UK Online Safety Act: What It Means for Your Privacy

The UK Online Safety Act is the most significant piece of internet legislation Britain has passed this century. It reshapes how platforms handle harmful content, verify user ages, and cooperate with regulators — and in doing so, it touches almost every aspect of your online privacy. Whether you run a small website, moderate a community forum, or simply scroll social media over your morning coffee, the Act quietly changes the rules of engagement between you, the platforms you use, and the British state.

This guide breaks down what the UK Online Safety Act actually says, how it affects your personal privacy in practical terms, and what you can do to protect your data while remaining compliant with the law.

What Is the UK Online Safety Act?

The UK Online Safety Act is a 2023 law that places legal duties on online platforms — from social networks and search engines to messaging apps and pornography sites — to protect users, especially children, from illegal and harmful content. It is enforced by Ofcom, which has the power to issue fines of up to £18 million or 10% of a company's global annual turnover, whichever is greater.

The Act came into force in stages, with the most impactful provisions on illegal content duties and age assurance beginning to bite from 2024 into 2025 and 2026. It replaces the previous patchwork of self-regulation with a comprehensive, statutory framework overseen by a single regulator.

Who the Act Applies To

The Act has extraterritorial reach. It applies to any service with "links to the UK", which broadly means:

• Services with a significant number of UK users
• Services that target the UK market
• Services that can be accessed from the UK and pose a material risk of harm to UK users

In practice, this pulls in almost every major global platform, plus thousands of smaller international sites and forums.

The Three Categories of Regulated Services

1. Category 1: The largest user-to-user services with the widest reach — think major social networks. They face the strictest duties.
2. Category 2A: The largest search services, subject to specific search-related obligations.
3. Category 2B: Other significant user-to-user services that don't meet Category 1 thresholds but still carry considerable duties.

Why the Online Safety Act Matters for Your Privacy

The Act was designed primarily as a safety measure, but almost every duty it imposes has a privacy consequence. Platforms cannot verify ages, detect illegal content, or assess risk without collecting more data about who you are and what you do. That trade-off is at the heart of the ongoing debate.

Age Assurance and Age Verification

One of the most visible changes for UK users is the rollout of "highly effective age assurance" for services likely to be accessed by children, and mandatory age verification for pornography and certain other adult content. Acceptable methods include:

• Photo-ID matching (uploading a passport or driving licence)
• Facial age estimation using a live selfie
• Credit or debit card checks
• Open banking checks
• Mobile network operator age checks
• Digital identity wallets

Each of these methods hands sensitive personal data — either directly to the platform or to a third-party age assurance provider — that would previously have stayed private. Even when providers promise not to retain images, the mere act of sharing a passport photo with a website creates a new privacy attack surface.

Impact on End-to-End Encryption

The most controversial section of the Act, often called the "spy clause," gives Ofcom the power to require services to use "accredited technology" to identify child sexual abuse material and terrorism content — potentially even in end-to-end encrypted messages. The government has said this power will only be used when "technically feasible," but the clause remains on the statute book.

For everyday users this matters because encrypted messaging apps like Signal, WhatsApp, and iMessage have all publicly warned they would rather withdraw from the UK than break their encryption. The long-term future of truly private messaging in the UK depends on how Ofcom actually exercises these powers.

Increased Data Collection and Retention

To meet their duties, platforms are collecting and retaining more information than before, including:

• Content moderation logs tied to individual accounts
• Reports and complaints, including reporter identities
• Age assurance records and audit trails
• Risk assessment data covering user behaviour patterns

Even where this data is held by third parties, it still exists somewhere — and where data exists, it can be breached, subpoenaed, or repurposed.

Key Privacy Trade-Offs at a Glance

Duty Under the Act	Intended Benefit	Privacy Cost
Age verification for adult sites	Prevents minors accessing pornography	Links real-world identity to browsing history
Age assurance on social platforms	Age-appropriate experiences for children	Wider ID or biometric collection for all users
Illegal content scanning	Faster removal of CSAM and terrorism material	Possible weakening of end-to-end encryption
Risk assessments	Better platform accountability	Deeper behavioural profiling of users
User reporting and appeals	Fairer moderation outcomes	More identity-linked moderation records retained

How the Act Interacts With UK GDPR

The Online Safety Act does not override UK GDPR or the Data Protection Act 2018. Platforms must still have a lawful basis for processing personal data, apply data minimisation, and respect your rights as a data subject. The Information Commissioner's Office (ICO) and Ofcom have published joint statements committing to work together where the two regimes overlap.

Your Data Rights Still Apply

Even under the new safety duties, you retain the right to:

• Access the personal data a platform holds about you (Subject Access Request)
• Request correction of inaccurate data
• Request erasure where the data is no longer necessary
• Object to certain types of processing
• Complain to the ICO if you believe your rights have been breached

Age assurance providers are themselves data controllers or processors under GDPR, so any biometric or ID data they collect must be handled lawfully, securely, and transparently.

Practical Steps to Protect Your Privacy Under the Act

You cannot opt out of the Online Safety Act, but you can make deliberate choices to minimise how much of your identity ends up scattered across the internet.

1. Choose Age Assurance Methods Carefully

When a site offers multiple age verification options, the least invasive is usually best. Ranking them roughly from least to most identifying:

1. Mobile network operator age check (confirms 18+ status without sharing ID)
2. Digital identity wallet with selective disclosure (shares only the "over 18" attribute)
3. Facial age estimation (biometric, but usually not retained)
4. Credit card check (links to financial identity)
5. Photo-ID upload (highest identifying data exposure)

Always check whether the age assurance provider is certified under a recognised scheme and read its retention policy before uploading anything.

