02.08 / Topic 08 of 11
Online & Data
Your data, online safety, hacking and what not to post.
Laws written for letters and phone lines now govern tweets, DMs and deepfakes. Newer laws target online platforms directly.
- 13
- Essential laws
- 04
- Chapters
- 02
- Weird ones
- 00
- Busted myths
AT A GLANCE · 04 KEY NUMBERS
CHAPTER A · 03 LAWS
Your data
Who can collect your data, and what you can make them do.
UK GDPR & Data Protection Act
Organisations must handle your personal data lawfully, fairly and securely. You have rights over it.
What it means for youSend a 'subject access request' to any company to get a copy of everything it holds about you. It's free.
In practice
- Right of access: ask any organisation what data it holds on you (usually answered within 1 month).
- Rights to correct, erase and object to some uses of your data.
- Regulated by the ICO, which can fine up to £17.5m or 4% of global turnover.
Cookies & spam
Websites need your consent for non-essential cookies, and businesses need your consent to send marketing emails and texts.
What it means for youUnsubscribe links must work. Report spam texts by forwarding them to 7726.
In practice
- Cookies that are strictly necessary (like a shopping basket) don't need consent.
- Firms can email existing customers about similar products if you could opt out.
- Every marketing message must give an easy way to unsubscribe.
CCTV & doorbell cameras
If your home camera records beyond your property, such as the street or a neighbour's garden, data protection law applies.
What it means for youPoint cameras at your own property where you can. Put up a sign if you record beyond it.
In practice
- You should be able to justify why you need to record beyond your boundary.
- People you record can ask you for copies of the footage.
- Recording audio is far more intrusive and harder to justify.
CHAPTER B · 04 LAWS
Staying safe
Platform duties, age checks and image-based abuse.
Online Safety Act
Makes platforms responsible for tackling illegal content and protecting children. Regulated by Ofcom.
What it means for youReport illegal or harmful content to the platform first. Platforms must have easy reporting tools.
In practice
- Since July 2025 sites with porn must use robust age checks.
- Created new offences: cyberflashing, sending flashing images to epileptic people, encouraging self-harm, and sending knowingly false messages to cause harm.
- Sharing intimate images without consent is a crime.
Age checks online
Since July 2025, sites that host pornography or other harmful content must use effective age checks.
What it means for youAdult sites must now verify age with things like photo ID or facial age estimates.
In practice
- Ticking a box saying 'I'm over 18' no longer counts.
- UK law sets no minimum age for social media; most apps use 13 because of their own terms.
- Under-13s need parental consent where online services rely on consent to use their data.
Intimate image abuse
Sharing, or threatening to share, intimate images of someone without consent is a crime, whether real or fake.
What it means for youReport it to the police and to the Revenge Porn Helpline on 0345 6000 459. StopNCII.org can help remove images.
In practice
- Cyberflashing (sending unsolicited sexual images) is also a crime.
- Creating sexually explicit deepfakes of adults without consent was made an offence in 2025.
- Victims can get images removed through services like the Revenge Porn Helpline.
Smart device security
Since April 2024, smart devices sold in the UK can't come with easy-to-guess default passwords.
What it means for youChange default passwords anyway, and keep devices updated. Sellers must say how long updates last.
In practice
- Makers must say how long they'll provide security updates.
- They must give a way to report security flaws.
- Covers phones, smart TVs, speakers, cameras and other connected products.
CHAPTER C · 03 LAWS
What you post
When messages, posts and shares cross a legal line.
Communications offences
Sending threatening or grossly offensive messages can be criminal.
What it means for youThink before you post. Sending a knowingly false message to cause harm is also a crime.
In practice
- Section 127 Communications Act 2003 covers messages sent over a public network.
- Harassment (Protection from Harassment Act 1997) includes online campaigns.
- Creating sexually explicit deepfakes of adults without consent is now an offence (2025).
Defamation Act
You can be sued for publishing a false statement that causes serious harm to someone's reputation, including in a tweet.
What it means for youSaying something is your honest opinion, based on facts, is a defence. Stating lies as fact is risky.
In practice
- Defences: truth, honest opinion and publication on a matter of public interest.
- Businesses must show serious financial loss.
- Retweeting can count as publishing.
Copyright, Designs and Patents Act
Protects creative work automatically. For books, music and art, copyright lasts for the creator's life plus 70 years.
What it means for youUsing someone's photo without permission can lead to a bill. Check the licence before you use it.
In practice
- There's no need to register copyright in the UK.
- Limited 'fair dealing' exceptions cover parody, quotation, criticism and research.
CHAPTER D · 03 LAWS
Money & hacking
Scams, hacking and earning money online.
Bank transfer scams
If you're tricked into sending money by bank transfer, your bank must usually refund you, up to £85,000.
What it means for youCall 159 to reach your bank safely. If you've been scammed, report it to your bank straight away.
In practice
- This covers 'authorised push payment' scams made through Faster Payments since October 2024.
- Report it to your bank quickly: claims must be made within 13 months.
- Refunds can be refused if you were grossly negligent or part of the fraud.
Computer Misuse Act
Accessing a computer, account or data without permission is a crime, even if you just look.
What it means for youLogging into a partner's phone or an ex's email without permission is a crime, even if you know the password.
In practice
- Logging into a partner's or ex's account without permission counts.
- Spreading malware or launching DDoS attacks carries heavier sentences.
Selling online & tax
Selling your own unwanted things is usually tax-free. Buying to resell, or making things to sell, is trading.
What it means for youPlatforms now report sellers with 30+ sales or over about £1,700 a year to HMRC. Trading income over £1,000 must be declared.
In practice
- The trading allowance lets you earn up to £1,000 a year from trading tax-free.
- Since 2024, platforms like eBay and Vinted share sellers' details with HMRC once they make 30 sales or about £1,700 in a year.
- Being reported doesn't automatically mean you owe tax.
NOTES
Did you know?
NOTE 01Ripping your own CDs to your laptop is technically copyright infringement in the UK: a 2014 exception was quashed by the High Court in 2015.
NOTE 02You need a TV Licence to watch or download anything on BBC iPlayer, live or on demand.
TAP A CARD TO REVEAL