17. UK digital restrictions and government overreach
Status reviewed 15 July 2026. This chapter separates law in force, announced policy requiring further legislation, open consultation, and speculation. Follow the dated official sources on each page before relying on a current status.
Why this chapter exists
The rest of this guide is largely timeless. The way encryption works, the reasons compartmentalisation helps, and the limits of a VPN do not change much from one year to the next. This chapter is different. It describes a specific moment in the United Kingdom, when a cluster of laws, regulations, and proposals began to change the everyday relationship between a person and the internet. The details will date. The direction of travel, and the way to think about it, will not.
Over a short period the UK has moved from a country where you could read, watch, and speak online without proving who you were, to one where identity, age, and location are increasingly demanded before you are allowed to do ordinary things. None of this arrived as a single dramatic announcement. It came as a series of reasonable-sounding measures, each justified by child safety, fraud prevention, or national security, and each adding a new place where you must identify yourself or be checked. The cumulative effect is larger than any single measure, and that is the part most easily missed.
This chapter is not a campaign and it is not legal advice. Its purpose is to set out, plainly and accurately, what is being introduced or threatened, why it matters for privacy and free expression, and what an ordinary person can sensibly do in response. Some of these measures are already law. Some are live proposals. Some are floated by politicians and may never happen. The page on each topic says clearly which is which, because the right response to a settled law is different from the right response to a trial balloon.
What is actually happening
It helps to see the separate measures as parts of one system rather than as isolated stories. Read together, they describe a structure in which more of online life is gated behind a check, and more of those checks are tied to a verified, real-world identity. The sections below summarise each strand; the dedicated pages that follow go into the detail.
The Online Safety Act as the engine
The Online Safety Act 2023 is the legal engine behind much of what follows. It places duties on online services to assess and reduce the risk of illegal and harmful content, and it gives the regulator, Ofcom, broad powers to write codes of practice, demand information, and levy very large fines. Most of the visible consequences of 2025 — age checks on adult sites, removals of content, the retreat of some smaller forums — flow from how this Act is being implemented. It is covered in detail in 17.1.
Age checks everywhere
From mid-2025, services that allow pornography or other content judged harmful to children have been required to use what the law calls "highly effective age assurance". In practice this means uploading identity documents, submitting to a face scan that estimates your age, or handing verification to a third-party company. What began with adult sites is spreading to other platforms, and the technical machinery built for it can be pointed at almost anything. This is covered in 17.2.
A national digital identity
Separately, the government has been building the components of a national digital identity: GOV.UK One Login, a wallet for official credentials, and a proposed national digital ID. The March 2026 consultation says the ID itself would be optional and that alternative proofs would remain available. The government intends digital right-to-work checking to become compulsory by the end of the Parliament, but says that check could use the national ID, a passport, or an eVisa. That distinction between a mandatory digital process and an optional credential matters. This is covered in 17.3.
Pressure on encryption
At the same time, the legal pressure on end-to-end encryption has intensified. Under powers in the Investigatory Powers Act, the government has issued secret notices to technology companies, and in 2025 one such demand led a major manufacturer to withdraw an encrypted backup feature from the UK rather than weaken it everywhere. The Online Safety Act also contains a power that could, in principle, require encrypted messaging services to scan messages. This is covered in 17.5.
VPNs and the circumvention question
When age checks arrived, VPN use in the UK rose sharply, because a VPN can make a connection appear to originate elsewhere. The government's March-to-May 2026 consultation asked whether children's VPN access should be restricted and whether everyone should face an age check to obtain a VPN. As of 15 July 2026 no such restriction has been enacted or formally adopted; a further government update on circumvention was due by 16 July. This is covered in 17.4.
