17. UK digital restrictions and government overreach

Status reviewed 1 September 2026. This chapter separates law in force, announced policy requiring further legislation, open consultation, and speculation. Follow the dated official sources on each page before relying on a current status.

Why this chapter exists

Most of this guide is fairly timeless. How encryption works, why compartmentalisation helps, the limits of a VPN: none of that changes much year to year.

This chapter is different. It describes a specific moment in the United Kingdom, when a cluster of laws, regulations and proposals began to change the everyday relationship between a person and the internet. The details will date. The direction of travel, and how to think about it, will not.

In a short period the UK has gone from a country where you could read, watch and speak online without proving who you were, to one where identity, age and location are increasingly demanded before you can do ordinary things.

There was no single dramatic announcement. It arrived as a series of reasonable-sounding measures, each justified by child safety, fraud prevention or national security, and each adding a new place where you must identify yourself or be checked. The cumulative effect is larger than any single measure, and that is the part most easily missed.

This chapter is not a campaign and not legal advice. It sets out, plainly and accurately:

• what is being introduced or threatened;
• why it matters for privacy and free expression;
• what an ordinary person can sensibly do about it.

Some of these measures are already law. Some are live proposals. Some are floated by politicians and may never happen. Each page says clearly which is which, because the right response to a settled law is different from the right response to a trial balloon.

What is actually happening

See the separate measures as parts of one system, not isolated stories. Together they describe a structure where more of online life is gated behind a check, and more of those checks are tied to a verified, real-world identity.

The sections below summarise each strand; the dedicated pages that follow go into detail.

The Online Safety Act as the engine

The Online Safety Act 2023 is the legal engine behind much of what follows. It places duties on online services to assess and reduce the risk of illegal and harmful content. It gives the regulator, Ofcom, broad powers to write codes of practice, demand information and levy very large fines.

Most of the visible consequences of 2025 (age checks on adult sites, content removals, the retreat of some smaller forums) flow from how this Act is being implemented. Details in 17.1.

Age checks everywhere

From mid-2025, services that allow pornography or other content judged harmful to children have had to use what the law calls "highly effective age assurance". In practice that means:

• uploading identity documents;
• a face scan that estimates your age;
• handing verification to a third-party company.

It began with adult sites and is spreading to other platforms. The machinery built for it can be pointed at almost anything. Details in 17.2.

A national digital identity

Separately, the government has been building the parts of a national digital identity: GOV.UK One Login, a wallet for official credentials, and a proposed national digital ID.

The March 2026 consultation says the ID itself would be optional and alternative proofs would remain available. The government intends digital right-to-work checking to become compulsory by the end of the Parliament, but says that check could use the national ID, a passport or an eVisa.

That distinction between a mandatory digital process and an optional credential matters. Details in 17.3.

Pressure on encryption

Legal pressure on end-to-end encryption has intensified. Under Investigatory Powers Act powers, the government has issued secret notices to technology companies. In 2025 one such demand led a major manufacturer to withdraw an encrypted backup feature from the UK rather than weaken it everywhere.

The Online Safety Act also contains a power that could, in principle, require encrypted messaging services to scan messages. Details in 17.5.

VPNs and the circumvention question

When age checks arrived, UK VPN use rose sharply, because a VPN can make your connection appear to come from elsewhere.

The government's March-to-May 2026 consultation asked whether children's VPN access should be restricted and whether everyone should face an age check to get a VPN. Its July response said it would not ban or age-gate VPNs, but it:

• commissioned Ofcom research into platform-level circumvention measures;
• called for engagement with VPN providers;
• reserved the possibility of further action if circumvention is not adequately addressed.

No VPN restriction has been enacted. Details in 17.4.

Age limits for social media

The government has moved beyond merely considering an under-16 social-media restriction:

• 15 June 2026: announced an intention to stop in-scope social-media companies offering services to under-16s, with the first regulations intended by the end of 2026 and commencement expected in spring 2027, subject to parliamentary approval.
• 15 July 2026: announced default midnight-to-6am curfews and restrictions on addictive features for 16- and 17-year-olds.

These are announced policies, not yet operative rules. They will need stronger age assurance, but age assurance need not always establish your name or full identity. Details in 17.6.

Data law and individual rights

The Data (Use and Access) Act 2025 changed UK data-protection, digital-verification, automated-decision, cookie and regulator provisions in stages. All of its data-protection provisions were in force by 19 June 2026.

It did not abolish the familiar rights of access, correction, erasure in qualifying cases, objection and complaint. It did change parts of how organisations may process data and how complaints must be handled. The practical rights and the new complaints duty are in 17.8.

The common thread: identity attached to everything

The single most useful idea in this chapter: these measures share a direction. Each one, on its own terms, is about safety or fairness. Each one also attaches a verified identity to something that used to be anonymous or pseudonymous: reading, watching, speaking, working, proving your age.

Once identity is attached at one point, it is easier to attach at the next, because the infrastructure and the public habit already exist.

Taken one at a time, each looks modest:

• an age check on an adult site affects a narrow activity;
• a digital wallet is a convenience;
• a power to scan messages is aimed at the worst crimes.

But a society where you routinely prove who you are to read, speak, work and receive services is a different society, however benign each step was. The value of privacy is not that any one disclosure is catastrophic; it is that the absence of routine identification leaves room for ordinary life, dissent and error.

To be fair about it, the problems these measures respond to are real. Children do encounter material that harms them. Fraud is real and devastating. Serious criminals do use encrypted channels.

The argument here is not that these problems are imaginary. It is that the chosen responses carry costs to everyone's privacy and freedom that are often understated, fall hardest on the law-abiding, and are hard to reverse once the infrastructure is built. A measure can be well-intentioned and still be a poor trade.

How to read the rest of this chapter

Every page that follows uses the same structure:

• what the measure is;
• what is law and what is merely proposed, clearly separated;
• the genuine privacy and free-expression concerns, without exaggeration;
• practical, lawful responses.

The aim is to keep you accurately informed rather than alarmed, because fear leads to poor decisions and overstatement is easy to dismiss.

Nothing in this chapter encourages breaking the law. Several protective steps it describes are entirely legal in the UK today: using a VPN, choosing encrypted messengers, minimising the personal data you hand over, declining optional identity schemes.

Where a measure is mandatory, the chapter says so and focuses on reducing the data you expose rather than on evasion. That distinction matters, ethically and for your own safety. It runs through the rest of the guide, particularly Chapter 16 on freedom of speech and Chapter 1 on threat modelling.

Practical security responses are gathered in 17.7. Legal rights and complaint routes for when an organisation mishandles your personal information are in 17.8.

Keeping perspective

Reading a chapter like this, it is easy to slide into complacency or panic. Both are mistakes.

• Complacency says none of this affects ordinary, law-abiding people. That ignores how often broad systems catch the innocent through error, breach or mission creep.
• Panic says the country is already a surveillance state and nothing can be done. That is inaccurate and paralysing.

The truth sits in between: real powers and real infrastructure are being built quickly, public scrutiny has not kept pace, and you still have meaningful, lawful choices about how much you expose.

The UK still has courts, a free press, elections and a vocal civil society. Several of these measures have been challenged, delayed or amended precisely because people noticed and objected.

So staying informed is not a counsel of despair; it is what keeps that scrutiny going. This chapter aims to make you one of the people who has noticed, and to help you act on it sensibly, for yourself and as part of the wider public conversation about what kind of digital society the country chooses to build.