From AI training to banning VPNs – here are 8 questions the internet is asking about the Online Safety Act

It's been almost two weeks since the Online Safety Act was introduced in the UK. The law requires websites and apps to conduct age verification checks before allowing users to view content deemed as potentially harmful to under 18s or explicit.

Despite the law being well intentioned, people are unhappy at having to hand over sensitive personal information to third-party companies. Many have turned to the best VPNs in an attempt to bypass age verification checks.

Supporters and opponents of the law have made their views clear but there are still questions being asked. People are wondering how their data is used and stored, what the risks are, and are even asking if there'll be a VPN ban.

We've pulled together some of the most popular questions people are asking and give them our best answer.

What is the Online Safety Act?

This is probably a good place to start. The Online Safety Act 2023 is a new law introduced by the UK government which aims to keep children, and adults, safe online.

In an explainer, the UK government said "platforms will be required to prevent children from accessing harmful and age-inappropriate content."

The main way this is done is through age verification checks. In order to access age-restricted content, users will have to prove they are over 18. This can include submitting photo ID, completing credit card or bank checks, and uploading a live selfie.

OFCOM has the power to enforce regulations and fine those found to be breaking the law. Fines may be up to 10% of global revenue or £18 million, whichever is greater.

What are the cybersecurity and privacy risks?

There are numerous privacy and cybersecurity risks posed by the Online Safety Act. Privacy advocates believe the law imposes on people's online freedoms and argue we shouldn't need to hand over our data to browse the web.

Cybersecurity experts see it as a "disaster waiting to happen." We're trusting our highly sensitive personal information to third-parties, many of which are not based in the UK.

These age check providers store data for different lengths of time but it only takes one to suffer a data breach and risk serious consequences for huge amounts of people – one expert believed this was a matter of when, not if.

We fully support the law's goals, but we're not surprised it doesn't cover personal data safety. There must be a balance between protecting vulnerable internet users but not compromising our data privacy and security.

Do age verification companies store your data?

The answer varies between providers. Persona, Yoti, and AgeGO are some notable providers.

Persona, used by Reddit, says it retains personal data "for as long as necessary to provide the service and fulfill the verification you have requested." But it also says data collection may vary depending on how you use the service and how third-parties implement it.

In Reddit's case, the site says Persona doesn't retain your uploaded photo for longer than 7 days.

Yoti, which is used by Spotify, says it stores your data for up to 28 days, and doesn't have access to it beyond that. Yoti says some of its clients will configure the service to delete your data as soon as age verification is complete.

AgeGO says it does "not access or retain your personal data during the verification process." However it uses third-party providers in the age-check process and only receives the results. Although it improves anonymity, these third-parties are not disclosed so we don't know how they process and store data. This leaves us asking if AgeGO is safe to use.

Is my data being used to train AI?

This is a big concern people have and is another question which doesn't have a straightforward answer.

AI-powered age estimation techniques are employed by some age-check providers. AI will analyze a picture of your face, or even your browsing habits, to determine whether you're over 18.

Age-check providers, including Persona, have said it uses "uploaded images of identity documents" to train its services and enable it to understand what documents and their features look like.

Age verification on social media app X is another which utilizes AI-based age estimation, using its own AI systems. Its Age Assurance on X policy doesn't state how its AI systems use this data. However its wider privacy policy states it may use the data it collects "to help train our machine learning or artificial intelligence models."

We would therefore exercise caution in uploading your information to providers using AI-based age estimation.

Will every website introduce age checks?

By the letter of the law, any site or app hosting adult content must introduce age verification checks and they're present on many popular sites. Reddit and X require age checks, as well as Spotify – something which has baffled people online.

There have been complaints of overreach and unintended consequences of the legislation. Reddit users have noted that subreddits discussing sobriety, mental health support, and combating addiction have been impacted.

Wikipedia may have to introduce checks and it is fighting the regulations as a result. The BBC reported that information and news reports covering the conflicts in Gaza and Ukraine have also been blocked by age verification rules.

Reports of this type of content being blocked is worrying, especially at a time when internet censorship and disinformation is highly prevalent.

The UK government has said "platforms should not arbitrarily block or remove content and instead must take a risk-based, proportionate approach to child safety duties." It also said the law is "not designed to censor political debate." It "does not require platforms to age gate any content other than those which present the most serious risks to children."

Will the government look at my ID?

No, the government will not look at any age verification related information you upload.

Beyond passing the law, the government has little to no involvement in its day-to-day running or enforcement – and this makes the process quite inefficient.

There are multiple age-check providers, requiring multiple proofs of age. You'll likely have to prove your age multiple times as not every site uses the same provider.

Some experts, and internet users, believe the UK government should have set up a secure, government-run, age-check system and database. This would be more streamlined and having only one database would reduce the risk of data breaches.

Will the government ban VPNs?

Major VPN providers saw a surge in sign ups in the first week of the law's introduction as people searched for ways to avoid age verification checks.

The likes of Proton VPN, NordVPN, Opera VPN, and Surfshark – as well as suspect free VPNs – rose up the Apple App Store's top charts.

In 2022, Labour MP Sarah Champion proposed an amendment to the Online Safety Act – then still a Bill – which would see OFCOM investigate if VPN use was undermining internet regulations.

The amendment didn't pass and on July 28 2025, Champion responded to the news of a UK VPN surge. She said in a tweet she warned the previous government this would happen and "child protection should always be the priority."

The UK's Secretary of State for Science, Innovation and Technology, Peter Kyle, has acknowledged VPN use is rising and would look "very closely" at how they're being used – however, he said he would not ban VPNs.

So, it is very unlikely the UK government will ban VPNs.

Is the Online Safety Act a good thing?

The law is well intentioned. It aims to protect children from seeing content they shouldn't and this can only be a good thing. It can be easy to access harmful content and children shouldn't be able to accidentally access it.

However, as we've detailed, the law's implementation has raised serious concerns around data privacy and security. So, while its motives are a good thing, the law risks compromising our safety in other ways.

A petition calling on the UK government to repeal the law is approaching 500,000 signatures. The government has said it won't repeal the law and Peter Kyle has said those wanting to overturn it are "on the side of predators."

These types of accusations do nothing but widen divisions and fail to recognise the genuine concerns people have regarding their personal information and its safety.