A new report out today from tech research site Comparitech looking at the U.K.’s Online Safety Act highlights rising concerns over censorship, surveillance and the unintended consequences of the law since it went into effect earlier this year.

The OSA, ostensibly designed to protect children and curb harmful content online, mandates age verification for adult sites and includes provisions for client-side scanning of encrypted messages. The U.K. government claimed when the OSA became law in September 2023 that it would make the country “the safest place in the world to be online.”

Despite seemingly good intentions, the Comparitech report finds that early data suggests that the legislation is driving users toward riskier behaviors rather than curbing them. Virtual private network usage spiked immediately after the law’s rollout, with NordVPN reporting a 1,000% increase in purchases and ProtonVPN downloads jumping 1,800%.

Comparitech also saw a 943% surge in clicks to its VPN guides on the day the legislation went live.

The shift in how people in the U.K. interact online went beyond VPNs, with Google Trends data showing sharp increases in searches for fake IDs, dark web access and torrenting services, while porn sites that have not implemented age-verification checks have seen traffic double or triple. Comparitech notes that the trend punishes sites that comply while pushing users toward less secure alternatives.

With the implementation of the law and age-verification systems requiring users to submit sensitive ID data, privacy concerns are also a growing issue. The report cites examples of unsecured databases leaking thousands of Know Your Customer documents, which can be exploited by cybercriminals for identity fraud. On the dark web, demand for counterfeit and stolen U.K. documents has already risen, with offers of bulk driver’s licenses and passports surfacing in forums and marketplaces.

Messaging security is another area of concern, as the OSA empowers regulators to require client-side scanning of messages to detect child abuse material, a move that effectively breaks end-to-end encryption. A Journal of Cybersecurity study warns that such scanning would enable “bulk surveillance of everyone’s private data, all the time.” As a consequence, both WhatsApp and Signal have threatened to withdraw from the U.K. if forced to comply.

Although U.K. officials are currently insisting VPNs will not be banned, they have pledged to take action against providers promoting circumvention tools. The report cautions that the U.K. could consider age checks for VPNs or even deep-packet inspection technology, a tactic used in China and Russia.

“While any attempt to reduce the dissemination of [child abuse material] should be applauded, it’s clear that the U.K.’s Online Safety Act comes with a number of concerning and privacy-encroaching practices,” the report concludes.

Those concerns include the risk of identity theft and fraud from age-verification systems, the real-time surveillance of citizens, potential restrictions on VPN usage and that forcing users to go through age-verification systems means those looking to circumvent the restrictions may find themselves exposed to unsafe alternatives, scams and threats.

Image: SiliconANGLE/Ideogram