The UK Online Safety Act: A Bold Step with Flaws but a Path Forward

The Online Safety Act 2023 (OSA), which came into force on July 25, 2025, represents the UK government’s earnest attempt to protect children from harmful and age-inappropriate online content. However, as with many ambitious tech-related policies crafted by lawmakers primarily versed in politics—not technology—the implementation has been far from perfect. The act introduces a new age verification system for adult websites, replacing the previous weak “Are you over 18?” click-through method with a more robust, yet controversial, process requiring users to prove their age.

The idea behind the OSA is commendable. With studies showing that nearly 90% of UK children have mobile phones by age 11, and 1 in 5 minors holding adult profiles on social media, the risk of easy access to inappropriate content has been a genuine concern. Previously, parents largely bore the burden of filtering content with little governmental support. The OSA aims to fill that gap by mandating stricter controls and increasing platform transparency about harmful content.

Yet, the act’s implementation, especially the age verification process, has sparked backlash. Within just a week, over half a million people signed petitions calling for its repeal. Critics argue the system is intrusive and risks exposing sensitive personal data. Instead of a centralized, government-secured verification system, users must entrust their identity details to multiple third-party services with varying security standards. This fragmented approach creates a sizable risk of data breaches and privacy violations, potentially deterring adults from accessing legitimate content.

This new hurdle has already led to a sharp drop in visits to major adult websites like Pornhub, as many users either refuse to verify their age or fear the loss of anonymity. While some see this as censorship, others view it as a necessary evolution in safeguarding minors online. The UK’s model starkly contrasts with the EU’s emerging approach, which relies on a single, centralized, privacy-focused verification app designed to share minimal data and avoid logging browsing histories.

Meanwhile, tech-savvy users continue to find workarounds—most notably using VPNs to bypass UK restrictions by masking their location. This undermines the law’s objectives and highlights the challenge of regulating digital spaces where borders are virtual and anonymity is easily sought. The government has no plans to ban VPNs, placing additional responsibility on parents to monitor their children’s online activities.

What Undercode Say:

The Online Safety Act’s ambition is admirable and necessary, but the UK’s current age verification system is a classic case of good intentions hampered by poor execution. By delegating identity checks to numerous third-party companies without a unified, secure infrastructure, the UK government has inadvertently created a patchwork of privacy and security vulnerabilities that could undermine public trust.

Centralizing age verification under a government-backed, highly secure, and privacy-preserving platform—perhaps modeled on the EU’s approach—would be a far more effective solution. Such a system would limit data exposure, reduce the attack surface for cybercriminals, and make age verification less cumbersome for users. Without this, the current setup risks alienating adult users, driving them to seek dangerous workarounds, and ultimately failing to protect children effectively.

The article also highlights an interesting potential avenue in biometric verification technology. Facial recognition combined with challenge-response tests could provide age verification without storing personal data, preserving privacy and minimizing risk. Although this tech is currently imperfect, ongoing advancements could soon offer a more user-friendly, secure alternative to cumbersome ID checks.

Moreover, the stark drop in adult website traffic post-OSA signals that many adults are unwilling to accept the privacy trade-offs currently required. This decline could push adult content platforms to innovate and develop their own trusted, privacy-centric age verification methods, potentially positioning them as leaders in online security and data protection—a surprising but welcome evolution for the industry.

VPN usage further complicates enforcement, and while they offer a privacy shield for legitimate users, they also empower minors to circumvent controls. This dual-edged sword means any online safety policy must be paired with education and parental involvement rather than relying solely on technical barriers.

Ultimately, the OSA should not be repealed but refined. Privacy concerns can be addressed through tighter regulations on third-party age verification providers, rigorous security audits, and transparent data-handling policies. Collaboration between government, tech companies, and privacy advocates is essential to develop a system that protects children without sacrificing adult users’ privacy and freedoms.

🔍 Fact Checker Results:

✅ The claim that nearly 90% of UK children have mobile phones by age 11 is consistent with Ofcom research data.
✅ Age verification via third parties without centralization does increase risks of data breaches, as recent incidents with UK retailers and dating services have shown.
✅ VPNs remain legal and widely used in the UK, often enabling circumvention of geo-restrictions and content controls.

📊 Prediction:

As digital regulation evolves, the UK government will likely face mounting pressure to overhaul the age verification system under the Online Safety Act. We predict a move toward a centralized, government-backed verification platform—potentially inspired by the EU’s model—within the next two years. Biometric and AI-driven privacy-preserving technologies will gain prominence as private companies and regulators seek to balance safety and user privacy.

Additionally, adult content providers will be incentivized to innovate trustworthy age verification systems to regain user trust and traffic, possibly positioning themselves as pioneers in online data privacy. Meanwhile, VPN use will continue to challenge enforcement, ensuring that a purely technological fix will never fully solve the issue without complementary education and parental controls.