UK Online Safety Act: What It Means for Your Privacy

The UK Online Safety Act 2023 is one of the most far-reaching pieces of internet legislation ever passed by Parliament. Marketed as a landmark effort to make Britain "the safest place in the world to be online," the Act imposes sweeping new duties on social networks, search engines, messaging apps and even smaller user-to-user platforms. But behind the headlines about protecting children and tackling illegal content lies a more complicated story — one with serious implications for the privacy of every ordinary user in the UK.

This guide explains what the Online Safety Act actually does, how Ofcom is enforcing it, where the privacy risks lie, and the practical steps you can take to keep your personal data under your own control.

What Is the UK Online Safety Act?

The Online Safety Act 2023 is a UK law that regulates how online services handle illegal and harmful content. It gives Ofcom, the communications regulator, the power to fine non-compliant platforms up to £18 million or 10% of global annual turnover — whichever is higher — and in extreme cases to block services from operating in the UK.

The Act applies to any service with a "significant number of UK users" or that targets the UK market, regardless of where the company is based. This means US-based platforms like Meta, Google, X and Discord are all in scope, alongside UK-based forums, dating apps, and even small community sites.

Key Duties Imposed on Platforms

1. Illegal content duties — platforms must proactively prevent users from encountering content related to terrorism, child sexual abuse material (CSAM), fraud, and a long list of "priority offences."
2. Child safety duties — services likely to be accessed by children must assess risks and implement "highly effective" age assurance.
3. Transparency duties — large platforms must publish regular reports on moderation decisions, risk assessments and enforcement actions.
4. User empowerment tools — Category 1 services must give adults controls to filter certain legal-but-harmful content.
5. Fraudulent advertising duties — platforms must take action against scam ads, a direct response to the surge in investment and romance fraud.

Why the Act Raises Privacy Concerns

Although the law's goals are widely supported, the mechanisms it uses to achieve them have alarmed privacy campaigners, cryptographers, security researchers and even some of the platforms it regulates. The core tension is simple: you cannot police private communications and verify every user's age without collecting more data about them.

1. The Encryption Backdoor Problem

Section 121 of the Act empowers Ofcom to require messaging services to use "accredited technology" to scan content for CSAM — including in end-to-end encrypted messages. Technologists have warned that there is no way to scan encrypted messages without undermining the encryption itself, a practice sometimes called client-side scanning.

Signal, WhatsApp and Apple's iMessage all publicly threatened to withdraw from the UK rather than weaken their encryption. The government eventually conceded that the scanning powers would only be used when it was "technically feasible" — but the clause remains in the law, ready to be activated.

2. Age Verification and Identity Data

From July 2025, services hosting adult content and many social platforms are required to implement "highly effective age assurance." In practice, this means uploading a government ID, submitting a facial age estimation scan, or linking your account to a bank or mobile operator record.

Every age check creates a new data point tying your real-world identity to the sites you visit. Even when the verification is handled by a third party, those third parties become attractive targets for hackers — and the breach of a single age-verification provider could expose millions of users' browsing habits.

3. Expanded Platform Surveillance

To meet their illegal-content duties, platforms are investing heavily in automated monitoring systems. These tools scan posts, messages, images and link destinations at scale. The result is a quieter, more constant form of surveillance baked into the services most of us use every day.

Who Is Affected?

The Act's scope is far broader than most users realise. The table below summarises how different categories of service are treated.

Service Type	Examples	Main Duties
Category 1 (large user-to-user)	Facebook, Instagram, TikTok, X	All duties, including user empowerment and transparency reports
Category 2A (large search)	Google, Bing	Illegal content, child safety, fraud ads
Category 2B (smaller user-to-user)	Reddit, Discord, mid-sized forums	Illegal content and child safety duties
Adult content services	Pornography sites	Mandatory age verification
Small/community sites	Hobby forums, local community apps	Illegal content duties scaled to risk

Ofcom's Enforcement Timeline

The Act was passed in October 2023, but its duties are being switched on in phases as Ofcom publishes codes of practice. Here is a simplified timeline:

1. March 2025 — illegal content duties came into force. Platforms had to complete risk assessments and implement safety measures.
2. July 2025 — children's safety duties and age assurance requirements activated for in-scope services.
3. Late 2025 onwards — categorisation of the largest services under Category 1, triggering transparency and user-empowerment duties.
4. 2026 — ongoing consultations on encrypted messaging scanning technologies and expanded enforcement.

Practical Privacy Impact for UK Users

What does all of this mean if you are an ordinary person browsing, chatting and shopping in the UK? Here are the most important day-to-day changes you should be aware of.

More Identity Checks

You will encounter age verification walls on far more sites than before — not just adult content, but gambling, dating, alcohol retail, and increasingly mainstream social platforms. Each check asks you to disclose personal data to a service you may not know or trust.

