LONDON, June 20, 2026 — Weeks after Britain’s landmark Online Safety Act ushered in mandatory age verification for pornography and other harmful online content, the measure intended to shield children has instead ignited a fierce backlash over privacy, with users flooding to circumvention tools and reigniting debate over digital identity.
The rules, enforced from July 25, 2025, require platforms hosting pornographic material or content promoting self-harm, suicide, or eating disorders to implement “highly effective” age checks. Self-declaration is no longer sufficient. Ofcom, the regulator, has directed services to use methods such as government-issued photo ID, facial age estimation, credit card verification, or bank-linked checks.
Major platforms responded swiftly. Pornhub and similar sites rolled out verification systems. Social networks, including Reddit, Bluesky, Discord, and X, introduced measures to restrict underage access to flagged content. Spotify has required face scans via third-party provider Yoti for certain 18+ material.
The backlash was immediate. Proton VPN reported a surge in UK sign-ups exceeding 1,400% in the hours after enforcement began, with sustained increases approaching 1,800% in daily figures. VPN apps dominated Apple’s UK App Store charts, while a parliamentary petition calling for repeal of the Act gathered hundreds of thousands of signatures.
Users have adopted workarounds ranging from VPNs to uploading images of video game characters in attempts to fool facial estimation systems. Privacy advocates, including the Electronic Frontier Foundation, have warned that the requirements risk normalising mass data collection and chilling free expression, with parallels drawn to similar efforts in the EU and US states.
Ofcom maintains that the measures strike a necessary balance. Regulatory data have shown children as young as eight encountering pornography online. The goal is not to block adults from legal content but to move beyond token barriers. Non-compliant platforms face fines of up to £18 million or 10% of global annual revenue.
Public opinion is nuanced. An Ipsos poll found 69% of Britons support age verification in principle for platforms hosting harmful content. Yet willingness to submit personal data drops sharply: only 14-19% said they would do so for pornography or dating sites.
The Digital Identity Gap
Critics argue the timing exposes a deeper policy shortfall. While age verification is now mandatory, the UK lags European peers in widespread, privacy-preserving digital IDs capable of zero-knowledge proofs, systems that could confirm a user is over 18 without revealing name, exact birthdate or other personal data.
Countries such as Poland (with millions of active eIDs) and Italy (rolling out digital wallets) have advanced further under EU eIDAS 2.0 frameworks. The UK has taken steps toward a “BritCard” digital identity scheme, announced in 2025 to tackle illegal working and streamline public services. However, plans for mandatory use in right-to-work checks were later diluted amid privacy concerns and public opposition.
Government guidance notes that some age assurance technologies can estimate age from images without storing them or identifying individuals. Yet many implementations still rely on third-party uploads of sensitive documents, fuelling fears of data breaches or mission creep.
Outlook
Ofcom continues enforcement actions, including investigations into non-compliant pornography sites, while traffic to major adult platforms in the UK has reportedly declined. Whether the Act ultimately delivers safer online spaces for children, or simply drives determined users offshore via VPNs, remains an open question.
For a law born of genuine concern over youth exposure to harmful material, its early days have highlighted the perennial tension between protection and privacy in the digital age. As ministers weigh further digital identity moves, the experience of the past year suggests public tolerance for intrusive verification has limits.
The Online Safety Act is law. Its success will be measured not in headlines, but in outcomes that balance child safety with the hard-won expectation that adults retain control over their personal data. The story continues.
