If a website has recently asked you to prove your age with a photo of your ID or a selfie, that's the Online Safety Act in action. It's one of the biggest changes to how Britain uses the internet in years, and it gets discussed in a lot of heat and not much light. Here's the calm version.
What the Act is for
The Online Safety Act is aimed at the platforms, not at you. It puts legal duties on sites and apps to reduce the risk of children seeing harmful content, with Ofcom as the regulator able to investigate and fine services that fall short. The intent, protecting children, has broad public backing. The arguments are about the methods.
What's actually live now
Since mid-2025, sites hosting adult or other sensitive content have had to run “highly effective” age checks for every user, typically an ID upload or a facial-age scan, with no exemption for existing accounts. Ofcom has been busy: by early 2026 it had opened investigations into more than ninety services and issued its first fines, with its attention reaching the big social and messaging platforms too.
The bit that should give you pause: your data
The honest concern here isn't “I want children to see harmful things”. Of course not. It's that handing your passport or your face to dozens of random websites creates dozens of new places for it to leak. We've already seen identity data spill out of breaches at large platforms. The more sites that hold a copy of your ID, the bigger the target painted on all of us. That's a legitimate worry, and it's the one this brand actually cares about.
The under-16 social media ban: it's happening
On 15 June 2026 the government announced that social media will be banned for under-16s, with the protections expected to come into force in spring 2027. It's being done through secondary legislation, using powers the government already has, rather than a new Act. Platforms like Snapchat, TikTok, YouTube, Instagram, Facebook and X are in scope; messaging apps such as WhatsApp and Signal are not. Some of the same restrictions will be switched on by default for 16- and 17-year-olds too, so nobody hits a cliff edge on their sixteenth birthday.
The government's own headline was about giving kids their childhood back, which is exactly the thinking behind Takeback Family, our plan for sensible first phones for children.
The wrinkle people spot is that proving you're over 16 runs on the same age-check plumbing as everything else in this article, which means more sites asking for ID or a face scan. That's why the privacy-preserving options below matter even more from 2027.
Will a VPN get you around it?
Partly, and decreasingly. A VPN changes where you appear to be, so it can sidestep checks that are purely location-based. But it does nothing against an account-level identity check. Those ask who you are, not where you are. In July 2026 the government confirmed it won't ban or age-gate VPNs, because they have legitimate privacy and security uses, but it's putting the onus on platforms to spot and stop under-age users getting round their checks. We're not in the business of teaching people to dodge the law; we're in the business of the lawful, privacy-respecting path through it.
The better answer than dodging
The real fix for “I don't want my ID sitting on some site's server” isn't a workaround. It's choosing privacy-preserving verification, which lets you prove you're old enough without surrendering your identity at all. It's lawful, it's breach-proof by design, and it's exactly what the privacy-minded should be asking for. We've written it up here: prove you're over 18 without handing over your passport.