The internet, once a Wild West of unregulated information and connection, is now firmly within the sights of governments around the world. In the UK, this new era of digital regulation is encapsulated by the Online Safety Act, a sprawling piece of legislation passed in 2023. Its stated purpose is ambitious and, for many, laudable: to make the UK “the safest place in the world to be online.” This sweeping act, created by the Department for Science, Innovation and Technology, has been rolled out in phases, with one of its most contentious and impactful measures coming into force on 25th July of this year: mandatory age verification for online pornography.
In the days since its implementation, the digital landscape has been irrevocably altered. Major platforms, including some of the largest adult content providers, have either complied with the new rules by implementing “highly effective” age checks or, in some cases, have chosen to block UK users entirely. The enforcement body, Ofcom, has wasted no time, launching investigations into a number of sites that have failed to comply. This seismic shift, however, has ignited a fierce and multi-faceted debate about its efficacy and its broader implications for digital rights. Critics argue that this is less of a sturdy wall and more of a flimsy curtain, easily bypassed with readily available tools. Reports from ethical hackers have already demonstrated how simple software and techniques can circumnavigate the new systems in seconds. This has led to a dramatic spike in the use of Virtual Private Networks (VPNs) in the UK, with some services reporting a download increase of over 1,800% as users seek to mask their location.
The conversation is also being shaped by the risk of pushing content into darker, less-regulated corners of the internet. The government’s goal is to create a safer environment, but what happens when the content is no longer on a platform that, while explicit, is at least visible and subject to some level of public scrutiny? The fear is that the new rules will simply drive users to less scrupulous, unregulated sites, or even deeper into the dark web, where content is not only unmonitored but potentially more harmful and illegal. The promise of a safer internet for children is the driving force, but the unintended consequences—from revenue loss for compliant sites to the proliferation of an untraceable black market for explicit material—are becoming increasingly difficult to ignore. This new law, while well-intentioned, is forcing a reckoning with the complex realities of digital privacy, freedom, and the near-impossibility of legislating away human curiosity in the digital age. While we all agree in principle its good, the implementation is short sighted.
The Noble Aims of the Online Safety Act
The Online Safety Act was born from a widespread desire to protect the most vulnerable in our society, particularly children, from the damaging effects of online content especially graphic, exploitative and extreme hardcore porn. Statistics from Ofcom show that children as young as eight have accessed pornography online, with a significant number of teenagers being exposed to other forms of harmful material. The Act, therefore, aims to create a legal framework that holds tech companies accountable for the content on their platforms. The new age verification rules for pornography are a key component of this, moving beyond the easily-ignored tick-box age confirmations to a system of “highly effective” checks. For many, this is a long-overdue and positive step. It places the onus on the platforms to protect children rather than on parents or individuals, and it reflects a societal consensus that minors should be shielded from adult material. The act also extends to content promoting suicide, self-harm, and eating disorders, aiming to make the digital space a less toxic environment overall.
The rationale is clear: by creating a legal and financial imperative for platforms to act, the law will fundamentally alter the digital ecosystem. Websites that fail to comply face the threat of crippling fines, up to £18 million or 10% of their global revenue, a penalty significant enough to force a change in behaviour. Proponents of the act argue that while no system is foolproof, a robust verification process is a “giant, unprecedented step forward,” as Technology Secretary Peter Kyle stated, and that even if it’s not a perfect fix, it will drastically reduce a child’s exposure to harmful content. This proactive, preventative approach is seen as a necessary and essential measure in a world where children are growing up with unprecedented access to digital content.
The Privacy Paradox and the Dark Side of Compliance
While the intentions of the Online Safety Act are widely supported, its methods have opened a Pandora’s box of privacy and security concerns. The “highly effective” age checks often require users to submit sensitive personal data, such as a photo of a government-issued ID (like a passport or driving licence), or a live facial scan for age estimation. While verification companies like Yoti, AgeGo, AllTrustPass, OneID claim to use privacy-first approaches and delete data immediately, critics argue that once such information is uploaded, its security is never guaranteed. A data breach at a verification company could link a user’s government ID to their history of viewing explicit content, creating a perfect storm for blackmail and extortion. The possibility of such a leak could expose an individual’s most private predilections and fantasies, making them a target for malicious actors.
Furthermore, there is a fear that this system could lay the groundwork for increased government surveillance and censorship. The government has denied any intention of monitoring private citizens, but the precedent of requiring such personal data for internet access could be extended to other forms of content in the future, what about gambling or extreme political views. What if, for example, graphic images in news reports on war or violence were deemed “harmful content” that required age verification? This slippery slope argument suggests that the Online Safety Act, while starting with pornography, could gradually erode a broader range of digital freedoms and the cornerstone of the internet which is open freedom. The act also fails to address the grim reality of children creating and sharing their own explicit content, a form of sexting that exists entirely outside the purview of commercial platforms and their new age verification systems. But hopefully the OSA will reduce their exposure and therefore the desire for children to do so.
