Implementation of the UK Online Safety Act

❗Article Status Notice: This Article is a stub

---

This article is underdeveloped, and needs additional work to meet the wiki's Content Guidelines and be in line with our Mission Statement for comprehensive coverage of consumer protection issues. Learn more ▼

Issues may include:

• This article needs to be expanded to provide meaningful information
• This article requires additional verifiable evidence to demonstrate systemic impact
• More documentation is needed to establish how this reflects broader consumer protection concerns
• The connection between individual incidents and company-wide practices needs to be better established
• The article is simply too short, and lacks sufficient content

How you can help:

• Add documented examples with verifiable sources
• Provide evidence of similar incidents affecting other consumers
• Include relevant company policies or communications that demonstrate systemic practices
• Link to credible reporting that covers these issues
• Flesh out the article with relevant information

This notice will be removed once the article is sufficiently developed. Once you believe the article is ready to have its notice removed, visit the Discord (join here) and post to the #appeals channel, or mention its status on the article's talk page.

United Kingdom's Online Safety Act 2023 is a set of laws that claims to protect children and adults online. The act applies to search services and services that allow users to post content online or to interact with each other (Section 4).

One of the duties of the act requires affected websites to implement their own solution for identity verification such that it is highly effective to prove one's age (Section 12.6). There is no official government-sanctioned identity verification platform. Each service provider must implement their own solution or find a third party solution to use to remain compliant.

While the press release says "the measures platforms have to put in place must confirm your age without collecting or storing personal data, unless absolutely necessary," the legislation requires that companies track usage by specific people and provide data and/or remote access to Ofcom on demand (Section 100) Enforcement of this act is done by the UK's Office of Communications (OFCOM). The penalty for breaking these rules is the greater of £18 million and 10% of the person’s qualifying worldwide revenue (Schedule 13.4).

Background

The Online Safety Act is a "Bill to make provision for and in connection with the regulation by OFCOM of certain internet services; for and in connection with communications offences; and for connected purposes."

The Online Safety Act received royal assent on 26 October 2023, following five years of work by Carnegie UK, working in concert with over 50 partners. In 2018, Carnegie UK published a series of blogs by William Perrin and Professor Lorna Woods, outlining the proposal for social media regulation. The UK Government published its White Paper on 8 April 2019, tackling online harm, with a duty of care approach at its core. Carnegie UK ended their work on the Online Safety Act in October 2023.

The bill was sponsored by Michelle Donelan, the (now former) Conservative MP for Chippenham and Lord Parkinson of Whitley Bay, a current member of the House of Lords. Both on behalf of the UK Department for Digital, Culture, Media and Sport.

The Online Safety Act is one act in two different stages. The original that reached royal assent on 26 October 2023 under Rishi Sunak's Conservative government, and the amended version in 2025, under Kier Starmer's Labour government. In February 2025, amendments related to making corporations more accountable for the content on their websites, as well as accountability for people accessing inappropriate content were brought to and voted on in parliament. The bill was changed again in May 2025 to include biometric face scans and government ID requirements, which was was not voted on in parliament.

Age Verification Providers Association (AVPA) was formed in 2018 and is growing rapidly as the age and identity provider industry takes off. It represents all main technology suppliers who have invested in the development of age verification solutions to support the implementation of age restrictions online.

The impact

Since the UK Online Safety Act applies to search services and services that allow users to post content online or to interact with each other, it has a broad impact across the entire internet for those accessing websites from within the UK. All online services that OFCOM deems to be within the scope of the Online Safety Act must incorporate an identity verification process to determine each user's age. This has forced many websites to geo-block the UK because they are too small to justify or afford implementing their own the identity verification process or partnering with a third provider. A list of affected websites is available on OnlineSafetyAct.co.uk.

Change this section's title to be descriptive of the incident.

Impartial and complete description of the events, including actions taken by the company, and the timeline of the incident coming to the public's attention.

---

Add your text below this box. Once this section is complete, delete this box by clicking on it and pressing backspace.

Spotify

To view age-restricted content on Spotify, users in the UK are now asked for facial scanning; if that fails, ID verification can only correct the error.

