UK Online Safety Act: How It Affects Your Internet and What You Can Do

What the Online Safety Act actually does

The UK Online Safety Act became law in October 2023. It gives Ofcom, the UK's communications regulator, sweeping powers to regulate online platforms, including the ability to require platforms to use "accredited technology" to scan messages for illegal content.

This is not theoretical. Ofcom has been issuing codes of practice and enforcement guidance throughout 2024-2026, and platforms operating in the UK are adapting their services to comply.

Key provisions:

• Platforms must use automated tools to detect and remove illegal content
• Ofcom can require scanning of encrypted messages using "accredited technology"
• Age verification is required for platforms hosting content harmful to children
• Platforms face fines of up to 10% of global revenue for non-compliance
• Senior managers can face criminal prosecution

The encryption problem

The most controversial provision is Section 122, which allows Ofcom to issue "technology notices" requiring platforms to identify illegal content in encrypted messages. Signal and WhatsApp have both threatened to leave the UK market rather than compromise their encryption.

As of 2026, Ofcom has acknowledged that no technology currently exists that can scan encrypted messages without breaking the encryption itself. But the legal power remains on the books, and platforms must comply if and when Ofcom issues a technology notice.

What's already changed

Even without fully exercising its scanning powers, the Online Safety Act has already affected internet use in the UK:

• Age verification walls are appearing on more websites, requiring users to prove their age through ID uploads or facial recognition
• VPN usage in the UK has increased significantly as users seek to avoid age verification and maintain privacy
• Some smaller platforms have geo-blocked UK users rather than invest in compliance infrastructure
• Content moderation has become more aggressive across platforms serving UK users

How VPN usage is changing in the UK

The UK has traditionally been a low-VPN-usage country compared to Germany or the Netherlands. That's changing. According to industry data, UK VPN adoption grew by over 40% in the 18 months following the Act's passage.

The primary drivers:

• Avoiding age verification on adult content sites
• Maintaining privacy in the face of potential message scanning
• Accessing content blocked or restricted in the UK
• General distrust of government surveillance powers

What a VPN does and doesn't protect

A VPN protects:

• Your browsing history from your ISP (BT, Virgin Media, Sky, etc.)
• Your IP address from websites and services
• Your location data from geo-restriction systems
• Your traffic from network-level monitoring

A VPN doesn't protect against:

• Client-side scanning (if a platform scans messages on your device before sending)
• Content you voluntarily upload to platforms that comply with Ofcom's requirements
• Age verification that uses device-level checks rather than IP-based geo-detection

Practical steps for UK residents

1. Use a VPN to encrypt your internet traffic and prevent ISP-level monitoring. IMBA VPN uses VLESS Reality, which is indistinguishable from normal HTTPS traffic
2. Choose messaging apps carefully. Signal remains the gold standard for encrypted messaging and has committed to leaving the UK rather than compromising encryption
3. Be aware of what you share on platforms that comply with UK scanning requirements
4. Stay informed about Ofcom's enforcement actions and any technology notices issued

The Online Safety Act represents a fundamental shift in how the UK government approaches internet regulation. Whether you agree with its goals or not, understanding what it does and protecting your privacy accordingly is practical, not political.

[Start protecting your privacy](/auth/register)