UK Online Safety Act: What It Means for Your Privacy

The UK Online Safety Act is one of the most far-reaching pieces of internet legislation in British history. Passed in October 2023 and now being enforced in phases by Ofcom through 2025 and 2026, it changes how platforms must handle harmful content, how they verify your age, and ultimately how much of your personal information flows through the services you use every day.

If you are a UK resident, a creator, or simply someone who values keeping their browsing habits to themselves, understanding the Act is no longer optional. This guide explains, in plain English, what the law actually requires, what it means for your privacy, and what practical steps you can take to protect yourself.

What Is the UK Online Safety Act?

The UK Online Safety Act 2023 is a law that places legal duties on online platforms, including social networks, search engines, messaging apps, adult sites, and even smaller user-to-user services, to protect users (especially children) from illegal and harmful content. It is enforced by Ofcom, the UK's communications regulator, which can issue fines of up to £18 million or 10% of global annual turnover, whichever is higher.

The Act applies to any service with a significant UK user base, regardless of where the company is based. That means platforms headquartered in the United States, Ireland, or anywhere else must still comply when serving British users.

Who Is Covered by the Act?

Category 1 services: The largest platforms, such as Facebook, X, TikTok, YouTube, and Instagram, face the strictest duties.
Category 2A services: Search engines like Google and Bing.
Category 2B services: Smaller user-to-user services that still have significant reach.
Pornography providers: Any site hosting adult content must implement "highly effective" age verification.
Private messaging apps: Including WhatsApp, Signal, and iMessage, under certain provisions.

The Key Privacy Implications

At its heart, the Act asks platforms to monitor more, verify more, and retain more information about who you are and what you do online. Each of these requirements has direct consequences for personal privacy.

1. Mandatory Age Verification

From July 2025, any UK user visiting an adult website or an age-restricted service must prove they are over 18 using "highly effective" methods. Acceptable techniques published by Ofcom include:

Photo-ID matching (uploading a passport or driving licence)
Facial age estimation using a live selfie
Credit card checks
Open banking age confirmation
Mobile network operator age checks
Digital identity wallets

Each of these creates a new data trail. Even when the age-check provider promises not to store your ID, you are now trusting an additional third party with biometric or identity data that did not previously need to exist.

2. Pressure on End-to-End Encryption

Section 121 of the Act gives Ofcom the power to require messaging services to use "accredited technology" to scan for child sexual abuse material (CSAM) and terrorism content, even in end-to-end encrypted chats. In practice, this would require client-side scanning, where your phone checks messages before they are encrypted and sent.

Signal, WhatsApp, and Apple all publicly stated they would withdraw from the UK market rather than weaken their encryption. The government has since said the power will not be used "until it is technically feasible", but the legal provision remains on the books and could be activated at any time.

3. Expanded Data Retention and Content Moderation

To prove compliance to Ofcom, platforms are now keeping more logs: who posted what, who reported whom, what moderation action was taken, and when. This expanded record-keeping is useful for safety audits but also creates larger pools of personal data vulnerable to breaches, subpoenas, or insider misuse.

4. Chilling Effects on Anonymous Speech

Category 1 services must offer adult users the option to verify their identity and to filter out content from unverified accounts. While voluntary, it nudges the ecosystem toward identified use by default, which can discourage whistleblowers, abuse survivors, LGBTQ+ users in hostile family settings, and journalists' sources.

Age Verification Methods Compared

Not all age-check methods carry the same privacy cost. If you have no choice but to verify, understanding the trade-offs matters.

Method	Data Shared	Privacy Risk	Reversibility
Photo ID upload	Full name, DOB, document number, photo	High	Low – ID is permanent
Facial age estimation	Live selfie (usually deleted)	Medium	Medium – biometric data
Credit card check	Card number, name	Medium	Medium
Open banking	Bank-confirmed age flag only	Low-Medium	High
Mobile operator check	Phone number age flag	Low	High
Digital ID wallet (e.g. GOV.UK One Login)	Verified age attribute	Low	High

Where possible, prefer methods that share a simple "yes/no, over 18" attribute rather than uploading a full identity document.

What the Act Does Not Do

There is a lot of misinformation online, so it is worth being clear about the limits of the Act.

It does not ban encrypted messaging.
It does not require you to upload ID to use social media (only age-restricted services).
It does not make it illegal to browse the web privately or use encrypted DNS.
It does not apply to purely private one-to-one communication outside the defined duties.
It does not override UK GDPR; platforms must still minimise data and have a lawful basis for processing.

Practical Steps to Protect Your Privacy

You cannot opt out of the law, but you can reduce how much personal data you expose in the process of complying with it.

