As of November 6, 2026, some kinds of pornography are illegal to own in England and Wales, not just to make or sell. And the UK government has been unusually clear about what “own” means: if it’s sitting in your iCloud, your Google Drive or a forgotten folder on an old laptop, that counts.
The new offences come from the Crime and Policing Act 2026, and the possession angle is what caught the attention of UNILAD Tech and plenty of nervous phone owners. We read the official guidance to work out what’s actually covered, what isn’t, and what it means for the way cloud storage works.
The short version
- Three new categories are now illegal to possess or publish in England and Wales: depictions of strangulation or suffocation, sex between people presented as close relatives, and sexual activity involving someone who is, or is pretending to be, under 16.
- Possession can mean a file on a device, in a personal account or in the cloud.
- Possession is a “continuing act,” so images saved before November 6 became illegal to keep on November 6.
- Realistic AI-generated images are covered if a reasonable person would think the people are real.
- Maximum sentences run from two years for possession to five years for publishing.
What the law actually bans
The guidance from the Ministry of Justice is narrower than some headlines suggest. It only covers pornographic images that are “explicit and realistic,” and only content where the people appear real to a reasonable viewer. It isn’t a ban on porn in general, and Justice Minister Alex Davies-Jones stressed that “this isn’t about criminalising harmless sexual preferences.”
The categories came out of Baroness Bertin’s Independent Pornography Review, which argued that some content, choking in particular, was shaping what young people think normal sex looks like. The government ties the law to its goal of halving violence against women and girls within a decade.
| Category | Max for possession | Max for publishing |
|---|---|---|
| Strangulation or suffocation | 2 years | 5 years |
| Penetrative sex between people presented as close relatives | 2 years | 5 years |
| Sexual activity with someone who is, or pretends to be, under 16 | 3 years | 5 years |
A few details are easy to miss. The “relatives” category includes people who are only pretending, so a step-family roleplay scene counts if one person is presented as under 18. “Suffocation” doesn’t require hands on the neck; the guidance says covering someone’s mouth and nose or compressing the chest can qualify. And the under-16 offence applies even when everyone involved is an adult playing a role.
Why your cloud storage counts
The word “possess” isn’t defined in the Act, so courts will give it its ordinary meaning. The government’s view is that it generally means having “custody or control” of an image, and it spells out what that can look like: an image “stored on a device, retained in a personal account or cloud, saved in files, or otherwise kept physically or virtually.”
That’s a big deal for how most people use their phones. Photos and videos sync to iCloud, Google Photos or OneDrive without anyone thinking about it. Messaging apps save attachments automatically. A clip someone sent you in a group chat three years ago might be sitting in a cloud backup right now.
“Publish” is just as broad. It covers giving or making an image available to someone else “by any means,” including uploading, posting, sending, sharing or distributing. Forwarding a video in a group chat is publishing under that definition, and publishing carries the heaviest penalty.
Deleting isn’t always deleting
The government says anyone holding covered material needed to “permanently delete it or otherwise get rid of it” before November 6. In practice, most cloud services don’t delete anything the first time you hit the trash icon. They keep it in a recovery folder for weeks.
| Service | Where deleted files go | How long they stay |
|---|---|---|
| iCloud Photos | Recently Deleted album | Up to 30 days |
| Google Photos | Trash (backed-up items) | Up to 60 days |
| OneDrive (personal) | Recycle bin | Up to 30 days |
| Dropbox | Deleted files | 30 days or more, depending on plan |
Old device backups are another blind spot. An iPhone backup made to a Mac or PC, or stored in iCloud, can still hold photos you’ve since removed from the phone. If you’re not sure what’s in yours, our guide on how to back up your iPhone walks through where iCloud, Mac and Windows backups live and how to manage them.
The defences, in plain English
The law doesn’t make you a criminal just because someone sends you something. The guidance lists several defences:
- You hadn’t seen it. If you hadn’t seen the image and didn’t know, or have reason to suspect, it was covered by the law.
- It was unsolicited. For possession, if you were sent it without asking and didn’t keep it for an unreasonable length of time.
- You were in it. If you took part in the act shown and other conditions are met.
- Legitimate reason. For example, research, journalism or law enforcement work.
The unsolicited defence has a clock built into it. “Didn’t keep it for an unreasonable length of time” means the safest thing to do with anything unwanted is delete it promptly and empty the recently deleted folder too. It’s also a good reason to check whether WhatsApp is set to save media to your camera roll automatically. On iPhone that’s the Save to Photos option, and on Android it’s Media visibility.
AI images are in, cartoons are out
The test is whether a reasonable person would think the people shown are real. The government’s factsheet says that means realistic AI-generated images are included. Obviously drawn or animated content generally isn’t caught by these specific offences, although other UK laws on indecent images of children still apply to that.
That puts AI image generators in an awkward spot. A tool that produces photorealistic output could now create something illegal to possess in England and Wales, and the user would be the one in possession.
Will anyone actually check your iCloud?
The law doesn’t give police new powers to search cloud accounts, and Apple doesn’t scan iCloud Photos for this kind of material. The company dropped its plan to scan for known child abuse images in 2022 after a privacy backlash. Google does scan for known child sexual abuse material, but that’s a separate system aimed at a separate crime.
Realistically, these offences are most likely to come up when someone’s devices are already being examined for another reason, or when content is shared and reported. That’s how the older “extreme pornography” offence, on the books since 2009, has mostly worked. Still, “nobody will look” is not a legal defence, and UK users have fewer encryption options than most. Apple withdrew Advanced Data Protection, its end-to-end encryption for iCloud, for new UK users in 2025 after a government demand for access.
If you’re visiting from the US, the law covers what you possess while you’re in England and Wales, including on your phone. Scotland and Northern Ireland have their own laws.
Sources and further reading
- UNILAD Tech: What the UK’s new porn ban actually covers, from websites to your iCloud
- GOV.UK: Crime and Policing Act 2026, offences relating to pornography
- GOV.UK: Crime and Policing Act 2026 pornography factsheet
About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.
