UK Online Safety Act: What It Means for Your Privacy

The UK Online Safety Act is one of the most ambitious internet regulations ever passed in Britain. It aims to make the UK "the safest place in the world to be online" — but critics argue it also reshapes the relationship between citizens, platforms and the state in ways that could weaken personal privacy. If you live in the UK, use social media, send private messages or run a website, this law affects you.

This guide explains what the Online Safety Act actually does, how Ofcom is enforcing it, what it means for encrypted messaging and age verification, and the practical steps you can take to protect your privacy without breaking the law.

What Is the UK Online Safety Act?

The Online Safety Act 2023 is a UK law that places legal duties on online platforms to protect users — especially children — from illegal and harmful content. It received Royal Assent in October 2023 and is being rolled out in phases by the regulator Ofcom through 2025 and 2026.

In practical terms, the Act requires in-scope services to:

1. Carry out risk assessments for illegal content and (where relevant) content harmful to children.
2. Put systems in place to detect, remove and reduce exposure to such content.
3. Use "highly effective" age assurance where adult content is accessible.
4. Publish transparency reports and cooperate with Ofcom investigations.
5. Give users clearer tools to report content and appeal moderation decisions.

The law covers a huge range of services: social networks, search engines, messaging apps, forums, dating sites, pornography sites, cloud file-sharing tools, and even small community platforms. Fines can reach £18 million or 10% of global annual turnover — whichever is higher — and senior managers can face criminal liability in certain cases.

Who Does It Apply To?

The Act has extraterritorial reach. A service based anywhere in the world falls in scope if it has a significant number of UK users, targets the UK market, or can be accessed from the UK and poses a material risk of harm. That means American, European and Asian platforms must comply too — or face enforcement action and potential blocking.

Why Privacy Advocates Are Worried

On the surface, few people oppose the goals of the Act: reducing child sexual abuse material, terrorist content, fraud and self-harm promotion are uncontroversial aims. The concerns centre on how the law achieves them, and the knock-on effects for everyday users.

1. The Encryption Question

The most contested provision is Section 121, which gives Ofcom the power to require services to use "accredited technology" to identify illegal content — including in private messages. End-to-end encryption, used by WhatsApp, Signal, iMessage and others, means not even the provider can read the contents of a message. Scanning messages would, by definition, break or weaken that protection.

The UK government has said the power will only be used when it is "technically feasible" to do so without undermining privacy. Technologists, from Cambridge academics to the companies themselves, argue that no such technology currently exists. Signal and WhatsApp have both indicated they would withdraw from the UK rather than compromise their encryption.

2. Age Verification and Identity Data

From July 2025, sites hosting pornography or other adult content accessible in the UK must use "highly effective" age assurance. In practice, this means uploading ID documents, performing a facial age estimation scan, verifying a credit card, or using a digital identity wallet.

Even if those checks are performed by a third party, you are still handing sensitive data — your face, your passport, your card — to a commercial provider in order to browse perfectly legal content. A breach or misuse could link your real identity to intimate browsing history.

3. Over-removal and Chilling Effects

Faced with enormous fines, platforms have a strong incentive to over-moderate. Automated filters are blunt instruments: harm-reduction resources, LGBTQ+ content, journalism about war crimes, and political speech have all been incorrectly flagged by similar systems elsewhere. Users may find legitimate posts removed with limited recourse.

4. Reduced Anonymity

The Act doesn't ban anonymous accounts, but Category 1 services (the largest platforms) must offer users tools to verify their identity and to filter out non-verified accounts. Combined with age checks, the long-term direction of travel is a web where more of your behaviour is tied to a verified real-world identity.

How the Act Is Being Enforced

Ofcom is the regulator. Enforcement is being phased in, roughly as follows:

Phase	Focus	Approximate Timing
Phase 1	Illegal content duties — risk assessments and safety measures	Live from March 2025
Phase 2	Child safety duties and age assurance for adult content	From July 2025
Phase 3	Transparency, user empowerment and Category 1 duties	Rolling through 2026

Ofcom has already opened investigations into file-sharing sites, adult platforms and smaller forums that have failed to engage with the new duties. Several non-compliant sites have geoblocked UK users entirely rather than invest in compliance.

What It Means for Everyday Users

If you're a regular internet user in the UK, you'll notice the Act in several concrete ways.

More Age Gates

Expect to be asked to verify your age not just on adult sites, but on social platforms where adult content may appear, dating apps, some gaming services and alcohol or gambling sites. Methods will vary from facial age estimation (your webcam) to credit card checks to government-backed digital ID.

Different Default Settings

Platforms are tightening defaults for users who appear to be under 18: private accounts, restricted DMs, reduced algorithmic amplification of risky content, and stricter filters. Even adults may find default feeds tamer than before.

Some Services Leaving the UK

A number of smaller forums, niche adult sites and privacy-focused services have already blocked UK visitors. Expect this to continue — the compliance burden is heavy, and for a modest site, UK traffic simply may not be worth the legal risk.

More Data About You, Held in More Places

This is the central privacy paradox. A law intended to make users safer requires platforms and third-party verifiers to collect more sensitive personal data — ID documents, biometrics, payment credentials — than ever before. Each new database is a potential breach target.

