UK Online Safety Act: What It Means for Your Privacy

The UK Online Safety Act is one of the most significant pieces of internet legislation Britain has ever passed. It reshapes how platforms moderate content, how they verify who you are, and ultimately how much privacy you can expect when you use the web from a UK connection. If you post on social media, run a small website, use encrypted messaging, or simply browse news sites, this law touches your digital life in ways that are not always obvious.

This guide breaks down what the Act actually does, which parts affect your personal privacy most directly, and what practical steps you can take to keep control of your data without falling foul of the new rules.

What Is the UK Online Safety Act?

The UK Online Safety Act 2023 is a law that imposes a legal duty of care on online platforms to protect users — particularly children — from illegal and harmful content. It is enforced by Ofcom, which can issue fines of up to £18 million or 10% of global annual turnover, whichever is higher.

The Act applies to any service with a significant number of UK users or that targets the UK market, regardless of where the company is based. That includes social networks, search engines, messaging apps, pornography sites, cloud storage platforms, dating apps, and even smaller forums and comment sections if they allow user-generated content.

Core Duties the Act Introduces

1. Illegal content duties: platforms must proactively remove content linked to terrorism, child sexual abuse material, fraud, and other priority offences.
2. Child safety duties: services likely to be accessed by children must assess risks and reduce exposure to harmful material such as self-harm promotion, pornography, and bullying.
3. Age assurance: platforms hosting adult content or high-risk material must verify that users are over 18 using "highly effective" age checks.
4. Transparency reporting: larger services must publish how they moderate content and handle complaints.
5. User empowerment tools: category 1 platforms must give adults tools to filter unverified accounts and reduce exposure to certain legal-but-harmful content.

Why the Act Matters for Your Privacy

On paper, the Act is about safety. In practice, several of its mechanisms require platforms to collect, process, or scan more of your data than they did before. That is where the privacy conversation begins.

1. Age Verification and Identity Data

To access adult sites, and increasingly social platforms with mature content, UK users are now being asked to prove their age. Accepted methods include uploading a passport or driving licence, submitting a selfie for facial age estimation, linking a bank or mobile account, or using a digital ID wallet.

Each of these creates a new data footprint. Even when providers promise not to store the underlying document, metadata, timestamps, and verification tokens still exist. If a verification provider is breached — and several already have been — intimate browsing habits can be linked back to a real name.

2. Pressure on End-to-End Encryption

One of the most debated provisions in the Act is the power for Ofcom to require messaging services to use "accredited technology" to scan for child sexual abuse material. In private, end-to-end encrypted services, that effectively means client-side scanning: software on your phone checks messages before they are encrypted and sent.

The government has said it will not use this power until it is "technically feasible" to do so without breaking encryption, but the clause remains in the law. Services like Signal and WhatsApp have publicly stated they would withdraw from the UK market rather than compromise their encryption.

3. More Logging, Longer Retention

To demonstrate compliance, platforms must keep detailed records of moderation decisions, risk assessments, and user reports. That often translates to longer retention of your posts, DMs flagged by filters, and metadata about who you interact with. Even content you delete may be preserved for audit purposes.

4. Chilling Effects on Anonymous Speech

The Act does not ban anonymity, but "user verification" duties encourage platforms to offer verified-only modes. Over time, unverified accounts may see reduced visibility, lose features, or be filtered out by default. For whistleblowers, abuse survivors, LGBTQ+ users in hostile family situations, and journalists' sources, that shift matters enormously.

Who the Act Applies To

The scope is wider than many people realise. The following table summarises the main categories and what they must do.

Service type	Examples	Key duties
Category 1 (large user-to-user)	Facebook, X, TikTok, YouTube	Illegal content, child safety, user empowerment, transparency, verification options
Category 2A (large search)	Google, Bing	Illegal content, child safety, transparency
Category 2B (smaller user-to-user with risk factors)	Mid-sized forums, niche social apps	Illegal content, child safety, transparency
Pornography services	Adult tube sites, cam platforms	Highly effective age assurance
Small services with user content	Hobby forums, blog comments, Discord servers	Illegal content duties, risk assessments proportional to size

How Age Assurance Actually Works

Ofcom's codes list several methods platforms can use. Each has different privacy trade-offs.

Common Methods Compared

Method	How it works	Privacy risk
Photo ID upload	You upload a passport or licence to a verifier	High — sensitive document in third-party hands
Facial age estimation	A selfie is analysed to estimate your age bracket	Medium — biometric data processed, usually deleted after check
Credit card check	Small authorisation on a card only adults can hold	Medium — links identity to the service
Mobile network check	Your carrier confirms you're over 18	Low to medium — carrier learns which site you visited
Digital ID wallet	A reusable attribute ("over 18") is shared without revealing identity	Low — if the wallet is well designed and audited

Where you have a choice, reusable digital ID wallets and mobile-network checks tend to leak the least information. Avoid uploading identity documents to small or unknown verifiers.

Practical Steps to Protect Your Privacy Under the Act

You cannot opt out of a UK law, but you can minimise how much personal data is collected about you as platforms adapt. The following steps are legal, sensible, and widely recommended by UK privacy groups.

