UK Online Safety Act: What It Means for Your Privacy

The UK Online Safety Act is one of the most significant pieces of internet regulation ever passed in Britain. Signed into law in October 2023 and now being enforced by Ofcom through 2025 and 2026, it fundamentally changes how online platforms handle user content, safety, and — crucially — your personal privacy. If you use social media, messaging apps, search engines, or any user-generated content platform in the UK, this law affects you.

This guide breaks down exactly what the Online Safety Act does, how it impacts your privacy, and what practical steps you can take to protect your data under the new regime.

What Is the UK Online Safety Act?

The UK Online Safety Act 2023 is a law that places a legal duty of care on online platforms to protect users — particularly children — from illegal and harmful content. It is regulated by Ofcom, which has the power to issue fines of up to £18 million or 10% of a company's global annual turnover, whichever is greater.

The Act covers a wide range of services, including:

Social media platforms (Facebook, X, Instagram, TikTok)
Search engines (Google, Bing)
Messaging apps (WhatsApp, Signal, Telegram)
Video-sharing platforms (YouTube)
Adult content sites
Cloud storage and file-sharing services
Online forums and discussion boards
Gaming platforms with chat features

The law's ambitions are broad: reducing exposure to illegal content (terrorism, child sexual abuse material, fraud), protecting children from harmful material, and giving adults more control over what they see online. However, achieving these goals has meant introducing measures that raise significant privacy concerns.

Why the Online Safety Act Matters for Privacy

Privacy campaigners, cryptographers, and civil liberties groups have been sounding the alarm since the Bill was first proposed. The core tension is straightforward: to detect harmful content at scale, platforms may need to monitor, scan, or verify user activity in ways that undermine encryption and anonymity.

Here are the main privacy pressure points introduced by the Act:

1. Threats to End-to-End Encryption

Section 121 of the Act allows Ofcom to require platforms to use "accredited technology" to scan private messages for child sexual abuse material (CSAM) and terrorism content. For end-to-end encrypted services like WhatsApp and Signal, this is technically incompatible with true encryption. If a message is scanned before it is encrypted (client-side scanning), the privacy guarantee is broken.

Signal has publicly stated it would withdraw from the UK rather than compromise its encryption. Apple abandoned its own client-side scanning proposal in 2022 after backlash. The UK government has said the powers will only be used when "technically feasible," but the legal power remains on the statute book.

2. Mandatory Age Verification

The Act requires platforms hosting pornography and content "harmful to children" to implement "highly effective" age verification. Since July 2025, these rules have been actively enforced. In practice, this means uploading a government-issued ID, submitting to facial age estimation, or linking your identity to a third-party verification service.

Every age check creates a new data footprint linking your identity to sensitive browsing habits — a serious privacy risk if that data is breached or misused.

3. Increased Data Collection and Retention

To comply with reporting duties, platforms must keep more detailed logs of user activity, moderation decisions, and content flags. This means more data about you sitting on more servers for longer periods.

4. Chilling Effect on Anonymous Speech

While the Act does not ban anonymity outright, larger platforms must give users the option to verify their identity and filter out non-verified accounts. Over time, this may pressure users to give up anonymity to fully participate online.

Key Provisions Explained

Understanding the specific duties imposed by the Act helps you see where your privacy is most at risk. Here is a breakdown of the main obligations placed on platforms.

Provision	What It Requires	Privacy Impact
Illegal Content Duty	Platforms must proactively detect and remove illegal content	Requires automated scanning of user content
Child Safety Duty	Prevent children from accessing harmful content	Mandates age verification with ID or biometrics
User Empowerment Duty	Give adults tools to filter content and verify identity	Encourages identity verification
Transparency Reporting	Publish annual reports on moderation and enforcement	Requires extensive logging of user activity
Section 121 Powers	Ofcom can order content scanning technology	Potentially breaks end-to-end encryption
Fraud Prevention Duty	Remove fraudulent adverts and scam content	Increased monitoring of links and communications

How the Online Safety Act Affects Everyday Users

The theoretical concerns become very concrete once you look at day-to-day online activity. Here are the practical changes UK users are already experiencing in 2025 and 2026.

Age Checks on Adult and Age-Restricted Sites

Since July 2025, adult websites accessible from the UK have been required to verify user ages. This typically means:

Uploading a photo of your passport, driving licence, or national ID
Taking a live selfie for facial matching or age estimation
Linking a credit card or mobile phone contract for age confirmation
Using a third-party "digital identity wallet" that stores your age credentials

Changes to Social Media Experience

Platforms like X, Instagram, and TikTok have rolled out UK-specific settings including default content filters for minors, more aggressive removal of borderline content, and prompts to verify identity for expanded features. Some content that was previously available is now geo-blocked for UK users.

Messaging App Uncertainty

Popular encrypted messengers continue to operate in the UK but remain in a legally uncertain position. If Ofcom ever activates its Section 121 powers, users may face a choice between using less secure services or losing access to their preferred apps entirely.

