The U.K.’s new Online Safety Act: The good, the bad, and the ugly

Six years in the making, the U.K.’s Online Safety Bill is now a done deal. The country’s House of Lords passed it yesterday, so it will receive royal assent and pass into law in the coming days. And everyone should be paying attention to what happens next.

That’s because the new law is at the vanguard of a global push to, well, make online life safer, especially for children. Some of this stuff is in current U.S. bills (like age-gating) and some is in the EU’s under-consideration “Chat Control” proposal (scanning messages)—no matter the place, the same issues apply. So, here’s a quick breakdown, starting with the more obviously positive aspects of the incoming Online Safety Act.

Self-protection. Social media platforms will have to give adult users tools to filter out harmful-but-not-illegal content such as racist posts or those that encourage self-harm.

New sexual offenses. Sending a nude picture to someone to distress them and gain gratification? Cyber-flashing will be illegal now—and something that makes someone a registered sex offender. Also, sharing an intimate image (real or a deepfake) of someone without their consent is now going to be illegal.

…Aaaand that’s about it as far as the clearly good goes. Let’s head into murkier territory now.

Porn publishers must keep kids out. Good—nay, essential—in theory, but the age-verification and age-estimation tools from which they must choose all introduce new problems around privacy and bias. Over to the communications regulator Ofcom now, to figure out how to make this part workable.

Social media platforms and harmful content. Again, kids are supposed to be shielded from seeing harmful content, such as posts that romanticize suicide or depict serious violence. Age verification or estimation again—see above.

Still murkier…

Platforms and harmful content. Online platforms must remove illegal content quickly or even stop it from being uploaded in the first place. Civil rights advocates hate this because they see the definitions of illegal content as too blurry—thus forcing the platform operators to make constant calls about what is and isn’t allowed—and because it’s hard to appeal against a preemptive upload block. They warn that the likes of Facebook and X may even have to block the upload of protest videos, under the U.K.’s draconian public order laws.

And now, the pièce de résistance.

Undermining end-to-end encryption. What has become known as the bill’s “spy clause” will allow the government, via Ofcom, to tell an encrypted messaging platform, such as Signal or WhatsApp, to make it possible to scan their messages for terrorist or child abuse material.

Yes, the government did recently perform a slight climbdown by saying it wouldn’t try to enforce this until it becomes “technically feasible” to bypass end-to-end encryption without compromising users’ privacy, but the clause will be part of the Act, making it something of a sword of Damocles.

Already, hardline interior minister Suella Braverman has used the looming law to warn Facebook parent Meta against expanding the use of end-to-end encryption on Messenger and Instagram. “My call to Meta is to work with us more constructively to roll out end-to-end encryption with robust safety measures because what they’re proposing at the moment will make Facebook and Instagram Direct safe havens for pedophiles,” she reportedly told the BBC today before continuing on Times Radio: “We want to encourage them to adopt the technological solution. We believe the solution exists, whereby user privacy can be protected and child safety can be safeguarded.”

So no, the U.K.’s threat to the integrity of end-to-end encryption is anything but neutralized—and now the government is even gaining the power to jail executives of companies that won’t comply. Signal president Meredith Whittaker has reiterated her service’s threat to walk if necessary, posting on Bluesky today that “we will do whatever we can to continue ensuring people in the U.K. can use Signal, but if the choice came down to being forced to build a backdoor, or leaving, we would leave.”

More news below.

Want to send thoughts or suggestions to Data Sheet? Drop a line here.

David Meyer