Read these messages one at a time.
"What games are you into?"
"You're so much more mature than people your age."
"Is your mum still at work?"
"You can tell me anything. I'm not like the others."
"Let's talk on another app, this one's rubbish."
"Don't tell anyone about us. They wouldn't understand."
On its own, nothing here would trip a word filter. There is no explicit content, no slur, no threat. Yet anyone who has worked in safeguarding sees the pattern straight away. Rapport, flattery, a check on supervision, a claim of a special bond, a move to a more private channel, then secrecy. Each message is harmless on its face. Together they are the structure of grooming.
That is the central problem for anyone building online safety systems. Grooming is not a word. It is a process, and detection has to work at the level where the harm actually happens.
What the research has told us for two decades The idea that grooming moves through recognisable phases is not new. Rachel O'Connell's 2003 work at the University of Central Lancashire was among the first systematic analyses of online grooming conversations. It identified stages including friendship forming, relationship forming, risk assessment, exclusivity and a sexual stage (Whittle et al., 2013; Swansea University repository). In the risk assessment stage, the offender tries to work out how likely the contact is to be discovered by a parent, carer or older sibling.
Later work refined the picture in an important way. Lorenzo-Dus and colleagues, analysing groomer chat logs, argued that online grooming is not a neat, linear journey from befriending to abuse. Instead, groomers activate a "communicative entrapment network" of overlapping, non-sequential strategies: deceptive trust development, compliance testing, isolation and sexual gratification. These sit between first access to the child and any attempt at offline approach (Lorenzo-Dus et al., summarised in Journal of Corpora and Discourse Studies). Isolation, for example, includes asking to talk privately, checking the child is unsupervised and telling them to delete their messages (Swansea University repository).
So the research gives us two things at once. There is a recognisable architecture to grooming, and that architecture is flexible. Stages overlap, repeat and run in parallel.
It can happen fast The second thing the evidence tells us is that online grooming can move very quickly. In an analysis of 100 decoy chat transcripts, Winters, Kaylor and Jeglic found that around two thirds of offenders introduced sexual content within the first 30 minutes of conversation (Winters et al., 2017, as reported in a critical systematic review), and that offenders typically moved to attempt offline contact within about three days. A more recent field experiment using honeypot chatbots in online chatrooms recorded an average of 16 minutes between first contact and the introduction of sexual content (Justice Quarterly, 2023).
The Tech Coalition's industry guidance puts it plainly. Progression is not always linear, grooming can begin or end at any stage, and it "can last anywhere from minutes to months" (Tech Coalition, 2022).
This matters for design. A system that waits for explicit content is, in many cases, a system that intervenes after the most important prevention window has already closed.
Why keyword filtering fails Keyword lists are the default safety tool because they are cheap, explainable and easy to deploy. They also fail in both directions.
They produce false positives because they look for exact text without context. They produce false negatives because offenders adapt. The Tech Coalition notes that a filter looking for "12 year old" may miss "12yo", and that fast-changing slang means keyword lists need constant updating to stay relevant (Tech Coalition, 2022).
There is a deeper problem. Most of the work of grooming is done in language that is ordinary. Compliments. Questions about school. Sympathy about a row with a parent. A filter tuned to catch the sexual stage will, by design, ignore the stages that come before it, which are precisely the stages where a child can still be protected before abuse occurs.
Platform switching compounds this. Perpetrators may make first contact in a public or semi-public space, such as a gaming stream or a public post, then move the child into direct messages or onto an encrypted service as the relationship develops (Tech Coalition, 2022). The request to move is itself a signal. On a word list, it is invisible.
The scale of the problem The UK data are a reminder that this is not a niche risk. Figures compiled by the NSPCC from 44 UK police forces show 7,263 Sexual Communication with a Child offences recorded in 2024/25, a record high (Bedford Independent, reporting NSPCC data). In the South West alone, these offences have more than doubled since the offence was introduced, and Snapchat was mentioned in 324 Childline counselling sessions about online sexual abuse between April 2025 and March 2026, a 19% increase on the previous year (BBC News).
Recorded crime is, of course, the visible fraction. Much of this abuse happens in private spaces and is never reported.
The sequence is the signal Routine activity theory tells us that harm occurs when a motivated offender and a suitable target come together in the absence of a capable guardian. Online, the platform is in the best position to act as that guardian, because it is the only actor that can see the interaction as it unfolds.
But guardianship only works if it operates at the same level as the offending. If grooming is a sequence, then the guardian has to be able to see sequences. A guardian who only notices the final, explicit act is not really guarding. They are recording.
Situational crime prevention adds a second insight. Every stage of the grooming process is also an opportunity to intervene. Risk assessment questions ("who else is home?"), isolation moves ("let's go to another app") and secrecy requests ("don't tell anyone") are moments when friction, a prompt to the child or a human review could break the chain. A process with many steps is a process with many points of failure, for the offender as much as for us.
What sequence-aware safety looks like For platforms, regulators and safety teams, this points to a practical agenda.
- Safe defaults that remove opportunity. Ofcom's illegal content codes already move in this direction. They mean that, by default, children's profiles, locations and connections are not visible to other users, children are not suggested as connections, and accounts children are not connected to cannot send them direct messages (Ofcom). These measures make it harder to reach the first stage at all.
