UK Online Safety Act: What It Means for Your Privacy

The UK Online Safety Act is one of the most significant pieces of internet regulation Britain has ever passed. It promises to make the web safer, particularly for children, but critics warn it may also reshape how private your online life really is. If you use social media, messaging apps, forums, search engines or even a link shortener, this law touches you.

This guide breaks down the Online Safety Act in plain English, explains what it means for your privacy in practical terms, and shows what you can do to stay in control of your personal data.

What Is the UK Online Safety Act?

The UK Online Safety Act 2023 is a law that places legal duties on online platforms to protect users — especially children — from illegal and harmful content. It is enforced by Ofcom, which can issue fines of up to £18 million or 10% of a company's global turnover, whichever is higher.

The Act applies to a huge range of services: social networks, search engines, messaging platforms, dating apps, pornography sites, file-sharing services, gaming platforms and many user-to-user services with a link to the UK. If your users are in Britain, the law almost certainly applies to you — regardless of where your company is based.

The Core Duties Platforms Must Follow

1. Remove illegal content such as terrorism, child sexual abuse material, fraud and intimate image abuse.
2. Protect children from content that is legal but harmful to minors, including pornography, self-harm promotion and extreme violence.
3. Enforce age limits through "highly effective" age assurance where relevant.
4. Be transparent about moderation, risks and complaints handling.
5. Give adults more control over the content they see on the largest platforms (so-called "Category 1" services).

Why the Online Safety Act Is a Privacy Issue

Safety and privacy are not opposites, but regulating one almost always affects the other. The Online Safety Act expands what platforms must know about you, what they must scan, and how long they must retain certain data. That shifts the balance between user privacy and platform oversight.

There are three main pressure points where the Act bumps up against your privacy: age verification, content scanning, and data retention.

1. Age Verification and Identity Checks

To stop under-18s accessing adult material and some risky features, many platforms must now use "highly effective age assurance". In practice, that can mean:

• Uploading a photo of a passport, driving licence or other ID.
• Submitting a selfie for facial age estimation.
• Linking a bank account, mobile contract or credit reference profile.
• Using a third-party digital identity provider.

Even when the age check is handled by a separate provider, you are still handing over sensitive personal data to extra parties. More touchpoints mean more potential for breaches, misuse or profile building.

2. Content Scanning and End-to-End Encryption

One of the most debated parts of the Act is the power for Ofcom to require platforms to use "accredited technology" to detect child sexual abuse material and terrorism content, including in private messages. The government has said this power will only be used when "technically feasible", but the wording still sits uneasily with end-to-end encryption.

Services like Signal and WhatsApp warned they would rather withdraw from the UK than weaken their encryption. For you as a user, the key point is this: if client-side scanning is ever rolled out, it would mean messages are checked on your device before being sent, even when the chat is encrypted. That is a fundamental shift in what "private messaging" means.

3. More Data Retained for Longer

To prove they are meeting their duties, platforms must keep records: risk assessments, moderation logs, reports, appeals and in some cases evidence relating to specific users. This extra retention increases the amount of data about you that sits on company servers, which in turn increases exposure if that company is ever breached.

What Changes for You as a UK Internet User

The Act rolls out in phases, but the effects are already visible. Here is what everyday browsing in the UK looks like under the new rules.

Adult Sites and Age Gates

Pornography sites accessible from the UK must verify that users are 18 or over using robust methods, not just a tick-box. Expect to see ID checks, facial age estimation or digital wallet logins. Some sites may geoblock the UK entirely rather than comply.

Social Media and Search

Large social platforms must offer adults tools to filter out legal-but-unwanted content such as abuse, self-harm material or content from unverified accounts. Search engines must reduce the visibility of illegal content and provide crisis prevention information for certain sensitive queries.

Messaging Apps and Forums

Smaller community forums, Discord servers and niche messaging platforms also fall under the Act if they have UK users and allow user-to-user content. Many hobbyist sites have closed UK access rather than face compliance costs — an unintended consequence that has shrunk parts of the independent web.

Links, Shorteners and Redirects

Link shorteners and redirect services sit in an interesting position. They do not host content themselves, but they can be used to disguise destinations. Reputable shorteners already block malware, phishing and illegal material. If you run campaigns or share links professionally, using a trustworthy, UK-friendly tool like Lunyb helps make sure your links are not flagged, broken or caught up in overzealous filtering. You can read our honest review of Lunyb for more on how it handles safety and privacy.

The Privacy Trade-Offs in a Simple Table

Area	Safety Benefit	Privacy Cost
Age verification	Keeps children off adult platforms	Adults share ID, biometrics or bank data with more parties
Content scanning	Faster detection of illegal material	Pressure on end-to-end encryption and private messaging
Transparency reports	Better oversight of big tech	More user data logged and retained
User empowerment tools	More control over your feed	Platforms learn even more about your preferences
Platform geoblocking	Removes risky foreign sites	Shrinks independent and niche UK web

How the Online Safety Act Interacts With UK GDPR

The Act does not replace UK GDPR or the Data Protection Act 2018 — it sits alongside them. Platforms must still have a lawful basis for processing your data, minimise what they collect, and respect your rights to access, correct and delete information.

In practice, that means:

• Age assurance providers must process ID data only for age checking, not for marketing or profiling.
• Platforms should not retain verification data longer than necessary.
• You can still submit a Subject Access Request to see what a service holds about you.
• You can complain to the ICO if you believe your data has been misused during a safety process.

