Ofcom can force companies to scan private messages. If they can't break encryption, they must build the tools to do so.
The Online Safety Act 2023 gives Ofcom power to require platforms to use 'accredited technology' to scan private messages for illegal content — effectively mandating backdoors in end-to-end encryption.
Platforms have a legal duty to prevent child sexual abuse material (CSAM) and terrorism content. If Ofcom decides a platform isn't doing enough, it can issue a Technology Notice requiring the platform to deploy scanning technology — even on end-to-end encrypted messages. The platform cannot publicly disclose it received a notice. Failure to comply carries fines of up to 10% of global revenue or criminal liability for senior managers.
Signal, WhatsApp, and Apple have all stated they would rather withdraw from the UK than comply. Signal's president said they would 'absolutely, 100% walk' rather than undermine encryption. Apple withdrew its Advanced Data Protection (end-to-end encrypted iCloud backup) from the UK in February 2025 rather than build a backdoor. The Act's defenders say scanning can happen 'client-side' before encryption — but security researchers unanimously agree this is functionally equivalent to breaking encryption.
As of 2025, Ofcom has not yet issued a Technology Notice. The regulator acknowledged that no scanning technology currently meets accuracy requirements without unacceptable false positive rates. However, the power remains in law. Ofcom is conducting consultations on 'accredited technology' standards. The threat is sufficient: companies are changing behaviour. Apple removed ADP from the UK preemptively. This is the chilling effect in action.
No Technology Notices have been enforced yet, but the law's passage caused immediate harm. Apple withdrew ADP from UK users in early 2025 — meaning UK iCloud backups are now accessible to Apple (and thus to UK authorities via warrants). UK users of iCloud lost a security feature available everywhere else. Privacy-focused services are evaluating UK market withdrawal. UK citizens face a degraded security landscape compared to the rest of the world.