Open Rights Group

@openrightsgroup.org

5899 Followers 887 Following

We fight for digital rights. Join us. https://www.openrightsgroup.org/join/

Dear Prime Minister, You have inherited an economy that has been quietly wired to serve a handful of dominant US-based technology firms. You also have the rare opportunity to tap into the public mood by curbing their excessive power over the economy and our lives. A critical break with the UK’s current relationship with dominant Big Tech and AI monopolies is core to a successful premiership. The abuse of structural and market power of a small number of Big Tech companies is a root cause of many of the problems the UK public face: huge potential losses in tax receipts because of firms avoiding paying their fair share in taxes, an economy that feels increasingly out of reach for most, the extraction of value hindering real growth and innovation, and meaningful climate action being undermined. Our call to you is not for an anti-tech response, but an anti-monopoly one. Such a position would help unlock the British innovation and growth that these monopolies are currently suppressing.
5 steps to an effective ICO Be accountable Give people the right to appeal. Put the public first Make its primary responsibility to enforce the law, investigate and remedy infringements. Be independent Make sure it's protected from government interference. End corruption Stop the revolving door between the regulator and Big Tech. Let public interest organisations represent the public Groups like ORG should be able to bring challenges.
What age assurance means for the future of digital rights, online safety, and the Internet at large. Speakers: James Baker, Platform Power and Free Expression Program Manager – Open Rights Group Nicholas Williams, Policy and Campaigns Officer – Index on Censorship Moritz Katzner, General Director, European Affairs & U.S. Advisory – Stop Killing Games Paige Collings, Senior Speech and Privacy Activist – Electronic Frontier Foundation Date: 16th July 2026 Time: 7:30 - 9:00 PM IST Mode: Online
Protecting children online is an objective we all share. The challenge is ensuring measures strengthen child safety without weakening the privacy and security millions of people rely on every day, including children. As organisations committed to a safe, secure, and rights-respecting internet, we are concerned by suggestions that the Government restrict virtual private networks (VPNs). VPNs are cybersecurity tools. They help people protect personal information on public Wi-Fi, enable secure remote working, allow students to access education networks safely, and help small businesses protect their systems. VPNs are essential for human rights defenders and journalists, domestic abuse survivors, the LGBTQ+ community, and others at heightened risk online. The evidence does not support assumptions that young people use VPNs to bypass age restrictions. Ofcom’s research found that only around 3% of children had used VPNs to access content meant for older audiences. Evidence from Australia shows children are much more likely to get around age checks by not being asked, giving false information, or even drawing on a moustache. Restricting VPNs would undercut the security and privacy of millions, without making children safer. Age-gating VPNs would require everyone to surrender sensitive personal information simply to access tools designed to protect privacy. Blocking VPN traffic reliably is technically unfeasible, and risks blocking employers, schools and public authorities using VPNs from accessing parts of the web. This would push people away from compliant and reputable VPN providers toward unregulated, data-exploiting services that are harder to oversee, leaving them less secure. The Government should focus on policy interventions that address the root causes of online harms: strong enforcement of platform obligations, better parental controls, investment in digital literacy, and safety- and privacy-by-design obligations.
A timeline 2019 – Data Free Flow with Trust (DFFT) initiative introduced by Japan. 2022 – Biden signs an Executive Order establishing a mechanism to protect personal data transfers to the US, and restrictions to the President’s authority to conduct surveillance programmes. 2022 – OECD Declaration on Government Access to Personal Data Held by Private Sector Entities. 2023– DFTT endorsed by G7 leaders. 2023– European Commission adopted an adequacy decision for the EU-US Data Privacy Framework, legalising transfers of personal data between the EU and the US. 2025– Trump tries to fire the head of the Federal Trade Commission, Rebecca Slaughter. 2026– Supreme Court overturns precedent of Humphrey's Executor that prevents Presidents from removing members of independent agencies at will, finding the dismissal of Rebecca Slaughter without cause was lawful.
Our suggestions don’t break Labour’s manifesto commitments. They’d help reset digital policy in favour of the UK economy and better value in government spending to improve our social balance and protect our democracy. Become an ORG member – openrightsgroup.org/join
Transparency in UK public policy. Show us your thinking – The UK government says that they promote systemic policy analysis. This is used to understand the complicated interactions that take place in difficult areas of policy, using ‘systems thinking’ and ‘futures thinking’. This is exactly what is needed, so that we can have grown up policy discussions. However, little of this work seems to reach the public domain. Government needs to make clear its understanding and analysis of the digital policy landscape. This way, we can better engage with the government to deliver policy that tackles the root causes of our political situation.
