The UK government has introduced new measures under the “Children’s Wellbeing and Schools Bill” that could significantly impact data privacy and encryption. The proposals include mandatory client-side scanning on all phones and tablets used in the UK.
Lawmakers state that “any relevant device supplied for use in the UK must have installed tamper-proof system software which is highly effective at preventing the recording, transmitting (by any means, including livestreaming) and viewing of CSAM using that device.”
In practice, this would mean continuous scanning of all activity on phones and tablets, potentially banning end-to-end encryption and open-source operating systems such as GrapheneOS. Users may also be restricted from having administrative control over their own devices.
The bill also includes measures targeting VPN usage. It seeks to prohibit VPN services for children in the UK and requires regulated user-to-user services to implement “highly-effective age assurance measures.” This could involve identity verification for users under 16, potentially limiting anonymous communication, whistleblowing, and other privacy-sensitive activities.
Privacy advocates warn that these measures could set a global precedent for state surveillance and intrusion into private communications. Critics argue that while the bill is framed as protecting children, it risks undermining secure digital communication for all users.
The debate highlights the ongoing tension between security measures and digital privacy, with experts calling for transparency from lawmakers and stronger protections for user data.