Online Safety Act: UK online safety law is going to change the way we use the internet

If you live in the UK, the way you access the internet is about to fundamentally change. A new law, the Online Safety Act, comes into force on 25 July and will see a broad range of online providers asking UK users to verify their age through selfies, ID documents and other methods in order to access particular services. Other countries are watching closely, and may follow suit, potentially bringing about a huge change to the way we operate online.

What is the Online Safety Act?

The law is intended to protect children from being exposed to harmful content online. That involves blocking them from accessing pornography and also content that encourages self-harm, depicts violence or encourages dangerous stunts.

Such content remains legal for adults to access online, but they will now have to prove how old they are to do so – which isn’t currently routine. The law is also intended to prevent the spread of illegal content, ranging from child sexual abuse to fraud to terrorism.

Ella Bradshaw at the UK’s National Society for the Prevention of Cruelty to Children (NSPCC) says it is like bringing the internet in line with the sale of alcohol or cigarettes in the real world. “Adults have to prove who they are in a safe, privacy-preserving way all the time. I see this more as a culture change to fix this lag we’ve had online,” she says.

When does it take effect?

The deadline for complying with the legislation is 25 July, but its effects have already been felt. In the past few months, many small websites have shut down rather than risk falling foul of the legislation, which can impose fines of up to £18 million or 10 per cent of global revenue, whichever is larger.

More recently, big websites have been announcing how they are going to meet the act’s obligations, and most of them plan to use third-party age verification tools. Earlier this week, Reddit began checking the age of users from the UK using a tool called Persona, while Bluesky will be using a service called Kids Web Services. Bluesky says that anyone who isn’t verified will be blocked from adult content and also won’t be allowed to use direct messaging. Major pornography sites like PornHub have also said they will introduce age verification.

So how do you verify your age online?

One thing is for sure, clicking a button that says “I am over 18” is no longer going to cut it. The UK regulator Ofcom will be in charge of enforcing the act, and it has made it clear that more rigorous checks will be needed. These may take the form of uploading scans of government ID documents or using AI face recognition that determines whether the person in front of a camera is 18 or not.

Persona, for example, requires users to either upload a photograph of themselves or a photo of a driving licence or passport. Reddit won’t have access to that data, and Persona promises to delete it within a week after performing age verification. New Scientist asked Persona to explain the process, but the company wasn’t able to comment before publication.

Should we be wary of age verification?

Alan Woodward at the University of Surrey in the UK says that trusting websites – particularly those “dubious by nature”, like pornography publishers – directly with your data is less than ideal. But that being sent to a site’s chosen third party verification tool also gives you little control over who you have to share your data with. He says the government could step in and run verification itself, but then there are still privacy issues with telling the state which websites you frequent.

“Personally, I would minimise giving any information online that is not strictly necessary,” says Woodward. “I think the AI-based facial age verification is probably the best way through this minefield.”

Will age verification work?

It is relatively easy for websites and online services to tell where users are based, meaning that UK users can be made to verify their age and others won’t need to. But some people could use tools called virtual private networks (VPNs) to appear as if they are based elsewhere to circumvent the checks. These aren’t a niche product: almost half of internet users in the UK have used one.

“VPNs are lawful services that can be used by people in the UK. While age assurance will make the online space safer for children, it is not a silver bullet. We recognise that determined teenagers may well find ways to access online pornography,” says a spokesperson for Ofcom. “Our guidance is clear that platforms must not host, share or permit content that encourages use of VPNs as a way to get around online safety measures.”

What will all of this mean for people outside the UK?

Other countries are also introducing or investigating similar measures to the UK. In France, large pornography websites are being made to verify their users’ ages, while Australia plans to ban social media for under-16s. At a certain point, it may become easier for websites to check everyone’s age rather than try to selectively apply the patchwork of international legislation.