Change the approach to online safety. Break Big Tech – We must tackle the concentration of informational power in social media tech giants and AI companies. So far, safety measures have punished users instead. User empowerment – We need to tackle the power of social media directly, by empowering users to control the information they receive and building platforms like BlueSky and Mastodon. Government and Labour politicians should publish to these networks, so people aren’t forced to use X or Facebook to receive government social media updates. Shift ad-spend – The next administration should shift government ad budgets to local news sites, rather than funding Meta and Google.
Ditch the Digital ID scheme. Stop digital surveillance – It’s still unclear why digital ID is government policy or what it would really deliver. Digital ID appears to have been promoted because of the personal desires of Tony Blair, combined with the illusion that it could help with the evasion of work permits. In our view, Digital ID remains a solution in search of a problem, that threatens to poison the next Labour prime minister’s relationship with the public. Combined with AI, Digital ID could be used to limit access to public services and automate decisions using AI. This a recipe for reinforcing systemic discrimination.
Roll back the digital hostile environment. Migrant digital justice – The Home Office’s approach of creating hostility to migrants has had a deep and lasting impact on UK politics. It has fuelled the politics of hate. ORG’s upcoming report shows that borders and migration policy is being digitised in ways that are dehumanising and creates systemic rights violations, by treating the most vulnerable people as potential threats. These changes are fuelling an AI and border surveillance industry that’s dependent on political hostility to migrants. A holistic approach – The UK’s foreign and climate policy risks increase the instability that pushes people to migrate.The UK needs to take a holistic view of migration.
Regulate AI and ban predictive policing. Bring in safeguards for the use of AI – There’s no legal framework to make sure that public or private sector use of AI does not breach our human rights and dignity. Yet biased and inaccurate decisions are a natural feature of technologies that are statistical and correlative in nature. Regulation of AI was a Labour manifesto pledge, which curiously disappeared in the face of lobbing and trade agreements with the US. But it remains necessary. Prioritise public safety – Without a legal framework, government will continue to deploy ill-judged systems like employing AI in immigration decisions, expanding facial recognition and rolling out predictive policing tech that targets and criminalises whole communities.
Reset the regulators in the UK. End regulatory capture – The Starmer government took the view that to attract billions of US investment in data centres and AI, they should hold back the regulators. The ICO was given duties to balance rights and business growth, while the CMA was given a “strategic steer” to avoid dissuading monopolists from investing. Strengthen competition and protect data – UK business throughout the economy would benefit from CMA action to increase cloud competition and reduce excessive charges. The ICO’s failure to regulate both the private sector and government has been disastrous for the most vulnerable in our society, such as with the eVisa scheme for people who have the right to live and work in the UK.
Reset UK Digital Sovereignty. Greater autonomy – Governments across the EU are building back their state capacity to supervise and build software systems that they own and control through open source. The State is able to manage contractors and own what they build, rather than having consultancies as the experts and contractors owning and controlling software systems. No more Palantirs – Contracts with Palantir should be exited as fast as possible. There are already multiple open source products that federate data for governments, and Manchester’s NHS have delivered their own federated data system for their region. That’s Manchesterism in action. This is not an impossible task.
Reset the UK digital economy. End the Big Tech rip-off – Burnham says he wants to end ‘40-years of neo-liberalism’. This process of siphoning wealth from government and the economy is nowhere more alive than in the digital sector. AWS and Microsoft have been ripping off both British businesses and the government to the tune of hundreds of millions of inflated cloud charges, according to investigations by the Competition and Markets Authority. US firms are using tax efficiency measures to ensure that they don’t pay their way towards the maintenance of basic state functions. Breaking our digital dependency – Ending our dependence on foreign tech for our digital infrastructure and building the UK’s domestic tech sector, especially through open source, is an easy win.
Five steps to ensure an effective data regulator. Be accountable – Give people the right to appeal. Put the public first – Make it the regulator’s primary responsibility to enforce the law, investigate and remedy infringements. Be independent – Make sure the regulator is protected from government interference. End corruption – Stop the revolving door between the regulator and Big Tech to ensure an arms-length relationship. Let public interest organisations represent the public – Groups like ORG should be able to bring challenges.
Quote from Jim Killock, ORG Exec Director: "John Edward's departure is a chance for the Government to reset the regulators' approach of providing data protection in name only. Parliament must ensure that the future Commission is run by professionals who want the law enforced, including against government data failures."
