UK Cracks Down with New Online Safety Act, But Loopholes Persist

The days of simply clicking “Yes, I’m 18” to access social media in the UK are over, or at least, that’s the goal.

Starting this week, adult websites are legally required to introduce serious age verification measures under the country’s sweeping new Online Safety Act. The goal is to make it much harder for children to accidentally or intentionally stumble into explicit content. Sites that don’t comply face massive fines and regulators aren’t bluffing.

However, while the law promises a safer digital space for children, it also raises significant questions: Will these new checks actually be effective? Which websites are following the rules? And how easy will it be for people to get around them anyway?

Age Verification Now Mandatory for Adult Sites

Online platforms that involve adult sites or host sensitive material, such as content related to self-harm, suicide, or eating disorders, are now legally obligated to implement “highly effective” age verification systems under the UK’s new Online Safety Act.

Gone are the days of simple self-declaration checkboxes. Instead, sites must adopt more rigorous tools like facial age estimation, photo-ID matching, open banking verification, credit-card checks, mobile network age confirmations, or email-based inference.

Thousands of adult websites are now scrambling to comply with the UK’s tough new age-verification laws. Industry giants like Aylo, Bluesky, and Grindr, along with social platforms including Reddit, X (formerly Twitter), have already started enforcing the rules, implementing stricter checks for UK users to avoid penalties.

What Happens If Platforms Don’t Comply

The UK’s message to tech companies is loud and clear: protect children online or face the consequences. Under the Online Safety Act, platforms that fail to meet the new safety standards could be hit with fines of up to £18 million, or 10% of their global revenue, whichever figure is larger.

But the penalties don’t stop at financial pain. Ofcom, the UK’s regulatory and competition authority for broadcasting, the internet, and telecommunications, has the authority to block non-compliant platforms entirely. That means services could be pulled from app stores or shut out by internet providers, effectively erasing their presence from the UK market. In extreme cases, executives could also be held personally liable.

Privacy and Practical Concerns Raised

Despite the UK’s ambitious goals, the age-verification rollout under the Online Safety Act is already showing cracks. One of the most glaring loopholes is the widespread use of VPNs. With a few clicks, users can mask their location and access restricted content as if they were outside the UK, rendering the entire system ineffective for those determined to get around it.

Another major flaw lies in the age-verification systems themselves. Ethical hackers demonstrated they could bypass these tools in seconds using basic, off-the-shelf software, highlighting how easily the current technology can be exploited. This raises serious concerns about the reliability of the very tools meant to protect minors.

Ethical hackers have shown Sky News how new age verification systems can be bypassed on adult websites in a matter of seconds.

Lastly, platforms that rely on photo ID uploads face a growing problem with fake or borrowed documents. Since many systems don’t verify IDs against official databases, it’s possible for users to upload someone else’s ID and gain access undetected. These vulnerabilities show that, while the intention behind the law is strong, its enforcement still has a long way to go.

VPNs Surge as Users Seek Workarounds

With the UK’s Online Safety Act now in force, PureVPN saw a 45% spike in branded searches from UK users on launch day, clear evidence of rising demand for online privacy.

VPNs remain legal, but Ofcom has warned platforms not to encourage their use to bypass age checks. For users concerned about data privacy and increased surveillance, PureVPN continues to provide a secure, reliable way to stay protected online.

Expanded Online Safety Duties

Beyond adult content, the Online Safety Act imposes duties on platforms with user‑generated content, requiring them to prevent access by minors to harmful material, maintain rapid takedown protocols, and offer child‑friendly reporting channels.

Algorithmic recommendation systems must filter out harmful content and journals or politically significant posts must remain preserved under ‘democratically important’ content protections.

The Act also empowers the government to direct Ofcom to modify draft safety codes, an authority that has drawn criticism over potential threats to Ofcom’s independence.

Online Safety Act Faces Heat Over Free Speech, Tech Burdens, and Site Bans

A petition to repeal the Online Safety Act has drawn more than 330,000 signatures, with critics arguing that the law’s scope unfairly targets niche communities, imposes onerous technical burdens on smaller platforms, and limits free expression online.

Several adult and Rule 34 sites have already blocked UK traffic entirely, saying compliance is too costly and intrusive, even when content is fictional or niche in nature.