A Blueprint for Alternatives: Beyond the Blanket Ban
The debate over the Online Safety Act is not just about its pros and cons; it’s also about whether there are more effective and less invasive alternatives. Instead of a blanket requirement for age verification, some critics and digital rights advocates have suggested a number of alternative approaches. One idea revolves around locking down devices at the cellular level. Mobile data providers could offer an opt-in or opt-out service that tags a device, such as a child’s phone, as a “child’s device” based on its IMEI number, thereby restricting access to adult sites. This places the control in the hands of parents and mobile providers rather than requiring a mass data collection from all internet users.
Another proposed alternative is to couple a password-protected access system with strict legal accountability. This would mean that a user could create a password to access adult sites, but if a child is found to have bypassed these measures on a device they own, the legal account holder (the parent) could face a substantial fine or even a potential jail term. The idea is to create a strong incentive for parents to take an active role in monitoring their children’s online activity. Combined with an increased focus on digital literacy and education in schools, these alternatives could create a more comprehensive and less technologically fraught solution that protects children without compromising the privacy of every adult internet user.
The Inevitable Game of Digital Cat and Mouse
The reality of the new age verification system is that it’s a preventative measure, not a definitive, 100% foolproof block. The moment the new rules came into force, a digital cat-and-mouse game began. Tech-savvy users, whether children or adults, are already employing a variety of methods to bypass the checks. VPNs are the most common workaround, allowing a user to spoof their location and appear to be browsing from a country without such restrictions. Free and paid VPN services, such as Proton VPN, have seen a massive surge in popularity, proving that if a digital wall is built, a digital ladder will be found.
Furthermore, the new systems can be tricked. Ethical hackers have demonstrated how “fake selfie” videos and other widely available technologies can fool facial recognition algorithms. Children could also use a friend who is over 18 to verify their age, or even use a family member’s credit card without their knowledge. While verification firms like Yoti and TransUnion’s TruValidate insist that they do not retain personal data, once this sensitive information is entered into a system, it is vulnerable. A copy of a passport, a facial scan, or a credit card number, once leaked into the wild, can be copied, sold, and misused in ways that are impossible to control. The new regulations, while aiming to create a sense of digital security, have inadvertently created a new threat vector of risk for millions of UK citizens. The surface area for risk and online bad actors is already very large.
A Flawed Compromise: The Future of Digital Freedoms
The implementation of the Online Safety Act’s age verification rules marks a significant, and in many ways unsettling, moment in the history of the UK internet. The act represents a noble, and widely supported, aim: to protect children from the online world’s darker corners. However, the path chosen to achieve this goal has created a series of complex and interconnected problems that cannot be easily dismissed. On one hand, we have a system designed to shield the young, forcing a level of accountability on tech giants that has been absent for too long. On the other, we have a privacy paradox where a person’s right to browse anonymously is being sacrificed in exchange for a security measure that is demonstrably imperfect and easily circumvented.
The surge in VPN usage and the documented ability to bypass these checks highlight the fundamental challenge of legislating online behaviour. The internet, by its very nature, resists national borders and centralised control. By attempting to impose a rigid system, the government has inadvertently created a new market for unregulated content and a greater risk of data exposure for its citizens. The debate is now less about whether children should be protected, but rather how best to achieve that goal without sacrificing the principles of an open, private internet. The law, as it stands, is a flawed compromise—a brave but imperfect attempt to protect the vulnerable that has created a new set of digital anxieties for everyone else.
Facts
- Ofcom’s Power: Ofcom is the independent regulator responsible for enforcing the Online Safety Act. It has the power to issue fines of up to £18 million or 10% of a company’s global turnover for non-compliance.
- The Big Names: Major platforms that have implemented age checks include Pornhub, YouPorn, RedTube, and social media sites like X, Reddit, and Bluesky. Some sites have opted to block UK users completely rather than comply.
- The VPN Surge: Following the 25th July enforcement date, VPN downloads in the UK surged by up to 1,800% as users sought to bypass the new age verification requirements.
- Verification Methods: The “highly effective” methods approved by Ofcom include uploading a government ID, using a credit card, open banking data, or a digital ID wallet from a certified provider.
- The Origins: The Online Safety Act was signed into law in October 2023 but its various provisions have been implemented in phases over time.
Links
- Ofcom: The Online Safety Act Explained: The official breakdown from the UK’s regulator on the law’s purpose and enforcement. https://www.ofcom.org.uk/online-safety
- BBC News: What the Online Safety Act means for you: A journalistic overview of how the new law impacts everyday internet users in the UK. https://www.bbc.com/news/technology-67123991
- TechRadar: ‘No plans to repeal the Online Safety Act’: An article from a tech perspective, detailing the government’s response to the backlash and the rise of VPN usage. https://www.techradar.com/vpn/vpn-privacy-security/no-plans-to-repeal-the-online-safety-act-uk-government-responds-to-age-verification-backlash
