UK Online Safety Act: What It Means for Your Privacy

The UK Online Safety Act is one of the most sweeping pieces of internet legislation Britain has ever passed. It promises to make the online world safer, particularly for children, but it also raises profound questions about privacy, encryption, and the future of anonymous browsing. If you live in the UK, or run a service that reaches UK users, the Act now shapes nearly every corner of your digital life.

This guide breaks down what the Online Safety Act actually does, how it affects your personal privacy, and what practical steps you can take to maintain control over your data in the new regulatory landscape.

What Is the UK Online Safety Act?

The UK Online Safety Act 2023 is a law that imposes a legal duty of care on online platforms to protect users, especially children, from illegal and harmful content. It is enforced by Ofcom, the UK's communications regulator, which can issue fines of up to £18 million or 10% of a company's global annual turnover, whichever is higher.

The Act received Royal Assent in October 2023 and its provisions have been rolling out in phases through 2024 and 2025. By early 2026, most of its core obligations, including age assurance requirements and illegal content duties, are fully in force.

Who Does the Act Apply To?

The scope is deliberately broad. It covers:

User-to-user services: social networks, messaging apps, forums, and comment sections.
Search services: general and vertical search engines.
Pornography providers: any site publishing adult content accessible from the UK.
Services with UK users: even if the company is based abroad, as long as it has a "significant number" of UK users or targets the UK market.

That means a small forum hosted in Germany, a video platform run from Singapore, or a chat app based in California can all fall under Ofcom's jurisdiction if British users rely on them.

The Core Duties Imposed on Platforms

At its heart, the Online Safety Act requires platforms to carry out risk assessments and take proportionate measures to reduce the likelihood of users encountering harmful content. The duties fall into several buckets.

1. Illegal Content Duties

All in-scope services must proactively prevent users from seeing priority illegal content, which includes terrorism, child sexual abuse material (CSAM), fraud, revenge pornography, and content that incites violence. Platforms must deploy systems to detect, remove, and report such content.

2. Child Safety Duties

Services likely to be accessed by children must shield minors from pornography, suicide and self-harm promotion, cyberbullying, and other "content harmful to children." This is where age assurance comes in, and it is one of the most controversial aspects of the Act.

3. Transparency and Reporting

The largest services, designated as Category 1, must publish transparency reports, offer user empowerment tools, protect journalistic and democratically important content, and give users clear complaint mechanisms.

How the Online Safety Act Affects Your Privacy

The Act is framed around safety, but the compliance mechanisms it demands have significant privacy implications. Here are the areas where UK users are most likely to feel the impact.

Age Verification and Identity Checks

Since July 2025, pornography sites and many social platforms have been required to implement "highly effective" age assurance. In practice, this often means uploading a photo ID, submitting a selfie for facial age estimation, performing a credit card check, or linking to a bank or mobile operator record.

Each of these methods involves sharing sensitive personal data with a third party. Even when providers claim to delete the data immediately, you are expanding the number of organisations that hold identifying information about your browsing habits.

Pressure on End-to-End Encryption

Section 121 of the Act gives Ofcom the power to require platforms to use "accredited technology" to scan private messages for CSAM and terrorism content. Encrypted messaging services have warned that this is technically incompatible with end-to-end encryption; you cannot scan a message on a server if only the sender and recipient hold the keys.

The UK government has said the power will only be used when "technically feasible," and Ofcom has so far not forced any messenger to break encryption. But the legal lever exists, and that alone shapes how services design their products for UK users.

Expanded Data Collection by Platforms

To comply with risk assessments, content moderation obligations, and age-gating, platforms now collect more data about you than before. That includes behavioural signals used to estimate age, device fingerprints used to spot repeat offenders, and detailed logs of flagged interactions.

Chilling Effects on Anonymous Speech

Although the Act does not ban anonymity outright, Category 1 services must give users the option to verify their identity and to filter out non-verified accounts. Over time, this creates social pressure to shed anonymity, which is a lifeline for whistleblowers, abuse survivors, LGBTQ+ people in hostile environments, and political dissidents.

Age Assurance Methods Compared

If you are going to be asked to prove your age online, it helps to understand the trade-offs between the main methods now being deployed by UK-facing services.

Method	Data Shared	Privacy Risk	Friction
Photo ID upload	Passport or driving licence image	High	High
Facial age estimation	Live selfie or short video	Medium to High	Medium
Credit card check	Card number, billing data	Medium	Low
Mobile operator check	Phone number, age flag from carrier	Low to Medium	Low
Digital identity wallet	Cryptographic age proof only	Low	Low once set up
Open banking check	Bank account access	High	Medium

Where you have a choice, digital identity wallets that use zero-knowledge proofs share the least information. They can confirm "this person is over 18" without revealing your name, date of birth, or document number to the site you are visiting.

Pros and Cons of the Online Safety Act for Privacy

Pros

Stronger legal protection against image-based abuse, including deepfake intimate imagery.
Clearer complaint and takedown rights for harmful content targeting you.
New criminal offences for cyberflashing, epilepsy trolling, and fraudulent impersonation.
Platforms are forced to take moderation seriously rather than treating it as optional.
Transparency reports give researchers and journalists more visibility into platform behaviour.

