UK Online Safety Act: What It Means for Your Privacy

The Online Safety Act 2023 is one of the most ambitious pieces of internet legislation ever passed in the United Kingdom. Hailed by the government as a landmark effort to make Britain "the safest place in the world to be online," the Act has also drawn sharp criticism from privacy campaigners, security researchers, and technology companies who argue it undermines encryption, enables mass surveillance, and risks turning everyday internet users into subjects of constant monitoring.

If you live in the UK, use British services, or operate a platform that reaches UK users, the Act affects you. This guide explains what the Online Safety Act actually does, how it changes your privacy online, what it means for encrypted messaging, and the practical steps you can take to protect your personal data in the new regulatory landscape.

What Is the UK Online Safety Act?

The UK Online Safety Act is a 2023 law that imposes a legal "duty of care" on online services to protect users, particularly children, from illegal and harmful content. It is enforced by Ofcom, the UK communications regulator, which can issue fines of up to £18 million or 10% of global annual turnover for non-compliance.

The Act applies to a sweeping range of services: social networks, search engines, messaging apps, forums, dating sites, pornography platforms, and even smaller user-to-user services. Any platform with "links to the UK" falls within scope, regardless of where it is headquartered. That extraterritorial reach is one reason the Act has generated international debate.

Key Duties Imposed by the Act

Illegal content duties: Platforms must proactively prevent users encountering illegal material, including terrorism content, child sexual abuse material (CSAM), fraud, and incitement to violence.
Child safety duties: Services likely to be accessed by children must assess risks and apply age-appropriate protections.
Age assurance: Platforms hosting pornography or other age-restricted content must implement "highly effective" age verification.
Transparency reporting: Large platforms must publish regular reports on how they handle harmful content.
User empowerment tools: Category 1 services (the largest platforms) must offer users controls over the content they see.

How the Act Changes Online Privacy in the UK

Although the Online Safety Act is framed as safety legislation, nearly every obligation it creates has downstream privacy consequences. To police content at scale, platforms must inspect, categorise, and often retain more information about users than they did before.

1. More Data Collection, Not Less

To comply with risk assessments and age checks, services now need to verify who you are, estimate how old you are, and in some cases confirm your identity against official documents. That shifts the baseline from anonymous browsing to identified browsing. Platforms that previously allowed pseudonymous accounts may now gatekeep access behind document uploads, face scans, or credit card checks.

2. Age Verification and Identity Exposure

Age assurance is perhaps the most visible change for everyday users. From 2025 onwards, UK users attempting to access adult content, certain social features, or alcohol and gambling sites may be asked to prove they are over 18. Methods include:

Government ID uploads (passport, driving licence)
Facial age estimation using live selfies
Credit card or open banking verification
Mobile network operator age checks
Digital identity wallet integrations

Each method creates a new data trail. Even when third-party providers claim to delete biometric data immediately, the architecture introduces new attack surfaces. A breach of an age verification provider could expose millions of records linking real identities to the specific sites a person visited.

3. Pressure on End-to-End Encryption

The most controversial element of the Act is Section 121, which gives Ofcom the power to require platforms to use "accredited technology" to detect CSAM and terrorism content, including in private messages. In practice, this would mean scanning messages before they are encrypted (client-side scanning).

Messaging providers including Signal, WhatsApp, and Element publicly warned they would withdraw from the UK market rather than weaken encryption. The government later issued a statement saying the power would only be exercised when "technically feasible," which many interpret as a pause rather than a repeal. The legal power still exists on the statute books.

4. Expanded Logging and Retention

To demonstrate compliance, platforms are retaining more logs: moderation decisions, user reports, content takedowns, and complaint histories. These records can be requested by Ofcom and, in some circumstances, by law enforcement. Logs that once would have been purged after 30 days may now be stored for years.

Who Does the Act Apply To?

The Act creates tiered obligations depending on the type and size of a service. Understanding where a platform sits in the hierarchy helps you anticipate how much data it is collecting about you.

Service Category	Examples	Main Duties	Privacy Impact
Category 1 (large user-to-user)	Facebook, X, TikTok, YouTube	Full duties plus user empowerment and transparency	High: identity verification options, extensive logging
Category 2A (large search)	Google, Bing	Illegal content, search result controls	Medium: more query logging and filtering
Category 2B (high-risk smaller platforms)	Certain forums, dating apps	Illegal content and child safety	Medium: expanded moderation data
Pornography providers	Adult tube sites, cam platforms	Highly effective age verification	Very high: identity linked to viewing habits
Small or low-risk services	Hobby forums, small blogs with comments	Basic illegal content duties	Low to medium

What the Act Means for Everyday Internet Users

For the average UK resident, the Online Safety Act will show up in small but accumulating ways. Here is what to expect in practice.

More Friction at Signup

Expect more platforms to ask for age estimation on first visit, even if you are not creating an account. Some sites will present cookie-style banners asking you to prove age before showing content. Others will quietly embed facial estimation into the signup flow.

Changes to Content Visibility

Platforms are tuning algorithms to downrank or hide content that could trigger a duty of care breach. Legal but "harmful" material, political speech on sensitive topics, and discussions of self-harm or eating disorders may be throttled by default. Users under 18 will see heavily filtered feeds.

New Reporting and Appeal Tools

Category 1 services must offer clearer complaint systems. If a post is removed, you should have a route to appeal. In theory this improves accountability; in practice, moderation at scale remains automated and error-prone.

Potential Service Withdrawals

Some niche platforms, encrypted messengers, or small overseas services may geo-block the UK entirely rather than comply. UK users may find themselves cut off from forums, image boards, or communication tools that remain available elsewhere.

Encrypted Messaging Under the Act

End-to-end encryption (E2EE) is the backbone of modern digital privacy. It ensures that only you and the recipient can read your messages. The Online Safety Act does not formally ban E2EE, but it creates legal mechanisms that could force providers to weaken it.

The Client-Side Scanning Debate

Client-side scanning (CSS) means your device compares your messages or images against a database of banned content before encrypting and sending them. Supporters argue this preserves encryption "in transit." Critics, including Apple's own security researchers and more than 300 academics, counter that CSS fundamentally breaks the privacy guarantee: your device is now spying on you on behalf of a third party.

Once a scanning infrastructure exists, scope creep is inevitable. A system built to detect CSAM can be reconfigured to detect political dissent, leaked documents, or copyrighted material. That is why security experts treat CSS as incompatible with meaningful privacy.

What Messaging Users Should Do

Prefer open-source messengers whose code can be independently audited for scanning backdoors.
Keep apps updated so you receive the latest security patches, but monitor release notes for scanning-related changes.
Use disappearing messages for sensitive conversations to limit the data available if a device is seized or compromised.
Consider decentralised alternatives such as Matrix-based services, which distribute trust rather than concentrating it in a single provider.

Protecting Your Privacy Under the Online Safety Act

You cannot opt out of the Act, but you can minimise the amount of personal data you expose while complying with age checks and other requirements.

1. Use Privacy-Respecting Age Verification Methods

When given a choice, prefer age estimation methods that use zero-knowledge or token-based approaches over those that require uploading a passport. Services built on digital identity wallets can prove you are over 18 without revealing your name or document number to the site itself.

2. Separate Identities for Different Activities

Use distinct email addresses, usernames, and payment methods for different categories of browsing. Email aliasing services and virtual cards make this easier than ever and limit cross-site tracking even when identification is required.

3. Harden Your Browser and DNS

Switch to a privacy-focused browser such as Firefox or Brave, enable DNS over HTTPS with a provider like Cloudflare or Quad9, and install reputable tracker-blocking extensions. These steps reduce the amount of browsing data that leaks to third parties regardless of what any individual platform does.

4. Shorten and Control the Links You Share

If you run a newsletter, business account, or community, the links you distribute leave a trail. Using a privacy-respecting link management platform like Lunyb lets you control redirects, rotate destinations, and avoid handing analytics data to opaque third parties. For a deeper look at how it compares with alternatives, see our honest review of Lunyb and the broader 2026 buyer's guide to URL shorteners.

5. Review Platform Privacy Settings Regularly

As platforms roll out Online Safety Act compliance features, default settings often change. Audit your account settings every few months, especially permissions around content visibility, age confirmation, and data sharing with safety partners.

6. Exercise Your UK GDPR Rights

The Online Safety Act does not override UK GDPR. You retain the right to access, correct, and delete data that platforms hold about you, including moderation records and age verification data. Submit subject access requests periodically to see what is actually being stored.

The Bigger Picture: Safety vs. Surveillance

The Online Safety Act reflects a genuine tension that democracies worldwide are grappling with. Children and vulnerable users do face real harm online, and the laissez-faire era of unregulated platforms created serious damage. At the same time, the tools built to address those harms concentrate immense power in regulators and large platforms, and they rely on surveillance architectures that history suggests will be expanded, not contained.

Similar laws are advancing in the EU (Digital Services Act), Australia (Online Safety Amendment), and Canada (Online Harms Act). The UK is a bellwether; the compromises struck here will influence how global platforms design products for everyone. Staying informed and taking deliberate steps to protect your data is no longer optional — it is a baseline part of modern digital citizenship.

Frequently Asked Questions

Does the UK Online Safety Act ban end-to-end encryption?

No, the Act does not explicitly ban end-to-end encryption. However, Section 121 gives Ofcom the power to require platforms to use "accredited technology" to scan for illegal content, which many security experts argue would effectively break E2EE through client-side scanning. The government has said this power will only be used when "technically feasible," but the legal authority remains in force.

Do I have to upload my passport to use social media now?

Not necessarily. Age verification requirements are strictest for pornography and other age-restricted content. Mainstream social media may offer multiple verification methods, including facial age estimation, mobile operator checks, or digital ID wallets. You can usually choose the least invasive option, but minors or users whose age cannot be estimated confidently may face harder requirements.

Does the Act apply to small blogs and forums?

Yes, in principle. Any user-to-user service with links to the UK falls within scope, though smaller and lower-risk services face lighter duties. Ofcom has published guidance for small businesses and community sites, focusing on basic illegal content obligations rather than the full regime applied to major platforms.

What happens if a platform refuses to comply with the Act?

Ofcom can issue fines of up to £18 million or 10% of global annual turnover, whichever is higher. In serious cases, it can seek court orders requiring UK internet service providers to block access to non-compliant services. Senior managers can also face criminal liability for certain failures, particularly those relating to child safety.

Can I still protect my privacy online as a UK user?

Absolutely. The Act changes the regulatory environment but does not strip away your personal choices. You can use privacy-focused browsers, encrypted DNS, email aliases, privacy-respecting link tools, and open-source messaging apps to limit how much data you expose. Combined with regular use of your UK GDPR rights, these tools let you maintain meaningful privacy even as platforms collect more data for compliance.