UK Online Safety Act: What It Means for Your Privacy in 2026

The UK Online Safety Act is one of the most far-reaching pieces of internet regulation Britain has ever passed. Pitched as a way to protect children and curb illegal content, it also hands sweeping new powers to Ofcom and places significant obligations on the platforms you use every day. For ordinary users, the question is simple: what does the Online Safety Act actually mean for your privacy?

This guide breaks the Act down in plain English, focusing on the practical privacy implications for UK residents — from age verification and messaging scans to data retention, link sharing and what you can do to keep more of your online life to yourself.

What is the UK Online Safety Act?

The UK Online Safety Act 2023 is a law that regulates online platforms used by people in the United Kingdom. It requires in-scope services — social networks, search engines, messaging apps, forums, adult sites and many user-to-user platforms — to assess risks of illegal and harmful content and take steps to reduce them, under the supervision of regulator Ofcom.

The Act came into force in October 2023, but most of its duties are being switched on in phases through 2024, 2025 and 2026 as Ofcom publishes codes of practice. By 2026, the majority of its illegal content, child safety and age-assurance duties are fully active, and enforcement is biting.

Who the Act applies to

User-to-user services — social media, forums, dating apps, comment sections, community platforms.
Search services — general-purpose search engines.
Services likely to be accessed by children — any platform with meaningful UK child usage.
Pornographic content providers — subject to strict age-verification duties.

It applies to any service with a significant UK user base, regardless of where the company is headquartered. A US startup with British users must still comply.

The core privacy tensions in the Act

Online safety and online privacy are not automatically opposed, but the Act creates several friction points. Understanding them is essential before you can judge how it affects you personally.

1. Age assurance and identity

Platforms likely to be accessed by children must put in place "highly effective" age assurance. In practice this means some form of age verification or age estimation — uploading ID, using a credit card check, face-scan age estimation, mobile operator checks or third-party digital ID wallets.

The privacy issue: proving you are over 18 to access a legal adult site, a wine retailer or even some social features now routinely involves sharing identity signals with a third party. Even when age-check vendors promise to delete data, you are creating more copies of sensitive attributes than before.

2. Messaging and end-to-end encryption

Section 121 of the Act gives Ofcom the power to require services to use "accredited technology" to identify child sexual abuse material (CSAM) in private messages. In theory this could apply to end-to-end encrypted platforms such as Signal, WhatsApp and iMessage.

The UK government has said it will only use this power when it is "technically feasible" — effectively a pause, because scanning encrypted content without breaking encryption is not currently possible at scale. But the power sits on the statute book. If future technology appears to permit client-side scanning, the regulator can switch it on without passing a new law.

3. Content moderation at scale

To meet their safety duties, platforms are deploying more automated moderation, keyword matching, hash-matching and behavioural analytics. That means more of your posts, DMs metadata, link shares and search terms are inspected by algorithms, logged and sometimes reviewed by humans.

4. Data retention and law enforcement access

Platforms must keep detailed records of risk assessments, enforcement actions and reports. Combined with existing UK data retention rules, this expands the pool of information available if a court order or information notice is served.

What changes for you as a UK user

Most of the Act's impact on everyday users falls into five categories. Here is what to expect — and what you may already be seeing.

More age checks, more often

Adult content sites now require robust age verification before you see anything beyond a landing page.
Social networks are rolling out age estimation to gate features such as livestreaming, DMs with strangers and certain ad categories.
Some gaming, dating and even e-commerce platforms are adopting age gates to reduce regulatory risk.

Expect to be asked to prove your age far more often than you did in 2022. Where possible, prefer providers that use double-blind or zero-knowledge age assurance, where the site only learns "over 18: yes/no" and never your name, date of birth or document image.

Stricter content moderation

Lawful-but-awful content for adults is largely out of scope for user-to-user platforms (that proposal was dropped from the Bill). But illegal content duties are broad and include fraud, harassment, threats, intimate image abuse, terror content and more. You may see more posts removed, more accounts suspended and more appeals — including false positives against legitimate speech.