2. Use Encrypted DNS and a Privacy-Focused Browser

Regulator-mandated content controls typically operate at the platform level, but ISPs and public networks also filter and log DNS traffic. Enabling encrypted DNS (DoH or DoT) in your browser or operating system, alongside a browser like Brave, Firefox, or Safari with tracking protection turned up, reduces the amount of metadata your network provider can see about your browsing habits.

3. Separate Identities Where Reasonable

Keep your "identity-verified" accounts (banking, government services, age-verified adult sites) separate from casual browsing and social identities. Use different email addresses, and consider email aliasing services to avoid linking accounts by shared contact details.

4. Be Careful What You Click and Share

Under the Act, platforms log and retain far more moderation and link data than before. Shortened, disposable, or branded links can help you understand exactly where a URL leads before you click, and let you share content on your own domain rather than exposing raw affiliate or tracking URLs. Privacy-conscious link tools like Lunyb let you shorten and manage links without the aggressive tracking that some legacy shorteners bake in — a useful habit whether you are a creator, marketer, or just a careful sharer. You can read an independent take in our honest review of Lunyb, or compare alternatives in our 2026 URL shortener buyer's guide.

5. Exercise Your Data Rights Actively

If you are asked to complete age verification or hand over ID, follow up a few weeks later with a Subject Access Request to confirm the data has been deleted or minimised as promised. Providers that ignore or delay these requests can be reported to the ICO.

What the Act Means for Small UK Websites and Creators

Not every site is a Category 1 platform, but the Act still applies to any UK-facing service that hosts user-generated content — including comment sections, forums, and community boards. If you run a small website, the practical implications include:

• Carrying out an illegal content risk assessment and keeping a record of it
• Providing clear reporting and complaints mechanisms
• Publishing terms of service that reflect the Act's requirements
• Applying proportionate age assurance if your service is likely to be accessed by children

For very small services, Ofcom has taken a proportionate approach, but "small" is not the same as "exempt." Even hobby forums must at least document their risk assessment.

Marketing, Links and Compliance

Creators and marketers should also consider how the links they share reflect on their brand under the Act. Cloaked or misleading redirects can be treated as harmful, particularly where they lead to scams, phishing, or age-restricted content without warning. Using a reputable, transparent shortener — and choosing branded domains where possible — helps signal legitimacy to both users and regulators. Our Rebrandly review covers one option in the branded-link space if you're evaluating tools.

Enforcement: What Ofcom Can Actually Do

Ofcom's powers under the Act are unusually broad for a UK regulator. It can:

1. Require information from platforms, including confidential technical detail
2. Enter premises and inspect algorithms in limited circumstances
3. Impose fines up to £18 million or 10% of global turnover
4. Apply for court orders that block non-compliant services from the UK
5. Hold senior managers criminally liable in specific cases involving child safety

The regulator has said it will focus initial enforcement on the highest-risk services and the clearest breaches, rather than pursuing every small forum. Still, the mere existence of these powers changes how platforms design their products for UK users.

The Bigger Picture: Safety, Privacy and Free Expression

The UK Online Safety Act is neither the privacy catastrophe some critics feared nor the clean solution its supporters promised. It genuinely does raise the floor on how platforms handle illegal content — but it also normalises identity checks for ordinary browsing, expands data collection, and creates legal hooks that could weaken encryption in future.

The healthiest response is neither panic nor complacency. Understand the trade-offs, use the least invasive verification method available, keep your identities compartmentalised, and exercise your GDPR rights when providers over-collect. The Act will evolve — subsequent codes of practice, court rulings, and the promised review of encryption powers will all shape how it operates in practice.

Frequently Asked Questions

Does the UK Online Safety Act require me to give my ID to social media sites?

Not always. Most social platforms use age assurance rather than full identity verification, and methods like facial age estimation or mobile operator checks do not require you to upload ID. However, adult content sites and some higher-risk services do require stronger verification, which usually involves ID or a payment method. You can typically choose the least identifying method they offer.

Will end-to-end encrypted messaging still work in the UK?

Yes, for now. The Act contains powers that could in future require scanning of encrypted content, but the government has stated these will only be used when "technically feasible" — a standard that does not currently exist without breaking encryption. Major encrypted messengers continue to operate in the UK, and any move to force scanning would likely trigger legal challenges.

What happens to my ID after age verification?

Certified age assurance providers are required under UK GDPR to minimise data and delete it after use, unless they have another lawful basis to keep it. Reputable providers typically discard the image immediately after verification and retain only a token or hash proving that verification took place. You have the right to submit a Subject Access Request to confirm this.

Does the Act apply to small forums and personal blogs?

If your site hosts user-generated content and is accessible from the UK, then yes — but the duties are proportionate to your size and risk. In practice, small blogs and hobby forums mainly need to document a basic risk assessment, provide clear reporting mechanisms, and remove illegal content promptly. Ofcom has published guidance specifically for smaller services.

How can I complain if I think a platform is misusing data collected under the Act?

Privacy complaints go to the Information Commissioner's Office (ICO), which enforces UK GDPR and the Data Protection Act 2018. Safety-duty complaints — for example, if a platform is failing to remove illegal content — go to Ofcom. The two regulators coordinate on overlapping issues, so you can approach whichever is most relevant and expect them to route your complaint appropriately.