The scale of an intended online nudity intervention was made clear in a major government announcement on Monday 8 June 2026. The Prime Minister unveiled plans to compel technology giants to integrate system-wide nudity detection and blocking tools across all smartphones and tablets sold or used in the UK. Under these proposals, tech companies are given a strict three-month window to deploy these technical solutions across operating systems, applications, and third-party messaging services. Failure to comply would result in severe corporate fines, with the government explicitly stating that criminal liability for tech executives remains under active consideration. While the policy outlines an age-verification process to allow adults to opt out, the default setting for UK devices would see automated blocking applied at the hardware and software level.
This intervention coincides with separate reports that the government is considering an outright ban on under-16s accessing “high-risk” social media apps. These proposed regulations would prohibit younger teenagers from using features such as disappearing messages, live-streaming, and private chats with strangers, alongside a ban on romantic or sexual AI chatbots for anyone under 18. Following an online safety consultation that drew roughly 120,000 responses, Technology Secretary Liz Kendall indicated that “all options are on the table,” including an Australian-style blanket ban on social media for under-16s, citing data linking platforms like Snapchat to thousands of criminal offences.
Standing guard on fundamental liberties: How scanning clashes with human rights law
While the protection of minors is a vital societal objective, the UK Government’s current legislative trajectory places it on a direct collision course with established human rights law. Crucially, the UK remains a full member of the Council of Europe – an institution entirely separate from the European Union and is therefore legally bound by the rulings of the European Convention on Human Rights (ECHR).
Legal and technical experts argue that implementing system-wide scanning or bypassing – encryption creates permanent, systemic vulnerabilities. Over the past decade, the ECHR has established a powerful body of case law that firmly undermines the legality of such intrusive domestic policies:
Podchasov v. Russia (February 2024):
The Court categorically ruled that mandating encryption backdoors is unlawful. Weakening security for all users to intercept targeted data breaches Article 8 (the Right to Privacy), establishing that client-side scanning (CSS) is an unconstitutional structural vulnerability.
Škoberne v. Slovenia (February 2024):
This judgment affirmed that the indiscriminate, systematic monitoring of data without strict, objective filtering constitutes an unjustifiable privacy breach. Proactively parsing files on a personal smartphone represents an even deeper infringement than retaining connection logs.
Big Brother Watch & Others v. UK (May 2021):
The Grand Chamber determined that bulk, automated screening mechanisms lack necessary legal safeguards. Automated processing must require independent judicial authorisation rather than being triggered by broad executive powers.
Roman Zakharov v. Russia (December 2015):
The Court ruled that the mere existence of a mass surveillance apparatus amounts to an Article 8 violation. This allows citizens and advocacy groups to challenge the legality of such policies the moment they are codified, without needing to prove their specific device was targeted.
These precedents elevate the domestic debate from a simple policy disagreement to a fundamental constitutional issue. They provide civil liberties groups with immediate legal leverage, demonstrating that mass device scanning is legally flawed from its inception.
The threat to national security and the reality of tech retaliation
Far from making the British public safer, forcing technology companies to alter operating systems to allow automated scanning introduces severe vulnerabilities that threaten national security. Prominent security bodies – including the UK’s National Cyber Security Centre (NCSC), the National Protective Security Authority (NPSA), and the US Cybersecurity and Infrastructure Security Agency (CISA) – frequently warn that hostile state actors and sophisticated cybercriminals actively target messaging applications and mobile devices.
By mandating a localised scanning mechanism on UK devices, the government inadvertently creates a high-value target. If malicious actors compromise this built-in backdoor, they gain a gateway into personal devices nationwide, directly jeopardising critical national infrastructure, government operations, and secure diplomatic communications.
Furthermore, major tech platforms like Apple and Google are highly likely to resist these mandates, with industry analysts predicting a structural standoff where tech giants may choose to withdraw specific services or hardware from the UK market rather than absorb immense compliance liabilities. Apple has previously warned it would pull encrypted features like FaceTime and iMessage from the UK over domestic surveillance demands, whilst Google has formally cautioned that the massive financial penalties under the Online Safety Act risk driving digital services out of the country entirely. Dedicated privacy platforms are already drawing a firm line; Signal’s leadership has explicitly warned that the app would completely exit the UK market rather than weaken encryption or deploy on-device scanning tools. Such an exodus would operate as a severe, self-inflicted reverse sanction. Because the UK’s economy, public services, and daily governance rely entirely on these platforms, a market exit would cause unprecedented disruption. Ironically, government ministers, MPs, and peers rely on these exact commercial smartphones and secure communication channels every day to conduct state business.
An old playbook and the lack of a democratic mandate
This aggressive legislative push is part of a long-standing pattern in British politics. The current attempt to bypass device encryption strongly echoes the Conservative government’s 2015 proposal to ban end-to-end encryption on messaging apps under the banner of counter-terrorism. That effort ultimately resulted in the Investigatory Powers Act 2016, heavily criticised by civil rights groups as the ‘Snooper’s Charter.’ This push for automated control is further complicated by recent revelations surrounding the ‘Mandelson files’, which sparked intense political scrutiny after Downing Street admitted that Prime Minister Keir Starmer uses an auto-delete function on WhatsApp, raising sharp questions over official transparency and the preservation of government communications. The state’s desire to monitor digital spaces has simply shifted its justification from national security to child protection, relying on the same underlying mechanism: compromising individual privacy.
Additionally, implementing the necessary infrastructure to manage widespread age assurance ties directly into the sensitive debate surrounding Digital IDs in the UK. Mandating that adults verify their identity to access an unrestricted internet requires a robust, centralised digital verification framework. However, a digital identity system was completely absent from the Labour Party’s 2024 election manifesto. Without explicit democratic consent, the current administration lacks a mandate from the British electorate to introduce a digital tracking apparatus.
The VPN identity crisis and authoritarian alignment
The government’s proposed digital restrictions directly contradict official UK cybersecurity guidance from the National Cyber Security Centre (NCSC), the Metropolitan Police, and the South East Cyber Resilience Centre (SECRC), all of whom actively promote Virtual Private Networks (VPNs) as an essential pillar for safeguarding sensitive data, protecting remote workers, and preventing criminals from intercepting banking details on public Wi-Fi. By forcing tech platforms to intercept data before encryption occurs or restricting tools that safely route web traffic, the UK risks crippling vital privacy software and introducing structural vulnerabilities. Compromising these secure networking tools places the UK on a dangerous trajectory alongside authoritarian regimes like China, Russia, Belarus, Iran, and North Korea – nations that heavily penalise or ban unauthorised VPN use to maintain total state control over information.
Time to back off, ditch the Act and choose education
The UK government should urgently withdraw these digital proposals. The sustainable, long-term solution to protecting the younger generation lies in comprehensive digital education and robust parental guidance, not in introducing blunt smartphone restrictions that disproportionately disrupt adults using legitimate services for work and daily life.
Crucially, digital privacy is entirely a cross-party issue that exists irrespective of political leanings, as its compromise directly impacts the security of everyone across society. Instead of isolating the nation behind a domestic digital barrier, Westminster should abandon the unworkable and authoritarian Online Safety Act, which was originally passed by the Tories.
The UK should instead adopt the European Union’s Digital Services Act (DSA) in full. Fully embracing the DSA framework would allow the UK to align with a softer, co-regulatory approach to internet safety that focuses on platform accountability rather than breaking device security. Crucially, adopting the DSA in full serves a broader strategic purpose: aligning British digital regulations with Europe offers a clear pathway to rejoining the EU Single Market, establishing a necessary foundation for the UK to ultimately rejoin the European Union.
