The Online Safety Act (OSA) is a law that is as ambitious as it is controversial. Enacted in October 2023 and implemented progressively until 2025, it aims to protect children and adolescents from illegal or offensive content on the Internet by imposing on platforms hosting user-generated content (social networks, forums, messaging services, etc.) a new duty of care to their communities. For those of us who work in technology or in digital transformation processes, understanding its scope is vital: the UK has become a regulatory laboratory whose effects will reverberate in the rest of the world, including Latin America.
This article delves into the OSA, analyzes its criticisms and evaluates its possible projection in our region, especially in Chile, where the discussion on the protection of minors and digital privacy is also booming. In addition, you will find a table of significant events which summarizes the key moments of the law.
How the Online Safety Act works
The OSA focuses on two types of services: those that allow direct interaction between users and those that provide search functions. As of July 25, 2025, it requires that more than 100,000 companiesincluding social networks, forums, messaging services, and video streaming sites, implement robust mechanisms for prevent users from accessing illegal or harmful contentby means of risk assessment, filters and moderation processes. The law also requires the establishment of age limits for certain content and failure to comply may lead to fines of up to 10 % of the company's global revenues or £18 million, whichever is greater.
Another new feature is that platform managers may face criminal liabilities if they fail to cooperate with Ofcom's (the UK regulator) requests for information or if they fail to ensure that the company complies with its child safety duties. Ofcom, for its part, can audit and require corrective action.
Age verification measures
The most visible component of the OSA is the age controls to block minors' access to pornography, self-harm, suicide or eating disorder content. These measures, proposed in the May 2024 child safety rules, came into effect on July 25, 2025. Services are allowed to use technologies such as facial assessmentThe system provides bank verification, identity recognition, and credit card verification to confirm the age of the users.
However, the result has been paradoxical: the use of virtual private networks (VPNs) soared by 1800 % and VPN apps topped downloads in the app stores. The age verification provider industry itself acknowledges that, since the law came into force, five million additional verifications are performed per day.
Limits and controversies
1. Definition of "harmful content" and overreach.
Although its stated aim is to protect children, the OSA has been criticized for the breadth of its definition of "harmful content" and the powers it gives Ofcom to moderate lawful content. In November 2022, the obligation to remove or block "lawful but harmful" content aimed at adults was removed from the draft, but still applies to minors.
2. Age and privacy verification.
The law does not prohibit age verification providers from monetizing or sharing users' personal data; they are only required to comply with data protection regulations. Several users have expressed frustration that they must hand over sensitive information to a third party just to access a website.
3. Threat to encryption and privacy.
The most controversial part is Ofcom's power to require "accredited technology" providers to scan encrypted communications for illegal material. This involves on-device scanning(client-side scanning) of services such as WhatsApp, Signal or Element before encrypting messages, which would amount to intercepting every message. Cryptography experts have claimed that this practice would generate countless false positives and prove ineffective in combating extremism or child sexual abuse. A report by the British Computer Society noted in September 2023 that imposing scanning of encrypted messages is not feasible without creating serious security risks and keeping an eye on millions of users.
4. Disinformation and political discourse.
The OSA came into being following a "white paper" published in 2019 to address concerns about the spread of disinformation on social networks. Despite this, a report by the UK Parliament's Science, Innovation and Technology Committee (SITC) concluded in July 2025 that the law does not adequately address algorithmic amplification of "legal but harmful" disinformation.. The committee chair, Chi Onwurah, emphasized that social networking are not neutral and called for the adoption of principles based on public safety, free expression, shared responsibility and control of data.
Chronology and relevant facts of the OSA
| Date/Milestone | Fact | Detail |
|---|---|---|
| 8 April 2019 | Publication of the Online Harms Whitepaper | The UK government outlines for the first time a duty of care framework for platforms. |
| May 2021 | First draft of the Online Safety Bill | It includes new obligations for "category 1 services" (such as Facebook and TikTok), freedom of expression impact assessment and criminal liability for managers. |
| November 2022 | Legal but harmful" section eliminated | After criticism from parliamentarians and civil organizations, its scope is reduced to apply only to minors. |
| October 2023 | Approval of the Online Safety Act | Receive Royal Assent and becomes law after a legislative process of more than four years. |
| December 2024 | Ofcom publishes codes of practice on unlawful damage | They come into force in March 2025 and oblige platforms to conduct rigorous risk assessments, filter harmful content and modify algorithms to protect minors. |
| July 25, 2025 | Start of age controls | Services should prevent minors from accessing pornography or self-harming content through verification techniques (facial AI, digital ID, etc.). |
| August 2025 | Massive increase in VPN use and controversies | The deployment of age-verification triggers the use of VPNs, and allegations of censorship of lawful content (e.g., publications on Palestine, Alcoholics Anonymous or classical art) arise. |
What does Latin America say about OSA?
