UK Online Safety Act

The Online Safety Act is the UK’s sweeping law regulating online content, and it has moved decisively from “on the books” to “being enforced.” Its most privacy-relevant feature: platforms that host adult content, or are likely to be accessed by children, must implement “highly effective” age assurance — meaning many UK users now have to prove their age to access large parts of the web. This is the real-world test case the rest of the world is studying.

What it requires

• Services hosting pornography or other content harmful to minors must use “highly effective” age checks — not a self-attested “I am 18” button, but methods judged accurate, robust, reliable, and fair (ID checks, face-age estimation, credit-card checks, and similar).
• Platforms must assess and mitigate risks to children from their design and content.
• The regulator, Ofcom, can levy fines up to £18 million or 10% of global annual revenue, whichever is greater.

The privacy tension is built in: to gate access by age, services (or their third-party vendors) must collect or process identity or biometric signals from adults, creating new honeypots of sensitive data and new ways to link browsing to real identities.

Where it stands (2026)

This is not theoretical — enforcement is live:

• Age-assurance duties for adult-content services became enforceable on July 25, 2025.
• By February 2026, Ofcom had opened investigations into more than 90 platforms and issued several fines.
• On February 12, 2026, Ofcom fined Kick Online Entertainment £800,000 for failing to run required age checks across dozens of adult sites; a separate adult-site operator was fined £1 million.
• Ofcom and the ICO issued a joint age-assurance statement in March 2026 and are due to report on how effective age assurance is by end of July 2026.

A predictable side effect: interest in VPNs surged as some users sought to bypass the checks — a reminder that age gates are both privacy-invasive and leaky.

Timeline

• 2023 — Online Safety Act passes into law.
• July 25, 2025 — “Highly effective” age-assurance duties for adult content become enforceable.
• Feb 12, 2026 — Ofcom fines Kick £800,000; 90+ investigations underway.
• March 2026 — Ofcom/ICO joint statement on age assurance.
• End of July 2026 — Ofcom due to report on age-assurance effectiveness.

What it means for you

If you’re in the UK, expect to encounter age checks on more sites, and think about how you’re being verified — a reputable “double-blind” age-estimation method that doesn’t retain your data is very different from uploading your passport to an unknown vendor. Everyone else should watch the UK closely: it’s the live demonstration of what mandatory age verification actually looks like at national scale, and its stumbles are shaping debates in the EU and US.

Where to follow it: Ofcom publishes enforcement updates and industry bulletins; the Open Rights Group tracks the civil-liberties angle. We’ll update this entry as Ofcom’s July report and further fines land.