Regulatory Analysis — September 2026
The EU E-Commerce Directive ceased to apply in the UK on 31 December 2020. The Digital Markets, Competition and Consumers Act 2024 received Royal Assent on 24 May 2024. The 41 months between those two dates — with no enforceable UK platform liability framework for fake business listings — is the period in which the fake locksmith listing model scaled from a manageable problem into a systematic national crisis.
31 Dec 2020
E-Commerce Directive ceased applying
41 months
regulatory vacuum
24 May 2024
DMCCA Royal Assent
0
fake listings removed Sept 2026
The EU E-Commerce Directive (2000/31/EC) applied to the UK as an EU member state and throughout the transition period until 31 December 2020. For platform liability â the legal mechanism most relevant to fake Google Maps listings â the Directive established two critical obligations.
Notice and takedown obligation
Once a platform became aware of illegal content â through a formal notification â it was required to act expeditiously to remove or disable access to that content or risk incurring liability. A formal notification of a fake locksmith listing to Google created a legal obligation to investigate and act. Failure to act after notification created platform liability under the Directive.
Prohibition on general monitoring
Platforms were not required to proactively monitor all content â but they were required to act when notified. The notification mechanism had teeth that the UK's post-Brexit equivalent did not immediately replicate.
Country of origin principle
An information society service established in one EU member state was subject to the laws of that member state across the entire EU. This created a single regulatory framework for platforms operating across EU borders â and meant that EU-level enforcement action against Google affected its operations across all member states simultaneously.
The E-Commerce Directive ceased to apply to the UK when the transition period ended on 31 December 2020. The government published guidance on 5 January 2021 confirming this. The guidance stated that the government remained committed to upholding notice and takedown in principle â but the legislative instrument that gave that principle enforceable legal weight was gone.
The Online Safety Act 2023 addressed harmful content. The Digital Markets, Competition and Consumers Act 2024 addressed digital markets competition. The DMCCA received Royal Assent on 24 May 2024 â 41 months after the E-Commerce Directive ceased to apply. During those 41 months the UK had no specific legislative instrument requiring Google to act on notified fake business listings with the same force as the EU Directive had provided.
The 41-month vacuum â what happened during it
Between January 2021 and May 2024 the fake locksmith listing model accelerated significantly. Post-COVID shell company formations surged. Virtual office address registrations multiplied. VoIP number banks expanded to cover multiple London postcodes simultaneously. Astra Security pricing lists were adopted across the network as the standard overcharging mechanism. The model that locksmithscams.co.uk now documents across over 90 companies was largely built and consolidated during the period when the UK had no enforceable platform liability framework equivalent to what the E-Commerce Directive had provided.
31 December 2020
EU E-Commerce Directive ceases to apply to UK
The transition period ends. The E-Commerce Directive (2000/31/EC) â which required platforms to operate notice and takedown procedures for illegal content and established intermediary liability frameworks â no longer applies to the United Kingdom. The government publishes guidance on 5 January 2021 confirming this. Platforms operating in the UK no longer face EU-level obligations to act on notified illegal listings.
January 2021 â December 2021
Regulatory vacuum â no replacement legislation
The government commits to introducing a new Online Safety regulatory framework â but no legislation is introduced during 2021. Fake locksmith shell company registrations begin accelerating. The post-COVID surge of new company formations â many at virtual office addresses with misclassified SIC codes â begins in earnest. Google Maps fake locksmith listings proliferate with no enforceable UK legal instrument requiring their removal after notification.
25 August 2023
EU Digital Services Act â Very Large Online Platforms obligations begin
Google is designated a Very Large Online Platform and Very Large Online Search Engine under the EU Digital Services Act. From this date Google must conduct algorithmic risk assessments, publish transparency reports every six months, provide researchers with data access, and maintain notice and action mechanisms for illegal content â for EU users. UK users receive none of these protections.
25 April 2023
DMCCA Bill introduced to Parliament
The Digital Markets, Competition and Consumers Bill is introduced to Parliament â two years after the regulatory vacuum created by Brexit began. Over two years have passed since the E-Commerce Directive ceased to apply. The fake locksmith listing model has had two full years to entrench itself in the absence of an enforceable UK platform liability framework.
