,000, and a Β£1m+ penalty in 2025. Platforms are legally responsible for scam content.
Next steps: Draft Fraudulent Advertising Codes of Practice published 10 July 2026 (consultation closes 2 Oct 2026) β final scam-ad rules expected 2027, covering Facebook, YouTube, X, TikTok and search platforms.
Crime and Policing Act 2026
Royal Assent β 29 April 2026, phased commencementWhat it does: Major criminal justice Act covering online fraud, stalking and abuse. Includes a duty on platforms to remove non-consensual intimate images within 48 hours of being notified, enforced under the Online Safety Act penalty regime (up to 10% of global turnover).
Impact on you: Platforms must act fast on intimate-image abuse or face OSA-level fines. Stronger offences for stalking, spiking and harmful substances. Stalking victims gain the right to know the identity of their perpetrator.
Next steps: Provisions commencing in phases through 2026-27. Ofcom to set out how the 48-hour takedown duty will be enforced.
Data (Use and Access) Act 2025
Royal Assent β Partially in forceWhat it does: The UK's new data protection law (replacing the lapsed DPDI Bill). Reforms UK GDPR: new recognised legitimate interests, a permission-plus-safeguards model for automated decision-making, DSAR changes, and cookie-consent flexibility. Creates new criminal offences for deepfake intimate images and gives the ICO stronger enforcement powers.
Impact on you: Creating deepfake intimate images is now a criminal offence (from 6 Feb 2026). AI-driven decision-making is easier to use lawfully but must be transparent. Smart data schemes and digital verification services will cut identity fraud. The ICO can compel interviews and reports.
Next steps: Main data protection provisions in force 5 Feb 2026. Formal complaints procedures (s.164A DPA 2018) live 19 June 2026. Smart data schemes rolling out through 2026-27.
Economic Crime and Corporate Transparency Act 2024
Royal Assent β Rolling outWhat it does: Expanded powers to seize crypto assets linked to crime, new corporate transparency requirements, and stronger sanctions for fraud. Companies must identity-verify their directors.
Impact on you: Crypto scammers can have assets frozen without conviction. Identity fraud harder to hide behind shell companies. Companies House can now reject suspicious filings.
Next steps: Mandatory director ID verification live since 18 Nov 2025. ~983,000 non-compliance letters sent Nov 2025βMay 2026. Enforcement activity starts November 2026.
Digital Markets, Competition and Consumers Act 2024
Royal Assent β In force (partially commenced)What it does: New consumer protections against fake reviews, subscription traps, and misleading online practices. CMA gains stronger enforcement powers including direct fines up to 10% of global turnover.
Impact on you: Fake review farms targeted β bans on fake and incentivised reviews in force since 6 Apr 2025. Misleading online practices face penalties. Protects consumers from scammy checkout flows.
Next steps: CMA enforcement active β 5 investigations into misleading reviews opened March 2026. Subscription auto-renewal rules still to commence, expected autumn 2026.
Telecoms anti-fraud measures (Ofcom)
Delivered via Ofcom regulation β In forceWhat it does: No standalone Act was needed: Ofcom has used its existing powers to crack down on scam calls and texts. New rules (15 July 2026) require providers to block, limit and disrupt scam text messages, and to block international calls that spoof UK mobile numbers.
Impact on you: Number spoofing is much harder β fewer "your bank" scam calls and fake SMS. Complements the SIM farm ban and the telecoms Fraud Sector Charter. Consumers should still report scams to 7726.
Next steps: Rules being implemented by providers through 2026-27. Ofcom continues to update CLI guidance as fraud tactics evolve.
Cyber Security and Resilience (Network and Information Systems) Bill
Pending β House of Lords, Committee stageWhat it does: Strengthens the UK's Network and Information Systems Regulations 2018. Requires essential service operators and digital service providers to meet higher cyber security standards and report incidents faster.
Impact on you: Critical infrastructure providers face stricter security duties. Wider reporting obligations for data centres, cloud providers, and digital services. Aligns with EU NIS2 framework.
Next steps: Passed all Commons stages (third reading 16 June 2026); now HL Bill 32 in the House of Lords. Royal Assent expected late 2026.
Artificial Intelligence (Regulation) Bill [HL]
Pending β 1st reading, House of LordsWhat it does: Framework for regulating AI systems. Requires transparency from AI developers, safety testing for high-risk AI, and labelling of AI-generated content including deepfakes.
Impact on you: Deepfake scams could be criminalised. AI-generated scam calls, videos, and images must be labelled. Developers liable for unsafe AI products.
Next steps: Reintroduced 4 March 2025 (HL Bill 76) after the previous version fell at the 2024 election. Still awaiting second reading as of August 2026 β unlikely to progress without government backing.
Automated Online Software (Access and Transparency) Bill
Pending β awaiting 2nd readingWhat it does: Would require operators of bots that systematically access and copy content from UK websites to declare their identity and the purpose of their activity. Introduced by Damian Hinds MP, backed by the News Media Association.
Impact on you: Website owners β from online retailers to local news publishers β could see who is scraping their content and strike a fair deal. Reduces anonymous mass scraping that fuels spam and counterfeit sites.
Next steps: Presented in the 2026-27 session; second reading due. Private Members' Bill β passage not guaranteed.
UK Cryptoasset Regulation (FSMA regime)
Pending β regulations made, regime from 25 Oct 2027What it does: Comprehensive crypto regulation covering exchanges, stablecoins, custody and staking, delivered via the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026. Aligns with EU MiCA framework. FCA authorisation required for crypto activities.
Impact on you: Unregistered crypto exchanges blocked in the UK from late 2027. Scam tokens harder to issue. FCA published final rules on 30 June 2026. Stablecoin payments to be regulated separately by the Treasury.
Next steps: Regime comes into force 25 October 2027. Treasury consulting on stablecoin payment services (from April 2026). FCA authorisation window opens through 2026-27.
Fraud sentencing β mandatory minimums proposal
Dropped β no bill introducedWhat it does: The 2023 Fraud Strategy proposed mandatory minimum sentences for fraud offences above Β£100k and longer custodial terms for repeat scam offenders. No bill has ever been introduced to deliver this.
Impact on you: No change to fraud sentencing. Fraud still does not carry automatic prison time. General sentencing reform instead went through the Sentencing Act 2026, which focuses on short-sentence reform.
Next steps: No standalone fraud sentencing bill expected in the current session. Watch for a re-announcement in a future King's Speech.