UK Online Safety Act: What It Means for Your Privacy in 2026

The UK Online Safety Act is one of the most sweeping pieces of internet legislation the country has ever passed. Marketed as a way to protect children and remove illegal content, it also introduces obligations on tech companies that have significant implications for the privacy of everyday users. If you send messages, share links, browse forums, or run a small online community, this law affects you.

This guide breaks down what the Act actually does, how it changes the way platforms handle your data, and the practical steps you can take to protect your privacy under the new rules.

What Is the UK Online Safety Act?

The UK Online Safety Act is a 2023 law that places a legal duty of care on online platforms operating in the United Kingdom to prevent users from being exposed to illegal or harmful content. It is enforced by Ofcom, the UK's communications regulator, which now has powers to fine companies up to £18 million or 10% of global annual turnover — whichever is greater.

The Act applies to a huge range of services: social media platforms, search engines, messaging apps, cloud file-sharing tools, adult sites, forums, dating apps, and even smaller user-to-user services. If your website hosts user-generated content and is accessible in the UK, the law likely applies to you.

Key Objectives of the Act

Protect children from pornography, self-harm content, and cyberbullying.
Remove illegal content such as terrorism, child sexual abuse material (CSAM), fraud, and hate speech.
Increase transparency around how platforms moderate content and handle complaints.
Enforce age verification on sites that host adult material.
Give Ofcom regulatory teeth to fine, block, or prosecute non-compliant platforms.

Why the Online Safety Act Raises Privacy Concerns

While the Act's goals are widely supported, the way it achieves them has drawn sharp criticism from privacy advocates, security researchers, and digital rights organisations such as the Open Rights Group and Electronic Frontier Foundation. The core tension is simple: the more platforms are forced to scan, verify, and monitor users, the less private their services become.

1. The Threat to End-to-End Encryption

Section 122 of the Act gives Ofcom the power to require messaging services to use "accredited technology" to identify illegal content — including inside end-to-end encrypted (E2EE) chats. This is the most controversial part of the law. Companies like Signal, WhatsApp, and Apple's iMessage have publicly stated they would rather withdraw from the UK than break encryption for their users.

The problem is technical: you cannot scan encrypted messages without either weakening the encryption or installing scanning software on the user's device (known as client-side scanning). Both approaches create vulnerabilities that criminals, hostile governments, or hackers could exploit.

2. Mandatory Age Verification

Sites hosting adult content must now verify users are 18 or older using "highly effective" methods. Acceptable methods include:

Photo ID matching (passport, driving licence)
Facial age estimation via webcam
Credit card checks
Mobile network operator age confirmation
Bank or open banking verification

Each of these creates a new database linking your real identity to your browsing habits — a treasure trove for hackers if breached. The 2015 Ashley Madison hack showed exactly how damaging such data leaks can be.

3. Increased Data Retention

To demonstrate compliance with Ofcom, platforms may retain more user data for longer — including logs of moderation decisions, reported content, and user reports. This runs counter to the data minimisation principle at the heart of UK GDPR.

How the Act Affects Different Types of Users

Everyday Social Media Users

Expect more aggressive automated moderation, more account verification prompts, and possibly age checks on mainstream platforms. Content that is legal but deemed "harmful" (a vague category) may be down-ranked or removed. Some smaller communities may shut down UK access entirely rather than comply.

Small Website and Forum Owners

If you run a hobby forum, Discord server, or comments section, the Act may apply to you. You need to complete a risk assessment, publish clear terms of service, provide reporting tools, and act on illegal content quickly. Failure to comply can trigger enforcement action from Ofcom.

Journalists, Activists, and Whistleblowers

The weakening of secure messaging is particularly concerning for people who rely on encryption to protect sources or organise safely. The Act contains some exemptions for journalism, but experts argue these are too narrow to offer meaningful protection in practice.

Businesses and Marketers

Companies using link-sharing, email campaigns, or user-generated content need to think more carefully about compliance. Tools that offer transparency, click analytics without excessive tracking, and clean redirects — like Lunyb's privacy-respecting URL shortener — become more valuable in a landscape where every data point could become a liability.

Online Safety Act vs UK GDPR: How They Interact

Both laws apply simultaneously, and platforms must comply with each. Here's how they compare:

Aspect	UK GDPR	Online Safety Act
Primary Goal	Protect personal data	Protect users from harmful content
Regulator	ICO	Ofcom
Data Approach	Minimise data collection	May require more data collection (age, moderation logs)
Encryption	Encouraged as a safeguard	May be weakened by scanning requirements
Max Fines	£17.5m or 4% turnover	£18m or 10% turnover
Scope	Any organisation handling UK personal data	Any user-to-user or search service accessible in UK

The two regimes can create direct conflicts. For example, collecting ID scans for age verification is a data-heavy activity that GDPR would prefer to avoid, but the Online Safety Act may require it.

