Written By Jack Dinauer ’28

Introduction

The right to privacy has long been recognized as a right crucial to a democratic society.¹See U.N. High Comm’r for Hum. Rts., The Right to Privacy in the Digital Age, ¶ 2, U.N. Doc. A/HRC/51/17 (Aug. 4, 2022) [hereinafter UN Report] (explaining the existence of the right to privacy and stating that new digital threats to this right have arisen). But as the world becomes increasingly virtual, many states have struggled to protect this right and balance it with new laws related to online age verification and mandatory decryption.²See, e.g., Kids Online Safety Act, S. 1748, 119th Cong. (2025) (proposing the creation of a legal duty of care for internet service platforms to limit the exposure of harmful content to minors); Online Safety Amendment (Social Media Minimum Age) Act 2024, (Cth) (Austl.) (prohibiting people under the age of 16 from creating social media accounts); The Digital Personal Data Protection Act, 2023, (India) (prohibiting platform from processing minors’ data without parental consent and encouraging the adoption of age verification systems). These new laws erode the right to privacy by forcing everyday internet users to upload their personal identifying information to the websites they use.³See Paige Collins, No, the UK’s Online Safety Act Doesn’t Make Children Safer Online, Elec. Frontier Found., (Aug. 1, 2025) https://www.eff.org/deeplinks/2025/08/no-uks-online-safety-act-doesnt-make-children-safer-online (on file with American University International Law Review) (describing the actions taken by online service providers to comply with age verification laws); Elly Rostoum, Access Denied: The UK Online Safety Act Misses Its Mark, Ctr. for Eur. Pol’y Analysis, (Aug. 18, 2025) https://cepa.org/article/access-denied-the-uk-online-safety-act-misses-its-mark (on file with American University International Law Review) (explaining the European trend towards age verification and the problems with such laws). Often, these laws are born out of the desire to protect children online.⁴See Rostoum, supra note 3 (describing the global trend of states implementing laws designed to protect children from harmful content online). However, the effect that these laws have may be equivalent to a form of mass surveillance: a practice considered a threat to democracy by the United Nations.⁵See UN Report, supra note 1, ¶¶ 3, 29, 32, 38, 41 (elaborating on how technological developments have allowed states to engage in the unprecedented monitoring of persons in public and online).

One such law is the United Kingdom’s Online Safety Act (“OSA”), enacted for the purpose of preventing children from accessing age-inappropriate and harmful content.⁶Online Safety Act 2023, ch. 50, pt. 1 (Eng.) [hereinafter OSA]; Online Safety Act: Explainer, GOV.UK, (Apr. 24, 2025) https://www.gov.uk/government/publications/online-safety-act-explainer/online-safety-act-explainer (on file with American University International Law Review). The U.K. officially recognized the right to privacy when it incorporated the European Convention on Human Rights (“ECHR”) into domestic law.⁷Human Rights Act 1998, ch. 42, art. 8 (Eng.) [hereinafter HRA]. The OSA violates the ECHR by unnecessarily interfering with the right to privacy in forcing websites to collect personal identifying information from their users and allowing the government to access private information.

Background

The ECHR was adopted by the Council of Europe in 1950 to pursue “the maintenance and further realization of human rights and fundamental freedoms.”⁸Convention for the Protection of Human Rights and Fundamental Freedoms, Nov. 4, 1950, E.T.S. No. 5, 213 U.N.T.S. 222 [hereinafter European Convention on Human Rights]. To achieve this goal, the ECHR created the European Court of Human Rights, which has jurisdiction over the application and interpretation of the ECHR.⁹Id. art. 19. Article 8 of the ECHR mandates that “[e]veryone has the right to respect for his private and family life, his home and his correspondence,” and that “[t]here shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society . . . .”¹⁰Id. art. 8. In 1951, the U.K. ratified the ECHR, and in 1988 the U.K. passed the Human Rights Act 1988 (HRA) to enshrine the rights guaranteed by the ECHR into domestic law, including, without change, those found within Article 8.¹¹HRA, supra note 7, art. 8.

