Kids Say the Online Safety Act Changed Nothing
More than a year after the UK's Online Safety Act began reshaping how British users access the internet, the young people it was designed to protect say it hasn't made a dent. According to reporting, children told the Children's Commissioner that the law has made "absolutely no difference" to their online experience, a striking verdict on a piece of legislation that has forced age checks, identity verification, and content restrictions across major platforms.
The Commissioner isn't just relaying frustrated feedback from kids. The office is reportedly furious with Ofcom, the regulator tasked with enforcing the Act, over what's described as a string of failures. For a law that was sold to the public as a way to make the UK "the safest place in the world" to be online, hearing directly from the intended beneficiaries that nothing has actually changed is a serious credibility problem, not just a policy hiccup.
The Privacy Cost Nobody Asked For
Here's the part that matters most for anyone thinking about digital privacy: the Online Safety Act didn't arrive without cost. To comply, platforms have rolled out age verification systems that often require government ID, facial scans, or credit card checks just to access ordinary content. Services from gaming platforms to social networks have implemented these checks, including Battle.net's move to add UK age verification for accounts based in Britain.
Every one of those checks creates a data trail. Users have understandably worried about what happens to the identity documents and biometric scans they hand over, and whether regulators or platforms retain that information longer than necessary. Industry guidance has pushed back on the idea that every age check gets logged and handed to Ofcom on demand, and a closer look at what Ofcom can actually demand from age verification data records shows the reality is more nuanced than the worst-case fears. Still, the fact that this question needs answering at all reflects how much personal data infrastructure has been built around a law that, according to the kids it targets, hasn't achieved its core goal.
Why the Law Isn't Landing
Part of the disconnect comes down to behavior. When platforms started demanding ID or facial scans to access certain content, a large share of UK users didn't submit to verification. They routed around it. One year into the age-check regime, VPN sign-ups in the UK jumped by 1,800 percent, a figure that speaks volumes about how the public, including teenagers old enough to download an app, responded to the new rules.
That's the uncomfortable irony at the center of this story. A law built to shield children from harmful content pushed a significant number of users toward tools that mask their location and identity entirely, tools that also happen to strip away the very verification the law relies on. If kids are simply using a VPN to bypass age gates, the underlying safety goals of the Online Safety Act are not being met, even as the privacy trade-offs from identity verification remain very real for the users who did comply.
What This Means For You
If you're a parent, a teenager, or just a UK internet user trying to make sense of this, the takeaway is straightforward: the Online Safety Act has changed how you interact with platforms, but according to the people it was meant to protect, it hasn't changed the underlying risks. You may have already handed over an ID scan or completed a facial age check for a service you use regularly. That data now exists somewhere, subject to rules that are still being clarified in real time.
Meanwhile, if you or someone in your household has turned to a VPN to avoid age verification, it's worth understanding that this workaround also removes any content filtering or safety features the platform might have intended to apply. A VPN protects your privacy and location, but it isn't a parental control tool, and using one to dodge an age gate doesn't add any actual safety layer back into the equation.
Key Takeaways
The gap between policy intent and lived experience is now being voiced by the same children the Online Safety Act was written to protect, and by the Children's Commissioner tasked with holding Ofcom accountable. For everyday users, the practical steps are clear. Review what identity data you've submitted to platforms under UK age verification rules and ask providers about their retention policies. If your household uses a VPN, treat it as a privacy tool, not a substitute for actual conversations about online safety. And keep an eye on how Ofcom responds to this criticism, because the next round of enforcement decisions will shape how much personal data UK users are asked to hand over next.