1. Use a Privacy-Respecting Browser

Switch to Firefox, Brave, or Safari with strict tracking protection. These browsers block the cross-site trackers that build detailed profiles about you, which is especially important as platforms collect more data to meet their safety duties.

2. Enable Encrypted DNS

DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) stops your internet provider, and anyone sharing your network, from seeing a plain-text list of every website you visit. Cloudflare (1.1.1.1), Quad9, and NextDNS all support this and can be enabled in modern browsers and operating systems in under a minute.

3. Prefer Identity Wallets Over ID Uploads

When age verification is unavoidable, choose providers that use zero-knowledge or attribute-only proofs. The GOV.UK One Login and certain regulated identity providers are increasingly offering "over 18" tokens that do not hand your passport scan to the end site.

4. Separate Your Identities

Use distinct email addresses (via aliases such as Apple's Hide My Email, Fastmail, or SimpleLogin) for different categories of service. If one platform is breached or compelled to disclose data, the blast radius is limited.

5. Shorten and Audit Your Links

If you share links publicly, as a creator, journalist, or small business, use a privacy-first link shortener that does not fingerprint your audience or build profiles on the people who click. Lunyb is a UK-friendly option that focuses on minimal data collection and transparent analytics, avoiding the invasive tracking that larger shorteners sometimes embed. You can read an honest breakdown in our review of Lunyb for 2026, or compare the main alternatives in our Rebrandly vs Lunyb review.

6. Review App Permissions Regularly

On iOS and Android, revisit which apps have access to your contacts, microphone, photos, and location. Safety-duty compliance has led some apps to request broader permissions; grant only what is strictly needed.

What It Means for Creators and Small Businesses

If you run a UK-facing user-to-user service, even a small forum, Discord server monetised through Patreon, or a comments-enabled Substack, you may fall within scope. Key obligations include:

Completing an illegal content risk assessment.
Publishing clear terms of service and enforcing them consistently.
Offering an accessible reporting and complaints mechanism.
Keeping records of your risk assessments for Ofcom inspection.
If children can access your service, completing a separate children's risk assessment.

Ofcom has published simplified guidance for small services, but ignoring the duties is not an option, even hobbyist platforms can be fined.

The Bigger Picture: Safety vs Privacy

The Online Safety Act sits at the intersection of two legitimate goals: protecting people (especially children) from genuinely harmful content, and preserving the private, pseudonymous, encrypted internet that civil society depends on. Reasonable people disagree on where the balance should sit.

What is undeniable is that the Act shifts the default toward more verification, more logging, and more monitoring. For most users, that trade-off is invisible until something goes wrong, a data breach, an over-broad takedown, or a compelled disclosure. Building sensible privacy habits now is the cheapest insurance against those moments.

Frequently Asked Questions

Do I have to upload my passport to use social media in the UK?

No. The Act does not require ID uploads for general social media use. Identity verification on Category 1 platforms is voluntary and is offered so that you can choose to filter out unverified accounts. Mandatory age checks apply mainly to adult content services and certain age-restricted features.

Will the UK Online Safety Act break encrypted messaging like Signal or WhatsApp?

Not today. Section 121 gives Ofcom the power to require scanning of encrypted content, but the government has stated it will only use this power when it is "technically feasible" to do so without undermining encryption, something most cryptographers say is impossible. For now, end-to-end encryption on Signal, WhatsApp, and iMessage continues as normal.

Does the Act apply to websites based outside the UK?

Yes. Any online service with a significant number of UK users, or that targets the UK market, is within scope regardless of where the company is headquartered. Ofcom can fine non-UK companies and, in serious cases, seek court orders to restrict access to non-compliant services.

What is the safest way to verify my age online?

Prefer methods that share only an "over 18" confirmation rather than your full identity document. Open banking checks, mobile network operator checks, and regulated digital identity wallets are generally less invasive than uploading a passport or driving licence scan.

Can I be fined as an individual under the Online Safety Act?

The fines in the Act target platforms, not individual users. However, senior managers of non-compliant services can face criminal liability in certain circumstances, and existing laws (such as the Communications Act 2003 and Malicious Communications Act 1988) still apply to individuals who post illegal content.

Final Thoughts

The UK Online Safety Act is here to stay, and its full effects will unfold over the next few years as Ofcom publishes more codes of practice and begins serious enforcement. For the average user, the practical takeaway is simple: assume more of your online activity is being verified and logged than before, and adjust your habits accordingly. Choose services that minimise data collection, prefer privacy-preserving verification methods, and treat every optional "verify yourself" prompt as a decision worth pausing on.

Safety and privacy are not opposites. With the right tools and a little awareness, you can comply with the law, stay safe online, and keep your personal information genuinely personal.