UK Online Safety Act: What It Means for Your Privacy

The UK Online Safety Act is one of the most sweeping pieces of internet regulation Britain has ever introduced. Passed in 2023 and now fully in force through 2025 and 2026, it promises to make the internet safer, particularly for children. But alongside its child protection goals, it introduces obligations on platforms that have profound implications for the privacy of every adult user in the UK too.

This guide breaks down what the Online Safety Act actually requires, how it affects your personal privacy, what has changed in practice on sites you use every day, and the practical steps you can take to protect your data under the new regime.

What is the UK Online Safety Act?

The UK Online Safety Act 2023 is a law that places legal duties on online platforms — including social networks, search engines, messaging services, pornography sites, and user-to-user services — to protect users (especially children) from illegal and harmful content. It is enforced by Ofcom, which has the power to fine companies up to £18 million or 10% of global annual turnover, whichever is greater.

The Act covers three broad categories of duties:

Illegal content duties: Platforms must proactively prevent and remove illegal material such as child sexual abuse imagery, terrorist content, fraud, and intimate image abuse.
Child safety duties: Services likely to be accessed by children must assess risks and implement age-appropriate protections, including highly effective age verification where adult content is involved.
Transparency and user empowerment: Larger platforms must publish risk assessments, offer adult users tools to filter certain content, and provide clear reporting mechanisms.

On paper, these aims are uncontroversial. In practice, the mechanisms chosen to achieve them touch directly on how much personal information you must hand over to use the internet in Britain.

Why the Online Safety Act matters for your privacy

Privacy campaigners, security researchers, and major technology companies have raised significant concerns about the Act since it was first drafted. The core issue is that several of its duties can only be fulfilled by platforms collecting more data about users, scanning more content, or weakening the technical protections that normally keep communications private.

1. Age verification creates new data trails

From July 2025, any UK-accessible site that hosts adult content, and many that host content considered harmful to children, must use "highly effective age assurance." In practice this means one of the following:

Uploading a photo of your passport, driving licence or other government ID
Submitting a live selfie for facial age estimation
Linking a bank account, mobile operator record, or credit card
Using a digital identity wallet provided by a third-party age-assurance company

Each of these methods creates a record linking your real-world identity to specific categories of browsing — something that previously was not required to simply read a website. Even when age-assurance providers claim to delete data immediately, the simple existence of these verification events creates new attack surfaces and new potential subpoena targets.

2. Pressure on end-to-end encryption

One of the most contentious sections of the Act gives Ofcom the power to require platforms to use "accredited technology" to identify child sexual abuse material in private messages. Services like Signal, WhatsApp and iMessage use end-to-end encryption, meaning not even the provider can read the content. Scanning messages for banned material on the user's device before encryption — so-called client-side scanning — is widely considered by cryptographers to break the privacy guarantees of encryption entirely.

The government has said it will not use these powers until the technology is "technically feasible" without undermining encryption, but the legal power remains on the statute book. Several messaging companies have publicly stated they would withdraw from the UK rather than comply.

3. Expanded content monitoring

To meet illegal content duties, platforms must proactively detect certain categories of material. For large services this means more automated scanning, more AI-driven moderation, and more metadata retention — including who posted what, when, from where, and who saw it. That data, once collected, can be requested by law enforcement, exposed in breaches, or repurposed for advertising.

4. Reduced anonymity in practice

The Act does not technically ban anonymous accounts. Category 1 services (the largest social platforms) must, however, offer users the option to verify their identity and to filter out posts from unverified accounts. The predictable result is strong social pressure toward verification, as unverified voices are increasingly hidden by default by other users.

Which services are affected?

The Act's reach is broad. If a service has links to the UK — meaning it has UK users or is targeted at the UK — it is in scope, regardless of where the company is based. Below is a simplified overview of how different service types are affected.

Service type	Main duties	Privacy impact for users
Large social networks (Category 1)	Illegal content, child safety, user empowerment tools, identity verification option, transparency reports	High — more monitoring, verification pressure, risk assessments on your activity
Search engines	Reduce illegal content in results, protect children from harmful search results	Medium — more query filtering and logging
Messaging apps	Illegal content duties, potential scanning powers	Potentially high — risk of weakened encryption
Adult content sites	Highly effective age verification	Very high — ID or biometric data required to access
Smaller forums and user-to-user services	Illegal content duties, child risk assessments	Low to medium — depends on size and content
File sharing, link shorteners, cloud storage	Illegal content duties where user-to-user features exist	Varies — generally low for private use

What has actually changed since enforcement began

The Act's duties have come into force in waves, with the biggest practical changes landing in 2025.

Age gates on adult and gambling sites

Since July 2025, most major adult sites accessible from UK IP addresses present a mandatory age-assurance screen. Some have deployed facial age estimation, others require ID uploads via third parties such as Yoti, Persona, or VerifyMy. A number of smaller sites have simply blocked UK traffic rather than deploy verification.

Content filtering on social platforms

Meta, TikTok, Snap, X, Reddit and others have introduced new content controls, defaulted younger accounts to more restrictive settings, and expanded their reporting and appeals systems. Some content categories — including self-harm imagery, certain hate speech, and promotion of dangerous stunts — are more aggressively removed than before.

Risk assessments and transparency

Platforms in scope have published risk assessments and submitted them to Ofcom. These documents describe how user data is analysed to detect harm, giving the public more insight into the scale of behind-the-scenes monitoring.

