Rethinking the Online Safety Act from a European Perspective

What If the UK Had Stayed in the EU?

By Talk2EU Contributors - July 2025

The UK’s Online Safety Act (OSA) is one of the most comprehensive and controversial attempts to regulate the internet in a democratic country. It aims to reduce online harms by introducing legal duties for platforms to moderate content, prevent harm, and cooperate with Ofcom, the newly empowered regulator.

The law has drawn both praise and criticism. Some see it as a strong step toward safer digital spaces. Others raise concerns about privacy, particularly with encryption, freedom of expression, and whether the UK can effectively go it alone in regulating the global internet.

At Talk2EU.org, we ask a broader question:

Would the OSA, in its current form, have been possible if the UK were still a member of the European Union?

Our view is: probably not.

But more importantly, had the UK remained in the EU, it could have helped shape a shared European solution to online harms, with greater safeguards and longer-lasting influence.

1. The EU Has Its Own Digital Framework: The Digital Services Act

The EU’s Digital Services Act (DSA), adopted in 2022, regulates how online platforms handle illegal content, misinformation, user safety, and transparency. As an EU-wide regulation, the DSA applies directly across all member states and limits how much national governments can diverge.

Had the UK remained in the EU, it would have been bound by the DSA, and therefore unable to introduce national laws like the OSA that significantly exceed or contradict it. Key provisions in the OSA, such as risk-based duties and proactive monitoring, would likely have faced legal hurdles in Brussels.

But here’s the missed opportunity: 

The UK could have helped shape the DSA itself.

2. Monitoring Obligations: The Legal Divergence

One of the most important differences is around proactive content monitoring.

The OSA places duties on platforms to identify and act on potentially harmful content before users even report it. The DSA, however, prohibits what are known as “general monitoring obligations,” obligations to watch all user content.

Why? Because such obligations can interfere with freedom of expression and open the door to excessive surveillance.

As part of the EU, the UK would have been constrained by this safeguarding principle. But having left, we’ve chosen a different path; one that some see as braver, but others would say is much riskier.

At Talk2EU, we believe that freedom and safety must be jointly protected; not traded off.

3. Encryption, Privacy, and the ECHR

One of the most scrutinised parts of the OSA is its potential to require platforms to scan encrypted communications for illegal material.

While this goal is widely supported, the method raises serious concerns for privacy and end-to-end encryption. Encrypted platforms like Signal and WhatsApp have warned they may withdraw from the UK if forced to compromise encryption.

This isn’t just about tech policy, it’s about human rights.

The UK remains a signatory to the European Convention on Human Rights (ECHR), a non-EU treaty which protects the right to private communication (Article and freedom of expression (Article 10). These rights still apply via the Human Rights Act 1998.

It’s worth noting: the ECHR is not an EU instrument, but it underpins much of the legal rights framework in both UK and EU law.

If the OSA’s implementation leads to disproportionate surveillance or weakened encryption, legal challenges under the ECHR are likely.

At Talk2EU, we note with concern recent political calls to withdraw from the ECHR altogether. Such a move would break longstanding legal commitments and isolate the UK further from European legal norms. It would also threaten our data adequacy agreement with the EU, risking real-world consequences for trade and digital access.

4. Age Verification, Data Collection, and GDPR Compatibility

The OSA requires platforms to implement age-appropriate protections, which may include verifying users’ ages.

That sounds sensible. Yes. However, the implementation matters. In the EU, any age verification system must comply with the General Data Protection Regulation (GDPR): data collection must be proportionate, necessary, and privacy-respecting.

If age checks require official ID, facial recognition, or biometrics, they could be problematic under EU standards, and in practice, discourage users or push platforms to withdraw features.

Had the UK remained in the EU, GDPR compliance would have likely limited how far these services could go.

Instead, we’ve opened the door to intrusive, data-intensive, and legally uncertain solutions.

5. The Loss of Influence: From Co-Author to Bystander

Before Brexit, the UK played a leading role in shaping EU digital law, including GDPR.

The UK was also often sceptical of Brussels. But it was also a clear leader. It could have used that leadership to propose a tougher EU-wide response to online harms: stronger protection tools, consistent standards, and smarter enforcement.

Instead, we’ve chosen a go-it-alone model. The OSA, which may be ambitious, also isolates the UK and is very risky.

At Talk2EU, we ask:

Wouldn’t it have been better to shape a European solution, rather than building our own and asking companies to choose?

6. The Real-World Impact: Companies Are Already Reacting

Several companies have already responded to the UK’s regulatory divergence:

      •     Apple disabled Group FaceTime and SharePlay in the UK in 2024, citing surveillance concerns linked to the Investigatory Powers Act and Online Safety Act.

      •     Signal and WhatsApp have publicly said they may withdraw from the UK if required to compromise encryption.

      •     Open-source and community-driven platforms like Mozilla and Wikipedia have warned that the OSA could lead to over-removal of content or technical withdrawal due to compliance costs.

      •     Smaller platforms may avoid launching in the UK altogether.

The result?

A slim and less innovative digital market with fewer choices for users, and a chilling effect on privacy-first tools, start-ups, and cross-border services.

Also, a dent in growth.

The attempt to create a UK version of Silicon Valley will be potentially hampered by OSA.

Conclusion: Lead Together, or Fall Behind Alone?

The Online Safety Act reflects a serious attempt to address real harms online. 

Those goals deserve support. But the path we’ve taken is complicated, and fraught with legal, economic, and ethical risks.

Had the UK remained in the EU, the OSA would likely not have passed in its current form.

But more importantly, the UK could have helped lead the European conversation on online safety.

That’s what we’ve lost with Brexit: not just alignment, but influence and cooperation.

At Talk2EU, we believe there’s still a case to be made, not just for rejoining the EU, but for rejoining the debate.

To lead and stand shoulder to shoulder with the EU, writing the rules and not waiting for them to arrive by email.