Image of a mobile phone held in a pair of hands with the thumbs over the screen with a neon effects in blue and purple. Text: Sign the petition – Protect VPN use in the UK. https://action.openrightsgroup.org/tell-government-protect-vpn-use-uk
The only way to restrict VPNs is authoritarian. Trying to ban or age-gate VPNs because they might be used to bypass digital ID age checks would be as unworkable as banning web browsers because they allow access to adult content. Attempts to have a perfect age verification system that no-one can get around would involve an extreme level of digital authoritarianism. To comprehensively prevent circumvention of age checks, a State would need to remove the ability of users to install and use software on their computer and try to prevent the Internet from providing open connectivity. The government must not blow up our cybersecurity and the open Internet with technologically illiterate and authoritarian attacks on VPN use.
Requiring sites to detect VPNs won't work. The Age Verification Providers Association propose that sites age-gating content should detect VPN use and direct it to their services. Technical infeasibility – Detection relies on blacklists of commercial VPN servers, which are incomplete and easily outpaced by new services. False positives and exclusion – It would prevent law-abiding users, such as remote workers, people in high-risk environments, or families securing their Internet connection from getting online. Privacy risks – This would require intrusive traffic analysis, undermining privacy and data protection. Creating diplomatic rows – Users in countries that don't have age restrictions would also be caught up in it.
Restricting VPNs is almost impossible. DIY VPNs – Anyone can create a VPN on widely available cloud servers. This ability is built directly into the Linux OS and many consumer routers. Private, self-hosted VPNs can't be feasibly tracked or blocked. Integration with operating systems – VPN functionality is a standard feature of Linux, Windows, macOS, iOS and Android. Blocking or regulating it would require restricting core Internet protocols, with catastrophic knock-on effects for business and personal security. Global nature of the Internet – Users will be driven to offshore providers, which would create compliance headaches for businesses, while leaving determined individuals unaffected by domestic restrictions on VPN use.
VPNs are unlikely to be used by 6-12 year olds. Younger users – 6-12 year olds are the focus of bringing in online safety' measures like age verification. But they face significant barriers to VPN use. The majority in this group are highly unlikely to download, configure or subscribe to VPNs without adult help. Especially if parental controls on app store downloads are enabled. Adolescents and tech savvy teens – Those with the capacity to use VPNs are likely to be teens around 13-18 years old. This group already have the skills and determination to use other workarounds to age checks (e.g. proxy sites, Tor, P2P sharing or borrowed account credentials). VPN use is not a meaningful threat to the effectiveness of age verification, so restrictions are wholly unjustified.
Why are more adults turning to VPNs? The increase in VPN downloads suggests the public are wary of sharing their personal information with age verification providers. That's because the industry is unregulated and companies are based in other countries that may have weaker data protection laws. Also, the data gathered from ID checks can end up being repurposed for uses such as targeted advertising. Asking adults to hand over highly sensitive ID documents or biometric data to unfamiliar companies goes against many years of cybersecurity advice around being careful when handing over personal data online. Despite calls from ORG for age verification providers to be regulated, the government has done nothing except expand digital ID age checks into more areas of the Internet.
What are Virtual Private Networks (VPNs)? With a VPN, people can get on the Internet via a secure, encrypted connection to a remote server. Cybersecurity and data privacy – VPNs mask your IP address to help prevent data tracking and unauthorised access, protecting users from data theft, DDoS attacks, identity fraud and surveillance. This is important when using public WiFi or remote working and some VPN services are bundled with parental filters to restrict harmful websites at the network level. Free expression – In places like Russia and China, VPNs let people access news, social media and resources blocked by governments. This far outweighs the narrow concern that VPNs could be used to bypass age checks.
Sign the petition: Ban Al Tools in Asylum action.openrightsgroup.org/ ban-ai-tools-asylum-decision-making
The need to show political courage. The theme of this year's Refugee Week is courage. But despite questions about the legality of using Al tools, the Home Office has pressed ahead anyway and rolled out their use across the asylum system. So, we're calling on MPs to show courage, to set aside the political noise, and demand that everyone in the UK is treated fairly and lawfully.
The lawfulness of the Al in aslyum cases. The Home Office is likely to be failing to ensure that decisions affecting fundamental rights are lawful and fair. • Lack of transparency Asylum applicants are not being told that Al is being used in assessments of their applications, so they cannot correct errors. • Al Playbook standards The Home Office is failing in its duty to be open and collaborative when deploying Al. • No Equality Impact Assessment The tools may not meet the Public Sector Equality Duty.
