The Government has updated the Online Safety Act 2023 via the Online Safety Act 2023 (Priority Offences) (Amendment) Regulations 2025. The instrument adds section 184 (encouraging or assisting serious self-harm) to Schedule 7 and replaces paragraph 28A to list cyberflashing (Sexual Offences Act 2003 section 66A) alongside intimate image abuse (section 66B). The Regulations apply across the UK and take effect on 8 January 2026, 21 days after being made on 18 December 2025.
Designating an offence as a ‘priority offence’ engages proactive duties for in-scope user‑to‑user and search services under Part 3 of the Act. Providers must assess and mitigate the risk of users encountering content amounting to these offences and take proportionate steps to prevent such content from appearing on their services. Ofcom guidance requires risk assessments to be “suitable and sufficient”, supported by records and regular review, with penalties of up to £18 million or 10% of global turnover for breaches.
Section 184 criminalises acts intended to encourage or assist serious self-harm, including sending, transmitting or publishing communications by electronic means, forwarding others’ content, and sharing hyperlinks. “Serious self-harm” means grievous bodily harm in England, Wales and Northern Ireland, and severe injury in Scotland. Conviction on indictment carries a maximum sentence of five years’ imprisonment.
Section 66A of the Sexual Offences Act 2003 makes it an offence to send or give a photograph or film of genitals with intent to cause alarm, distress or humiliation, or for sexual gratification while reckless as to causing harm-commonly referred to as cyberflashing. Sections 66B to 66D cover non‑consensual intimate image sharing and threats to share, with defined exemptions and interpretations.
The 2025 Regulations revoke S.I. 2024/1188, which had added section 66B to Schedule 7 and removed the repealed section 33 offence from the Criminal Justice and Courts Act 2015. The new instrument retains section 66B, adds section 66A, and inserts a new paragraph 2A for section 184.
For compliance teams, immediate actions include updating illegal content risk assessments to cover section 184 and sections 66A–66B, aligning detection and enforcement workflows, and ensuring terms of service and user‑reporting routes clearly set out the provider’s approach to priority illegal content. Ofcom’s guidance sets expectations on record‑keeping and periodic review.
Providers should ensure moderation tooling, age‑appropriate controls and staff training reflect the updated offences so measures are effective by 8 January 2026. Ofcom indicates it can open investigations and sanction services that fail to implement proportionate measures or evidence their risk assessment and mitigation; it also groups priority illegal content into 17 categories for assessment.
This change updates the statutory list rather than the underlying offences, which are already in force: section 184 since 31 January 2024 and sections 66A–66B via the Online Safety Act 2023. No separate Impact Assessment accompanies the 2025 Regulations, with the Government citing de minimis impacts.