Reduced anonymity in practice

The Act does not ban anonymity outright. Category 1 platforms (the largest) must give adult users a choice to verify themselves and to filter out unverified accounts. In practice this creates social pressure to link your real identity to your profile if you want full reach and interaction.

Changes to link sharing and previews

Because platforms must assess risk from external links, you may notice more friction around shortened URLs, warnings on outbound links, and unfurled previews being blocked or delayed. Choosing a transparent, privacy-respecting shortener matters more than it used to — services that log minimal data and offer clear destination previews help both your audience and the platforms you post on.

More requests for government-approved digital ID

The UK is building a trust framework for digital identity. Many age-assurance vendors will plug into it. Over time, carrying a reusable digital ID in a wallet app may become the default way to prove age, residence or eligibility online.

How the Act affects specific services

Social media

Large platforms (Category 1) face the heaviest duties: transparency reports, user-empowerment tools, identity verification options, and extensive risk assessments. Smaller platforms still have illegal content and child safety duties, but lighter administrative load.

Private messaging

Messaging apps are in scope as user-to-user services. The encryption-scanning power remains dormant but legally available. Metadata (who you message, when, from where) is already accessible under existing UK investigatory powers and is not changed by the Act.

Search engines

Search services must minimise the chance of users encountering illegal content and protect children from harmful material in results. Expect more filtered, personalised and age-gated results in the UK than in other regions.

Adult content sites

These face the strictest age-verification duties. Non-compliant sites can be fined up to 10% of global turnover or £18 million (whichever is higher) and, in the worst cases, blocked at the ISP level through business disruption measures.

Forums, niche communities and small services

Even small UK-focused forums have duties. Many hobby sites and independent communities have shut down or geo-blocked UK users rather than absorb the compliance cost. This is a quiet but significant privacy cost: fewer small, independent places to talk, more consolidation on a handful of giants.

Online Safety Act vs GDPR: how they interact

The Online Safety Act does not replace UK GDPR or the Data Protection Act 2018 — it sits alongside them. Platforms still need a lawful basis to process your personal data, must respect your subject access rights, and cannot use safety duties as a blanket excuse for mass data collection.

Ofcom and the Information Commissioner's Office (ICO) have published joint statements emphasising that age assurance and content moderation must be data-minimising and proportionate. In theory, that gives you grounds to push back if a provider demands excessive identity data in the name of safety.

Area	UK GDPR focus	Online Safety Act focus
Primary goal	Protect personal data	Reduce online harm
Regulator	ICO	Ofcom
Who it binds	Any data controller/processor	In-scope online services
Max fines	£17.5m or 4% global turnover	£18m or 10% global turnover
User rights	Access, erasure, portability, objection	Reporting, appeals, user-empowerment tools

Practical steps to protect your privacy under the Act

You cannot opt out of the law, but you can shape how much of your identity leaks through it. The following steps are proportionate for most UK users.

1. Choose privacy-first providers by default

Prefer messengers with strong end-to-end encryption and a public track record of resisting data requests.
Use search engines that do not build long-term profiles on you.
Pick email, cloud storage and link tools that publish clear data-handling practices. For link sharing, a transparent option like Lunyb gives you short links with minimal logging and clean destination previews — useful when platforms are increasingly suspicious of opaque redirectors.

2. Use the least identifying age-check option available

Prefer face-scan estimation over document upload where both are offered — the image is usually processed and discarded in seconds.
Prefer independent third-party age-assurance providers over giving ID directly to the content site.
Look for "zero-knowledge" or "attribute-only" schemes that confirm over 18 without sharing your name or date of birth.

3. Harden your browser and DNS

Enable encrypted DNS (DoH or DoT) in your browser or operating system so your ISP cannot easily log every domain you visit.
Use a privacy-respecting browser with tracker blocking and strict cookie isolation.
Keep a separate browser profile for identity-linked activity (banking, government, work) and another for general browsing.

