On this page · 8 sections
If your dating app has members in the UK, the Online Safety Act applies to you, wherever the company is based [2]. Since 17 March 2025 you have had to assess and reduce the risk of illegal harms, including fraud [1]. Since 25 July 2025 you have had to either keep children out with highly effective age assurance or follow Ofcom's children's safety codes [1][5]. On top of that you need reporting tools, a complaints process and written records that Ofcom can ask for at short notice [5][6]. Getting it wrong can cost up to £18 million or 10% of qualifying worldwide revenue, whichever is greater [4].
This guide sets out what that means in practice as of 16 October 2026, with the dates, Ofcom's dating-specific guidance and a checklist you can work through with your team.
Who is covered
Ofcom published a guide for dating and social discovery services in May 2026. It says the Act applies to services with UK links where members share profiles, messages, images or video, or are matched with strangers [2]. In the Act's terms, that makes a dating app a "user-to-user" service. Size does not matter for the core duties: a small niche app has the same baseline obligations as a large one, scaled to its risks.
Ofcom's guide names the harms it expects dating services to think about [2]:
- Fraud and romance scams. Ofcom's research found 29% of adults online have experienced romance or dating scams, and 6% have come across fraud on a dating site or app [2].
- Intimate image abuse and sextortion. In a Thorn survey cited by Ofcom, 11% of perpetrators first contacted young victims through an online dating service [2].
- Harassment and stalking, including new fake profiles set up to keep contacting someone after being blocked [2].
- Gender-based harms such as misogynistic abuse and coercive control [2].
For a deeper look at the fraud side, see our guide to romance scams and what operators can do.
The dates that matter
| Date | What happened or is due | Status in October 2026 |
|---|---|---|
| 16 March 2025 | Illegal content risk assessments due | In force, review at least yearly |
| 17 March 2025 | Illegal content codes of practice in force | In force |
| 16 April 2025 | Children's access assessments due | In force |
| 24 July 2025 | Children's risk assessments due, where children are likely to access | In force |
| 25 July 2025 | Protection of Children Codes in force | In force |
| 7 April 2026 | Duty to report child sexual exploitation and abuse content to the National Crime Agency | In force |
| 11 April 2026 | Fee notifications due for providers at or above the revenue threshold | Passed |
| 31 July 2026 | Risk assessment records due from providers Ofcom served notices on | Passed |
| Autumn 2026 | New priority offences (serious self-harm, cyberflashing) and image hash matching measures | Expected, subject to Parliament |
| October to November 2026 | Category 1 and 2A services file records and publish risk assessment summaries | Depends on the register |
Two points stand out. First, the fee regime only applies to providers with qualifying worldwide revenue of £250 million or more, so most independent dating apps are outside it [10]. Second, Ofcom's June 2026 bulletin says illegal content risk assessments must be updated "as soon as practical" after its 25 June 2026 statement adding cyberflashing and serious self-harm as priority offences [7]. Cyberflashing is a real risk on dating apps, so that update should already be on your list.
Illegal harms: the duties since March 2025
Every in-scope service had to complete an illegal content risk assessment by 16 March 2025, covering 17 kinds of illegal content [1][2]. The codes of practice that set out recommended measures came into force the next day [1].
Ofcom's baseline measures for all in-scope services are [2]:
- terms and conditions that are easy to find and understand
- a complaints tool for reporting illegal or harmful material, backed by a process for handling those complaints
- the ability to review content and take it down quickly when there is reason to believe it is illegal
For dating services, Ofcom also points to nine practical actions to protect women and girls, including safer default settings, reducing the spread of content that promotes gender-based harm, trusted flagger programmes and routes for reporting incidents that happened off the service [2].
You do not have to adopt every code measure. But if you choose an alternative, you must record what you did instead, when it took effect and how it meets the duty [6].
Children: access assessments and age checks
This is where dating apps differ from many other services. Under the Act, a provider can only conclude that children cannot access its service if it uses age verification or age estimation that means children are not normally able to get in [5]. A date-of-birth box does not count: Ofcom says self-declaration of age is not highly effective [3].
That leaves two routes:
- Keep children out. Use highly effective age assurance at sign-up. Ofcom lists open banking, photo ID matching, facial age estimation, mobile network operator checks, credit card checks, digital identity services and email-based age estimation as methods capable of meeting the bar [3]. Whatever you use must be "technically accurate, robust, reliable and fair" [3].
