Over half of children experience ‘harmful’ content online

Research from the Department for Science, Innovation and Technology (DSIT) shows that despite the implementation of the Online Safety Act’s child safety duties in July 2025, over half of children have seen or interacted with content not meant for them in the last three months.

The Online Safety Act mandates that services that could expose children to inappropriate content or unwanted attention must use "highly effective" age verification measures to stop children from seeing the most harmful types of content online.  

In a survey commissioned by DSIT and conducted by BMG Research to assess how children aged 11 to 17 experience the regulations enforced by the policy, researchers found that the most commonly reported experiences for over a quarter of children include seeing violent or hateful content including racism, homophobia, ableism, transphobia or sexism.

Just under a sixth of those surveyed also reported that an adult they don’t know has tried to contact them or sent them messages in the past three months or someone has requested personal or sensitive information from them.  

Just last week, Ofcom, the UK’s independent media watchdog that enforces the act, fined an online porn provider £630,000 for not having age checks in place and refusing to reply to an information request.  

George Lusty, director of enforcement at Ofcom, said: “Age checks are no longer optional for porn sites in the UK. They are a cornerstone of our laws to protect children from content they should not be seeing. Providers also need to know that if they don’t supply accurate information to us on time, when we request it, they should expect to face enforcement action, including fines.”

Despite these regulations, the research shows that nearly two in five of all children surveyed have successfully circumvented an age check. This includes both advanced checks and simpler checks like tick boxes and entering a birth date. The most common method that children use to bypass the checks is by pretending to be older, by either falsely entering a birth date, wearing a disguise, or using another person’s ID card.  

Speaking to Holyrood in February 2025, when the act was implemented, Ciaran Martin, former chief executive of the National Cyber Security Centre, said that the legislation was “likely to fail because of US pushback” and warned that “in tech, there's no such thing as a regulatory superpower, and we’re about to find that out.”

Another method commonly used to defeat age checks is through a virtual private network (VPN). By using a VPN, children can change the virtual location of their device to a jurisdiction that does not enforce age checks for restricted content, bypassing Ofcom regulations in the process.  

Nearly six in 10 children aged 11 to 17 say they have heard of VPNs, with around 26 per cent of children surveyed saying they have used one in their lifetime.

The researchers found that in general VPN users are more likely to have experienced harmful content than users who have bypassed age checks in other ways. Among children who have both bypassed an age check and currently use a VPN, the likelihood of having seen harmful content after bypassing is significantly higher, sitting at 67 per cent, compared with 43 per cent of children who have bypassed but never used a VPN.