UK Online Safety Act: What It Means for Your Privacy

The UK Online Safety Act is one of the most significant pieces of internet legislation Britain has ever passed. Promoted as a way to protect children and tackle illegal content, it also hands sweeping new powers to Ofcom and places unprecedented duties on tech platforms. For ordinary users, the question is simple but important: what does it mean for your privacy?

This guide breaks down the Act in plain English, explains how it affects everyday browsing, messaging and account sign-ups, and sets out practical steps you can take to keep your personal data under your own control.

What Is the UK Online Safety Act?

The Online Safety Act 2023 is a UK law that regulates how online services handle harmful and illegal content. It applies to search engines, social networks, messaging apps, pornography sites, forums, cloud storage providers and many smaller platforms that let users interact with each other.

In broad terms, the Act requires in-scope services to:

1. Assess the risk of illegal content appearing on their platform.
2. Put systems in place to detect, remove and prevent that content.
3. Protect children from material deemed harmful, including pornography and content promoting self-harm.
4. Give users tools to control what they see and to report problems.
5. Comply with information requests and codes of practice issued by Ofcom.

Ofcom is the designated regulator and can issue fines of up to £18 million or 10% of global annual turnover — whichever is higher. Senior managers can also face criminal liability in certain cases.

Who Does the Act Apply To?

The Act has extraterritorial reach. A platform does not need to be based in the UK to be caught by it — if it has a significant number of UK users or targets the UK market, it must comply. That means American social networks, European forums and even hobbyist platforms with British users can fall within scope.

Why Privacy Campaigners Are Worried

While the Act's goals around child safety and illegal content enjoy broad public support, several provisions have drawn sustained criticism from privacy groups, security researchers and major technology firms. The core concerns revolve around three areas: encryption, age verification and content scanning.

1. The Encryption Question

The most controversial element is Section 121, which allows Ofcom to require platforms to use "accredited technology" to identify child sexual abuse material (CSAM) and terrorism content, including in private messages. On paper this sounds reasonable. In practice, it would require services such as WhatsApp, Signal and iMessage to scan the contents of messages before they are encrypted — a technique often called client-side scanning.

Security experts argue this fundamentally breaks end-to-end encryption. If a device scans your messages and reports matches to a third party, the privacy guarantee of end-to-end encryption no longer holds. Signal and WhatsApp both publicly stated they would rather withdraw from the UK than comply with such a demand.

The government has since said the power will only be used when it is "technically feasible" — but it has not removed the clause from the law. The threat remains dormant on the statute book.

2. Age Verification and Identity Data

The Act requires platforms likely to be accessed by children to use "highly effective" age assurance. In practice this often means uploading a photo of your passport or driving licence, submitting a selfie for facial age estimation, or linking your account to a credit card or mobile operator.

Even when the verification itself is handled by a third-party provider, this creates new databases of highly sensitive information: identity documents linked to the specific adult sites, forums or social networks a user wants to access. A breach of such a database could be devastating — far more damaging than a typical password leak.

3. Content Moderation and Over-Removal

Because platforms face enormous fines for failing to remove illegal content quickly, there is a strong incentive to over-remove. Automated moderation systems routinely take down lawful speech, satire, journalism and LGBTQ+ content in error. Under the Act, that incentive gets sharper, which can indirectly chill legitimate expression and reduce the diversity of information available online.

How the Act Affects Your Day-to-Day Privacy

Rather than list every provision, it helps to look at how the Act touches the things people actually do online.

Signing Up for New Services

You will encounter more identity checks, especially on adult sites, dating apps and some social networks. Expect to see:

• Document uploads (passport, driving licence).
• Live selfie checks and face-age estimation.
• Credit card verification used purely for age, not payment.
• Mobile network age checks tied to your phone contract.

Private Messaging

For now, end-to-end encrypted messengers continue to operate normally in the UK. However, platforms must still assess risk and may introduce metadata-based detection, account-level checks, or warnings around certain shared links and images. The underlying encryption has not been broken — but the surrounding ecosystem is becoming more intrusive.

Browsing Adult or Sensitive Content

Pornography sites with UK users must now gate access behind strong age checks. Beyond the immediate privacy impact, this creates a record — somewhere — that a specific identity requested access. For many lawful users this is deeply uncomfortable, especially given how often such databases are targeted by attackers.

Posting and Sharing

User-generated content faces faster takedowns, more aggressive filtering of links, and in some cases requirements to verify your identity before posting at scale. Journalists, researchers and activists who rely on pseudonymity are among those most affected.

Comparing the Act With Other Privacy Regimes

The UK is not alone in regulating online platforms, but its approach differs in important ways. The table below sets out some headline differences.