The problem with Al in the asylum process. There's a potential breach of data protection law if the ACS tool produces inaccurate summaries of applicants' personal data that they do not have the opportunity to correct. The Home Office's own evaluation of the Al tools found: • 9% of Al-generated summaries of the ACS were so flawed they had to be removed from the pilot. • 5% of users of the APS were "not confident in tool accuracy".
The use of Al tools in asylum decisions. Al tools create a new text of interviews and materials. They choose what to include and exclude, rather than simply indexing or organising the existing source information. • Asylum Case Summarisation (ACS) uses ChatGPT-4 to summarise asylum interview transcripts into concise summary documents. • Asylum Policy Search (APS) summarises country Policy and Information Notes, guidance documents, and Country of Origin Information reports.
The use of Al tools in asylum decisions. A legal opinion commissioned by ORG shows that the Home Office's use of Al in asylum decision-making is likely to be unlawful. Image: Screenshot of an article from The Independent with the headline: 'Home Office use of AI in asylum cases could be unlawful, legal experts warn – Exclusive: Caseworkers use AI to summarise asylum interviews and to search for information about country of origin.'
Text: Courage to Reject AI in Asylum – Refugee Week 2026. Image: Woman wearing a beanie looking to the left with a lined halftone effect on a flared background in light green and blue.
Quote from James Baker, ORG Programme Manager: "Stop Killing the Internet will challenge divisive policies that prescribe the wrong medicine of exclusion, surveillance and control to tackle online harms. It will champion positive rights-respecting alternatives, and promote the work campaigns are doing around the world."
A systems-led approach to online safety. User switching rights – Allow users to switch platforms while retaining their contact networks, as you can with your phone number or your email account. Freeing user feeds – Ensure users can control content on platforms, directly or by third parties, to decide what makes them safer and what gives them value. Creating competition by breaking up platforms – Stop platforms being able to own multiple social networks and prevent tech giants using platforms as part of a wider business strategy. Socially-driven social media – On Mastodon and BlueSky, user switching rights are central, and their communities power small environments, leading to safer spaces.
Treating the symptoms, not the root cause. Platforms rely on extensive data collection to keep users online for longer and target them with ads. Algorithms prioritise content most likely to capture attention and drive interaction, spreading harmful, polarising and addictive content. The data shared for age verification can also be used by platforms and the wider data broker ecosystem to send you ads and customised content. A social media ban is a policy that will fuel the reinforcing loop that generates online harms for profit while sacrificing privacy and free expression.
Stripping away rights and creating new risks. Every failed attempt to make children safer online is followed by more surveillance and censorship. In less than a year, the government has expanded age verification to such an extent that it'll be virtually impossible to be online in the UK without handing over identity documents or biometric data to unregulated companies. Children have rights too and these policies will harm their free expression and privacy rights, and push them into less regulated spaces. Meanwhile the business models driving harms are untouched.
We need public code for public money. What is open source? Open source products use code that is made public and can be used, modified and shared by others. We’re not locked in to the proprietary systems of a small number of US tech firms, so we don’t have to start from scratch if we change vendor. Why this is needed – Making Digital Sovereignty a central strategic goal of UK digital policy will drive competition and innovation with effective regulation to create a more level playing field for UK businesses.
What are the risks of digital dependency? National security – The US has tech powers of sanction which can be used to stop a US company from supplying services. Economic – The UK government exposes itself to vendor lock-in when contracting for proprietary software, resulting in inflated costs and the extraction of value from the UK economy. Tech policy capture – Big Tech has used its outsized power and resources to control markets, limit innovation, curb regulation and lobby Government.
Why we need a Digital Sovereignty strategy. What is it? It means that a country has control over its critical infrastructure and digital policy making. It’s vital to protect communication, banking, energy, travel and healthcare systems that we all rely on. Crisis of digital dependency – The UK is overly reliant on a small number of foreign owned tech giants for its digital systems. When we contract these companies, we subscribe to their exclusive product, meaning we have to change the entire system if we want to move supplier.
Text: End the Big Tech Rip-Off. Write to your MP. Image: Monochrome photo of Peter Thiel, co-founder of Palantir, with Kier Starmer peeking over his shoulder on top of a pink, blue and yellow patterned background in vertical panels.
Image: A police officer in a florescent jacket attaches a 'Live Facial Recognition this area' sign to a lamppost on a public street. Text: Rein in Facial Recognition: Rights groups say government must protect public's privacy. Logos: Big Brother Watch, Liberty, Glitch, Justice, Ada Lovelace Institute, Open Rights Group, Race Equality First, Rights of Women, Statewatch, and End Violence Against Women.