In general, the region does not have equivalent legislation requiring age verifications or forcing platforms to scan encrypted messages. However, the debate on digital child protection and content moderation is intensifying in several countries:
- Brazil has discussed the Bill 2630/2020 (known as Marco Civil da Internet 2.0), which seeks to regulate disinformation and require transparency from platforms. Although it does not contain age verification provisions, it proposes sanctions and obligations similar to those of the OSA in terms of moderation.
- Mexico and Argentina have proposed laws to combat abuses on social networks and the dissemination of harmful content, but none include scanning of encrypted communications.
- Chile stands out for its Cybersecurity Framework Law (Law 21 663)enacted in April 2024 and still in the process of implementation, which recognizes the right to use encryption in its article 3.6b freedomhouse.org. This law establishes that any person may apply computer security techniques, including encryption. In addition, the new draft Personal Data Protection Lawapproved by Congress in August 2024 but which will enter into force two years later, creates a Data Protection Agency with sanctioning powers.
Local criteria
Chilean authorities do not restrict the use of anonymous communication or require real-name verification to access online services. The Constitution guarantees the inviolability of private communications and judicial authorization is required for any interception. In fact, the Cybersecurity Framework Law has been praised by international digital rights organizations for recognizing encryption as a right.
This stance contrasts with the OSA, which potentially weakens encryption by scanning prior to encryption. Incorporating similar legislation in Chile would imply modifying constitutional principles and the recently approved cybersecurity law. Moreover, in a country where public policies are debated on the basis of fundamental rights and respect for privacy, the idea of forcing companies to monitor their users' messages would be perceived as a regression to the times of the system. Echelonthe Anglo-Saxon espionage network that in the 1990s aroused worldwide alarm for its massive interceptions.
Implications and challenges for the region
1. Impact on privacy and freedom of expression.
The British experience shows that legislating for protective purposes can end up eroding fundamental rights. Age verification requirements force users to hand over biometric data or sensitive documents; message scanning breaches the confidentiality of communications and generates false positives that end up censoring legitimate content. For Latin America, where state surveillance and the use of spyware have been controversial, adopting a similar framework without strong safeguards could exacerbate distrust of institutions and platforms.
2. Protection of children and adolescents versus digital rights.
Concern about minors' access to harmful content is legitimate. However, the experience with OSA shows that technocratic filters are not enough Children resort to VPNs and other tools to circumvent control, while adults are restricted in their access to information or support on sensitive topics. Policies must combine digital education, parental support and adaptive filters without compromising the privacy of the adult population.
3. Need for transparency and accountability.
A robust regulatory framework should require platforms to publicly report on their recommendation and moderation algorithms, as well as their procedures for detecting abuse. The OSA has been criticized for failing to address disinformation amplification, a problem that the UK Parliament's Science, Innovation and Technology Committee considers central.
4. Regional and international cooperation.
The global trend points towards greater coordination between countries to combat online crime. The OSA inspires similar initiatives in Australia and the European Union, but the key will be in designing harmonized standards that respect privacy and free speechas stated in the Cybersecurity Framework Law Chile. Latin America could lead an approach that combines child protection and human rights advocacyavoiding falling into massive surveillance schemes worthy of a wink to Echelon.
Conclusion
The British Online Safety Act is a legal experiment that has tested the boundaries between digital protection and surveillance. While it aims to safeguard minors and curb the dissemination of illegal content, its mechanisms - such as intrusive age checks and scanning of encrypted messages - threaten privacy and freedom of expression, generating a boomerang effect: increased use of VPNs and censorship of legitimate content.
For Chile and other Latin American countries promoting modern cybersecurity and data protection laws, the challenge is to learn from British mistakes. Protecting children in the digital age requires clear rules, transparency of platforms and education, not the imposition of mass surveillance systems. In other words, we must build a secure internet without becoming our own "Big Brother"..
Check out a very good video of a great actor in the world of technology, Marc Vidal:
