UK Online Safety Act: What It Means for Your Privacy

The UK Online Safety Act is one of the most sweeping pieces of internet legislation in British history. Passed in October 2023 and now being enforced in phases by Ofcom through 2025 and 2026, it reshapes how platforms moderate content, verify users and respond to harmful material. For ordinary users, it also raises serious questions about privacy, free expression and the future of encrypted communication in the UK.

This guide explains what the Act actually does, which parts affect your personal privacy, and the practical steps you can take to stay in control of your data as the new rules bed in.

What Is the UK Online Safety Act?

The UK Online Safety Act 2023 is a law that places legal duties on online platforms to protect users — particularly children — from illegal and harmful content. Ofcom is the designated regulator, with powers to fine companies up to £18 million or 10% of global annual turnover, whichever is higher.

The Act applies to any service with a significant UK user base, regardless of where the company is headquartered. This includes social media platforms, search engines, messaging apps, adult content sites, gaming platforms and even smaller user-to-user services like forums and comment sections.

Key Objectives of the Act

1. Remove illegal content quickly, including child sexual abuse material, terrorist content and fraud.
2. Protect children from legal-but-harmful content such as pornography, self-harm promotion and eating disorder material.
3. Give adults more control over the content they see on the largest platforms (Category 1 services).
4. Require robust age verification for adult content providers.
5. Enforce transparency through risk assessments and public reporting.

How the Act Affects Your Privacy

While the Act's intentions focus on safety, several provisions have direct consequences for personal privacy. Understanding these is essential if you want to make informed choices about the services you use.

1. Age Verification and Identity Checks

Platforms hosting pornography or other content deemed harmful to children must now implement "highly effective" age assurance. In practice, this means uploading a photo of your ID, submitting a selfie for facial age estimation, verifying through a credit card, or using a third-party age verification provider.

Every one of these methods involves sharing sensitive personal data with a company you may never have interacted with before. Even when verification is handled by a specialist provider using "double-blind" tokens, your biometric or document data is still being processed, stored temporarily, and could be exposed in a breach.

2. Pressure on End-to-End Encryption

Section 121 of the Act gives Ofcom the power to require messaging services to use "accredited technology" to scan content — including in private messages — for child sexual abuse material. Critics, including Signal and WhatsApp, have argued this is incompatible with end-to-end encryption, because scanning content on your device before it is encrypted (client-side scanning) effectively creates a backdoor.

The UK government has stated the power will only be used when "technically feasible," and no notices have been issued at the time of writing. However, the legal mechanism remains on the books, creating long-term uncertainty for anyone who relies on encrypted messaging for personal, professional or journalistic reasons.

3. Content Monitoring and Data Retention

To comply with the Act, platforms must conduct detailed risk assessments and monitor user behaviour at scale. This typically means more logging, more automated analysis of posts and messages, and longer retention of data that might previously have been deleted quickly. The more data a platform holds about you, the greater the risk if it is hacked, subpoenaed or sold.

4. User Verification on Large Platforms

Category 1 services — the largest social media platforms — must offer adults the option to verify their identity and to filter out content from non-verified accounts. While optional, this creates a two-tier system where verified users enjoy more reach, incentivising people to hand over ID documents to private companies.

Who Is Affected?

The Act is deliberately broad. The table below summarises the main categories of service and the duties that apply.

Service Type	Examples	Main Duties
Category 1 (largest user-to-user)	Facebook, Instagram, X, TikTok, YouTube	Full duties: illegal content, child safety, adult user empowerment, verification options, transparency reports
Category 2A (large search)	Google, Bing	Illegal content duties, child safety, transparency
Category 2B (other large services)	Mid-sized social and messaging apps	Illegal content and child safety duties
Pornography providers	Adult content sites	Highly effective age assurance
Smaller user-to-user	Forums, Discord servers, comment sections	Illegal content duties, proportionate child safety measures

Pros and Cons of the Act for Privacy

Pros

• Stronger legal protections for children against grooming, abuse material and exploitation.
• Clear enforcement powers against platforms that ignore illegal content.
• Mandatory transparency reporting gives researchers and the public more insight into platform behaviour.
• Adults on large platforms gain new tools to filter content and verify who they interact with.
• Fraud and scam content — a major issue for UK consumers — must be actively tackled.

Cons

• Age verification normalises uploading ID documents and biometrics to access everyday services.
• Legal pressure on end-to-end encryption threatens the confidentiality of private messages.
• Increased content monitoring expands the amount of personal data platforms must retain.
• Smaller forums and community sites may close rather than face compliance costs.
• Legitimate speech may be over-removed as platforms err on the side of caution to avoid fines.

Practical Steps to Protect Your Privacy

You cannot opt out of the Act, but you can reduce the amount of personal information you expose as it is enforced. Here is a practical checklist.

1. Choose age verification methods carefully. If you must verify, prefer providers that use double-blind tokens or on-device facial age estimation that does not retain images. Avoid uploading your passport unless there is no alternative.
2. Use encrypted DNS. Services like Cloudflare 1.1.1.1, Quad9 or NextDNS encrypt your DNS lookups so your internet provider cannot easily log every domain you visit.
3. Switch to a privacy-respecting browser. Firefox, Brave and LibreWolf block trackers by default and give you more control over fingerprinting.
4. Minimise accounts. The fewer platforms that hold a verified copy of your ID, the lower your exposure if any one of them is breached.
5. Review app permissions quarterly. Revoke microphone, location and contacts access for apps that do not genuinely need them.
6. Use short-lived links for sharing. When sharing content publicly, a URL shortener with privacy controls — such as Lunyb — lets you track engagement without handing a third-party ad network your audience data. You can read our honest Lunyb review for details.
7. Think before verifying your social accounts. The new "verified adult" filters on Category 1 platforms are optional. Only opt in if the benefit genuinely outweighs the ID exposure.

Encrypted Messaging Under the Act

End-to-end encryption remains legal in the UK, and most major messaging apps continue to operate normally. The flashpoint is Section 121 and whether Ofcom will ever issue a technology notice requiring content scanning. Signal has publicly stated it would withdraw from the UK rather than compromise its encryption. Apple shelved its own client-side scanning plans in 2022 after a global backlash.

For now, the practical advice is unchanged: use apps with strong, independently audited end-to-end encryption, keep them updated, and verify safety numbers for sensitive conversations. If the regulatory position hardens, be prepared to migrate to services that remain outside the UK's enforcement reach.

Impact on Small Websites and Creators

One underreported consequence of the Act is its effect on small operators. Any site that allows user-generated content — comments, uploads, direct messages between users — technically falls within scope. While Ofcom has stressed a proportionate approach, the compliance burden is real: risk assessments, reporting mechanisms, moderation policies and record-keeping all take time and money.

Several UK-based hobby forums have already shut down rather than risk enforcement action. Creators who rely on their own platforms should document their moderation processes, publish clear terms of service, and make it easy for users to report illegal content. Using established, compliant third-party tools — from hosting to link management — reduces your personal exposure. Our 2026 URL shortener comparison covers which providers publish transparent compliance information.

How the Act Compares to Other Regulations

Regulation	Region	Primary Focus	Encryption Stance
Online Safety Act 2023	UK	Harmful content, child safety	Allows content-scanning notices (not yet used)
Digital Services Act	EU	Illegal content, transparency, systemic risk	Does not mandate scanning of private messages
GDPR / UK GDPR	EU / UK	Personal data protection	Encryption encouraged as safeguard
KOSA (proposed)	US	Child online safety	No scanning mandate, but duty-of-care model

What to Watch in 2026

The Act is being rolled out in phases. Illegal content codes of practice came into force in March 2025, child safety codes followed later that year, and the Category 1 duties — including user empowerment tools — are being implemented through 2026. Key things to monitor:

• Whether Ofcom issues its first Section 121 technology notice to a messaging service.
• How age verification providers evolve, and whether privacy-preserving options become the default.
• Legal challenges from platforms, civil liberties groups and encryption advocates.
• Any amendments following the government's post-implementation review.
• Guidance from the ICO on how Online Safety Act duties interact with UK GDPR obligations.

Frequently Asked Questions

Does the Online Safety Act ban end-to-end encryption?

No. End-to-end encryption remains legal and widely used. However, Section 121 gives Ofcom the power to require platforms to use accredited technology to scan for child sexual abuse material, which many experts argue is incompatible with true end-to-end encryption. No such notices have been issued yet.

Do I have to verify my age to use adult websites in the UK?

Yes, if the site is in scope of the Act and complying. From mid-2025, adult content providers must use "highly effective" age assurance such as ID checks, facial age estimation or credit card verification. The specific method varies by site.

Will small forums and blogs be shut down?

Not automatically. Ofcom has committed to a proportionate approach for smaller services, but any site hosting user-generated content has some duties under the Act. Some hobby forums have voluntarily closed to avoid the compliance workload, but most well-run small communities can continue operating with sensible moderation and a clear reporting mechanism.

How is my data protected when I verify my age?

Reputable age assurance providers use techniques like double-blind tokens, meaning the website never sees your ID and the verifier never sees which site you are visiting. However, protection depends entirely on the provider's practices. Always check their privacy policy, data retention period and whether they are certified under schemes like the Age Check Certification Scheme (ACCS).

Can I avoid the Act by using services based outside the UK?

Not entirely. The Act applies to any service with significant UK users, regardless of headquarters. However, enforcement against overseas platforms that ignore Ofcom is practically limited. In the long run, the safer and more sustainable approach is to minimise the personal data you share with any platform, use encrypted DNS and privacy-focused browsers, and favour services with transparent compliance and data-minimisation policies.

Final Thoughts

The UK Online Safety Act genuinely improves protections for children and raises the bar for platform accountability. But it also pushes the UK toward a more identity-verified, more heavily monitored internet, with real risks for encryption and personal data. The sensible response is neither panic nor complacency: understand the rules, choose privacy-respecting tools, and keep the amount of personal information you expose to each service as small as possible. The platforms you trust in 2026 will be the ones that treat compliance and privacy as complementary — not as a trade-off.