Vouchsafe’s take on the Online Safety Act
Chloe Coleman
It’s now been a week since the Online Safety Act’s age-assurance rules came into force. Since 25 July, providers like us have processed around five million extra checks every day.
Apple’s UK download chart now shows four VPNs in the top five free apps, and Proton VPN alone reports an 1,800 percent surge in installs.
Making it harder to reach restricted content clearly works in one sense; children are unlikely to land on it by accident. Yet the stampede to VPNs shows how quickly determined users route round blunt controls.
“Something must be done”
The breadth of the Act is starting to bite. Wikipedia is in the High Court arguing that Category 1 duties could force volunteer editors to hand over ID, undermining the very model that keeps the encyclopaedia free and open.
At the other end of the spectrum, an Nvidia update now blocks under-18s from changing their graphics card settings unless they prove their age; a reminder of how widely “potentially harmful” can be interpreted.
Technology strategist Rachel Coldicutt calls this “a sound-bite policy with messy consequences,” noting that kids can still “use a parent’s device or set up a VPN.”
The predictable next suggestion to ban VPNs altogether would punish legitimate uses, add surveillance pressure, and still fail to stop the most determined users.
Proofing fatigue
Andi Hindle, chair of the Identiverse conference, warns of proofing creep:
“Encouraging people to share sensitive documents for no good reason normalises risky behaviour… sensitive information gets proliferated and, eventually, exploited.”
Requiring a passport scan to tweak GPU settings or edit a wiki entry jars with any sense of proportionality and seeds ever larger troves of personal data for criminals to target.
We support proportional, experimental alternatives to handing over a government ID:
- Face-based age estimation from a short video selfie
- Examining a user’s online footprint from their email address or phone number
- Accepting PASS cards that are explicitly intended to help young people prove their age
Although these all feel less intrusive, they don’t solve the core issue. The only sustainable answer is standards-based, true digital ID: cryptographic, privacy-preserving credentials that let someone prove “I’m over 18” (or “I’m me”) without handing a random website their driving licence and photo.
What happens next
Ofcom can still hit platforms with fines of up to 10 percent of global turnover, but blanket ID demands risk eroding public trust and, ironically, weakening age assurance in the long run.
A risk-based approach, built on data-minimisation and interoperable digital ID, would protect children without turning everyday internet use into a high-stakes identity parade.
Vouchsafe specialises in practical, standards-aligned checks that stay firmly on the right side of proportionality.
If you’re reviewing your age-assurance stack and want a route that keeps regulators happy and respects user privacy, drop me a line at chloe@vouchsafe.id.