Service withdrawals

Several smaller platforms, forums and independent adult sites have geo-blocked the UK rather than take on compliance costs. This has reduced the diversity of services available to British users — an unintended privacy consequence, as people migrate to larger, more surveillance-heavy platforms.

Practical steps to protect your privacy under the Act

You cannot opt out of the law, but you can make thoughtful choices about how much of your identity you expose while using UK-regulated services.

1. Choose age-assurance methods carefully

Where you are required to prove your age, prefer methods that minimise data retention:

Facial age estimation is generally better than ID upload because reputable providers process the image on the fly and delete it immediately.
Digital identity wallets that return only a yes/no "over 18" token to the site are preferable to handing documents directly to the site itself.
Avoid uploading passport scans to small or unfamiliar sites. If no reputable third-party option is offered, consider whether you need to use that site at all.

2. Separate identities for different activities

Use distinct email addresses — ideally with an email aliasing service — for accounts tied to verified identity versus accounts used for general browsing, forums, or commentary. This limits the damage if an age-assurance provider or platform suffers a data breach.

3. Harden your browser and DNS

Use a privacy-respecting browser such as Firefox or Brave with tracker blocking enabled, and configure encrypted DNS (DNS-over-HTTPS) through a provider like Cloudflare 1.1.1.1 or Quad9. This reduces how much of your general browsing is visible to your network provider, which matters as more services log more about you.

4. Be careful what you shorten and share

Links you share on social networks are now part of the content moderation and risk assessment pipeline. If you are sharing links to legitimate but sensitive resources — support groups, political campaigns, journalism — a privacy-respecting URL shortener like Lunyb can give you cleaner analytics without handing another layer of behavioural data to a major advertising company. For a wider overview of options, see our 2026 buyer's guide to URL shorteners.

5. Keep encrypted messengers up to date

While the Act's scanning powers are not currently being exercised, the best protection remains strong, well-maintained end-to-end encrypted messaging. Keep apps updated, enable disappearing messages for sensitive conversations, and verify safety numbers with important contacts.

6. Use the empowerment tools you are now entitled to

Category 1 services must offer adult users controls over the content they see and the accounts they interact with. Explore the privacy and safety settings on each platform — many useful options are turned off by default.

Common misconceptions about the Act

"The Online Safety Act bans encryption."

It does not ban encryption. It does, however, create a legal power that could, in theory, be used to compel scanning that would undermine end-to-end encryption. Whether and how that power is used is one of the most important ongoing debates in UK tech policy.

"You have to upload your passport to use social media."

No. Identity verification on large social networks is optional for individual users. Age assurance is only mandatory where a service hosts adult content or where a platform has decided that assurance is the simplest way to meet its child safety duties.

"The Act only applies to UK companies."

Also false. It applies to any service with a significant UK user base or that targets the UK market, regardless of where the company is incorporated.

"Small blogs and forums are exempt."

They are not automatically exempt, though their duties are much lighter. Any user-to-user service — including a comments section — has some obligation around illegal content. Ofcom has published guidance aimed specifically at small services.

The bigger picture: safety versus privacy

The Online Safety Act represents a genuine attempt to address real harms, particularly to children. Few would argue that the pre-2023 internet was a well-regulated space. At the same time, the Act has shifted the default of the UK internet toward more data collection, more identity checks, and more content monitoring. These are the levers that reduce privacy, and once pulled they are difficult to unpull.

For individual users, the sensible response is neither panic nor passivity. The Act is now the law and compliance is non-negotiable for platforms. What you can do is understand the new data trails being generated, choose services and verification methods that minimise them, and build the habit of thinking about identity, metadata and content separately whenever you go online.

Frequently asked questions

Does the UK Online Safety Act apply to private messages?

Private one-to-one messages between users are generally outside the main content moderation duties, but messaging platforms themselves fall under the Act. The most contentious power — the ability for Ofcom to require scanning of private messages for child sexual abuse material — exists in the legislation but has not yet been activated, and the government has said it will not be used until a technical solution exists that does not undermine encryption.

Do I have to verify my age to watch adult content in the UK?

Yes. Since July 2025, any UK-accessible site hosting pornography must use "highly effective age assurance." You generally have a choice between facial age estimation, ID upload, or linking a financial or mobile account via a third-party provider. Reputable providers do not retain the material once verification is complete, but you should check each provider's privacy policy before uploading documents.

Can I be fined under the Online Safety Act as an individual?

The headline fines in the Act are aimed at platforms, not users. However, the Act did create or strengthen certain criminal offences for individuals, including sending threatening communications, cyberflashing, and encouraging self-harm. These can carry prison sentences. The Act does not criminalise ordinary users for their general browsing or posting.

Will using a privacy tool get around the Act's age checks?

Technically, routing your traffic through a non-UK connection may allow you to see non-UK versions of some sites, but this does not change your legal position in the UK, and many services are rolling out age checks globally regardless. Rather than trying to evade the law, the better strategy is to choose verification methods that collect the least data and to use services run by companies with strong privacy track records.

How can I complain if I think a platform is handling my data badly under the Act?

There are two separate routes. For complaints about how a platform is meeting its Online Safety Act duties — moderation, risk assessment, user tools — contact Ofcom. For complaints about how your personal data is being collected, stored or shared, including by age-assurance providers, contact the Information Commissioner's Office (ICO), which enforces UK data protection law alongside the new regime.