But now, online privacy rights are in danger.¹²See UN Report, supra note 1, ¶ 43 (“Systematic surveillance of people in the public space online and offline, in particular when combined with additional ways to analyze and connect the obtained information with other data sources, constitutes an interference with the right to privacy . . . .”). The UN High Commissioner for Human Rights has recognized “the very real and encroaching risk of creating systems of pervasive surveillance and control . . . .”¹³Id. ¶¶ 1, 3. In 2024, the European Court of Human Rights heard the case of Podchasov v. Russia, where a law mandated that internet communication organizers must store the contents and data of user communications and, under certain vague circumstances, must submit this information with the ability to decrypt it to the authorities.¹⁴Podchasov v. Russia, App. No. 33696/19, ¶ 1 (Feb. 13, 2024), https://hudoc.echr.coe.int/eng/?i=001-230854 (on file with American University International Law Review). The Court stated that “confidentiality of communications is an essential element of the right to respect for private life and correspondence, as enshrined in Article 8.”¹⁵Id. ¶ 65. Any interference with this right must be “necessary in a democratic society,” meaning that the law fulfills a “quality of law” requirement through sufficient safeguards to protect against arbitrariness and risk of abuse.¹⁶Id. ¶¶ 61, 74. Because the statute in Podchasov allowed law enforcement to access communications without judicial authorization or only in specifically defined circumstances, it did not protect against arbitrariness and risk of abuse, thus violating the ECHR.¹⁷See id. ¶ 80 (“The Court concludes from the foregoing that the contested legislation . . . impairs the very essence of the right to respect for private life under Article 8 of the Convention.”).

Analysis

Having codified the ECHR into domestic law through the HRA, U.K. courts must follow the decisions of the European Court of Human Rights when interpreting the privacy right guaranteed under Article 8.¹⁸See HRA, supra note 7, § 2(1)(a) (“A court or tribunal determining a question which has arisen in connection with a Convention right must take into account any judgement, decision, declaration, or advisory opinion of the European Court of Human Rights.”). First, the OSA does not meet the “quality of law” requirement because the OSA does not protect against the risk of abuse by imposing the legal duty of age verification without strictly defined limits.¹⁹See OSA, supra note 6, at pt. 3 ch. 2 § 12 (explaining the legal duty of age verification). Fundamentally, age verification is identity confirmation; the methods by which services can correctly confirm the age of a user all relate to personal identifying information.²⁰See Age Verification and Age Gating: Resource Hub, Elec. Frontier Found., https://www.eff.org/issues/age-verification (on file with American University International Law Review) (highlighting the deficiencies of age verification); see also Age Checks for Online Safety – what you need to know as a user, OFCOM, (June 26, 2025) https://www.ofcom.org.uk/online-safety/protecting-children/age-checks-for-online-safety–what-you-need-to-know-as-a-user (on file with American University International Law Review) (listing several recommended methods of age verification involving personal information). The OSA states that it is applicable to any website accessible by U.K. citizens that might contain some form of harmful content.²¹See OSA, supra note 6, pt. 2 §§ 3–5 (defining what services are covered by the OSA). This is so broad that it could apply to any website in which users interact with each other.²²See Rostoum, supra note 3 (listing several different kinds of websites that have implemented age verification or are subject to mandatory age verification laws). These provisions create arbitrariness and the risk of abuse by effectively allowing the government to force all websites to collect personal identifying information about its users, information which is then accessible by the government and third-party actors.²³See OSA, supra note 6, pt. 7 ch. 4 (granting Ofcom the power to compel services to provide user information in certain circumstances); see also Douglas Crawford, 70,000 government IDs leaked in Discord data breach, Proton Blog, (Oct. 16, 2025) https://proton.me/blog/discord-age-verfication-breach (on file with American University International Law Review) (reporting that 70,000 images of personal identification obtained from age verification were stolen in a data breach); see also UN Report, supra note 1, ¶¶ 41–42 (describing how governments can use private data collection services to bypass legal restrictions); Podchasov, App. No. 33696/19, ¶ 52 (“The storage, although carried out by private persons – the ICOs – is required by law; it follows that the interference is attributable to the Russian State.”). This is similar to Podchasov because in both instances, the regulation at issue is so vague and lacking in clarity that there is no defined limit to its application and enforcement.²⁴See Podchasov, App. No. 33696/19, ¶ 64 (explaining how the regulation confers unrestricted discretion to the authorities in accessing private communications).

