Platform Risk Matrix
Online grooming occurs across all digital platforms but certain design features — anonymity, ephemeral content, direct messaging, and young user bases — make some platforms significantly higher risk. This matrix gives officers a fast reference for platform-specific risks and what to look for.
| Platform | Risk Level | Key Risk Features | What Officers Should Know |
|---|---|---|---|
| Snapchat | Very High | Ephemeral messages, Snap Map location, My Eyes Only vault | Screenshots can be hidden. Map shows real-time location. "My Eyes Only" requires separate PIN — obtain via RIPA/PACE production order |
| Very High | DMs, Stories (disappear 24h), fake/finsta accounts, Reels | Groomers establish secondary accounts unknown to parents. Check linked accounts. Story content requires urgent preservation | |
| TikTok | High | Algorithm surfaces adult content to minors, DM from strangers, LIVE | LIVE feature allows adults to contact young creators in real time. DMs from adults to children under 16 restricted but bypassable |
| Discord | High | Private servers, voice/video channels, direct DMs, no age verification | Gaming communities are a primary vector. Servers can be entirely private with custom invites. Voice evidence requires specialist extraction |
| Roblox / Gaming platforms | High | In-game chat, avatar gifting, virtual currency, young user base | Groomers use in-game gifts (Robux) and private game servers. In-game text is logged — request via production order to developer |
| High | End-to-end encryption, group chats, disappearing messages | End-to-end encryption means provider cannot supply message content. Evidence must be obtained from device directly. Metadata available | |
| Telegram | Moderate–High | Self-destructing messages, anonymous bots, large unmoderated channels | Secret chats use client-side encryption — not recoverable from servers. Standard chats can be obtained via court order in UK-registered cases |
| Omegle / Chatroulette | Extreme | Anonymous random video chat, no account needed, no moderation | Omegle closed Nov 2023 but clones exist. Entirely anonymous. IP logging varies. IIOC offending frequently begins on these platforms |
Online Grooming Stages
Online grooming follows the same broad stages as offline grooming, but the digital environment accelerates the timeline dramatically. A child can move from first contact to exploitation within days. Officers should understand each stage to identify where in the process a victim may be.
| Stage | What the Offender Does | Indicators for Officers |
|---|---|---|
| 1. Target Selection | Identifies vulnerable children through public posts, profiles, or gaming chats; looks for signs of family conflict, loneliness, or low self-esteem | Child with public profile expressing distress; joined new gaming community or online group recently; unknown adult recently followed or messaged |
| 2. Friendship Building | Presents as a peer or older friend; shows intense interest in the child's life; provides validation and gifts; online "relationship" develops fast | Child describing an online friend who "really gets me"; gift cards or gaming currency received; late-night device use; secretive about online contacts |
| 3. Exclusivity and Isolation | Positions themselves as uniquely understanding; discourages contact with parents/friends; creates sense that "no one else understands" | Child withdrawing from family; dismissive of parents asking about their contacts; increasing reliance on one online friendship; anxiety if device is removed |
| 4. Sexualisation | Introduces sexual topics gradually; normalises sexual conversation; may share sexual images first ("desensitisation"); requests images | Child asking questions about sex disproportionate to age/development; discovery of sexual images on device; child mentions "a game" involving photos |
| 5. Coercion and Maintenance | Uses obtained images to coerce further compliance (sextortion); threatens to share images with family/school; may arrange physical meetings | Child distressed, withdrawn, or fearful around device use; mention of someone who "has photos"; child attempting to delete accounts or change devices |
Victim & Offender Indicators
Child victim indicators
- Unexplained gifts, money, or devices (especially a second phone)
- Becoming withdrawn, anxious, or angry when asked about online contacts
- Switching screens or closing apps when adults approach
- Staying up very late to communicate online, or waking at night
- Changes in language — using sexual or adult terminology not age-appropriate
- Unexpectedly accessing adult or inappropriate websites
- References to an older "boyfriend" or "girlfriend" met online, particularly in another city
- Self-harm, eating disorders, or significant mood changes emerging alongside new online relationships
Known offender behaviour patterns
- Uses multiple accounts across platforms; changes names frequently
- Claims to be the same age or slightly older than the child, then gradually reveals true age
- Makes early requests for photos of "non-sexual" nature (selfies, school uniform, bedroom)
- Displays knowledge of the child's routine, school, or address obtained from open source social media
- Grooms multiple children simultaneously — intel on one victim often links to others
- May have gaming usernames, Discord handles, or Snapchat IDs found across multiple victim devices
If a child has been coerced into sending sexual images and is now being threatened, treat this as an immediate safeguarding crisis. The child is at high risk of self-harm. Do not focus on device seizure before welfare — speak to the child first. Reassure them that they are not in trouble. Contact CEOP. Do not advise the child to pay the offender.
Evidence Preservation
Digital evidence in online grooming cases is highly volatile. Content disappears, accounts are deleted, and platforms outside UK jurisdiction may delete data within days of notification. Take preservation steps before any overt action where operationally possible.
Immediate preservation steps
- Screenshot and timestamp all visible content before contacting the platform or suspect. Use an approved force capture method or a neutral device — never a personal device.
- Record full URLs of profiles, posts, images. Include the username, display name, and any profile identifiers visible.
- Do not send a cease and desist to the suspect before evidence is secured — this triggers deletion.
- Submit a preservation request to the platform using MLAT procedures (US platforms) or via NCA NCCU for urgent international cases. UK providers respond to standard PACE production orders.
- Seize devices carefully: do not switch on a powered-down device without specialist advice. Biometric unlocking may be legally complicated — consult your Digital Media Investigator (DMI).
UK legal routes for digital evidence
| Route | Used When | Timeline |
|---|---|---|
| PACE s.19 seizure | Device at scene of arrest or search | Immediate |
| Production order (PACE s.9) | UK-based platform holds relevant data | Days–weeks |
| MLAT request via NCA/Home Office | US or foreign platform (Meta, Snap, Google) | Weeks–months; urgent track available |
| Emergency disclosure (IPA 2016 s.252) | Risk to life, immediate threat | Hours (emergency basis) |
| CEOP intelligence request | Cross-border or unknown offender | Varies |
CEOP Referral Pathway
The Child Exploitation and Online Protection Command (CEOP) is the UK's national centre for online child protection. It sits within the National Crime Agency. CEOP should be contacted in parallel with local safeguarding processes — it is not an alternative to MASH referral.
When to refer to CEOP
- Unknown offender located online who has made contact with or exploited a child
- Indecent images of children (IIOC) identified on a device — regardless of whether offender is known
- Cross-border or international dimension to a grooming case
- Multiple victims identified with a common online offender profile
- Offender using platforms based outside the UK — CEOP has established liaison with major US providers
Referral routes
- Online: ceop.police.uk/ceop-reporting/ — victims, parents, and professionals can all report
- Officer-to-CEOP: Contact via your force's CEOP Single Point of Contact (SPoC) for professional referrals with intelligence packs
- Emergency: 999 for immediate risk; CEOP for online-specific intelligence support
A CEOP referral does not replace a MASH referral. The child victim requires local statutory safeguarding — CEOP handles the offender and cross-border intelligence. Both referrals must be made. Document both in the same intelligence log.