Age limits for social media
The UK government has now moved beyond merely considering an under-16 social-media restriction. On 15 June 2026 it announced an intention to stop in-scope social-media companies offering services to under-16s, with the first regulations intended by the end of 2026 and commencement expected in spring 2027, subject to parliamentary approval. On 15 July it also announced default midnight-to-6am curfews and restrictions on addictive features for 16- and 17-year-olds. These are announced policies, not yet operative rules. They will require stronger age assurance, but age assurance need not always establish a person's name or full identity. This is covered in 17.6.
Data law and individual rights
The Data (Use and Access) Act 2025 changed UK data-protection, digital-verification, automated-decision, cookie, and regulator provisions in stages. All of its data-protection provisions were in force by 19 June 2026. It did not abolish the familiar rights of access, correction, erasure in qualifying cases, objection, and complaint, but it changed parts of how organisations may process data and how complaints must be handled. The practical rights and the new complaints duty are covered in 17.8.
The common thread: identity attached to everything
The single most useful idea in this chapter is that these measures share a direction. Each one, on its own terms, is about safety or fairness. But each one also has the effect of attaching a verified identity to an activity that used to be anonymous or pseudonymous: reading, watching, speaking, working, proving your age. Once identity is attached at one point, it becomes easier to attach it at the next, because the infrastructure and the public habit already exist.
This is why the cumulative picture matters more than any single rule. An age check on an adult site, taken alone, affects a narrow activity. A digital wallet, taken alone, is a convenience. A power to scan messages, taken alone, is aimed at the worst crimes. But a society in which you routinely prove who you are to read, to speak, to work, and to receive services is a different society from one in which you do not, regardless of how benign each individual step was. The value of privacy is not that any one disclosure is catastrophic; it is that the absence of routine identification leaves room for ordinary life, dissent, and error.
It is also worth being honest about the genuine problems these measures respond to. Children do encounter material online that harms them. Fraud is real and devastating. Serious criminals do use encrypted channels. The argument in this chapter is not that these problems are imaginary, but that the chosen responses carry costs to everyone's privacy and freedom that are frequently understated, that fall hardest on the law-abiding, and that are difficult to reverse once the infrastructure is built. A measure can be well-intentioned and still be a poor trade.
How to read the rest of this chapter
Each page that follows is structured the same way. It explains what the measure is, distinguishes clearly between what is law and what is merely proposed, sets out the genuine privacy and free-expression concerns without exaggeration, and then offers practical, lawful responses. The aim throughout is to keep you accurately informed rather than alarmed, because fear leads to poor decisions and overstatement is easy to dismiss.
Nothing in this chapter encourages breaking the law. Several of the protective steps it describes — using a VPN, choosing encrypted messengers, minimising the personal data you hand over, declining optional identity schemes — are entirely legal in the UK today. Where a measure is mandatory, the chapter says so, and focuses on reducing the data you expose rather than on evasion. The distinction matters, both ethically and for your own safety, and it is discussed throughout the rest of the guide, particularly in Chapter 16 on freedom of speech and Chapter 1 on threat modelling.
The practical security responses are gathered in 17.7. The legal rights and complaint routes that can be used when an organisation mishandles personal information are in 17.8.
Keeping perspective
It is easy, reading a chapter like this, to slide into either complacency or panic, and both are mistakes. Complacency says that none of this affects ordinary, law-abiding people, which ignores how often broad systems catch the innocent through error, breach, or mission creep. Panic says that the country has already become a surveillance state and nothing can be done, which is both inaccurate and paralysing. The truthful position sits between them: real powers and real infrastructure are being built quickly, public scrutiny has not kept pace, and individuals still have meaningful, lawful choices about how much they expose.
The UK remains a place with courts, a free press, elections, and a vocal civil society. Several of the measures described here have been challenged, delayed, or amended precisely because people noticed and objected. Staying informed is therefore not a counsel of despair but a precondition for that scrutiny to continue. The purpose of this chapter is to make you one of the people who has noticed, and to give you the means to act on it sensibly — for yourself, and as part of the wider public conversation about what kind of digital society the country chooses to build.