17 February 2024
EU Digital Services Act fully in force across all EU member states
The DSA comes into full force across all 27 EU member states. A consumer in Dublin, Paris, or Berlin searching Google Maps for a locksmith is now protected by algorithmic risk assessment obligations, transparency reporting requirements, and notice and action mechanisms. A consumer in London, Manchester, or Birmingham searching the same Google Maps has no equivalent protection.
24 May 2024
DMCCA 2024 receives Royal Assent
The Digital Markets, Competition and Consumers Act 2024 receives Royal Assent â 41 months after the EU E-Commerce Directive ceased to apply. The Act introduces the fake review criminal offence, the CMA conduct requirement powers, and the digital markets competition framework. It does not replicate the EU DSA's algorithmic risk assessment requirements, transparency reporting obligations, or researcher data access rights.
June 2026
CMA Fair Ranking Conduct Requirement imposed on Google
The CMA imposes a Fair Ranking Conduct Requirement on Google under the DMCCA 2024 â requiring Google to rank organic search and Maps results using objective non-discriminatory criteria. Compliance deadline December 2026. Every documented fake locksmith listing in the locksmithscams.co.uk database remains live at the point this requirement is imposed.
September 2026 â TODAY
Zero fake listings removed â 27 documented Place IDs all still live
A live Places API scan of the west London area confirms that zero fake locksmith listings have been removed despite months of reporting. All 27 documented Place IDs remain active on Google Maps. Four new fake listings are found during the scan that were not previously documented. The fair ranking requirement is in force. The fake review criminal offence is in force. Ten ASA rulings are outstanding. Not one listing has been removed.
The 41-month figure â December 2020 to May 2024 â covers only the gap between the E-Commerce Directive ceasing to apply and the DMCCA receiving Royal Assent. The actual period during which fake locksmith operators have operated without effective platform liability enforcement is significantly longer, because both the Online Safety Act 2023 and the DMCCA 2024 have taken years to implement after Royal Assent.
The Online Safety Act 2023 â still being implemented in 2026
The Online Safety Act received Royal Assent in October 2023. Ofcom took a phased implementation approach â illegal content duties did not come into force until March 2025. As of September 2026 Ofcom is still delivering final major components of the regime â the categorisation register, additional codes of practice for categorised services, and expanded transparency reporting requirements are all still being finalised throughout 2026 and into 2027.
The Online Safety Act does not directly address fake local business listings â it targets harmful content on user-to-user services and search. But the broader pattern is clear: the UK government has consistently passed legislation and then taken years to implement it, leaving a regulatory gap that fake operators have exploited throughout.
The real timeline â six years without effective enforcement
{desc}
From December 2020 to December 2026 is six years. Six years during which the fake locksmith listing model has operated in the UK without the platform liability enforcement framework that the EU E-Commerce Directive had provided. Six years during which the model scaled from dozens of shell companies to hundreds, from a west London problem to a national one, and from a consumer nuisance into what locksmithscams.co.uk documents as a coordinated criminal infrastructure involving money laundering, possible people trafficking, VAT fraud, and organised property access crime. The 41-month figure describes the legislative gap. The six-year figure describes the enforcement reality.
The most concrete illustration of the Brexit regulatory gap is the comparison between a consumer in Dublin and a consumer in London searching Google Maps for a locksmith in 2026.
Consumer in Dublin đŽđĒ
✓ EU Digital Services Act â full force since 17 Feb 2024
✓ Algorithmic risk assessment obligations on Google
✓ Transparency reports published every 6 months
✓ Notice and action mechanism with legal teeth
✓ EU Consumer Rights Directive pricing transparency
✓ Competition and Consumer Protection Commission enforcement
✓ Google faces fines up to 6% global turnover for DSA breaches
Consumer in London đŦđ§
✗ DMCCA 2024 â received Royal Assent 24 May 2024
✗ No algorithmic risk assessment requirement
✗ No mandatory transparency reporting on content moderation
✗ No researcher data access rights
✗ CMA Fair Ranking Conduct Requirement â December 2026 deadline
✗ Zero fake locksmith listings removed as of September 2026
✗ Google faces up to 10% global turnover for DMCCA breaches â untested
The DMCCA 2024 is the most significant reform to UK competition and consumer law in over a decade â described as the most significant since the establishment of the CMA in 2014 and its first major reform since the UK left the EU. It provides genuinely new tools. But it is not equivalent to the EU DSA.
Fake review criminal offence â April 2025
Commissioning, hosting, and publishing fake reviews is a criminal offence from April 2025 under the DMCCA. Every anonymous star-only rating on every fake locksmith listing is a potential criminal offence. No prosecution has yet been brought.
