UK Online Safety Act: What It Means for Your Privacy

The UK Online Safety Act is one of the most sweeping pieces of internet legislation ever passed in Britain. Billed as a law to protect children and tackle illegal content, it also hands regulators significant new powers over how platforms moderate speech, verify ages, and even scan private messages. For ordinary users, the practical question is simple: what does the Online Safety Act actually mean for your privacy?

This guide breaks down the Act in plain English, explains the privacy trade-offs that have been baked into its design, and offers practical steps you can take to protect your personal data as enforcement ramps up through 2026 and beyond.

What is the UK Online Safety Act?

The Online Safety Act 2023 is a UK law that imposes a legal "duty of care" on online platforms to protect users — especially children — from illegal and harmful content. It is enforced by Ofcom, the UK communications regulator, which can fine companies up to £18 million or 10% of global turnover (whichever is higher) and, in extreme cases, order internet service providers to block non-compliant services.

The Act covers an enormous range of services: social networks, search engines, messaging apps, forums, dating sites, pornography sites, cloud storage, and many smaller user-to-user platforms. If a service has a "significant number of UK users" or targets the UK market, it is in scope — even if the company is based abroad.

Key duties the Act creates

Illegal content duties: Platforms must proactively remove priority illegal content (terrorism, CSAM, fraud, hate crimes, and more).
Child safety duties: Services likely to be accessed by children must assess risks and implement safety measures, including "highly effective" age verification where appropriate.
Transparency duties: Larger platforms must publish annual reports on their moderation practices.
User empowerment duties: Category 1 services must give adult users tools to filter out legal-but-harmful content such as self-harm or abuse.
Fraud and scam duties: Platforms must take action against paid-for scam adverts and user-posted fraudulent content.

Why the Act Raises Privacy Concerns

The Online Safety Act is not, on its face, a privacy law — but almost every duty it creates has downstream consequences for how much data platforms collect about you, how they verify who you are, and whether your private communications remain truly private.

1. Age verification and identity data

The most visible change for UK users in 2025 and 2026 is the rollout of "highly effective age assurance." Pornography sites, and increasingly social networks and other services likely to be accessed by children, must verify that users are adults. Ofcom's guidance accepts several methods, including:

Photo-ID matching (uploading a passport or driving licence)
Facial age estimation from a live selfie
Credit card or open banking checks
Mobile network operator age checks
Digital identity wallets

Each of these methods involves sharing sensitive personal data — biometrics, government ID, or financial information — with either the platform or a third-party age assurance provider. Even when providers promise not to retain data, users have to trust the entire supply chain. A breach at an age-check vendor could expose exactly which adult websites a person has tried to access, a scenario privacy advocates have warned about for years.

2. The encryption question

Section 121 of the Act gives Ofcom the power to require platforms to use "accredited technology" to identify CSAM and terrorism content, including in private messages. End-to-end encrypted services like Signal, WhatsApp, and iMessage warned during the Bill's passage that this would effectively force client-side scanning — software running on your phone that inspects messages before they are encrypted.

The government has said the power will only be used when "technically feasible," and Ofcom has signalled it will not deploy it until such scanning can be done without undermining encryption. In practice, no such technology exists today. But the legal power remains on the statute book, which means the privacy guarantees of encrypted messaging in the UK depend on a regulator's restraint rather than a technical impossibility.

3. More data collection, more risk

To comply with risk assessments, content moderation duties, and age checks, platforms are collecting more data about user behaviour than ever before. More data means more targets for hackers, more subject-access complexity, and more opportunities for mission creep — data gathered for safety reasons being repurposed for advertising, law enforcement requests, or algorithmic profiling.

Who Does the Act Apply To?

The Act uses a tiered system based on size and risk. Understanding which tier a service falls into helps you anticipate how aggressively it will collect your data.

Category	Examples	Main Duties	Privacy Impact
Category 1 (largest user-to-user)	Facebook, X, TikTok, YouTube	All duties plus user empowerment, transparency, fraud ads	High — extensive age checks, content scanning, data retention
Category 2A (large search)	Google, Bing	Illegal content, child safety, transparency	Moderate — query logging, result filtering
Category 2B (smaller user-to-user)	Mid-sized forums, niche social apps	Illegal content, child safety	Moderate — depends on risk profile
Regulated pornography services	Adult sites with UK traffic	Highly effective age verification	Very high — ID or biometric checks
Small/low-risk services	Hobby forums, small blogs with comments	Basic illegal content duties	Lower — but still subject to Ofcom reporting

Practical Privacy Impacts for UK Users

You will be asked to prove your age more often

Expect age checks not just on adult sites but on mainstream social platforms, gaming services, and even some news comment sections. Where you have a choice of verification method, consider which exposes the least data. Facial age estimation that deletes the image immediately is generally less risky than uploading a passport photo that may be retained.