Second, the OSA also forces companies to allow the Office of Communications (Ofcom), the U.K. OSA Regulator, to scan private encrypted messages.²⁵See OSA, supra note 6, pt. 7 (stating OFCOM’s legal powers). Encrypted communications are an important aspect of privacy and crucial to the freedoms of privacy, expression, and association.²⁶See UN Report, supra note 1, ¶¶ 21–22 (explaining the value of encryption to human rights); Podchasov, App. No. 33696/19, ¶ 96 (stating that encryption is important to ensure the enjoyment of all human rights). The nature of encryption is such that a law mandating access to encrypted communications equates to a law requiring the creation of a backdoor, the abandonment of encryption, or the use of extremely problematic workarounds.²⁷See UN Report, supra note 1, ¶¶ 23–28 (describing the consequences of anti-encryption laws). Recognizing the issues with such laws, the European Court of Human Rights in Podchasov plainly stated that mandatory backdoors for encrypted communications “cannot be regarded as necessary in a democratic society” because they introduce the risk of general and indiscriminate surveillance “not proportionate to the legitimate aims pursued.”²⁸Podchasov, App. No. 33696/19, ¶ 79. By requiring companies to make encrypted messages available for scanning, the OSA is in effect requiring the creation of a backdoor or similar measure.²⁹See OSA, supra note 6, pt. 7 ch. 5 § 121 (allowing for OFCOM to issue notices to services requiring them to use their best endeavors to develop or source technology to achieve certain goals). Thus, just like the Podchasov law, the OSA creates arbitrariness and a potential for abuse by introducing the risk of widespread surveillance in violation of Article 8 of the ECHR.³⁰See Podchasov, App. No. 33696/19 ¶ 74 (explaining that legal provisions lacking arbitrariness and risk of abuse protections cannot limit a privacy interference to what is necessary in a democratic society).

Conclusion

The OSA is only one example of the privacy-interfering regulations being considered throughout the world.³¹Kids Online Safety Act, supra note 2; Online Safety Amendment (Social Media Minimum Age) Act 2024, supra note 2; The Digital Personal Data Protection Act, supra note 2. Even though these laws are enacted for a legitimate purpose, they risk exposing internet users’ personal information and private communications to the government.³²See Gina Romera et al., Safeguard Human Freedoms from Systematic Digital Interference, Surveillance and Chilling Effects on Civic Space, Off. of the U.N. High Comm. for Hum. Rts. (Apr. 27, 2026) https://www.ohchr.org/sites/default/files/statements/20260427-safeguard-hr-freed-syst-digi-inter-surv-chill-civic-space-sr-freedom-peaceful-en.pdf (on file with American University International Law Review) (describing the impact of digital surveillance on human rights). The OSA violates the privacy right described in Article 8 of the ECHR because it creates an interference with privacy not necessary in a democratic society by enabling arbitrary enforcement and the risk of abuse.³³See OSA, supra note 6, pt. 7 (describing the scope of the OSA applicability and the de-encryption abilities of Ofcom). The U.K. must ensure that the OSA is narrowly tailored to the harm it is designed to prevent, and further research must be done on how to protect children online without requiring all internet users to disclose their personal information.