Feature	UK Online Safety Act	EU Digital Services Act	US Section 230
Primary focus	Harmful & illegal content, child safety	Transparency, systemic risks, illegal content	Platform liability shield
Encryption risk	Scanning powers in law (dormant)	No equivalent scanning mandate	None
Age verification	Mandatory, "highly effective"	Risk-based, less prescriptive	Patchy state-level laws
Max fines	£18m or 10% global turnover	6% global turnover	N/A
Regulator	Ofcom	European Commission + national regulators	FTC (limited)

Pros and Cons for UK Users

Pros

• Stronger protections for children against harmful content.
• Clearer duties on platforms to remove illegal material quickly.
• Better reporting tools and user controls on major services.
• Independent oversight through Ofcom with real enforcement powers.
• Pressure on platforms to publish transparency data.

Cons

• Legal pressure on end-to-end encryption that security experts warn is dangerous.
• New identity databases created by age verification requirements.
• Risk of over-removal silencing lawful speech, journalism and minority voices.
• Smaller platforms, forums and hobby sites face heavy compliance costs.
• Some overseas services may simply block UK users rather than comply.

Practical Steps to Protect Your Privacy

You cannot opt out of UK law, but you can make smart choices about how much personal data you expose. The following steps work well in combination.

1. Minimise What You Hand Over

When a service asks for an ID document, ask yourself whether you really need an account there. Where age verification is unavoidable, prefer providers that use "zero knowledge" or token-based systems — they verify your age once and give the site only a yes/no answer, without passing on your document.

2. Separate Identities for Separate Purposes

Use different email addresses, usernames and even browsers for different parts of your online life — banking, work, social, and anything sensitive. Email aliasing services and password managers make this painless and dramatically reduce the blast radius of any single breach.

3. Harden Your Network and Browser

Switch to encrypted DNS (DNS over HTTPS or DNS over TLS) through a reputable provider so your internet provider cannot easily log every domain you visit. Use a privacy-respecting browser such as Firefox or Brave, enable tracking protection, and install a content blocker like uBlock Origin.

4. Be Careful With Shared Links

Links can leak surprising amounts of information — tracking parameters, referrer data, account identifiers. When sharing links in public or across platforms, use a trusted link management tool that strips trackers and gives you control over analytics. Services like Lunyb let you create clean, branded short links without the heavy tracking profiles that larger ad-tech-driven shorteners build. If you are weighing up options, our 2026 buyer's guide to URL shorteners compares the main players side by side.

5. Choose Messaging Apps That Resist Pressure

Stick with messengers that have publicly committed to end-to-end encryption and have a track record of standing up to legal demands. Review their transparency reports annually — the companies willing to walk away from markets rather than weaken encryption tend to be the strongest choices.

6. Review App Permissions Regularly

Every few months, go through your phone and browser and revoke permissions you no longer need: location, microphone, contacts, background data. The Act does not change what apps can ask for — but it does raise the stakes if that data ends up in a breach.

What to Expect Next

The Act is being rolled out in phases through Ofcom's codes of practice. Key milestones to watch include:

1. Full enforcement of illegal content duties, already underway.
2. Children's safety codes, including age assurance requirements across more categories of site.
3. Decisions about when, if ever, Ofcom will attempt to use its message-scanning powers.
4. Legal challenges from platforms, civil society groups and potentially the EU on grounds of proportionality and fundamental rights.

Expect further guidance, consultations and, almost certainly, test cases in the courts. The shape of the Act in practice will be defined as much by enforcement decisions as by the text of the law itself.

FAQ

Does the UK Online Safety Act ban encryption?

No. The Act does not ban end-to-end encryption, but it contains powers that could require platforms to scan content before it is encrypted. The government has said this will only be used when technically feasible, and so far no such notice has been issued. Encrypted messengers continue to operate normally in the UK.

Do I have to upload my passport to use social media now?

Not usually for mainstream social networks, but you will increasingly need to prove your age for adult content, dating services and some platforms with lots of younger users. Some sites offer alternatives such as facial age estimation or mobile operator checks instead of ID documents.

Is the Act the same as GDPR?

No. UK GDPR governs how personal data is collected and processed. The Online Safety Act governs the content and systems of online platforms. They overlap — for example, age verification raises GDPR questions — but they are separate laws with different regulators.

Can I avoid the Act by using overseas services?

Not really. The Act applies to any service with significant UK users, regardless of where it is based. Some smaller overseas services may choose to block UK traffic rather than comply, but that is their decision, not a legal workaround for users.

What is the single most useful step I can take today?

Audit the accounts and apps you no longer use and delete them. Every dormant account is a potential source of leaked data, and the fewer identity verifications you have scattered across the internet, the smaller your exposure under any regulatory regime — including the Online Safety Act.

Final Thoughts

The UK Online Safety Act is a serious attempt to tackle real problems: child exploitation, terrorist content, and the worst excesses of unmoderated platforms. But it also creates new privacy risks that will not go away on their own. Encryption pressures, identity databases and over-removal are structural issues that users, platforms and regulators will be negotiating for years.

The best response is informed and practical: understand what the Act does, choose tools and services that take privacy seriously, and keep your personal data footprint small. Privacy is no longer the default online — it is something you have to design into your own habits.