Default settings for children are tightening

If you are under 18, platforms must apply stricter default privacy settings, limit recommendations of harmful content, and in many cases restrict direct messaging from strangers. Parents gain more visibility, but teens lose some anonymity — a trade-off that has sparked debate about the right to privacy for young people themselves.

Smaller UK services may close or geo-block

Compliance costs are significant. Several smaller forums and hobbyist platforms have already blocked UK users entirely rather than face Ofcom enforcement. The result is a less diverse internet experience for people in Britain — a privacy issue in the sense that users are pushed toward a smaller number of large platforms with heavier data collection.

How to Protect Your Privacy Under the Online Safety Act

The Act is now law, but you still have meaningful control over how much personal data you expose. Here are practical steps that work within the new rules.

1. Minimise what you share during age checks

Where possible, choose age-estimation methods that do not require government ID. Prefer providers that are certified under the Age Check Certification Scheme (ACCS) and that publish clear data-deletion commitments. Avoid reusing the same email address across adult services and mainstream accounts.

2. Separate your identities

Use distinct email addresses, usernames, and even browsers for different categories of online activity. Email aliasing services (such as those offered by major email providers and dedicated tools like SimpleLogin or Firefox Relay) let you create disposable addresses that forward to your main inbox without revealing it.

3. Harden your browser and DNS

Use a privacy-focused browser such as Firefox, Brave, or Safari with tracking protection enabled. Enable encrypted DNS (DNS-over-HTTPS) through providers like Cloudflare 1.1.1.1 or Quad9 to prevent your internet provider from logging every domain you visit. These are network-level protections that work regardless of what any individual platform does.

4. Be careful with links you share and click

Under the Act, platforms are increasingly scanning URLs for fraud and illegal content, which means the links you post or click are logged and analysed. If you share links professionally — for marketing, journalism, or community management — consider using a reputable link management tool that gives you control over analytics and does not sell click data to third parties. Services like Lunyb let you create short links with privacy-respecting analytics; our honest review of Lunyb and our 2026 buyer's guide to URL shorteners explain how different providers compare on data handling.

5. Review your platform privacy settings annually

As platforms update their systems to comply with the Act, default settings change. Set a calendar reminder to review the privacy dashboards on your main accounts at least once a year. Pay particular attention to "activity data," "personalised ads," and any new "safety" toggles that may share more data than you expect.

6. Know your UK GDPR rights

The Online Safety Act does not override UK GDPR. You still have the right to request a copy of your personal data, correct inaccuracies, and in many cases demand deletion. If an age-check provider or platform refuses a reasonable request, you can escalate to the Information Commissioner's Office (ICO).

What's Next: Enforcement Timeline Through 2026

Ofcom has been rolling out the Act in phases. The illegal content codes of practice came into force in March 2025, child safety duties followed in summer 2025, and the full regime for Category 1 services is being finalised through 2026. Expect more consultations on encryption, more enforcement actions against non-compliant adult sites, and ongoing legal challenges from civil liberties groups.

The direction of travel is clear: UK internet users will be identified more often, communications will be scrutinised more intensively, and the burden of maintaining privacy will shift increasingly onto individuals. Understanding the Act is the first step; adjusting your digital habits is the second.

Frequently Asked Questions

Does the Online Safety Act break end-to-end encryption?

Not currently. The Act gives Ofcom the power to require scanning of encrypted messages, but the regulator has stated it will not use this power until technology exists that can do so without weakening encryption. No such technology exists today, so apps like Signal and WhatsApp continue to operate normally in the UK. However, the legal power remains, and this is a live concern for privacy advocates.

Do I have to use my real ID to access adult websites in the UK?

You must prove you are over 18 using a method the site has approved, but you do not always have to upload government ID. Many sites accept facial age estimation, credit card checks, or mobile operator verification. Choose the method that exposes the least personal data and check whether the provider is certified and deletes images immediately after verification.

Does the Online Safety Act apply to small websites and personal blogs?

Yes, if they allow user-generated content such as comments or forums and have UK users. However, Ofcom has indicated a proportionate approach for small, low-risk services — basic duties around illegal content apply, but the heaviest requirements (age checks, user empowerment tools, transparency reports) target larger platforms. Many small UK forums have nonetheless chosen to close comment sections or restrict access to reduce compliance risk.

Can I be fined personally for breaking the Online Safety Act?

The Act's fines target companies, not individual users. However, senior managers at non-compliant platforms can face criminal liability in certain circumstances, such as failing to comply with Ofcom information notices or breaching child safety duties. Ordinary users posting legal content are not the target of enforcement.

How does the Act interact with UK GDPR?

The Online Safety Act operates alongside, not instead of, UK GDPR. Platforms must still have a lawful basis for processing personal data, apply data minimisation, and respect your rights to access and erasure. If a safety measure collects more data than necessary, it may breach GDPR even if it satisfies the Online Safety Act. The ICO and Ofcom have published joint guidance on resolving these tensions.