Changes to Private Messaging

Some providers may add on-device scanning or weaken privacy protections to comply with UK requirements. Others may remove features from the UK market entirely. Users should keep an eye on their messaging app's privacy policy and look out for region-specific changes.

More Aggressive Content Moderation

Platforms afraid of 10% global-turnover fines are erring heavily on the side of removal. Legal posts, satire, political commentary and journalistic content have all been caught in automated takedowns. If your account is suspended, you now have a legal right to a clear appeal process on Category 1 services.

Link Tracking and Shortened URLs

Because platforms scan links at scale, the metadata around every URL you share is being analysed more intensively than ever. Using a trustworthy link management service matters more than it used to. A privacy-respecting shortener like Lunyb gives you control over your links without feeding third-party advertising networks — you can read our honest review of Lunyb or compare it against the alternatives in our 2026 URL shortener buyer's guide.

How to Protect Your Privacy Under the Online Safety Act

You cannot opt out of the Act, but you can reduce how much personal data you expose. Here are seven practical steps.

1. Prefer age-estimation over ID upload. Where services offer a choice, facial age estimation that discards the image immediately exposes less data than uploading a passport scan that may be retained.
2. Use separate email aliases. Services like Apple's Hide My Email or Fastmail Masked Emails let you register for sites without exposing your main inbox, limiting how your activity can be cross-referenced.
3. Switch to encrypted DNS. Enabling DNS over HTTPS in your browser or operating system stops your internet provider from logging every domain you visit.
4. Choose privacy-respecting browsers. Firefox, Brave and Safari all offer strong anti-tracking defaults that reduce the data collected by advertisers and analytics providers.
5. Audit app permissions quarterly. Review which apps have access to your contacts, location, microphone and camera, and revoke anything you no longer use.
6. Use strong, unique passwords with a reputable password manager. Age-verification providers become breach targets; unique passwords stop one leak compromising your other accounts.
7. Enable two-factor authentication. Use an authenticator app rather than SMS where possible, since SMS is vulnerable to SIM-swap attacks.

Pros and Cons of the Online Safety Act

Pros

• Creates clear legal duties around CSAM, terrorism and fraud content.
• Gives Ofcom real enforcement teeth, including meaningful fines.
• Mandates transparency reporting from the largest platforms.
• Introduces statutory protections for journalistic and "content of democratic importance."
• Requires platforms to tackle scam advertising, a major cause of consumer harm.

Cons

• Scanning powers threaten end-to-end encryption, affecting every user — not just offenders.
• Age assurance creates vast new honeypots of identity data.
• Compliance costs push smaller UK platforms toward closure or relocation.
• Over-removal of legal content chills legitimate speech.
• Many obligations are vague, leaving platforms to over-comply out of caution.

How the UK Compares Internationally

The Online Safety Act sits alongside similar laws being rolled out globally. Understanding the landscape helps put the UK rules in context.

Jurisdiction	Law	Encryption Scanning?	Mandatory Age Checks?
United Kingdom	Online Safety Act 2023	Permitted "when feasible"	Yes, for in-scope services
European Union	Digital Services Act	No general scanning mandate	Risk-based, not universal
Australia	Online Safety Act 2021	Industry codes under review	Being phased in
United States	Section 230 reforms (state-level)	No federal mandate	Patchwork of state laws

The Road Ahead

The Online Safety Act is a living framework. Ofcom will continue issuing codes of practice, consultations will refine age assurance standards, and the courts will inevitably be asked to weigh platform duties against the Human Rights Act's protections for private life and freedom of expression.

For now, UK internet users should assume that more of their online activity will be verified, logged and moderated than ever before. The best response is not panic but preparation: understand what the law requires, choose services that take privacy seriously, and build a few sensible habits that limit how much of yourself you leave scattered across the web.

Frequently Asked Questions

Does the Online Safety Act apply to me as a user?

The Act regulates platforms, not individuals. However, it changes the services you use — meaning you will see more age checks, stricter moderation and new reporting tools. Your legal rights, including freedom of expression and data protection under the UK GDPR, still apply.

Will my WhatsApp messages be scanned?

Not currently. The Act contains the power to require scanning of encrypted messages, but ministers have said it will only be used when a "technically feasible" method exists that does not break encryption. No such method has been accredited at the time of writing, and major providers have resisted implementation.

Is age verification safe to use?

It depends on the provider. Reputable services that use facial age estimation and immediately delete the source image expose less data than those that store ID documents. Always check the provider's privacy policy, and prefer services certified under the Age Check Certification Scheme (ACCS).

Can small UK websites be fined under the Act?

Yes, in theory. The Act applies regardless of size, though Ofcom has said enforcement will be proportionate. Smaller sites still need to carry out illegal-content risk assessments and have basic reporting and takedown procedures in place.

How do I complain if a platform removes my content wrongly?

Category 1 services must offer an appeals route under the Act. If you believe your rights have been breached, you can escalate to Ofcom, and in some cases to the Information Commissioner's Office (ICO) if personal data has been mishandled during moderation.