Quick answer
What you need to know
- Right now
- No general message-scanning order appears in the official sources checked for this guide.
- What might change
- Ofcom could eventually send a targeted order to one service after several legal and technical steps.
- Why people worry
- A poorly designed system could weaken the security that private conversations depend on.
Checked against official sources on 8 August 2026 sourcesource
Want the detail?Check the law, evidence and open questionsIncludes what the law requires, what Ofcom says, safeguards, technical diagrams and every source.
See the technical process diagram
What does the law actually require?
In the lawSection 121 gives Ofcom a targeted power to require a regulated user-to-user or search service to use accredited technology to identify terrorism content or child sexual exploitation and abuse content. A notice must be necessary and proportionate. source
Is this happening now?
What Ofcom saysOfcom published final guidance and advice on minimum accuracy standards in May 2026. The Secretary of State must approve and publish minimum standards, and an accreditation process must be established, before the identification-technology power can be used. This is a legal framework, not evidence that Ofcom has ordered every private message to be scanned. source
What do we know so far?
What we foundOfcom says it may issue a notice only after assessing the service, the technology, accuracy, privacy, freedom of expression, and whether less intrusive measures could work. Its implementation roadmap distinguishes completion of the framework from use of the power. source source
What could go wrong?
Our viewEnd-to-end encryption protects the content of a conversation so that the service itself cannot normally read it. We are concerned that a future requirement to detect content in an encrypted service could pressure providers to change that security model, creating new attack surfaces or encouraging overbroad scanning.
What is this trying to fix?
What Ofcom saysThe power is limited to terrorism and child sexual exploitation and abuse content. Ofcom frames it as a backstop for serious harms where other measures are insufficient, rather than a routine requirement for all services. source
What protections are built in?
In the lawThe Act requires necessity and proportionality assessments, technical evaluation, and consideration of freedom of expression and privacy. Technology used for identification must be accredited against government-set accuracy standards. source source
What has not been decided?
- What minimum accuracy standards will the Secretary of State set?
- Which technologies, if any, will pass accreditation for use in encrypted environments?
- How will independent experts scrutinise security and rights impacts before and after a notice?
- What practical remedy will users or providers have if a technology produces harmful errors?
These are open questions, not claims that a notice has already been issued.
Sources for this page
- Regulator statement
Ofcom. Statement: Technology Notices.
Ofcom's final guidance on exercising technology-notice powers and advice on minimum accuracy standards. Published 8 May 2026; last checked 8 August 2026.
- Regulator statement
Ofcom. Ofcom's approach to implementing the Online Safety Act.
Ofcom's implementation roadmap, milestones, active duties and planned regulatory work, updated in July 2026. Published 26 October 2023; last checked 8 August 2026.
- Primary legislation
UK Parliament. Online Safety Act 2023.
The current consolidated text of the Act, including regulated services, duties, enforcement powers, safeguards and exemptions. Published 26 October 2023; last checked 8 August 2026.