The Devil is in the detail of Online Safety Act (2023)

From the 25th July 2025, the child protection aspect of the Online Safety Act 2023 came into force in the UK. In a nutshell, organisations can be fined up to £18m or 10% of their income if they fail to take reasonable measures to protect UK users from accessing and viewing UK age restricted content on the world wide web. 

As of 25 July 2025, platforms have a legal duty to protect children online. Platforms are now required to use highly effective age assurance to prevent children from accessing pornography, or content which encourages self-harm, suicide or eating disorder content.

Platforms must also prevent children from accessing other harmful and age-inappropriate content such as bullying, hateful content and content which encourages dangerous stunts or ingesting dangerous substances. Platforms must also provide parents and children with clear and accessible ways to report problems online when they do arise. 

https://www.gov.uk/government/collections/online-safety-act#child-safety

The new act will be enforced by Ofcom that will also be granted the right to cancel platforms in certain circumstances.

In the most extreme cases, with the agreement of the courts, Ofcom will be able to require payment providers, advertisers and internet service providers to stop working with a site, preventing it from generating money or being accessed from the UK.

Furthermore

Ofcom will also be able to hold companies and senior managers (where they are at fault) criminally liable if the provider fails to comply with Ofcom’s enforcement notices in relation to specific child safety duties

The Devil is in the implementation detail

I ask my self what constitutes "highly effective age assurance". There is no standard  defined approach. For primarily UK based sites this could be a blanket type of verification on UK age restricted content. This could also impact on users from outside the UK who will be asked to verify their age even if they are out side the jurisdiction of the UK. Either way all users in the UK will be required to verify their age for every website that hosts UK age restricted content as defined in UK law. irrespective of their age.

For companies based outside the UK, this is likely to involve restricting access to content for UK users only. This could range from age verification to a complete block on UK users. For these types of platforms, UK users can likely use a VPN such as the one built into the Opera Web Browser and VPN to circumvent the UK only age based content restrictions.

In other words it seems to me the organisations that will be hit hardest by this change will be those offering a blanket change for all users. For those not based in the UK including many porn sites  it seems quite likely that after implementation, users will face a minor inconvenience that can be easily bypassed, albeit for all sites.

The way the bill has been implemented is dependent on how the age verification has actually been implemented. The onus is on the provider or platform to decide if and how there content is restricted, and also be prepared to face any consequences of this decision. Certainly the penalties for getting this wrong are set high and organisations will likely err on the side of caution on how they adhere to the new law.

While the aims of the Online Safety Act 2023 aims to encourage online platforms to do more to protect young children from accessing age restricted content are commendable, this comes at a high price and is unlikely to protect those with some basic IT skills from accessing this same content, the majority of which is not even hosted in the UK. At the same time the UK only implementation can come at a disadvantage for UK based organisations who are likely to subject all their users to the same checks, including those not based here. For users not from the UK such checks could be off putting.

There is much that can be said about the Online Safety Act 2023 and I am sure we will be hearing much about it over the next the coming months. Personally I would be wary of sharing any ID with any website, never mind having to do it for every site that hosts restricted content for UK users. Those who value their personal data and security should be looking to reduce their digital finger print, not increase it ad infinitum.