UK Online Safety Act: What It Means for Your Privacy

The UK Online Safety Act is one of the most ambitious pieces of internet regulation ever passed in Britain. It changes how platforms moderate content, how children access the web, and — most controversially — how private your messages and browsing really are. If you live in the UK, use British services, or run a website that reaches UK users, the law affects you.

This guide explains what the Online Safety Act does, how it reshapes your privacy, and what practical steps you can take to stay in control of your personal data.

What Is the UK Online Safety Act?

The UK Online Safety Act is a 2023 law that places legal duties on online platforms to protect users — especially children — from illegal and harmful content. Enforcement is handled by Ofcom, which can issue fines of up to £18 million or 10% of global annual revenue, whichever is higher.

The Act applies to any service with a significant UK user base, regardless of where the company is based. That includes social networks, search engines, messaging apps, pornography sites, forums, gaming platforms, cloud storage providers and many smaller user-to-user services.

The Core Duties Imposed

1. Illegal content duties: Platforms must proactively prevent users from encountering illegal material such as terrorism content, child sexual abuse material (CSAM), fraud and intimate image abuse.
2. Child safety duties: Services likely to be accessed by children must assess risks and apply measures such as age assurance, content filtering and safer defaults.
3. Transparency duties: Large platforms must publish annual transparency reports describing moderation outcomes, risk assessments and complaint handling.
4. User empowerment duties: Category 1 services must give adult users tools to filter out legal-but-harmful content, such as self-harm promotion or unsolicited abuse.

Why Privacy Advocates Are Worried

On paper, the Act is about safety. In practice, several provisions directly collide with how private online communication works. Three areas have attracted the most scrutiny: encrypted messaging, mandatory age verification, and the scope of content scanning.

1. The Encryption Clause (Section 121)

Section 121 gives Ofcom the power to require messaging services to use "accredited technology" to detect CSAM — even in end-to-end encrypted conversations. Companies like Signal, WhatsApp and Apple's iMessage publicly stated they would rather withdraw from the UK than break their encryption.

The government has since said the power will only be used when "technically feasible," and experts widely agree that scanning encrypted content without undermining encryption is not currently possible. The clause remains law, however, and could be activated as technology changes. For users, this creates a real question: can you trust that your messages will stay private forever?

2. Age Verification and Identity Checks

Services hosting pornography or content harmful to children must use "highly effective" age assurance. In practice, that often means uploading a government ID, submitting a face scan, or linking to a mobile operator or bank account.

This introduces a new privacy risk: a growing number of third-party age verification providers now hold sensitive identity data linked to adult browsing habits. A breach at one of these providers could be far more damaging than a traditional website hack.

3. Expanded Content Monitoring

To meet their illegal-content duties, platforms are investing heavily in automated scanning — hash matching, AI classifiers, URL blocklists and behavioural analysis. These systems can be effective, but they also generate false positives and create pressure to over-moderate, which can push legitimate speech off mainstream platforms.

How the Online Safety Act Changes Everyday Browsing

Most UK users will notice the Act's effects in small but persistent ways. Here is what has already begun rolling out:

• Age gates on adult sites: From mid-2025, major platforms began requiring ID or facial age estimation before granting access.
• Stricter default settings for under-18s: Recommender systems must be tuned to reduce exposure to harmful material, and private messaging defaults are tightening.
• More content removals and appeals: Expect more posts, images and links to be taken down — and more formal appeal routes to challenge those decisions.
• Blocked or withdrawn services: Some smaller forums and niche platforms have geo-blocked UK users rather than face compliance costs. Expect this trend to continue.
• More friction with link sharing: Platforms are scanning shared URLs more aggressively, which affects everyone who posts links in groups, chats and public channels.

Who the Act Applies To

The scope is broad. The table below summarises which categories of service face which duties.

Service Type	Example	Illegal Content Duty	Child Safety Duty	Age Assurance
Category 1 (large user-to-user)	Facebook, X, TikTok	Yes	Yes	Yes, where relevant
Category 2A (large search)	Google, Bing	Yes	Yes	Partial
Category 2B (smaller user-to-user)	Mid-size forums, Discord-like apps	Yes	Yes	Risk-based
Pornography providers	Adult tube sites	Yes	Yes	Mandatory, "highly effective"
Private messaging	WhatsApp, Signal, iMessage	Yes	Yes	Limited

Impact on Specific Groups

Adults Who Value Private Communication

If you rely on encrypted messengers for journalism, activism, legal work or personal safety, the lingering threat of client-side scanning is a long-term concern. The Act does not force platforms to break encryption today, but it establishes the legal scaffolding for doing so later.

Small Website Owners and Community Admins

Running a forum, Discord server, or any space where users can post to each other may bring your service into scope. Ofcom has published simplified guidance for low-risk services, but you are still expected to carry out a risk assessment, keep records and publish terms describing your moderation approach.