4. Rethink what you share on big platforms

Assume that anything posted to a Category 1 service will be scanned, logged and potentially shared with authorities on valid legal request. For sensitive conversations, move to end-to-end encrypted channels with trusted contacts rather than DMs on public platforms.

5. Exercise your data rights

If a platform collects identity data for age checks, use UK GDPR to ask: what did you collect, why, how long are you keeping it, and who did you share it with? Legitimate providers will answer within one month. Evasive answers are a signal to switch.

Common misconceptions about the Act

"The Act bans anonymity online."

False. You are not required to verify your identity to use the internet in the UK. Only the very largest platforms must offer verification, and only adult users there can choose to filter unverified accounts.

"End-to-end encryption is now illegal in the UK."

False. Encryption is legal. The Act contains a dormant power to require scanning technology, but Ofcom has stated it will not deploy it until it is technically feasible to do so without undermining encryption — a condition that is not currently met.

"The government can read my messages on demand."

Not under the Online Safety Act itself. Targeted interception has long been governed by the Investigatory Powers Act 2016 and requires warrants. The Online Safety Act's focus is on platform duties, not individual surveillance.

"Small websites can ignore the Act."

False. Even small user-to-user services with UK users have illegal content and (if accessed by children) child safety duties. Many have introduced tighter moderation, geo-blocking or registration requirements as a result.

What to watch in 2026 and beyond

Ofcom enforcement actions. The first high-profile fines will set the tone for how aggressively the Act is applied.
Digital ID rollout. As the UK's digital identity framework matures, expect more services to accept a single reusable wallet instead of bespoke age checks.
Encryption debate. Pressure to activate the scanning power will return. Public consultation responses matter.
Market consolidation. Watch whether smaller, independent UK-facing platforms survive compliance costs or get absorbed by giants.

If you are auditing the tools you rely on, our reviews of privacy-aware link services — including this honest review of Lunyb and our Rebrandly comparison — walk through exactly what gets logged when you shorten and share links in a post-Online-Safety-Act world.

Frequently asked questions

Does the UK Online Safety Act apply to me personally?

Not directly. The Act regulates platforms, not individual users. However, it changes how the services you use handle your data, moderate your posts and verify your age, so the effect on your privacy is real even if you have no legal duties under it yourself.

Do I have to upload my passport to use social media in the UK?

No. Most mainstream social networks use lighter-touch age estimation (such as face-scan or behavioural signals) rather than document uploads. Document upload is most common on adult sites and for the optional identity verification offered on the largest platforms.

Can Ofcom read my private messages?

Not under current arrangements. Ofcom has a dormant power to require platforms to deploy accredited scanning technology for CSAM, but has stated it will not use this power while doing so would undermine end-to-end encryption. Targeted interception remains governed by separate warrant-based laws.

Will the Online Safety Act slow down my internet or block sites?

Some adult sites that refuse to implement age checks can be subject to business disruption measures, including ISP-level blocking. Everyday browsing speed is unaffected, but you may notice more age gates, more content warnings and occasional friction around external links and link previews.

How can I share links privately under the new rules?

Use a transparent URL shortener that logs minimal data, shows clear destination previews and does not build advertising profiles on click behaviour. Avoid obscure redirect chains that look suspicious to platform moderation systems. Services designed around privacy, such as Lunyb, are built for exactly this kind of post-Online-Safety-Act environment.

The bottom line

The UK Online Safety Act is neither the privacy apocalypse its loudest critics feared nor the harmless child-protection measure its supporters often describe. It is a real shift in how online services operate in Britain — one that pushes more identity, more moderation and more data collection into the plumbing of everyday internet use.

For most users, the sensible response is not panic but hygiene: choose providers that minimise what they collect, use the lightest-touch age verification available, keep sensitive conversations in genuinely encrypted channels, and exercise your UK GDPR rights when platforms overreach. Privacy in 2026 is a set of small, consistent choices — and under the Online Safety Act, those choices matter more than ever.