The Information Commissioner's Office has published guidance encouraging platforms to pick the least privacy-invasive age assurance that still meets the "highly effective" bar. In theory, a reusable digital ID or anonymous token should be preferred to uploading your passport to every adult site you visit.

Practical Steps to Protect Your Privacy Under the Act

You cannot opt out of UK law, but you can be smarter about how you interact with regulated services. Here is a practical checklist for staying private.

1. Choose Privacy-Respecting Age Assurance

When a site offers several age-check options, look for:

• Providers certified under the UK digital identity trust framework.
• Options that return only a yes/no age signal, not your full ID.
• Reusable digital ID wallets so you verify once, not everywhere.
• Clear statements that biometric or ID data is deleted after checking.

2. Lock Down Your Browser and DNS

Use a privacy-focused browser such as Firefox or Brave, enable tracking protection, and consider encrypted DNS (DNS-over-HTTPS) to stop your internet provider seeing every domain you visit. These tools do not help you dodge the law, but they reduce background surveillance that has nothing to do with online safety.

3. Review Your Social Media Safety Settings

Large platforms must now offer adult user empowerment tools. Go into your settings and:

1. Turn on filters for abusive and hateful content if you want them.
2. Restrict messages from unverified accounts.
3. Opt out of personalised recommendations where possible.
4. Disable off-platform activity tracking.

4. Be Careful What You Share in "Private" Chats

End-to-end encryption remains strong on major messengers today, but the regulatory climate is uncertain. Treat anything you type as something that could, in the worst case, be scanned on your device. Share truly sensitive material sparingly and through services with strong transparency reports.

5. Use Trusted Tools for Links and Sharing

If you share a lot of links — for work, newsletters, or communities — pick a shortener that actively blocks malicious destinations and respects user data. Our 2026 buyer's guide to URL shorteners compares the main options, and our Rebrandly review looks at a popular branded-link alternative.

What the Act Means for Businesses and Creators

If you run a UK-facing website, community or app with any user-generated content — comments, uploads, DMs, reviews — the Online Safety Act likely applies. Even small platforms have duties, though they are proportionate to size and risk.

Key Compliance Steps

1. Carry out an illegal content risk assessment (and a children's access assessment if relevant).
2. Update terms of service to explain moderation and reporting.
3. Implement easy-to-find reporting and appeals tools.
4. Keep records of risk assessments and major moderation decisions.
5. Appoint someone responsible for Online Safety Act compliance.

For creators, the practical impact is that any platform you post on will moderate more aggressively. Expect faster takedowns, more appeals processes, and more friction when sharing content that touches on sensitive topics, even when it is entirely lawful.

Criticism and Ongoing Debate

The Online Safety Act has supporters and critics, and both sides have fair points.

Pros

• Stronger protections for children online.
• Clear legal duties for platforms that previously self-policed.
• A single UK regulator (Ofcom) with real enforcement powers.
• More transparency about how big platforms moderate.

Cons

• Potential pressure on end-to-end encryption and private messaging.
• More personal data flowing through age assurance systems.
• Smaller platforms may close UK access due to compliance costs.
• Risk of over-moderation and lawful speech being removed.
• Ambiguity around "legal but harmful" content for children.

Expect the law to keep evolving as Ofcom publishes further codes of practice and as courts interpret key terms. Privacy campaigners, child safety groups and industry bodies will all keep pushing for changes.

FAQ

Does the UK Online Safety Act apply to foreign websites?

Yes. The Act has extraterritorial reach. Any user-to-user or search service with a significant number of UK users, or that targets the UK market, falls within scope — even if the company has no office in Britain. Ofcom can fine non-UK companies and, in serious cases, seek business disruption measures.

Will I have to upload my passport to use social media?

Not for general use of mainstream social media, no. Robust age assurance is mainly required for adult content and for features that are high-risk for children. Mainstream platforms may use lighter methods such as age estimation or account signals. However, you may be asked to verify your age to unlock certain features or sections.

Does the Act break end-to-end encryption?

Not directly. The Act does not ban encryption, but it gives Ofcom the power to require "accredited technology" for scanning certain illegal content, which could in theory include client-side scanning. The government has said this will only be used where technically feasible, and so far no such notice has been issued. Major messaging apps remain end-to-end encrypted for now.

Can I be fined or prosecuted as an individual user?

The Act mainly targets platforms, not ordinary users. However, it also created or strengthened some user-facing offences, such as sending threatening communications, cyberflashing and sharing intimate images without consent. Normal lawful use of the internet is not criminalised by the Act.

How can I complain if I think a platform has mishandled my data?

Start with the platform's own complaints process, which the Act requires them to make accessible. If that fails, you can escalate privacy issues to the Information Commissioner's Office (ICO) and online safety issues to Ofcom. For age assurance providers certified under the UK digital identity trust framework, you can also complain to the certifying body.

Final Thoughts

The UK Online Safety Act is a serious attempt to make the internet less harmful, especially for young people. But it also quietly changes the privacy settings of British internet life: more verification, more scanning pressure, more retained data. Understanding the trade-offs is the first step to staying in control.

Pick privacy-respecting age assurance when you have the choice, lock down your browser and DNS, review your social media settings, and use trusted tools for sharing links and content. The law sets the floor — your own habits decide how private your online life actually is.