Ofcom Starts the Clock: UK Dating Apps Have Until April

Ofcom has handed every dating platform operating in the UK a detailed schedule of what needs to be done, when it needs to be done, and, implicitly, what happens if it is not. The regulator's newly published compliance roadmap runs from March 2026 through May 2027, with the first formal submissions due in April. If you have been treating the Online Safety Act as background noise, that stops now. This is a hard deadline backed by statutory authority, not a consultation document.

The High Intent Take

This is the end of dating's regulatory honeymoon. For years, the sector operated with less oversight than social media despite hosting the same trust and safety risks, romance fraud, sexual harassment, intimate image abuse, cyberflashing, often in a context explicitly designed to facilitate offline meetings. That asymmetry was always going to close. The phased timeline may look generous compared to earlier drafts, but these are hard deadlines backed by statutory authority. Dating platforms that treat this as a compliance exercise rather than an operational priority will find themselves explaining their risk frameworks to Ofcom by summer 2026. The ones that do not have frameworks to explain will be in a considerably worse position.

The operators who start building risk assessment frameworks now, allocate compliance budget, and engage with Ofcom's guidance as it publishes will be fine. The ones who wait until March 2026 to begin will be scrambling. Build the thing. Do not wait for the letter to arrive before you decide this is real.

What the Roadmap Actually Requires

The compliance burden is substantial. Dating platforms must conduct and document risk assessments for both illegal content and child access, two areas where the sector's track record has been patchy at best. Ofcom has published a digital tool for the Children's Access Assessment, which the regulator claims takes fewer than 10 minutes to complete. That figure is misleading. Completion time is not assessment time. The underlying work, evaluating age verification systems, understanding how under-18s might bypass controls, documenting mitigation measures, requires considerably more than 10 minutes of executive attention. Budget accordingly.

Platforms must also demonstrate they are addressing priority harms. Ofcom's Group Director of Online Safety, Oliver Griffiths, has flagged protections for women and girls as a core focus, alongside tackling illegal hate speech and terrorist content. For dating operators, the women and girls priority is existential. Women represent the commercially critical cohort for mixed-gender platforms. Retention and safety perception directly determine whether a service can maintain viable gender ratios. Any platform that cannot credibly demonstrate it is mitigating harassment, unsolicited sexual content, and intimate image abuse will struggle both with Ofcom and with its own unit economics, and those two problems will compound each other.

The roadmap also includes ongoing work on cyberflashing and intimate image abuse, offences that disproportionately affect dating platforms. Final statements on these priority offences are scheduled throughout 2026, which means compliance teams should expect the requirements to shift mid-process. Crisis response protocols, how platforms handle reports of imminent harm, will also be under scrutiny. Build your incident response framework before you need it, not during the first serious event.

The Child Access Problem

Dating services face a reputational and legal minefield around underage access. Most platforms set a minimum age of 18, but enforcement has historically relied on self-reported dates of birth and rudimentary checks. Ofcom's emphasis on Children's Access Assessments signals the regulator knows this and intends to fix it. The question is not whether underage users are getting through on some platforms. The question is whether you can document what you found and what you did about it.

The implications extend beyond immediate compliance. Platforms that discover material underage access during their assessments will need to document how they are addressing it, likely requiring investment in age verification technology that goes beyond the honor system. Some operators will face a choice between stronger age assurance and friction that damages conversion rates. Ofcom's position is clear: err on the side of exclusion. That is not a comfortable instruction for a product team that watches signup funnels obsessively, but it is the one the regulator is giving.

"Publishing risk assessment summaries means disclosing what harms a platform has identified and what it is doing about them. Competitors, journalists, and advocacy groups will compare disclosures. Any platform that publishes a threadbare summary, or one that appears to downplay known risks, will face questions it does not want to answer in public. The transparency requirement is not bureaucratic box-ticking. It is a mechanism for public accountability."

The October 2026 transparency summaries will become public relations flashpoints whether operators are ready for them or not. You do not get to choose whether this information becomes public. You only get to choose how prepared you are when it does. Operators who draft those summaries in September, under deadline pressure, with lawyers involved, will produce worse documents than the ones who start the process now.

Who This Hits Hardest

The phased timeline creates asymmetric pressure. Match Group (MTCH), Bumble (BMBL), and other well-capitalized operators have compliance infrastructure and legal teams that can absorb the workload. Smaller platforms and white-label providers face a more difficult calculation. Building the systems to conduct credible risk assessments, maintain statutory records, and implement mitigation measures costs money and operational bandwidth that many do not have. Some will decide the UK market is not worth the cost. Others will sell before the deadlines hit.

White-label operators, providers that power multiple dating services under different brands, face multiplicative compliance obligations if Ofcom treats each branded service as a separate in-scope entity. The consolidation pressure that was already building in the UK dating sector will accelerate. Platforms attempting to stay beneath Ofcom's radar by claiming they are not user-to-user services will find the regulator unsympathetic. Any service that facilitates communication between members almost certainly falls within scope, regardless of how artfully the terms of service are drafted. That argument has been tried. It does not hold.

"Dating platforms have 12 months to treat this seriously. The ones that wait until March 2026 to begin will be scrambling. And the ones that assume this is performative regulation that won't be enforced should ask themselves whether they are prepared to test that hypothesis with Ofcom holding statutory powers. The April 2026 deadline is fixed. The compliance burden is real."

What to Watch Beyond April 2026

Ofcom's January 2027 statutory report on app stores adds another variable. If the regulator concludes that Apple and Google are insufficiently policing age ratings and safety standards for dating apps distributed through their platforms, app store compliance requirements could tighten materially. Operators should watch this closely. App store rejections or additional review layers could create distribution bottlenecks just as platforms are trying to implement OSA changes, a timing problem nobody needs when compliance budgets are already stretched.

The statutory report on content harmful to children, due October 2026, will likely set the tone for Ofcom's enforcement appetite. If the regulator finds widespread failures in child protection, and given the sector's history, it probably will, expect accelerated timelines and reduced tolerance for non-compliance going into 2027. The regulatory environment for UK dating platforms has fundamentally changed, and the roadmap Ofcom just published is the clearest signal yet that the regulator intends to use the authority Parliament gave it. The operators who engage with this seriously, early, will not just survive the compliance cycle. They will be better businesses for having been forced to document what they actually do and do not do to protect their members.