CMA conduct requirement powers
The CMA can impose conduct requirements on designated strategic market status firms â including Google. The Fair Ranking Conduct Requirement was imposed June 2026 with a December 2026 compliance deadline.
Financial penalties up to 10% global turnover
The CMA can fine Google up to 10% of global annual turnover for non-compliance with conduct requirements. This is the first time a UK regulator has had financial penalty powers of this scale against a digital platform.
No algorithmic risk assessment requirement
The EU DSA requires Very Large Online Platforms to conduct systemic risk assessments of their algorithms â specifically including risks of illegal content propagation. The DMCCA has no equivalent requirement. Google is not required to assess whether its Maps ranking algorithm systematically promotes fake local business listings.
No transparency reporting obligation
The EU DSA requires VLOPs to publish transparency reports every six months on content moderation decisions. The DMCCA has no equivalent. Google is not required to report how many fake locksmith listings were reported, investigated, or removed in any given period.
No researcher data access rights
The EU DSA gives vetted researchers access to platform data to study systemic risks. The DMCCA has no equivalent. Academic researchers and public interest investigators cannot compel Google to provide data on fake listing patterns, spam report volumes, or removal decisions.
No specific verification requirement for high-risk categories
Neither the DMCCA nor any secondary legislation requires Google to implement enhanced verification for locksmith listings â or any other high-risk local service category. The driving licence verification model proposed by locksmithscams.co.uk has no legislative basis compelling its implementation.
The DMCCA 2024 is a framework. It gives the CMA powers it did not previously have. But the specific provisions that would address the fake locksmith listing problem directly are not in it. The following additions â either through secondary legislation under the DMCCA or through a separate UK Digital Services Act equivalent â would close the gap.
Algorithmic risk assessment for local services categories
Google should be required to assess and report on whether its Maps ranking algorithm systematically promotes fake over genuine local business listings in high-risk categories â specifically locksmiths, plumbers, electricians, and similar emergency trades where consumer vulnerability is highest.
Enhanced verification requirement for high-risk categories
Secondary legislation under the DMCCA should specify that local business listings in high-risk categories must meet a verification standard equivalent to Google's own US Local Services Ads requirements â including insurance verification, identity verification, and for mobile trades, driving licence verification against DVLA.
Mandatory transparency reporting on spam and fake listing removal
Google should be required to publish quarterly data on the number of locksmith listings reported as fake, investigated, and removed â disaggregated by category and geography. This is already required of Google for EU users under the DSA. UK users should have equivalent transparency.
Personal liability for directors of personal service shell companies
Where the director of a limited company is also the operative who personally attends a consumer's home and personally takes payment â the corporate veil should not shield that individual from personal consumer protection liability. This requires primary legislation but would eliminate the dissolve-and-reincorporate cycle that defines the fake locksmith shell company model.
Payment account verification matching legal entity
Any business accepting card payments through a Google-verified local listing should be required to take payment through a bank account registered in the same legal entity name as the listing. This creates a traceable financial record and eliminates the cash payment and rapid international transfer model used to conceal fraud proceeds.
The December 2026 test
The CMA Fair Ranking Conduct Requirement compliance deadline is December 2026. locksmithscams.co.uk will conduct a live Places API scan of the documented fake listing network in December 2026 and compare against the September 2026 baseline â 27 Place IDs all still live. If those same listings remain live in December 2026 â the conduct requirement has produced procedural not outcome compliance. That comparison, published on this site, is the evidence that the DMCCA's first major test of Google compliance produced no measurable consumer protection outcome in the most acutely affected trade in the UK. That evidence will go to the CMA, to the NTS eCrime team, to the select committee, and to every journalist who has covered this issue.
locksmithscams.co.uk — independent public interest resource. Published September 2026. Legislative sources: EU E-Commerce Directive (2000/31/EC); UK government guidance published 5 January 2021 (gov.uk); DMCCA 2024 Royal Assent 24 May 2024 (legislation.gov.uk); EU Digital Services Act â entered into force November 2022, full application 17 February 2024, VLOPs obligations from 25 August 2023 (EU Commission). All dates verified from primary legislative sources. Regulatory failure article → Database →
🔒 Need a genuine locksmith? Find an MLA approved operator near you.
✓ Find MLA Approved Locksmith →