• Government must regulate age assurance providers to protect users’ privacy and security as digital platforms start to implement Online Safety Act.
• Users are given no choice over how they verify age, with platforms such as Reddit, Bluesky and Grindr choosing providers with problematic privacy policies.
• Data protection law is not enough to protect users.
• There are growing threats to free expression, as platforms increasingly place features and content, such as direct messaging behind age gates, going beyond the Act’s intended focus on restricting access to adult content.

Open Rights Group has warned of serious privacy and security risks for people in the UK as online platforms start to ask users to verify their age, as required by the Online Safety Act. There are also freedom of expression harms as platforms require age verification to access features and content.