- Accept children may be present. Then you must complete a children's risk assessment and follow the Protection of Children Codes, which have applied since 25 July 2025 [1].
For most dating apps the first route is the only sensible one. And if your service allows pornographic content, including content members post in profiles or private messages, Ofcom says highly effective age assurance is required [2]. Our guide to age verification methods and costs compares the options.
Ofcom is watching how well this works. Its July 2026 report on age assurance looked at four dating services [8]. On average, 70% of people who completed an age check on those services were found to be 18 or over, with a range of 57% to 82% [8]. More pointedly, Ofcom found that around one in ten 15 to 17-year-olds were spending time on dating services with age assurance in place in December 2025, and concluded that "the presence of age checks seems to have had little impact" on older teens' use [8]. It says dating services are now adding challenge ages and liveness detection in response [8]. Expect closer scrutiny of dating in 2027.
Reporting, complaints and records
The complaints duty is set out in section 21 of the Act. The procedure must be "easy to access, easy to use (including by children) and transparent", and your terms of service must explain how complaints are handled [5]. Where children may use the service, members must also be able to complain if they were wrongly blocked by an age check [5].
Records are the part operators most often underestimate. Ofcom's record-keeping guidance asks for [6]:
- each risk assessment, with the evidence used, the risk level for each kind of priority illegal content and who approved it
- every code measure you have taken, with the date it took effect
- any alternative measures and how they meet the duty
- earlier versions kept for at least three years
Reviews must happen at least once a year and after any significant change to the service [6]. In April 2026 Ofcom used its powers to demand risk assessment records from selected providers, with a 31 July 2026 deadline [7]. Ofcom's August 2026 open letter repeated that these duties apply now, whatever future rules are announced [9].
Fines and enforcement so far
The maximum penalty is the greater of £18 million or 10% of a provider's qualifying worldwide revenue for its most recent complete accounting period [4].
As of its June 2026 bulletin, Ofcom had not announced enforcement against a dating service. That bulletin listed four fines totalling £2.17 million: £600,000 for Youngtek Solutions and £80,000 for First Time Videos for failing to use highly effective age assurance, £540,000 for 4chan and £950,000 for an online suicide forum provider [7]. Earlier in 2026 it fined 8579 LLC £1.35 million and Kick Online Entertainment £800,000 over missing age checks [10]. The pattern is clear: age assurance failures and ignored information requests are what Ofcom has acted on first.
The checklist
| Duty | What good looks like | Evidence to keep |
|---|---|---|
| Illegal content risk assessment | Covers all 17 kinds of illegal content, with fraud, intimate image abuse, harassment and cyberflashing assessed in detail | Dated assessment, evidence, sign-off |
| Code measures | Clear terms, reporting tool, fast takedown | List of measures and dates |
| Children's access assessment | Concludes children cannot access, based on highly effective age assurance | Method, vendor due diligence, test results |
| Age assurance | An Ofcom-listed method, with liveness and a challenge age | Pass rates, appeals, fixes made |
| Complaints | Easy to use, covers wrongful age-check blocks | Complaint logs and response times |
| Women and girls | Safer defaults, off-service incident reporting | Product decisions and dates |
| Annual review | At least yearly and after major changes | Review notes, version history |
| Records | Kept at least three years, ready to send to Ofcom | Records register |
Questions
Does the Online Safety Act apply to dating apps?
Yes. Ofcom says the Act covers dating and social discovery services where members share profiles, messages, images or video, or are matched with strangers, including services based outside the UK that have UK members.
Do UK dating apps have to verify age?
A dating app can only treat itself as closed to children if it uses age verification or age estimation that stops children normally getting in. Ofcom says services that allow pornographic content, including content members post, must use highly effective age assurance.
What are the fines under the Online Safety Act?
Ofcom can fine a provider up to £18 million or 10% of its qualifying worldwide revenue, whichever is greater.
Has Ofcom fined a dating app?
Not as far as Ofcom's published bulletins show. Its fines so far have mainly hit pornography sites, 4chan and a suicide forum, totalling £2.17 million in its June 2026 bulletin alone.
How often must a dating app update its risk assessment?
Ofcom expects reviews at least once a year and after any significant change to how the service is designed or run.