Pros and Cons of the Online Safety Act

Pros

• Clear legal duties on platforms to tackle illegal content, including CSAM and terrorism.
• Stronger protections and defaults for children online.
• Better reporting, appeals and transparency from large platforms.
• Criminalises new harms such as cyberflashing and intimate image abuse.
• Puts a well-resourced regulator (Ofcom) in charge of enforcement.

Cons

• Potential to weaken end-to-end encryption if scanning powers are activated.
• Age-verification systems create new honeypots of sensitive identity data.
• Risk of over-moderation and removal of lawful speech.
• Compliance burden pushes smaller services to geoblock UK users, reducing choice.
• Erosion of pseudonymity, which many vulnerable users rely on.

How to Protect Your Privacy Under the New Regime

You don't need to be an activist or a journalist to want sensible privacy hygiene. Here are practical steps that are fully lawful and increasingly important under the Online Safety Act.

1. Use encrypted messaging apps. Signal, WhatsApp and iMessage remain legal to use in the UK. Encrypted messaging protects your conversations from criminals and casual data collection, regardless of future regulatory debates.
2. Prefer privacy-respecting age verification. Where you must verify, choose providers that use "double-blind" systems — the site doesn't learn your identity, and the verifier doesn't learn which site you visited. Avoid uploading passport scans to unknown operators.
3. Lock down your browser. Use a privacy-focused browser (Firefox, Brave or Safari with strict tracking protection). Enable encrypted DNS (DNS-over-HTTPS) in your browser or operating system to prevent your ISP from logging every domain you visit.
4. Separate identities. Use different email addresses for sensitive accounts, your public social media, and routine shopping. Services like Apple's Hide My Email or SimpleLogin make this easy.
5. Be deliberate about what you share. The best data protection is data minimisation. Don't fill in optional profile fields. Don't link accounts unnecessarily. Review app permissions regularly.
6. Shorten and control the links you share. When you post links in public forums, a trustworthy link shortener lets you track performance, rotate destinations and avoid leaking tracking parameters from the original URL. If you want a UK-friendly option, Lunyb is a privacy-conscious URL shortener — our honest review explains how it compares to alternatives like Rebrandly, and our 2026 buyer's guide covers the wider market.
7. Keep software updated. Most real-world compromises exploit outdated browsers and operating systems, not sophisticated attacks. Automatic updates are your friend.
8. Use strong, unique passwords and 2FA. A password manager plus app-based two-factor authentication massively reduces the damage of any single data breach — including breaches at age-verification providers.

What Website Owners and Small Publishers Need to Do

If you run a UK-accessible service that allows user-generated content — even a hobby forum or a Discord-linked community site — you may be in scope. A proportionate compliance checklist looks like this:

1. Decide whether your service is "user-to-user" or "search" under the Act.
2. Carry out and document an illegal content risk assessment using Ofcom's templates.
3. Appoint a responsible person and record your governance.
4. Publish clear terms of service covering illegal content and enforcement.
5. Offer accessible reporting and appeals mechanisms.
6. If children can access your service, complete a children's access assessment and, if needed, a children's risk assessment.
7. Keep records — Ofcom can request them.

Ofcom has signalled a proportionate approach for small, low-risk services, but "small" does not mean "exempt". Ignoring the Act entirely is the single biggest mistake a UK site operator can make in 2026.

The Bigger Picture: Safety vs. Privacy

The Online Safety Act reflects a genuinely hard trade-off. Online harms are real: children have been groomed, people have been defrauded, and extremist content has radicalised attackers. Doing nothing was not a serious option.

At the same time, privacy is not a luxury. It protects abuse survivors, whistleblowers, LGBTQ+ people in hostile environments, journalists, activists and ordinary citizens from a future government they did not vote for. A regime that normalises mass identity checks and pressures platforms to weaken encryption has costs that will take years to fully understand.

The sensible response, as a user, is neither panic nor complacency. Understand the law, use the tools available to minimise the data you expose, support services that take privacy seriously, and engage with the ongoing public debate about how the Act is implemented.

Frequently Asked Questions

Does the Online Safety Act ban end-to-end encryption?

No. The Act does not ban encryption, and the government has said it will not require providers to break it until it is "technically feasible" to scan content without undermining privacy. However, the power to require scanning exists in the law, which is why services like Signal have said they would leave the UK rather than comply.

Do I have to verify my age to use social media in the UK?

Not necessarily on every platform, but any service that allows adult content or poses significant risk to children must use "highly effective" age assurance. In practice, expect to encounter more age checks across mainstream platforms, especially if your account behaviour suggests you might be under 18.

Is it legal to use privacy tools in the UK?

Yes. Encrypted messengers, private browsers, encrypted DNS, password managers and privacy-focused email services are all legal to use. The Online Safety Act regulates platforms and services, not the individual user's choice of privacy tools.

What happens if a platform ignores the Online Safety Act?

Ofcom can issue fines of up to £18 million or 10% of global annual turnover, require business disruption measures (including asking UK ISPs to block the service), and in some cases pursue criminal liability against senior managers. Several non-compliant adult sites have already geoblocked UK users as a result.

How does the Online Safety Act interact with UK GDPR?

Both laws apply. Platforms must meet their Online Safety Act duties and continue to comply with UK GDPR when processing personal data, including any data collected for age assurance. The Information Commissioner's Office and Ofcom are coordinating guidance, but tension between the two regimes — particularly around biometric age estimation — is an ongoing area of debate.