UK Online Safety Act: Privacy at Risk in the Name of Protection
As of July 25, 2025, the UK’s Online Safety Act (OSA), first enacted in October 2023 now requires websites hosting adult content or “primary priority” material (including self-harm or suicide content) to verify users’ ages using robust methods such as photo ID, facial scans, or credit-card checks 0‡Financial Times 1‡Wikipedia.
As an aside it is interesting how this has expanded to include things like music streaming services, I can only assume because of lyric content; Streamed radio like BBC Radio 4, because it’s classed as mature content on Alexa, for instance.
Why the concern around privacy?
- Identity data exposure: Platforms now often ask users to submit sensitive information like official ID or biometric scans—raising concerns about data handling, retention, and breaches 2‡Financial Times 3‡www.ofcom.org.uk.
- Third-party services & centralised control: Many platforms route verification through services like Persona (used by Reddit), meaning personal data is shared beyond the platform itself 4‡Wikipedia.
- Human-rights and encryption risks: Privacy advocates, including EFF, argue the OSA undermines free expression and privacy, and may pave the way for intrusive surveillance 5‡Electronic Frontier Foundation. Organisations like Article 19 and the Open Rights Group warn it’s a “censor’s charter” 6‡Wikipedia.
- Effects on public-interest platforms: Wikipedia (Wikimedia Foundation) lost a court challenge in August 2025 its designation as a Category 1 service could force age checks, impairing its open-editing model 7‡PC Gamer.
What’s actually happening?
- Major adult sites have seen traffic drop by as much as 47% from the UK as users face verification barriers 8‡Financial Times.
- VPN usage has surged, topping UK download charts many users turn to VPNs to avoid invasive checks 9‡The Week.
- A YouGov survey found almost 70% of Brits support the law’s intent, but 64% doubt its effectiveness and worry about privacy 10‡PC Gamer.
The Balance Isn’t Easy
Protecting children from harmful content is vital, but doing so by asking adults to share sensitive personal data raises serious privacy questions. Without strong data protection rules, verification systems, even when well-intentioned, risk creating new vulnerabilities.
In summary: The UK’s Online Safety Act marks a pivotal shift toward enforcing online safety through mandatory age verification. While it addresses real concerns around child protection, it also places user privacy on a precarious ledge raising questions about data security, censorship thresholds, and the future of open, anonymous online spaces.
What do you think can safer internet access be achieved without sacrificing privacy?