UK Online Safety Act: What It Means for Your Privacy

The UK Online Safety Act is one of the most sweeping pieces of internet regulation ever passed in Britain. It touches almost every service you use online — from social media and search engines to messaging apps, forums and even smaller user-to-user platforms. While the government has framed the Act as a child protection and anti-harm measure, it also has significant and sometimes uncomfortable implications for the privacy of ordinary adults.

This guide explains what the Online Safety Act actually does, how it affects your personal privacy in the UK, what has changed in practice during 2025 and 2026, and what you can realistically do to protect your data without breaking any rules.

What Is the UK Online Safety Act?

The UK Online Safety Act 2023 is a law that places legal duties on online services to prevent users — particularly children — from being exposed to illegal and harmful content. Ofcom is the designated regulator, with powers to issue codes of practice, demand information from platforms, and impose fines of up to £18 million or 10% of global annual turnover, whichever is higher.

In simple terms, the Act requires platforms to:

1. Assess the risks their services pose to users, especially children.
2. Remove illegal content quickly once they become aware of it.
3. Prevent children from encountering certain categories of legal-but-harmful content such as pornography, self-harm material and some violent content.
4. Enforce robust age assurance for services that host adult or restricted content.
5. Be transparent about moderation, reporting tools and risk assessments.

The duties were phased in through 2024, 2025 and into 2026, with age verification for adult sites and the full child safety codes among the most visible changes for everyday users.

Who Does the Act Apply To?

The scope is deliberately broad. The Act applies to any service with a "significant number of UK users" or that targets the UK market, regardless of where the company is based. That includes:

• Large social networks and video platforms.
• Search engines.
• Messaging and chat apps, including encrypted services.
• Adult content sites.
• Forums, community sites, dating apps and even some gaming platforms.
• Smaller user-to-user services, with lighter duties but still real obligations.

Why Privacy Advocates Are Concerned

On paper, protecting children online is uncontroversial. In practice, the mechanisms the Act relies on — age checks, content scanning and expanded data collection — raise serious privacy questions for every UK adult.

The three biggest areas of concern are:

1. Age assurance: New requirements that effectively force many sites to verify who is an adult, often by collecting ID, facial scans or financial information.
2. Message scanning powers: Clauses that allow Ofcom to require platforms to use "accredited technology" to detect illegal content, which critics argue could undermine end-to-end encryption.
3. Chilling effects on anonymity: Pressure on platforms to know more about their users, making genuinely anonymous participation harder.

Age Verification and Your ID

From 2025 onwards, UK users have increasingly been asked to prove their age before accessing adult content and some mainstream platforms. Depending on the service, this can involve:

• Uploading a photo of a passport or driving licence.
• Taking a selfie for a facial age estimation scan.
• Linking a credit card or mobile phone contract.
• Using a third-party digital identity provider.

Even when a reputable third party handles the check, you are still sharing more identifying information than ever before — and often with services you have no long-term relationship with. A leak, misconfiguration or hostile insider at an age verification provider could expose extremely sensitive data: not just who you are, but what you were trying to access.

Encrypted Messaging Under Pressure

Section 121 of the Act gives Ofcom the power to require services to use "accredited technology" to identify child sexual abuse material or terrorism content, including in private messages. The government has said this will only be used "where technically feasible", and major encrypted messaging apps have pushed back strongly.

Nothing in the Act repeals the right to use encryption, but the possibility of client-side scanning — where content is analysed on your device before it is encrypted — remains a live concern. For privacy-conscious users, the practical takeaway is that "private" messages on consumer platforms may not stay as private as they once were.

How the Online Safety Act Changes Your Day-to-Day Internet Use

Most UK users will notice the Act in small, cumulative ways rather than in one dramatic shift. Here are the most common changes already visible in 2026.

1. More Age Gates and ID Prompts

Adult sites now routinely demand verification. Some social platforms require age confirmation to see certain content or features. Expect this to spread to live streaming, dating and some gaming services.

2. Stricter Default Settings for Younger Users

Platforms are rolling out stronger default privacy settings for accounts that appear to belong to under-18s, restricting messaging, recommendations and content exposure. This is good for children but can also mean more intrusive age estimation for everyone.

3. More Aggressive Content Moderation

To avoid fines, platforms are tightening automated moderation. Legitimate posts about mental health, harm reduction, political protest or news reporting are sometimes caught in the net, which affects freedom of expression as well as privacy.

4. Smaller UK Platforms Closing or Geo-Blocking

Compliance is expensive. Some smaller forums and niche platforms have chosen to block UK users entirely rather than meet the obligations. The result is a slightly less diverse internet for British users and more concentration on a handful of large providers that can afford compliance teams.

Online Safety Act vs Other Privacy Laws

The Act does not replace existing privacy laws — it sits alongside them. Here is how it compares with the main frameworks UK users already live under.

Law	Main Goal	Regulator	Impact on You
UK GDPR	Protect personal data	ICO	Rights to access, delete and object to processing
Data Protection Act 2018	Implement GDPR in UK law	ICO	Legal basis for most privacy complaints
PECR	Regulate cookies and marketing	ICO	Cookie banners, consent for marketing emails
Online Safety Act 2023	Reduce online harm	Ofcom	Age checks, content moderation, risk duties
Investigatory Powers Act	Regulate state surveillance	IPCO	Government access to communications data

The crucial point is that the Online Safety Act increases the amount of data platforms hold about you, while UK GDPR is supposed to limit it. Where those two laws collide, users often end up with the worst of both worlds: more data collected "for safety", protected only as well as the platform chooses to protect it.