Link and Content Sharing

Platforms are more aggressively scanning links shared by users for fraud, phishing, and prohibited content. This has driven more people to use trusted link management tools when sharing URLs. Services like Lunyb offer clean, privacy-respecting URL shortening that keeps your shared links tidy without adding invasive tracking layers — a small but meaningful choice in an era of increased link surveillance. You can read our honest review of Lunyb to see how it compares to other options.

Practical Steps to Protect Your Privacy Under the Act

While you cannot opt out of the law, you can take sensible steps to minimise the privacy impact on your daily online life.

1. Use Encrypted DNS

Enable DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) in your browser and operating system. This prevents your internet provider from easily seeing which websites you visit — a first line of defence against network-level monitoring.

2. Choose Privacy-Focused Browsers

Browsers like Firefox, Brave, and Mullvad Browser block trackers, fingerprinting, and third-party cookies by default. They also give you granular control over what information websites can collect.

3. Be Selective About Age Verification Providers

If you must complete an age check, prefer providers that use zero-knowledge or double-blind architectures. These systems confirm your age to a site without revealing your identity, and confirm you visited a site without revealing which one to the ID provider.

4. Minimise Data Shared with Platforms

Review privacy settings on every major platform you use. Turn off ad personalisation, disable location history, and remove third-party app connections you no longer need.

5. Use Privacy-Respecting Tools for Links and Sharing

When sharing content, use tools that do not build advertising profiles on your recipients. Compare your options with our 2026 buyer's guide to URL shorteners to find one that fits your privacy preferences.

6. Keep Software Updated

Security patches often close vulnerabilities that could expose your data to breaches. Enable automatic updates on your phone, computer, and browser.

7. Use Strong, Unique Passwords and 2FA

As platforms collect more sensitive data (like verified identity documents), account security becomes even more important. A password manager plus two-factor authentication is now essential, not optional.

What Businesses and Content Creators Need to Know

If you run a website, forum, blog, or online community that hosts user-generated content and is accessible from the UK, you may fall within the Act's scope — even if your business is based elsewhere.

Key obligations for smaller services include:

Conducting risk assessments for illegal content
Providing clear terms of service and complaints procedures
Removing illegal content promptly when notified
Keeping records of moderation decisions
Publishing transparency reports (for larger services)

Content creators and marketers should also be aware that Ofcom takes fraudulent advertising seriously. If you rely on affiliate links or promotional URLs, using a reputable link management platform like Rebrandly or Lunyb helps ensure your links are transparent, trackable, and not flagged as suspicious by platform scanners.

Criticism and Ongoing Debate

The Online Safety Act remains controversial. Supporters point to real harms it addresses — child exploitation, terrorism recruitment, mass fraud, and viral misinformation. Critics argue the Act is too broad, too vague, and gives ministers and Ofcom too much unchecked power over online speech and private communications.

Notable concerns raised by experts include:

The precedent it sets globally for undermining encryption
The risk of over-removal of legal content by cautious platforms
The concentration of sensitive identity data with private verification firms
The chilling effect on journalism, activism, and marginalised communities
The technical impossibility of scanning encrypted content without breaking encryption

Expect ongoing legal challenges, technical workarounds, and legislative amendments over the coming years.

Frequently Asked Questions

Does the UK Online Safety Act break end-to-end encryption?

Not directly, but it gives Ofcom the legal power to require platforms to scan encrypted messages using "accredited technology" if such technology becomes available. In practice, most experts agree that any scanning of encrypted content undermines the core privacy guarantee of end-to-end encryption.

Do I have to verify my age to use social media in the UK?

For most mainstream social media, no — but platforms must have measures to prevent children from accessing harmful content. This may mean age assurance for certain features or content categories. Adult websites and services with high-risk content do require robust age verification for all UK users as of July 2025.

What happens if a platform ignores the Online Safety Act?

Ofcom can issue fines of up to £18 million or 10% of global annual turnover, whichever is greater. In serious cases, senior managers can face criminal liability, and Ofcom can require internet providers to block access to non-compliant services in the UK.

Can I use privacy tools to bypass age verification?

Technical tools that mask your location can sometimes bypass geographic checks, but this may violate a platform's terms of service and, in some cases, could raise legal questions. The safer long-term approach is to use age verification providers that minimise data collection and to demand better privacy protections from regulators.

Does the Act apply to small websites and blogs?

Potentially yes, if your site allows user-generated content (comments, forums, uploads) and is accessible from the UK. However, the compliance burden is proportionate to size and risk. Very small, low-risk services have lighter obligations than major platforms, but they still need to have basic safety measures and complaints processes in place.

Final Thoughts

The UK Online Safety Act represents a genuine attempt to make the internet safer, but it comes with real privacy trade-offs. The most important thing you can do as a user is stay informed, choose tools and platforms that respect your privacy, and make deliberate choices about what identity information you share online.

As enforcement ramps up through 2026, expect ongoing changes to how popular services operate in the UK. Bookmark trusted sources, follow Ofcom's published codes of practice, and treat every request for your ID or biometrics as a decision that deserves careful thought — not a reflex click.