UK Online Safety Act

United Kingdom's Online Safety Act 2023 is a set of laws that claims to protect children and adults online. The act applies to search services and services that allow users to post content online or to interact with each other (Section 4).

One of the duties of the act requires affected websites to implement their own solution for identity verification such that it is highly effective to prove one's age (Section 12.6). There is no official government-sanctioned identity verification platform. Each service provider must implement their own solution or find a third party solution to use to remain compliant. Another duty filters non-verified users from interacting with content made from an "adult user" (Section 15.10). These non-verified users will also be less visible, provided the adult user has toggled it.

While the press release says "the measures platforms have to put in place must confirm your age without collecting or storing personal data, unless absolutely necessary," the legislation requires that companies track usage by specific people and provide data and/or remote access to Ofcom on demand (Section 100) Enforcement of this act is done by the UK's Office of Communications (Ofcom). The penalty for breaking these rules is the greater of £18 million and 10% of the person’s qualifying worldwide revenue (Schedule 13.4).

Background

The Online Safety Act is a "Bill to make provision for and in connection with the regulation by Ofcom of certain internet services; for and in connection with communications offences; and for connected purposes."

The Online Safety Act received royal assent on 26 October 2023, following five years of work by Carnegie UK, working in concert with over 50 partners. In 2018, Carnegie UK published a series of blogs by William Perrin and Professor Lorna Woods, outlining the proposal for social media regulation. The UK Government published its White Paper on 8 April 2019, tackling online harm, with a duty of care approach at its core. Carnegie UK ended their work on the Online Safety Act in October 2023.

The bill was sponsored by Michelle Donelan, the (now former) Conservative MP for Chippenham and Lord Parkinson of Whitley Bay, a current member of the House of Lords. Both on behalf of the UK Department for Digital, Culture, Media and Sport.

The Online Safety Act is one act in two different stages. The original that reached royal assent on 26 October 2023 under Rishi Sunak's Conservative government, and the amended version in 2025, under Kier Starmer's Labour government. In February 2025, amendments related to making corporations more accountable for the content on their websites, as well as accountability for people accessing inappropriate content were brought to and voted on in parliament. The bill was changed again in May 2025 to include biometric face scans and government ID requirements, which was was not voted on in parliament.

Age Verification Providers Association (AVPA) was formed in 2018 and is growing rapidly as the age and identity provider industry takes off. It represents all main technology suppliers who have invested in the development of age verification solutions to support the implementation of age restrictions online.

The impact

Since the UK Online Safety Act applies to search services and services that allow users to post content online or to interact with each other, it has a broad impact across the entire internet for those accessing websites from within the UK. All online services that Ofcom deems to be within the scope of the Online Safety Act must incorporate an identity verification process to determine each user's age. This has forced many websites to geo-block the UK because they are too small to justify or afford implementing their own the identity verification process or partnering with a third provider. A list of affected websites is available on OnlineSafetyAct.co.uk.

The broad range of the act has caused content from breaking news, war footages, and political videos to be heavily suppressed and labelled "harmful".

Spotify

To view age-restricted content on Spotify, users in the UK are now asked for facial scanning; if that fails, only ID verification can correct the error.

YouTube

Main article: Youtubes Requirement for Government ID

On July 30, 2025, YouTube responded by announcing its verification system, requesting users for either a government-issued ID, a photo, or credit card, in order to show that users are 18 and older. Age will be estimated through various information, including videos watched, and would lock users flagged below 18 unless they send one of aforementioned proofs.

Wikipedia

The Wikimedia Foundation (WMF) sued the United Kingdom to prevent them from forcing age checks on their websites. The WMF made a statement that being forced to comply with this act would compromise the privacy of its editors and the neutrality of the encyclopedia. On August 11, 2025, the London High Court denied the WMF's reasoning, but didn't necessarily force age checks for the website.

4Chan

4chan is a simple image-based bulletin board where anyone can post comments and share images.

Ofcom's investigation

On 14 April 2025, Ofcom issued a formal information notice to the provider of the service 4chan requesting a copy of the record of its Illegal Content Risk Assessment, as part of the Risk Assessment Enforcement Programme. At the date of opening this investigation, no response has been received to the information notice.

