Does the online safety act allow retroactive scanning or is it based on current and future content.
This fact-check may be outdated. Consider refreshing it to get the most current information.
Executive summary
The Online Safety Act gives Ofcom statutory powers to require platforms to use “accredited technology” to detect illegal content — including tools that would operate on private or end‑to‑end encrypted communications — but the government has publicly delayed enforcing those scanning powers until they are declared “technically feasible” [1] [2] [3]. The available reporting shows the law is framed to create ongoing, prospective duties on platforms to detect and remove illegal material, not an explicit, clearly articulated authority to perform wholesale retroactive mass‑scans of users’ past private messages, although the statute’s broad technical notice powers leave room for contestable interpretations [4] [5] [6].
1. What the statute actually empowers regulators to do
The Act places new, proactive duties on regulated services to identify and remove illegal content and empowers Ofcom to set technical standards and require “accredited technology” to be deployed — language that contemplates active, platform‑side or client‑side detection systems rather than only reactive takedown on notice [4] [3]. Several analyses emphasise that these are forward‑looking obligations: Ofcom can issue technical notices requiring platforms to adopt scanning tools to prevent the circulation of child sexual abuse material and terrorism content [5] [3].
2. Client‑side scanning: forward‑looking requirement, not an explicit retroactive warrant
The most controversial instrument in the Act — often called client‑side scanning — would scan content on devices or before encryption to flag illegal material, a technique inherently oriented to real‑time or future content flows rather than a legal warrant to trawl archived data [5] [6]. Commentators and rights groups note the law does not explicitly mention “encryption” but does create a regulatory mechanism focused on preventing and removing illegal content as it appears, suggesting the legal architecture is primarily prospective [6] [7].
3. Government caveat and the “technically feasible” pause
The government has publicly stated it does not intend to enforce the encrypted‑message scanning provisions until doing so is “technically feasible,” a political and technical caveat that pauses implementation while leaving the statutory power intact [1] [2]. Critics read that pause as temporary: outlets tracking developments warn the clause has only been halted, not repealed, meaning lawmakers and regulators could still seek technical solutions to enable scanning in the future [2] [8].
4. Why critics worry about retrospective or expansive uses
Legal and civil‑liberties groups warn that the statutory power to mandate “accredited technology” combined with broad executive discretion could be repurposed or interpreted expansively to facilitate intrusive surveillance practices — including, in theory, requirements that touch stored content — even if the Act does not explicitly spell out retroactive mass‑scanning [3] [7]. Analysts point to the absence of explicit encryption protections in the text and to prior government powers to demand removal of encryption as reasons the practical effect could erode privacy over time [9] [8].
5. What the reporting does — and does not — show about retroactivity
The public record in these sources documents strong prospective powers and the political decision to delay enforcement, but it does not supply a clear statutory clause that unambiguously authorises retroactive mass scanning of historical private messages; the debate instead focuses on future‑oriented technical notices and client‑side scanning obligations that would operate going forward if implemented [1] [5] [4]. Absent direct text or regulatory guidance in the supplied reporting specifically authorising retroactive trawling of stored user content, it is not possible on this evidence to conclude the Act expressly permits retroactive scanning.
6. Bottom line and legal flashpoints to watch
Legally, the Act creates the pathway for Ofcom to require scanning technologies that would materially change how private communications are processed, but implementation is politically paused and legally contested; the statute is structured to impose ongoing, future‑facing duties on platforms rather than to announce an explicit, blanket retroactive scanning power, though regulatory notices and judicial or administrative interpretations could expand practical scope [1] [2] [5] [4]. Continued scrutiny should focus on Ofcom technical notices, any judicial review or legislative amendments, and whether government statements about “technical feasibility” harden into concrete enforcement or are used to broaden powers in practice [6] [9].