• UK Online Safety Act’s consequences mean a less safe internet.
• 400,000+ sign petition calling for law’s repeal.
• Users flock to VPNs in hope of circumventing restrictions.

Nearly half a million electronic signatures have been added to an online petition calling for the repeal of the UK’s Online Safety Act, since the law came into effect July 25, 2025.

The Online Safety Act is an attempt to shield minors from harmful content online, including porn, self-harm, suicide, and eating disorders. In the last fortnight, sign-ups to VPN (virtual private network) software services have surged, with Proton VPN reporting an increase in use of more than 1,400%, as users scramble to get around age verification checks.

The UK’s Secretary of State for Science says the government will be examining “very closely” at VPN use, with some industry commentators speculating that the government is considering a ban on the use of VPNs in the country, similar to that imposed in Russia, China, the UEA, and authoritarian states such as Iraq and North Korea.

Polling conducted by YouGov, a company traded on the London stock exchange, was commissioned on behalf of Ofcom, the UK’s data regulatory body. The resulting statistics show that 71% of those parents polled felt that the measures will make a positive difference to children’s safety online. Ninety percent of parents agreed it’s “important for tech forms to follow Ofcom’s rules”.

However, the impact of the legislation will have significant negative impacts on online safety for every internet user in the UK.

• The necessary upload of verifiable forms of identification to online services means that there will be many thousands more repositories of highly sensitive information stored digitally. The increase in numbers of data collections of this information provides bad actors with more high-value targets. Not only will identity theft become statistically more likely, but given the nature of such online services, any breach of security will have significant potential for blackmailing subscribers.

In 2015, millions of users’ data leaked from Ashley Madison, a service marketed at individuals seeking affairs outside their relationship or marriage.

• Providers of potentially harmful content may use third-party services to verify their users’ identity. Despite being specialists in handling this type of process, third-party companies are as likely as any other to leak data to bad actors.

According to the BBC, among 72,000 images submitted by women were subject to unauthorised access at Tea Dating Advice last month, including pictures of women holding forms of ID up to their devices’ cameras.

• As age verification and ID checks become more common, there is a greater opportunity for bad actors to impersonate verification services to capture user details, including pictures of documents, facial scans, and sensitive information such as passport or driver’s licence details. Users would be shepherded to such spoof sites by phishing attempts, which would be particularly attractive to children who are looking to circumvent controls.
• The use of VPNs is not a guarantee of user privacy, regardless of whether they are used to get around age verification processes. Because VPNs are often used by end-users to cloak their activities, the VPN providers are particularly attractive targets for bad actors.

VPNs from Nord, Cisco, and Fortinet are among those that have been compromised in the past, with UFO VPN exposing 894GB of data of its users those of six companies it owned, in 2020.

• Users choosing free VPN services are often unaware that their online activity is sold by the VPN provider to monetise the ‘free’ offering. Additionally, many VPNs have agreements with law enforcement organisations to release user data if presented with warrants in the course of the investigation of crimes.

Governments have a reputation for producing technology-related legislation that’s misguided, badly constructed, and/or introduced too late. The UK’s Online Safety Act epitomises the reasons behind that reputation. By attempting to make the internet safer for children (a motive that, on face value, can’t be argued against) it has exposed under-18s and much of the UK population to a greater degree of jeopardy than existed on July 24, 2025.

Children will find it more difficult under the Act to find and access unsuitable content. However, ‘more difficult’ does not mean impossible, and the difficulties placed in minors’ paths will make Brits’ online activities more dangerous.

(Image source: “Watson and Two Other Jeopardy Podiums” by Atomic Taco is licensed under CC BY-SA 2.0.)

Want to learn more about cybersecurity and the cloud from industry leaders? Check out Cyber Security & Cloud Expo taking place in Amsterdam, California, and London.

Explore other upcoming enterprise technology events and webinars powered by TechForge here.