On 10 June 2025, Ofcom opened an investigation into "the online discussion board" 4chan. The investigation will consider 4chan's compliance with its duties under the Online Safety Act 2023. Ofcom has powers under section 102(8) of the Act to require persons to respond to an information notice in the manner and form specified.

On 13 August 2025, Ofcom, in accordance with section 130 of the Online Safety Act 2023, issued 4chan Community Support LLC with a provisional notice of contravention, believing they had reasonable grounds for believing 4chan has contravened its duties under section 102(8) of the Act to comply (Ofcom.org appears to have blocked Archive.org from this and other pages sometime in July 2025).

4chan's response

Attorneys Preston Byrne and Ron Coleman, acting for 4chan, responded publicly to Ofcom’s provisional notice, which accuses the American company of failing to meet information notice requirements and possibly breaching duties related to content moderation.

The attorneys described the UK’s actions as an “illegal campaign of harassment” targeting American tech firms and warned that this extraterritorial enforcement of censorship law was incompatible with the First Amendment.

Since enforcement began, the UK’s media regulator Ofcom has reportedly sent formal notices to several US tech companies, instructing them to comply or face penalties. These letters have ignited backlash among American lawmakers, many of whom argue that Britain has crossed a line by trying to dictate speech rules to American businesses and citizens. House Judiciary Chair Jim Jordan, along with other members of Congress, has taken his concerns directly to British ministers, raising objections with Science Secretary Peter Kyle.

Consumer response

According to analysis by Cloudwards, Google searches for "how to get around age verification" and "is VPN legal in the UK" saw a massive growth of over 450 thousand and 380 thousand percent respectively. United Kingdom saw an increased VPN usage by 1400 percent. As of August 16, 2025, there has been at least 500 thousand signatures petitioning to repeal the act.

SafetyAct.co.uk

OnlineSafetyAct.co.uk is a website which was created in response to the Act's implementation and is operated by Neil Brown, a UK tech lawyer (decoded.legal). It lists all of the websites affected by the Online Safety Act, with the help of user submissions.

Use Their ID

Use Their ID.com is a parody site that uses publicly available data about UK members of parliament to create AI-generated mock driving licences. They are clearly marked as satire and users are warned not to use them for anything real.

Industry expert response

The act has been opposed as early as December 2023 by Internet Society.

Electronic Frontier Foundation

The Electronic Frontier Foundation (EFF) posted an article entitled No, the UK’s Online Safety Act Doesn’t Make Children Safer Online, and covers the threat to privacy of internet users and how the bill restricts free expression by arbitrating speech online, exposing users to algorithmic discrimination through face checks, and leaves millions of people without a personal device or form ID excluded from accessing the internet.

"The internet must remain a place where all voices can be heard, free from discrimination or censorship by government agencies. If the UK really wants to achieve its goal of being the safest place in the world to go online, it must lead the way in introducing policies that actually protect all users—including children—rather than pushing the enforcement of legislation that harms the very people it was meant to protect."

Theo Browne, YouTuber & CEO at T3 Chat

Parents, government, platforms, identity providers

Theo posted a YouTube video covering the Online Safety Act and how it going to destroy the free internet if the internet community doesn't stop it ASAP. He said it's rare that he gets that extreme about something like this, but believes that it is a really important thing that the community jump in front of.

The Online Safety Act will normalise providing your government-issued identification in order to see content, making everyone more susceptible and vulnerable to phishing attacks perpetrated by identity thieves. The act also shifts the responsibility of child safety to the government, who in turn shift it to the websites, who in turn shift it to a brand new identity and age verification industry.

Government response

Ofcom discouraged the promotion of VPNs.

UK Parliament considers all petitions that get more than 100,000 signatures for debate. On 28 July 2025, when the petition to repeal the act had about 400,000 signatures, the government responded with this message: "The Government has no plans to repeal the Online Safety Act, and is working closely with Ofcom to implement the Act as quickly and effectively as possible to enable UK users to benefit from its protections.", only a few days after coming into force. This was only after three days (25 July 2025) the "highly effective age assurance" requirement came into force.

The technology minister Peter Kyle said on Good Morning Britain, "if you want to overturn the Online Safety Act you are on the side of predators. Not those who want to keep children safe."

See also

• Ofcom
• Data Protection Act 2018
• Freedom of expression in the United Kingdom
• General Data Protection Regulation