Online Safety Act
About two years ago the UK passed the Online Safety Act. One of the laws it introduced is a requirement for online services to verify the age of users attempting to access adult content. This law came into effect a few days ago, on July 24ᵗʰ 2025.
The government has been trying to push through this law for at least a decade. Numerous experts and advisors have attempted to push back, warning of the dangers when it comes to the implementation of the law.
If we are to give benefit of doubt, the law has good intentions. I think people will unanimously agree that children accessing adult content is harmful. The problem is with the implementation of the law, and whether it prevents more harm than it causes.
Potential for Harm
I believe this law has potential for severe harm – that it has potential to ruin lives, and lead to deaths.
As Jim Killock, of the Open Rights Group writes1:
Age verification could lead to porn companies building databases of the UK’s porn habits, which could be vulnerable to Ashley Madison-style hacks.
The government has repeatedly refused to ensure that there is a legal duty for age verification providers to protect the privacy of web users.
There is also nothing to ensure a free and fair market for age verification.
It seems inevitable that a data breach will occur that links users’ private online activity to their real identity as a result of the age verification requirement. The government’s lack of guidance or proposed technical solution to privately verify identities online will lead to a patchwork of poorly implemented systems with poor data hygiene.
The wake of the Ashley Madison hack was linked to at least one confirmed suicide.2
In 2020, a Finnish psychotherapy service provider, Vastaamo, suffered a data breach3 that led to the leak of deeply sensitive information pertaining to 36,000 patients, including therapy session notes. Tragically, this breach is also linked to at least one confirmed suicide4, and likely caused emotional distress for thousands of people.
A few days ago, a US-based app for women’s dating safety, Tea, suffered a data breach that led to the leak of 72,000 images5. 13,000 of these images were selfies used for account verification.
Tea’s own privacy policy claimed to delete these images as soon as they were no longer needed. They were instead retained forever, and stored in a publicly accessible S3 bucket.
Just last week, my own data was implicated in a breach of a background check company. Why was that data kept longer than necessary to perform the background check?
These cases demonstrate that companies cannot be trusted to do the right thing when it comes to the privacy of their users. Even when there are severe penalties. Even when the consequences are existential threats to their operation.
Lack of Effectivity
I also do not believe that the law is at all effective. Children know technology better than their parents. They talk to each other. Word will get around once they figure out how easy it is to use a VPN.
The law counterproductively nudges children into using the internet with even less oversight.
They’ll be nudged into using free VPN services with dubious privacy policies. Some VPN services may funnel children to inappropriate content if they’re ad-supported. Obscure VPN services could also be leveraged by malicious actors for spying purposes.
Think Onavo, but instead of being backed by Facebook to spy on children, it’s backed by Russia.
Conclusion
A technical solution that enables online services to verify users’ ages whilst also preserving their privacy is absolutely viable. The UK government has access to expertise that could have assisted in drawing up a framework for this.
Anonymous Credit Tokens are an ingenious application of cryptography and just an example of something that could serve as the foundation of a privacy-preserving age verification system. In essence, ACTs enable the separation of the purchase and consumption of a service in a way that can’t be linked.
With ACTs, you could pay for tokens using your own payment details, and then later use those tokens to access a web page without that event being linkable back to the payment details.
I am deeply disappointed in my country for forcing through this law in the careless way that it has.
This is not a dramatic reaction to people not being able to watch porn as easily anymore. I sincerely feel this law is a danger to the country clumsily cooked up by clueless bureaucrats, and sets a dark precedent for the future.