On July 25, 2026, a significant milestone will be reached—a year since the implementation of the Online Safety Act’s pivotal child safety duties in the UK. This occasion provides a natural opportunity to reflect on the changes that have occurred since the Act received Royal Assent in October 2023, as well as to evaluate its impacts and the challenges persisting in the digital landscape. The introduction of the Act unfolded in phases, with the most crucial obligations for online platforms taking effect on July 25, 2025.
The primary focus of the child safety duties under the Act is to safeguard children using various online platforms. This includes enforcing stricter protections such as age verification processes, comprehensive assessments of potential risks to children, and initiatives aimed at curbing exposure to harmful content.
As one year has passed since these provisions came into force, a pressing question emerges: Has the Online Safety Act fundamentally altered the internet experience for UK users, or has it merely redirected existing challenges elsewhere? To explore this, cybersecurity experts have been consulted to provide insights and evaluations of the Act’s effects.
One clear area of concern arises from unintended consequences of the legislation. Professor George Loukas, who leads the Centre for Sustainable Cyber Security at the University of Greenwich, notes that Ofcom, the UK’s communications regulator, has transitioned from a consultative role to one of enforcement. This shift has been most apparent with large adult-oriented platforms, where discussions have emerged around a possible increase in Virtual Private Network (VPN) usage as users sought to bypass age verification processes. This trend was anticipated by experts.
The enforcement date triggered many users to adopt VPNs as a workaround for the newly mandated age verification measures. This shift is substantiated by data from Proton VPN’s 2025 report, indicating that the UK experienced a significant spike in VPN enrollments immediately following the enforcement.
However, the rise in VPN usage includes a perilous aspect—an influx of individuals turning to less reputable or free VPN services. Konstantin Levinzon, co-founder of Planet VPN, emphasizes that this has escalated security risks rather than promoting safe online practices. He highlights that many users, searching for free options, may inadvertently choose VPNs that compromise their privacy by leaking sensitive information and misusing their data. “The unintended consequence is a significant uptick in adopting insecure tools, which ultimately undermines privacy rather than protecting it,” Levinzon argues.
Sanjeev Malhotra, Chief Information Security Officer at TSG, echoes these concerns. He warns that those engaging with unverified VPNs expose themselves to substantial risks, including malware attacks, phishing schemes, and excessive data harvesting. He emphasizes that the very act of routing data through unknown servers raises serious concerns about user privacy and security.
Moreover, as the enforcement of the Act has progressed, experts have questioned whether the measures aimed at preventing children from accessing adult content are yielding tangible results. Elle Todd, Partner and Co-chair of the Entertainment & Media Industry Group at Reed Smith LLP, points to recent findings within Ofcom’s age assurance report. The data revealed that despite significant efforts in compliance and technology implementation, there has been little to no improvement in the rates at which children encounter harmful online content.
Brian Higgins, a Security Specialist at Comparitech, notes that while some fines for non-compliance have been issued—totaling around £4 million GBP—there remain glaring enforcement gaps, especially concerning AI and algorithm-based content. He points out that the modest amount collected in fines, alongside notable enforcement missteps, calls into question the effectiveness of the regulatory measures.
Amid these discussions, it is also imperative to examine the security of the systems employed for age verification checks. Boris Cipot, Principal Security Engineer at Black Duck, argues that organizations should look beyond the efficacy of age checks to the integrity of the software supporting these systems. Vulnerabilities or misconfigurations could undermine the efficacy of age verifications, posing potential regulatory challenges as well.
Furthermore, Sarah Bone, Co-Founder of YEO Messaging, has observed a transformation in the infrastructure surrounding identity verification. The responsibility has shifted away from platforms to a growing ecosystem of specialized identity providers, each managing sensitive data. While this transition has bolstered online safety, it concurrently concentrates trust in a smaller number of organizations, thereby increasing their attractiveness as targets for cyber attackers.
In terms of proactive measures, Martin Wegrostek, Cyber Security Portfolio Manager at OryxAlign, underscores the importance of security principles in age verification services. He suggests that organizations should operate under the assumption that breaches are inevitable, thereby prioritizing security and privacy from the design phase. It is crucial to minimize data collection, enforce robust encryption, and conduct thorough security assessments of third-party providers to ensure compliance does not equate to security.
Tim Ward, CEO and co-founder of Redflags, discusses another dimension of risk that emerges from the Act. Content moderators and customer service representatives at affected platforms now routinely handle sensitive government ID documents and personal information from minors. This new responsibility introduces significant human risk, ranging from negligent handling to targeted social engineering attacks. Ward emphasizes that as organizations scrutinize the verification systems themselves, equal attention must be given to the human element involved in these processes.
The conversation around the Online Safety Act thus reveals a complex interplay of advancements, unintended consequences, and ongoing challenges that will require continued attention as the digital landscape evolves. As the Act matures, stakeholders and experts advocate for a balanced approach—one that not only prioritizes child safety but also addresses the multiple facets of risk contained within this process.