A serious (and seemingly obvious) problem with the implementation of the Online Safety Act is that it requires malicious actors to not exist.
Since the UK govenment in any form hates paying for things, especially things required for their goals, the current situation is that websites have to work out to do age verification themselves. There is no government-approved or provided service for this - it's a free-for-all of third-party verification providers.
Now, some people are pointing out that depending on how these companies handle the data given to them to perform verification, it's possible this data could be stolen or leaked. This is a worrying possibility. This danger is primarily one of passive incompetence, although if your driver's licence gets leaked, you won't be happy either way.
But passive incompetence probably isn't going to hurt anyone before active malice does.
Normalising showing your face or identity documents to random websites is an incredibly stupid thing to do. You know who benefits from this? Actual criminals! Phishing attacks continue to be successful because people will put their banking details into websites that are very much not their banks. And while random websites asking for your banking details is suspicious, the OSA makes it so that random websites asking for your driver's license or passport or other such things will now be expected.
Meaning an enterprising criminal can set up a website, stick a fake age verification pop-up on it, and harvest a whole bunch of things that come in useful for committing identity theft. Or blackmail perhaps.
The overall point here is that in this respect, the Online Safety Act is going to make the internet more dangerous, in a way that should be obvious if you actually think about the potential negative consequences.
