If a website has recently asked you to prove your age with a photo of your ID or a selfie, that's the Online Safety Act in action. It's one of the biggest changes to how Britain uses the internet in years, and it gets discussed in a lot of heat and not much light. Here's the calm version.
What the Act is for
The Online Safety Act is aimed at the platforms, not at you. It puts legal duties on sites and apps to reduce the risk of children seeing harmful content, with Ofcom as the regulator able to investigate and fine services that fall short. The intent — protecting children — has broad public backing. The arguments are about the methods.
What's actually live now
Since mid-2025, sites hosting adult or other sensitive content have had to run “highly effective” age checks for every user — typically an ID upload or a facial-age scan, with no exemption for existing accounts. Ofcom has been busy: by early 2026 it had opened investigations into more than ninety services and issued its first fines, with its attention reaching the big social and messaging platforms too.
The bit that should give you pause: your data
The honest concern here isn't “I want children to see harmful things” — of course not. It's that handing your passport or your face to dozens of random websites creates dozens of new places for it to leak. We've already seen identity data spill out of breaches at large platforms. The more sites that hold a copy of your ID, the bigger the target painted on all of us. That's a legitimate worry, and it's the one this brand actually cares about.
Where the under-16 social media ban stands
You'll have seen headlines about banning under-16s from social media. As things stand in 2026 that is proposed, not yet law — it followed a large national consultation, and the government has signalled it intends to move quickly, but the regulations aren't in force. Worth watching rather than panicking over.
The wrinkle people spot is that verifying ages for social media runs on the same identity plumbing as digital ID. That overlap is real, and it's why the privacy crowd keeps one eye on it — see our digital ID explainer for that thread.
Will a VPN get you around it?
Partly, and decreasingly. A VPN changes where you appear to be, so it can sidestep checks that are purely location-based. But it does nothing against an account-level identity check — those ask who you are, not where you are. And the rules are tightening around circumvention. We're not in the business of teaching people to dodge the law; we're in the business of the lawful, privacy-respecting path through it.
The better answer than dodging
The real fix for “I don't want my ID sitting on some site's server” isn't a workaround — it's choosing privacy-preserving verification, which lets you prove you're old enough without surrendering your identity at all. It's lawful, it's breach-proof by design, and it's exactly what the privacy-minded should be asking for. We've written it up here: prove you're over 18 without handing over your passport.