YouTube

Main article: Youtubes Requirement for Government ID

On July 30, 2025, YouTube responded by announcing its verification system, requesting users for either a government-issued ID, a photo, or credit card, in order to show that users are 18 and older. Age will be estimated through various information, including videos watched, and would lock users flagged below 18 unless they send one of aforementioned proofs.

Wikipedia

The Wikimedia Foundation (WMF) sued the United Kingdom to prevent them from forcing age checks on their websites. The WMF made a statement that being forced to comply with this act would compromise the privacy of its editors and the neutrality of the encyclopedia. On August 11, 2025, the London High Court denied the WMF's reasoning, but didn't necessarily force age checks for the website.

Consumer response

Summary and key issues of prevailing sentiment from the consumers and commentators that can be documented via articles, emails to support, reviews and forum posts.

---

Add your text below this box. Once this section is complete, delete this box by clicking on it and pressing backspace.

United Kingdom saw an increased VPN usage by 1400 percent. As of August 16, 2025, there has been at least 500 thousand signatures petitioning to repeal the act.

SafetyAct.co.uk

OnlineSafetyAct.co.uk is operated by Neil Brown, a UK tech lawyer (decoded.legal). It lists all of the websites affected by the Online Safety Act, with the help of user submissions.

Use Their ID

This is a parody site that uses publicly available data about UK members of parliament to create AI-generated mock driving licences. They are clearly marked as satire and users are warned not to use them for anything real.

Industry expert response

Electronic Frontier Foundation

The Electronic Frontier Foundation (EFF) posted an article entitled No, the UK’s Online Safety Act Doesn’t Make Children Safer Online, and covers the threat to privacy of internet users and how the bill restricts free expression by arbitrating speech online, exposing users to algorithmic discrimination through face checks, and leaves millions of people without a personal device or form ID excluded from accessing the internet.

"The internet must remain a place where all voices can be heard, free from discrimination or censorship by government agencies. If the UK really wants to achieve its goal of being the safest place in the world to go online, it must lead the way in introducing policies that actually protect all users—including children—rather than pushing the enforcement of legislation that harms the very people it was meant to protect."

Theo Browne, YouTuber & CEO at T3 Chat

Theo posted a YouTube video covering the Online Safety Act and how it going to destroy the free internet if internet community don't stop it ASAP. He said it's rare that he gets that extreme about something like this, but it's a really important thing that the community jump in front of. In his opinion, this is the fist time something this potentially damaging has been implemented in decades.

Data Protection concerns

The Online Safety Act will normalise providing your government-issued identification in order to see content, making everyone more susceptible and vulnerable to phishing attacks perpetrated by identity thieves.

"The only winners of this shit are VPN companies and identity providers."

Parents, government, platforms, identity providers

Offloaded responsibility

By continuing to shift the responsibility down the pipe, we are increasing the potential harm for when it goes wrong. "Who is harmed if they fail their responsibility?"

Parents

when parents do a bad job of protecting their kids, the kid sees things that they shouldn't.

Governments

If the government does a bad job of helping the parents protect their kids, it could destroy the open internet.

Platforms

If the platform does a bad job of verifying the kids using the rules the government gave them, personal info starts to leak.

Third party identity verification providers

We've massively increased the opportunity and the like surface area of identity attacks and identity theft in general. We've made the internet less free and we've made it way harder to share information and we gave a ton of money to VPN companies for no reason.

Government response

Ofcom discouraged the promotion of VPNs.

UK Parliament considers all petitions that get more than 100,000 signatures for debate. On 28 July 2025, when the petition to repeal the act had about 400,000 signatures, the government responded with this message: "The Government has no plans to repeal the Online Safety Act, and is working closely with Ofcom to implement the Act as quickly and effectively as possible to enable UK users to benefit from its protections.", only a few days after coming into force. This was only after three days (25 July 2025) the "highly effective age assurance" requirement came into force.

The technology minister Peter Kyle said on Good Morning Britain, "if you want to overturn the Online Safety Act you are on the side of predators. Not those who want to keep children safe."