Pros and Cons of the Online Safety Act

Pros

Stronger protections for children against exploitative content
Clear legal obligations to remove terrorism material and CSAM
Better complaints and transparency mechanisms on major platforms
Higher accountability for tech giants who previously ignored UK concerns
Reduction in scam adverts and fraudulent posts

Cons

Potential weakening of end-to-end encryption for all users
New identity databases create fresh breach risks
Vague definitions of "legal but harmful" content may cause over-moderation
Compliance costs may drive smaller UK platforms out of business
Some international services may block UK users rather than comply
Chilling effect on legitimate speech and anonymous participation

How to Protect Your Privacy Under the Online Safety Act

You cannot opt out of the law, but you can take practical steps to keep your personal data under your control.

1. Use Privacy-Focused Browsers and Search Engines

Switch to browsers like Firefox, Brave, or Mullvad Browser and search engines such as DuckDuckGo or Startpage. These minimise tracking and reduce the fingerprint you leave behind on sites subject to the Act.

2. Adopt Encrypted DNS

Enable DNS over HTTPS (DoH) or DNS over TLS (DoT) in your browser and operating system. Providers like Cloudflare (1.1.1.1) and Quad9 encrypt your DNS lookups so your internet provider cannot easily log which sites you visit.

3. Be Selective About Age Verification

If a site requires age verification, prefer methods that use zero-knowledge proofs or reusable digital identity wallets that share only a yes/no age token, rather than uploading your passport to an unknown third party.

4. Minimise Your Digital Footprint

Every account you create is another database that could be breached. Use separate email aliases (via services like SimpleLogin or Apple Hide My Email) for different platforms, and delete accounts you no longer use.

5. Use Privacy-Respecting Link Tools

When sharing content, use link shorteners and analytics tools that don't aggressively fingerprint recipients. Tools like Lunyb provide clean redirects and click statistics without invasive tracking. For a broader comparison of options, see our 2026 URL shortener buyer's guide or our detailed Rebrandly review.

6. Keep Sensitive Conversations on Truly Secure Platforms

Signal and other independently audited messaging apps remain the gold standard for private communication. Watch closely how they respond to Ofcom notices — if they leave the UK market, alternatives may become necessary.

7. Stay Informed

The Act is being rolled out in phases through 2025 and 2026. Follow updates from the Open Rights Group, Big Brother Watch, and Ofcom's own consultation pages so you know when new obligations come into force.

What's Next: The Road Ahead

Ofcom is publishing codes of practice throughout 2025 and 2026. Key milestones include finalised illegal content codes, child safety codes, and enforcement decisions against non-compliant platforms. Legal challenges are also likely — several digital rights organisations are preparing court cases arguing that the encryption provisions are incompatible with human rights law.

Businesses running any user-facing UK service should treat compliance as an ongoing project rather than a one-off task. Users, meanwhile, should assume that the platforms they use will be under increasing pressure to collect, retain, and scan more information — and adjust their habits accordingly.

Frequently Asked Questions

Does the UK Online Safety Act ban end-to-end encryption?

Not explicitly. However, the Act gives Ofcom the power to require platforms to use "accredited technology" to detect illegal content, which security experts argue is impossible to do inside encrypted chats without breaking the encryption itself. The government has said it will not enforce this power until it is "technically feasible" — a caveat with no clear timeline.

Do I need to verify my age to use social media in the UK?

For general social media use, no — but platforms must prevent under-18s from seeing adult content, so you may encounter age-assurance prompts when accessing certain categories of material. Dedicated adult sites must implement "highly effective" age verification for all UK visitors.

Does the Online Safety Act apply to small blogs and forums?

Yes, if they host user-generated content (comments, posts, uploads) and are accessible to UK users. However, the obligations are proportionate to size and risk, so a small hobby forum will not face the same requirements as a global social network. Ofcom has published simplified guidance for smaller services.

Can I be fined as an individual user under the Act?

The Act primarily targets platforms, not individual users. However, some new criminal offences created by the Act — such as sending threatening communications or sharing intimate images without consent — do apply to individuals and can carry prison sentences.

How does the Online Safety Act affect businesses that share links or run marketing campaigns?

If your business hosts user-generated content or shares links that could lead to harmful material, you have a duty to assess and mitigate those risks. Using transparent, privacy-conscious link management tools and keeping clear records of moderation decisions will help demonstrate compliance without creating unnecessary data liabilities.