Cons

Mandatory age checks create new databases of sensitive identity information.
Legal powers exist to undermine end-to-end encryption, even if unused today.
Smaller platforms face compliance costs that may push them to geoblock UK users entirely.
Behavioural age estimation normalises passive surveillance of browsing habits.
Anonymous speech is subtly discouraged by verification-based filtering options.

How to Protect Your Privacy Under the New Regime

You cannot opt out of the Online Safety Act, but you can make deliberate choices that reduce how much personal data you expose while complying with the new rules.

1. Prefer Privacy-Preserving Age Assurance

When a service offers multiple age assurance options, choose the one that reveals the least. A digital identity wallet or carrier-based check is almost always preferable to uploading a passport scan to an unfamiliar third party.

2. Use Encrypted DNS and a Private Browser

Set your device or router to use encrypted DNS (DNS over HTTPS or DNS over TLS) so that your internet provider cannot easily log every domain you visit. Combine this with a hardened browser such as Firefox with strict tracking protection, Brave, or Mullvad Browser to reduce fingerprinting.

3. Segment Your Online Identity

Use different email addresses, usernames, and even browser profiles for different areas of your online life. Email aliasing services let you create a fresh address for every signup, so a single data breach does not unravel your whole identity.

4. Shorten and Control the Links You Share

Every time you share a raw URL, you may be leaking tracking parameters, internal paths, or even identifying query strings. A privacy-conscious link shortener such as Lunyb lets you wrap links in clean, controllable short URLs, strip trackers, and monitor click analytics without handing everything to large ad platforms. If you want a deeper look at how it stacks up, see our honest Lunyb review and our broader 2026 URL shortener buyer's guide.

5. Review App Permissions Regularly

Age assurance and content moderation obligations have pushed many apps to request more device permissions, including camera, contacts, and location. Audit these monthly and revoke anything that is not strictly necessary.

6. Keep Records of Your Data Rights Requests

The UK GDPR still applies alongside the Online Safety Act. You retain the right to request access to, correction of, and deletion of your personal data. If a platform forces you through age assurance, you can ask them in writing to confirm what data they retained and for how long.

What the Act Means for Small Publishers and Businesses

If you run a blog with comments, a Discord server, a niche forum, or a membership site that touches UK users, you are probably in scope. Ofcom has published a tiered approach so that the smallest services face lighter duties, but you still need to:

Carry out an illegal content risk assessment and document it.
Publish clear terms of service explaining what content is banned.
Offer an easy way for users to report illegal or harmful content.
Act quickly to remove flagged illegal content once you are aware of it.
Decide whether children are likely to access your service and, if so, apply child safety measures.

For marketers and link-sharing businesses, this also means being more careful about what you link to. If a short link you share leads to illegal content hosted elsewhere, platforms may still restrict it. Branded link tools like Rebrandly and Lunyb give you a layer of control, letting you deactivate or update destinations quickly if a situation changes.

The Road Ahead: What to Watch in 2026 and Beyond

Several flashpoints will determine how the Online Safety Act actually plays out over the next few years.

Ofcom codes of practice: still being iterated, these determine what "proportionate" actually means in practice for different categories of service.
Legal challenges: expect judicial review cases from civil liberties groups on age assurance and encryption powers.
International alignment: the EU's Digital Services Act and Australia's Online Safety reforms overlap with the UK regime, so expect platforms to converge on the strictest common denominator.
AI-generated content: amendments are already being proposed to tackle synthetic intimate imagery and AI-driven scams more aggressively.

The direction of travel is clear: more accountability for platforms, more friction for users, and more pressure on technologies that enable anonymity. The best defence is to stay informed, make conscious choices about which services you use, and lean on tools that minimise the data you leak by default.

Frequently Asked Questions

Does the UK Online Safety Act ban encryption?

No, the Act does not ban end-to-end encryption outright. However, Section 121 gives Ofcom the power to require platforms to use accredited technology to scan for CSAM and terrorism content, which could in theory conflict with strong encryption. The government has stated this power will only be used when technically feasible, and so far it has not been enforced against any encrypted messenger.

Do I have to upload my passport to use social media in the UK?

Not necessarily. Platforms must use "highly effective" age assurance, but they can choose between methods such as facial age estimation, mobile operator checks, credit card verification, or digital identity wallets. Where available, choose the option that reveals the least personal information about you.

What happens if a platform ignores the Online Safety Act?

Ofcom can impose fines of up to £18 million or 10% of global annual turnover, require specific remedial actions, and in serious cases apply to a court to have the service blocked in the UK. Senior managers can also face criminal liability for failing to comply with certain information notices.

Does the Act apply to companies outside the UK?

Yes. The Act has extraterritorial reach. Any service with a significant number of UK users or that targets the UK market is in scope, regardless of where the company is based. This is why many international platforms have rolled out UK-specific age checks and moderation changes.

How can I share links privately without triggering tracking?

Use a link shortener that strips tracking parameters and lets you control destinations, combine it with encrypted DNS, and avoid sharing raw URLs that contain session IDs or UTM tags. Privacy-focused shorteners like Lunyb are designed to minimise the data trail a shared link leaves behind, while still giving you basic analytics.