- Conversation-level, not message-level, detection. Risk should be assessed across a conversation and over time, looking at the combination and order of behaviours: personal information gathering, flattery, supervision checks, exclusivity, requests to move platform, secrecy and escalation. Research on grooming detection increasingly models conversations as sequences of messages rather than isolated lines of text (Osprey reference framework, CIKM 2024).
- Detection built for both speed profiles. Because some offenders escalate within minutes and others over months, systems need to catch rapid "blitz" escalation and slow-burn relationship building. One time window will not do both.
- Human judgement in the loop. The Tech Coalition is clear that even where classifiers flag potential grooming, trained human reviewers are still needed to interpret context (Tech Coalition, 2022).
- Proportionate, staged responses. Not every signal warrants a ban or a law-enforcement referral. Early-stage signals might trigger a supportive prompt to the child, added friction on a contact request or a block on moving to another channel. Ofcom has also proposed supportive prompts for child users at key moments, such as receiving a first message from a new user (Ofcom).
- Accuracy and privacy as safety requirements. False positives are not a technical footnote. The ICO has emphasised the importance of minimising false-positive reporting to law enforcement in grooming and CSAM detection (ICO). A system that cries wolf erodes trust, wastes investigative capacity and can harm the young people it flags.
The limits of what we know Some honesty about the evidence is needed. Much of the foundational research on grooming stages comes from transcripts in which adult volunteers or researchers posed as children, rather than from conversations with real children. Those transcripts tell us a great deal about offender strategy, but less about how children respond or how often grooming attempts fail. Researchers also debate whether very fast, direct sexual solicitation is grooming at all, since recognisable grooming strategies are sometimes absent (University of Turku). From a prevention standpoint, the distinction matters less than the conclusion: systems must be able to detect both patterns.
Stage models are tools for recognising risk, not scripts that every offender follows. Treating them as rigid checklists would simply replace one brittle filter with another.
The question to ask of any safety system If you run a platform where children talk to people they have not met offline, the question is not "do we filter for harmful words?" It is "could we recognise the shape of a grooming conversation before it reaches the point of abuse, and do we have a proportionate way to step in when we do?"
Grooming is a sequence. Our safeguards need to be too.
References BBC News (2026) Snapchat and Instagram grooming becoming "easier". https://www.bbc.co.uk/news/articles/cq33xd6j1dv5o Bedford Independent (2025) NSPCC calls for urgent action as online grooming cases double across East of England. https://www.bedfordindependent.co.uk/nspcc-calls-for-urgent-action-as-online-grooming-cases-double-across-east-of-england/ Information Commissioner's Office (2025) ICO response to Ofcom's additional safety measures consultation. https://ico.org.uk/media2/yb5drmre/ofcom-additional-measures-response-ico.pdf Lorenzo-Dus, N. et al. (2016) Online Grooming Discourse Model, as discussed in Journal of Corpora and Discourse Studies (2019), 2, 14–39. https://orca.cardiff.ac.uk/id/eprint/124676/1/jcads_2_1_2019_jcads.31.pdf O'Connell, R. (2003) Cyberspace Research Unit, University of Central Lancashire. Stage model as summarised in Whittle et al. (2013). Ofcom (2024) Protecting people from illegal harms online: overview. https://www.ofcom.org.uk/siteassets/resources/documents/online-safety/information-for-industry/illegal-harms/overview.pdf?v=387529 Ofcom, Tackling child sexual abuse under the online safety regime. https://www.ofcom.org.uk/online-safety/protecting-children/tackling-child-sexual-abuse-under-the-online-safety-regime Osprey: A reference framework for online grooming detection via neural models and conversation features (CIKM 2024). https://hosseinfani.github.io/res/papers/2024_CIKM_Osprey_A_Reference_Framework_for_Online_Grooming_Detection_via_Neural_Models_and_Conversation_Features.pdf Tech Coalition (2022) Online Grooming: Considerations for Detection, Response, and Prevention of Online Grooming. https://paragonn-cdn.nyc3.cdn.digitaloceanspaces.com/technologycoalition.org/uploads/Research-Paper-Online-Grooming-Considerations-for-Detection-Response-and-Prevention-of-Online-Grooming.pdf Justice Quarterly (2023) The relevance of targets' sexual knowledge in the progression of online sexual grooming events: findings from an online field experiment. https://www.tandfonline.com/doi/full/10.1080/07418825.2023.2241540 Whittle, H., Hamilton-Giachritsis, C., Beech, A. and Collings, G. (2013) A review of online grooming: characteristics and concerns. Aggression and Violent Behavior, 18(1), 62–70. https://purehost.bath.ac.uk/ws/files/145648608/Whittle_et_al_2013_Grooming_final_text_jan_2013.pdf Winters, G. M., Kaylor, L. E. and Jeglic, E. L. (2017) Sexual offenders contacting children online: an examination of transcripts of sexual grooming. Journal of Sexual Aggression, 23(1), 62–76. https://doi.org/10.1080/13552600.2016.1271146 Crossing the line: a critical systematic review of escalation crossover offending in online child sexual exploitation. https://pmc.ncbi.nlm.nih.gov/articles/PMC13578674/ University of Turku, Adolescents' disclosure of online sexual grooming. https://www.utupub.fi/server/api/core/bitstreams/5c17330b-df2a-4131-8992-c034c00ec810/content