1. Audit Which Services Hold Your ID

Make a list of every platform where you have completed age verification. Where possible, request deletion of the underlying document under UK GDPR once the check is complete. Most verifiers must comply within one month.

2. Use Separate Email Addresses

Use a dedicated email for services that require identity checks, and a different one for general browsing and newsletters. This limits cross-site profiling if any single provider is breached.

3. Prefer Encrypted Services While They Remain Encrypted

Signal, Element, Proton Mail, and similar services continue to offer strong end-to-end encryption. Using them for private conversations is still one of the most effective privacy choices available.

4. Harden Your DNS and Browser

Enable encrypted DNS (DNS over HTTPS or DNS over TLS) in your browser or operating system. Use a privacy-focused browser such as Firefox, Brave, or Safari with tracking protection enabled. Install uBlock Origin on desktop. These steps reduce the amount of behavioural data third parties can collect.

5. Be Careful With Short Links and Shared URLs

Links you share publicly can be scraped, tracked, and tied to analytics profiles. If you run a newsletter, Discord server, or small business and need to share links, use a reputable shortener that respects privacy and gives you control over expiry and analytics. Tools like Lunyb let you shorten URLs without the heavy third-party tracking that some older services bundle in — useful if you want clean, auditable links for a UK audience that may be more privacy-conscious under the new regime. If you are comparing options, our 2026 buyer's guide to URL shorteners breaks down the trade-offs.

6. Review Platform Privacy Controls Regularly

Category 1 platforms must now offer user empowerment tools. Spend ten minutes in your account settings on each major service and turn on filters for unverified accounts, sensitive content, and direct messages from strangers if those options matter to you.

What the Act Does Not Do

There is a lot of noise online about the Act. Some claims are overblown. For balance, here is what the Act does not do:

• It does not require every UK internet user to verify their identity to go online.
• It does not ban encryption outright.
• It does not criminalise ordinary users for seeing harmful content — duties fall on platforms, not individuals.
• It does not force small blogs with no user interaction to do anything new.
• It does not block access to tools that protect your privacy at the network level.

Running a Small UK Site Under the Act

If you run a blog, forum, Discord community, or small e-commerce site with reviews, you may be in scope — but your duties are proportional. Ofcom's "small, low-risk service" guidance expects you to:

1. Complete a basic illegal content risk assessment and keep a record of it.
2. Have clear terms of service explaining what is not allowed.
3. Provide a way for users to report illegal content.
4. Act promptly when illegal content is flagged.
5. Review your assessment annually or when you make major changes.

You do not need a legal team to do this, but you should document your decisions. If you also publish reviews or affiliate content — for example, comparing tools like our Rebrandly review or honest look at Lunyb — standard content moderation of comments is usually enough.

Pros and Cons for Everyday Users

Pros

• Faster removal of genuinely illegal content such as fraud ads and intimate image abuse.
• Better protections for children against pornography and self-harm material.
• More transparency about how platforms moderate.
• Clearer complaints and appeals processes on major services.

Cons

• More personal data collected through age verification.
• Potential long-term threat to end-to-end encryption.
• Risk of over-removal of legitimate content as platforms play it safe.
• Compliance costs may push smaller UK platforms to shut down or geoblock Britain.
• Pressure on anonymous and pseudonymous speech.

The Road Ahead

Ofcom is rolling out codes of practice in phases through 2025 and 2026, with age assurance duties already live for pornography services and user-to-user duties being enforced progressively. Expect further consultations on category thresholds, encryption, and generative AI content.

For individuals, the sensible stance is neither panic nor complacency. Treat identity data as valuable, choose services that minimise what they collect, and keep an eye on which platforms genuinely respect UK users versus those that treat compliance as a tick-box exercise.

Frequently Asked Questions

Does the UK Online Safety Act mean I have to verify my ID to use the internet?

No. The Act does not require universal identity verification. Age checks apply mainly to pornography sites and some high-risk content areas on larger platforms. Most everyday browsing, shopping, and messaging continues without identity verification.

Will the Act break encrypted messaging apps like Signal and WhatsApp?

Not immediately. The Act contains a power for Ofcom to require scanning of private messages, but the government has said it will not use that power until it is technically possible without undermining encryption. For now, these services remain fully end-to-end encrypted in the UK.

What happens to my ID documents after an age check?

Under UK GDPR, verifiers must only keep the document for as long as necessary. Many delete the image within minutes of a successful check and retain only a cryptographic token proving the check happened. You have the right to ask a verifier what they still hold and request deletion.

Does the Act apply to small blogs and hobby forums?

It can, if they host user-generated content such as comments, posts, or uploads. However, duties are proportionate to size and risk. A small, low-risk forum mainly needs a basic risk assessment, clear rules, and a reporting mechanism — not enterprise-grade moderation.

Can I still browse privately in the UK?

Yes. Encrypted DNS, privacy-focused browsers, tracker blockers, encrypted messengers, and careful account hygiene all remain fully legal and effective. The Act regulates platforms, not the privacy tools individuals use to protect themselves.