Pros and Cons of the Online Safety Act for Privacy

Pros

• Clearer legal duties on platforms to handle illegal content.
• Stronger protection for children from grooming, abuse material and harmful content.
• Better reporting and complaints tools on major services.
• Transparency reports that give researchers and journalists more insight.
• Pressure on platforms to improve default privacy settings for minors.

Cons

• Expanded identity collection via age assurance providers.
• Potential weakening of end-to-end encryption through scanning requirements.
• Over-moderation of legitimate speech, including health and political content.
• Smaller platforms blocked or shuttered, reducing choice.
• Centralisation of sensitive data in a few verification providers, creating attractive targets for attackers.

Practical Steps to Protect Your Privacy Under the Act

You cannot opt out of UK law, but you can be a more deliberate user. The following steps are legal, sensible and significantly reduce how much data you leak day to day.

1. Choose Age Verification Methods Carefully

When a service offers multiple options, pick the one that shares the least. Facial age estimation that is processed and immediately deleted is usually better than uploading a passport scan. Where possible, use a reputable third-party identity provider rather than giving ID directly to the end service.

2. Separate Identities for Separate Purposes

Use distinct email addresses — ideally with an alias service — for banking, shopping, social media and anything sensitive. If one platform is breached, the damage is contained. The same principle applies to usernames and profile photos.

3. Lock Down Browser and Device Settings

Use a privacy-focused browser, enable encrypted DNS (DNS over HTTPS), block third-party cookies, and keep your operating system updated. These basic hygiene steps do more for day-to-day privacy than most people realise.

4. Be Thoughtful About Links You Share

Links are a surprisingly rich source of personal information. Tracking parameters, referral tags and raw destination URLs can reveal where you shop, what services you use and even your approximate location. When sharing links publicly — on social media, in forums or in group chats — a privacy-respecting URL shortener like Lunyb can strip tracking parameters and give you a clean, neutral link. For a broader comparison of options, see our 2026 buyer's guide to URL shorteners and our honest review of Lunyb.

5. Exercise Your Data Rights

UK GDPR still gives you the right to request a copy of your data, correct it or ask for deletion. If a platform collected ID for age verification, you can ask what they still hold and request erasure where appropriate. The ICO publishes free templates for subject access requests.

6. Prefer Services With Strong Encryption and Minimal Data

Favour messaging apps that use end-to-end encryption by default, email providers that do not scan content for advertising, and cloud storage that offers zero-knowledge options. These do not make you invisible, but they drastically narrow the surface area of your digital life.

What Businesses and Website Owners Should Know

If you run a UK-facing website, forum, newsletter community or small platform, the Online Safety Act may apply to you even if you are not a tech giant. Key practical steps include:

1. Carry out an illegal content risk assessment and document it.
2. Provide clear reporting and complaints tools for users.
3. Review your terms of service to reflect your moderation approach.
4. If children can access your service, complete a children's access assessment.
5. Keep records — Ofcom can request information and expects evidence of compliance.

Marketing teams should also think about how they share links. Clean, trackable but privacy-respecting links are increasingly important both for compliance and user trust. Branded short links using tools like Lunyb or alternatives covered in our Rebrandly 2026 review can help you move away from messy tracking-heavy URLs without sacrificing analytics.

The Bigger Picture: Safety vs Privacy Is a False Choice

The dominant narrative around the Online Safety Act often frames it as safety versus privacy, as if protecting children must come at the cost of adult rights. In reality, well-designed privacy protections — strong encryption, data minimisation, independent oversight — tend to make everyone safer, including children. Mass data collection and weakened encryption create risks that outlast any single policy.

As a UK user, your best long-term strategy is to stay informed, use services that take data minimisation seriously, and push back politely but firmly when you are asked for more information than a service needs. The Act is now the law of the land, but how it is implemented is still being shaped by regulators, courts, journalists and users like you.

FAQ: UK Online Safety Act and Your Privacy

Does the UK Online Safety Act require me to share my ID online?

Not for every site, but for adult content and some restricted services you will typically need to prove your age. You can often choose between methods such as facial age estimation, credit card checks or ID upload, so pick the one that shares the least data and uses a reputable provider.

Will the Act break end-to-end encryption in messaging apps?

The Act does not ban encryption, but it gives Ofcom powers to require scanning technology "where technically feasible". Major encrypted messaging providers have strongly resisted client-side scanning. For now, end-to-end encryption remains available, but the policy debate is ongoing.

Can I be fined under the Online Safety Act as an individual user?

The Act's fines are aimed at platforms, not ordinary users. However, certain new communications offences — such as sending threatening messages or false information intended to cause harm — can carry criminal penalties for individuals, so normal common sense online still applies.

How does the Act interact with UK GDPR?

Both laws apply at the same time. Platforms must meet their Online Safety Act duties without breaching data protection law. In practice, you can still use your GDPR rights to ask what data a platform holds about you, including anything collected during age verification.

What is the single most effective step I can take to protect my privacy?

There is no single magic bullet, but using a privacy-respecting browser with encrypted DNS, separate email aliases for different services, strong unique passwords with a password manager, and clean shareable links through a trustworthy URL shortener will put you ahead of the vast majority of UK users.