The Online Safety Act and dating apps

The short version

• Dating apps are regulated services. Ofcom has published guidance written specifically for dating and social discovery services.
• Illegal content duties have applied since 17 March 2025. Services must assess and reduce the risk of illegal content and act quickly when they find it.
• Children's protections have applied since 25 July 2025. Where a dating service allows pornographic content, it must use highly effective age assurance to keep under-18s away from it.
• Cyberflashing has been a priority offence since 8 January 2026. Services must now work to prevent unsolicited sexual images, not just remove them.
• Fines go up to £18 million or 10% of qualifying worldwide revenue, whichever is greater.

Dating apps are in scope

The Online Safety Act 2023 received Royal Assent on 26 October 2023. It regulates "user-to-user services": under section 3, any service where content generated, uploaded or shared by one user can be encountered by another. Profiles, photos, prompts and private messages are all user content of exactly this kind.

Ofcom removed any doubt on 18 May 2026 with "Dating and social discovery: know the online safety risks, rules and how to comply", which covers dating and matchmaking services, profiles, direct messages and voice and video messages. The Act also reaches services based outside the UK if they have a significant number of UK users or target the UK, as the government's explainer sets out.

The timeline so far

Age checks: what is actually required

The popular summary, "dating apps must verify everyone's age since July 2025", is not quite right, and the detail matters.

Under section 12, services likely to be accessed by children must stop them encountering "primary priority" content, which includes pornography. Where that content is allowed, the law requires highly effective age assurance. Ofcom's dating guidance applies this directly: a dating service that permits pornographic content, including user-generated content in profiles or private messages, must use highly effective age assurance to keep under-18s from it.

A service that bans that content for everyone can rely on the ban, but only if it actually enforces it. And Ofcom expects robust age checks where a service sets an 18+ minimum age but has significant underage use. According to Ofcom's 15 July 2026 report, that use is real: "over one in ten 15 to 17-year-olds were continuing to visit and spend time on three of the most used dating apps in December 2025".

The industry has moved. Ofcom's September 2025 bulletin noted that Bumble, Match Group (Tinder and Hinge), Grindr and Feeld had announced or introduced age checks. Bumble launched optional ID verification in March 2025. Feeld told Mashable it would use Yoti, with selfie-based estimation and no retention of photos or dates of birth. In March 2026, Match Group announced that new Tinder users in the UK would need to scan their faces.

Cyberflashing: from offence to duty

Sending an unsolicited image of genitals to cause alarm, distress or humiliation, or for sexual gratification while reckless about that harm, became a criminal offence on 31 January 2024. For two years that was a matter for the police, not product teams.

That changed when the government made cyberflashing a priority offence, in force from 8 January 2026. Announcing the change in September 2025, it said "social media platforms and dating apps will be required to take proactive steps". Ofcom's measures, finalised on 25 June 2026, expect services at risk to assess the problem and respond with easy reporting, trained moderation, fast removal, and blocking and muting tools.

Romance fraud

The numbers are large and still rising. City of London Police reported 8,792 romance fraud reports and £94.7 million lost in the year to June 2024, with 45% of approaches made through dating sites. For 2024-25, Action Fraud figures cited by the regional organised crime units showed £106 million lost, up 18%, with an average loss of £11,222 per victim. Reported fraud understates the true total.

Most romance scams run through fake profiles and private messages, so they fall under the general illegal content duties. The Act's specific fraudulent advertising duties in section 38 cover paid-for adverts on the largest services, not ordinary user profiles. Alongside the Act, Match Group signed the government's voluntary Online Fraud Charter in 2023, which asks dating services to offer optional identity verification and to warn users about accounts likely to be involved in fraud.

Penalties and enforcement

Ofcom can fine a provider up to £18 million or 10% of qualifying worldwide revenue, whichever is greater. So far its enforcement has focused on pornography and other high-risk services rather than mainstream dating apps. By July 2026 it had opened 23 investigations covering 88 adult services and fined seven providers. One investigation into Novi, which runs Joi.com, was opened in January 2026 and closed in July after age checks were introduced, without a finding against the company.

The July report's message to dating apps was clear even without a named case: implement highly effective age assurance properly, check your vendors, and use measures such as liveness detection.

The privacy tension

Every age check processes personal data, and some methods process biometric data. Ofcom and the ICO said so directly in a joint statement in March 2026: methods must be necessary, proportionate and compliant with UK GDPR, and self-declaration alone is not effective. The ICO's age assurance opinion makes the same point.

Campaigners are less reassured. The Open Rights Group has criticised the lack of a public register of approved providers or mandatory security standards, warning of phishing, leaks and data reuse. Big Brother Watch argued that invasive checks threaten privacy and anonymity and are not a "silver bullet". These are advocacy positions, not regulator findings, but they point at a real problem. As we argued in Dating Apps Are Sensitive-Data Systems First, a dating app already holds location, sexuality and intent. Adding face scans and ID documents raises the stakes of every breach.

What it means for Affinity Atlas

Affinity Atlas is a concept and a demo, not a live service, so none of these duties apply to it today. If it ever launched in the UK, they would apply in full. We would rather design for them now than bolt them on later:

• Age assurance that keeps nothing it does not need. Estimate or verify, keep the result (over 18: yes or no), and do not keep the face or the document.
• No images from strangers by default. First messages are text. Photo sharing opens only when both people choose to allow it, which tackles cyberflashing at the design stage rather than in moderation.
• Reporting that is one tap away, with blocking and muting that work immediately.
• Behavioural data is a fraud signal too. Real profiles connect real Spotify, Steam or Goodreads histories. A fresh profile with no linked activity and a script of urgent money stories looks very different, and the system can say so without exposing anyone's data. Our identity verification post covers the trade-offs.
• Minimal raw data, always. Matches see derived signals, never raw histories. That limits what a breach, or a bad actor with an account, can learn.

The Online Safety Act turns safety from a feature into an obligation. For apps built around engagement, that is a cost. For an app built around fewer, better introductions, it should be the point.