Marketers and Link Sharers

Links are now a flashpoint. Aggressive URL scanning means that shortened links, redirect chains and unknown domains can be flagged, throttled or blocked. Using a reputable, transparent link management platform — rather than an anonymous free shortener with a poor reputation — matters more than ever. We cover this trade-off in detail in our 2026 buyer's guide to URL shorteners.

Parents and Younger Users

Many of the Act's protections are genuinely useful for families: safer defaults, clearer reporting tools, and faster takedown of harmful content. Parents should still have conversations about online safety rather than relying solely on platform-level filters.

Practical Steps to Protect Your Privacy

You cannot opt out of the Online Safety Act, but you can reduce how much personal information you expose while using UK-regulated services.

1. Choose age verification providers that use "double-blind" systems. These confirm your age to a website without telling the website who you are, and without telling the verifier which site you visited.
2. Switch to encrypted DNS. DNS-over-HTTPS or DNS-over-TLS prevents your internet provider from logging every domain you visit. Most modern browsers support this with a single setting change.
3. Use privacy-respecting browsers. Browsers like Firefox, Brave and Safari block trackers by default and reduce the fingerprinting data that advertisers and data brokers collect.
4. Review app permissions quarterly. Many apps request far more data than they need. Revoke access to contacts, location and microphone wherever it is not essential.
5. Minimise data at the source. Use alias email addresses, avoid linking your real name to every account, and prefer services that offer clear data export and deletion.
6. Be careful what you shorten and share. If you distribute links at scale, use a shortener that is transparent about how it handles click data. For example, Lunyb publishes its data practices and offers link-level privacy controls that make it easier to share safely without feeding more data into advertising ecosystems.

How the UK Approach Compares

The Online Safety Act does not exist in a vacuum. Similar laws are reshaping the global internet, and the UK sits somewhere between the EU's rules-based approach and the lighter-touch US model.

Jurisdiction	Key Law	Encryption Stance	Age Verification	Max Fine
United Kingdom	Online Safety Act 2023	Scan-when-feasible power	Mandatory for adult content	£18m or 10% revenue
European Union	Digital Services Act	Protects encryption	Risk-based	6% global revenue
Australia	Online Safety Act 2021	Industry codes model	Trialled for adult content	AU$1.65m per breach
United States	State-level laws (KOSA pending)	Strong constitutional protection	Varies by state	Varies

The Pros and Cons at a Glance

Pros

• Clearer accountability for platforms that profit from user content
• Stronger protections for children against harmful material
• Faster takedown of fraud, intimate image abuse and terrorist content
• Formal transparency reporting that researchers and journalists can scrutinise
• Ofcom enforcement with real financial teeth

Cons

• Encryption-scanning powers create long-term uncertainty for private messaging
• Mandatory age verification concentrates sensitive identity data in new third parties
• Automated moderation leads to over-removal of legitimate content
• Compliance costs may push smaller UK services out of the market
• Some overseas services choose to geo-block UK users entirely

What to Watch Next

Enforcement is being phased in through 2025 and 2026. Key milestones to follow include Ofcom's categorisation of services, further guidance on age assurance technologies, and any formal use of Section 121 encryption-related powers. Court challenges and parliamentary reviews are also likely as the Act beds in.

For UK users, the bottom line is simple: the internet you use day to day is becoming safer in some ways and more surveilled in others. Being deliberate about which services you trust, what data you hand over, and how you share links is now part of basic digital hygiene — not something only journalists or activists need to think about.

Frequently Asked Questions

Does the UK Online Safety Act break end-to-end encryption?

Not today. The Act contains a power (Section 121) that could in principle require scanning of encrypted content, but the government has said it will only be used when "technically feasible." Experts currently agree no such technology exists without weakening encryption, so for now your encrypted messages on Signal, WhatsApp and iMessage remain private.

Do I have to upload my ID to watch adult content in the UK?

You have to prove you are over 18, but ID upload is only one option. Many providers also accept facial age estimation, mobile operator checks, bank-based verification or credit card confirmation. Where possible, choose providers that advertise "double-blind" or "zero-knowledge" verification so the site never learns your identity.

Does the Online Safety Act apply to my small website or forum?

If users can post content that other users can see, it probably does. However, Ofcom has published a simplified compliance route for low-risk, low-traffic services. At minimum, you need a risk assessment, clear terms of service, a reporting mechanism and basic record-keeping.

Will the Act stop me using overseas services?

Most mainstream platforms will comply rather than leave the UK, but some smaller or niche services have already geo-blocked UK users to avoid compliance costs. Expect a gradual narrowing of the long tail of smaller international services available in Britain.

What is the single best step I can take to protect my privacy under the new rules?

Reduce the amount of personal data you give out in the first place. Use alias emails, privacy-respecting browsers, encrypted DNS, and services that are transparent about their data practices. Privacy is now a layered discipline — no single tool solves it, but each sensible choice compounds.