Online Safety Act 2026: How It Threatens End-To-End Encryption

The United Kingdom’s push for a safer online environment has culminated in the Online Safety Act, a sweeping piece of legislation aimed at curbing illegal and harmful content. However, buried within its provisions lies a contentious mechanism that could fundamentally alter the landscape of digital privacy. By empowering the regulator Ofcom to demand the deployment of specific scanning technologies on encrypted platforms, the Act raises alarms about the erosion of end-to-end encryption (E2EE)—the gold standard for secure communications. This article delves into the Act’s implications, technical challenges, global repercussions, and the ongoing battle between child protection and individual rights.

Understanding the Core Provisions of the Act

Enacted in 2023, the Online Safety Act places duties on online service providers to proactively identify and remove content related to child sexual abuse material (CSAM), terrorism, and other illegal activities. Central to this is Section 122, which allows Ofcom to issue notices requiring companies to utilize ‘accredited technology’ for content detection. While the Act claims to be technology-neutral, critics argue it implicitly targets E2EE services like WhatsApp, Signal, and iMessage.

Ofcom, as the enforcement body, holds significant authority. It can compel platforms to implement systems that scan user-generated content, including private messages. The government’s own statements acknowledge that no viable technology exists today that scans encrypted traffic without compromising security. Yet, the law persists, potentially forcing providers into a dilemma: comply by weakening encryption or face penalties, including fines up to 10% of global revenue.

• Key Duties Imposed: Platforms must assess risks, implement safety measures, and report compliance.
• Targeted Harms: Prioritizes CSAM but extends to ‘priority harms’ like violence and misinformation.
• Age Assurance: Mandates verification for users accessing certain content, raising biometric privacy concerns.

The Technical Impossibility of Secure Scanning

End-to-end encryption ensures that only the sender and recipient can access message contents; even the service provider cannot. Proposals like client-side scanning (CSS)—where devices scan content before encryption—sound appealing but crumble under scrutiny. CSS requires hashing images or messages against databases of known illegal material, but it creates vulnerabilities exploitable by hackers or authoritarian regimes.

Experts emphasize a binary reality: encryption either protects all users or none. Any mandated backdoor or scanning layer introduces systemic weaknesses. For instance, a flaw in the scanning software could expose billions of conversations. The UK government’s 2023 paper on E2EE and child safety admits implementation challenges but insists on ‘robust measures’ without specifying how.

As BCS, The Chartered Institute for IT, noted in 2023, 70% of its members doubt the feasibility of secure scanning alongside encryption.

Privacy and Security Risks for UK Users

For everyday UK internet users, the Act spells trouble. Weakened encryption leaves personal data—financial details, health records, political views—vulnerable to cybercriminals. High-profile breaches, like those affecting unencrypted services, underscore the peril. Moreover, age verification mandates could normalize biometric surveillance, with facial recognition rolled out across platforms.

The chilling effect on free speech is profound. Users may self-censor, fearing algorithmic flagging. Marginalized groups, journalists, and activists rely on E2EE to evade threats; diluting it endangers them most. Proton and Signal have warned of market exit, limiting UK access to secure tools and fragmenting the internet.

Global Ripple Effects and Industry Backlash

The Act’s extraterritorial reach affects any service with UK users, potentially dictating global standards. Tech giants face conflicting laws: comply with UK demands and alienate privacy-conscious markets, or resist and incur fines. This pressures international encryption norms, echoing EU and US debates.

Industry responses have been fierce. In 2023, WhatsApp tested message scanning in the EU, sparking outrage and reversal. Signal’s Moxie Marlinspike testified that no viable middle ground exists. ARTICLE 19 and EFF decry the Act as a threat to worldwide privacy.

Government Rationale vs. Expert Critiques

Proponents argue the Act is essential for child safety, citing E2EE’s role in concealing CSAM. The government’s GOV.UK page frames it as balanced, protecting privacy while prioritizing harms. Yet, critics like the Internet Society highlight that criminals adapt quickly, using dark web alternatives, while innocents bear the cost.

Ofcom’s 2024 guidance omits immediate encryption mandates, signaling caution. However, the powers remain, activatable anytime. A 2023 Lords statement deferred enforcement, but without statutory safeguards, uncertainty lingers.

Alternative Approaches to Online Safety

Rather than undermining encryption, experts advocate targeted strategies:

• Resource Law Enforcement: Boost funding for human-reviewed tips and metadata analysis.
• Education and Prevention: Invest in digital literacy and mental health support.
• International Cooperation: Share hashes legally without breaking encryption.
• Voluntary Tools: Enhance existing reports like PhotoDNA, which scans unencrypted uploads.

Countries like Australia have pursued metadata warrants successfully without E2EE breaks. The EU’s DSA emphasizes risk assessments over blanket scanning.

Current Status and Future Outlook

As of 2026, Ofcom rolls out codes of practice, with full enforcement slated for 2025. Tech firms monitor closely, some preparing legal challenges. Public campaigns urge amendments explicitly protecting E2EE. The Act’s evolution will test UK commitments to rights under the Human Rights Act 1998.

Frequently Asked Questions (FAQs)