The New Rules

On 9 June 2026, Ofcom — Britain's media regulator — published its Statement on Crisis Response Protocol, laying out mandatory rules for social media platforms like X and TikTok. The rules say these companies must take specific action when illegal content starts spreading rapidly during a crisis. These requirements will be written into the Codes of Practice under the Online Safety Act 2023.

The timing matters. This protocol is the final piece of a larger regulatory plan that Ofcom mapped out in October 2023, called the Roadmap to Regulation. That roadmap flagged crisis response as a priority area alongside protecting children. The June 2026 announcement is when those priorities become actual rules that platforms must follow.

What Platforms Must Actually Do

The crisis protocol framework sets clear boundaries around when platforms must act. "Priority illegal content" includes material that breaks laws listed in Schedules 5, 6, or 7 of the Online Safety Act — things like terrorism-related posts and hate speech. This is a specific legal test, not a vague one. It's anchored directly to existing criminal law, which means the rules have legal teeth and makes it harder for platforms to claim they didn't know when to act.

Here's how it works: when that kind of content starts spreading at the speed of a viral hit during a crisis, platforms are required to step in. The practical methods — slowing down how often a post appears in feeds, blocking uploads with matching content, preventing shares — are detailed in the Codes of Practice. The key shift is that platforms must interrupt the spread before it blows up, not just remove posts after millions have seen them.

Ofcom's broader protection package, outlined in a June 2025 statement on additional online protections, also requires platforms to prevent terrorism content and fake explicit videos from being uploaded in the first place. The crisis protocol fits into this larger system as the emergency measure — the part designed to work when normal moderation falls behind.

The Law Behind the Rules

The Online Safety Act, passed in October 2023, gave Ofcom the power to create Codes of Practice that have real legal force. If a platform follows a code, it's presumed to be obeying the underlying law. If it doesn't follow the code, that doesn't automatically mean it broke the law — but it puts the burden on the platform to defend itself in an enforcement case. For the biggest platforms, marked as Category 1 services, the penalties are steep: fines up to ten percent of global revenue, and even court orders that could block UK access.

This protocol is not just advice. It's part of a legal code with enforcement power. When The Guardian reported on 9 June 2026 that Ofcom told X and TikTok to adopt these measures, it was signalling that these platforms are expected to comply.

Why Crises Break Normal Moderation Systems

There's a pattern to examine. During the Southgate riots in August 2024, platform moderation teams that normally worked fine got overwhelmed by the sheer volume and speed of posts. Illegal content that would have been removed within hours spread to hundreds of thousands of people before action was taken. Similar problems occurred after terror attacks in France in 2023 and New Zealand in 2019. Crisis events are fundamentally testing grounds for moderation systems — and historically, reactive systems fail them.

Ofcom's protocol tries to reshape the problem. The idea is that pre-planned crisis triggers and technical measures ready to go can stop content before it goes viral, rather than after. Whether this works will come down to how detailed the Codes of Practice actually are and how platforms put the rules into practice — the fine details are where policy intentions often collide with how software actually functions.

What This Means for Tech Companies

For compliance teams at large platforms, the immediate challenge is reworking their crisis response systems to match these trigger points. The crime categories in Schedules 5, 6, and 7 are legally defined but practically messy — deciding whether something qualifies as terrorism-related content, for example, requires judgment that AI tools often struggle with. Platforms need to figure out how to combine human judgment with the speed required by a "going viral" standard.

For companies operating globally, the challenge multiplies. A crisis in the UK might involve content that's also spreading rapidly in Europe or the US, where different laws apply. The EU's Digital Services Act, for instance, has its own crisis framework. Platforms will need to decide whether they can turn UK crisis measures on and off by region, or whether activating them affects how their software works worldwide.

Ofcom's move also raises broader questions about how much responsibility platforms should bear. By requiring companies to prepare for crises before they happen — not just respond after the fact — the regulator is saying platforms have a duty to be ready. This framing goes beyond the UK and will influence how other countries think about platform accountability.

What Happens Now

The announcement means the Codes of Practice will now start operating. Platforms will report on their compliance, and Ofcom will review whether the measures work and are reasonable. If there are enforcement actions, they're more likely to come from these regular oversight checks than from sudden penalties — but the direction is clear: toward holding platforms accountable, not cutting them slack.

The fundamental question — whether these mandatory measures can actually reduce the real-world harm when illegal content spreads during crises — is still an open question that only time and evidence will answer. What we know now is where the UK regulator has drawn the line, and what legal tools it intends to use to hold it.