Letter from ORG to PicRights disputing allegations of copyright infringement for the reproduction of a photograph in a screenshot of an online advert in our report, “Bad Ads: Targeted Disinformation, Division and Fraud on Meta’s Platforms”.
Image: Patterned dark turquoise background. Text: 5 steps to an effective ICO. Be accountable – Give people the right to appeal. Put the public first – Make its primary responsibility to enforce the law, investigate and remedy infringements. Be independent – Make sure it's protected from government interference. End corruption – Stop the revolving door between the regulator and Big Tech. Let public interest organisations represent the public – Groups like ORG should be able to bring challenges.
Image: On top of a dark turquoise patterned background is a screenshot of an article from Computer Weekly – 'UK data watchdog accused of dragging feet on eVisa investigation – Despite longstanding data protection issues with the Home Office's electronic visa system being flagged five months ago, the UK's data regulator is yet to take any action.' Text: The ICO has ignored 19 civil society organisations who raised concerns about serious data breaches coming from the Home Office's eVisa scheme. This can't go on.
Image: On top of a dark turquoise patterned background are screenshots of two articles from The Guardian 'At least 49 relatives and colleagues of Afghans in data leak have been killed, study suggests – Research also finds 200 of 231 people notified by MoD of breach reported threats to themselves or families' and 'Civil liberties groups call for inquiry into UK data protection watchdog – Campaigners including Good Law Project describe ICO 'collapse in enforcement activity after Afghan data breach'. Text: The ICO failed to formally investigate the Ministry of Defence over the leak of a spreadsheet detailing 19,000 people who were fleeing the Taliban - the worst data breach in UK history. The ICO's decision to not even open an investigation led to an open letter from 70+ data protection experts calling for an inquiry into the collapse in enforcement action.
Image: 3D chain in silver across the top with one link broken open over a turquoise patterned background. Text: The UK's data protection regulator, the Information Commissioner's Office, often refuses to act when complaints are made about data breaches. In 2024, the ICO received 25,582 complaints and took regulatory action in exactly one case. They're failing to protect our rights.
Image: Vector illustration of an eye with a red pupil, white dotted lined circle iris on black with a grey checkerboard for tthe white of the eye. Rotating tapes with red and white stripes stetch out from around the eye. A grided grey background of content boxes, ie image icons, profile icon, video play icon and lines. Text: Have your say – No Online ID Checks! Respond to the consultation.
Better alternatives to achieve online safety. The government should support safer and more privacy-preserving alternatives instead of age verification systems. Interoperability – People should be able to choose safer services/platforms without losing networks, just how you can switch bank accounts easily. Empowering users – Encourage competition around safety and reduce dependence on large platforms that monetise attention to keep us online. Reject surveillance-based Internet – Creating privacy risks isn’t safe.
Bans and age-gating don’t work in practice. Restricting access to online content is easy to work around and could end up making young people less safe. Restrictions bypassed – The social media ban in Australia has seen young people use other people’s ID, false documents, disguses, shared accounts and accessing unlocked devices. Counterproductive – These measures risk pushing users towards less regulated and less safe spaces. This results in more surveillance, more data collection and little improvement in safety.
Online ID checks affect everyone, not just kids. Proposals for social media bans and restricted web access require ever more ID checkpoints across the Internet. Challenge everyone – Adults, not just children, have to upload ID documents, facial scans, or other sensitive data to access lawful online services. Major privacy and security risks – Biometric and identity data can be breached, misused or repurposed. Dangerous mission creep – Online ID checks may affect access to many sites, forums, games and VPNs, not just social media.
Image: Vector illustration of an eye with a red pupil, white dotted lined circle iris on black with a grey checkerboard for tthe white of the eye. Rotating tapes with red and white stripes stetch out from around the eye. A grided grey background of content boxes, ie image icons, profile icon, video play icon and lines. Text: No Online ID Checks! Have your say in the consultation: https://www.gov.uk/government/consultations/growing-up-in-the-online-world-a-national-consultation
Image: Vector illustration of an eye with a red pupil, white dotted lined circle iris on black with a grey checkerboard for tthe white of the eye. Rotating tapes with red and white stripes stetch out from around the eye. A grided grey background of content boxes, ie image icons, profile icon, video play icon and lines. Text: Have your say – No Online ID Checks! Respond to the consultation.
Copy of the joint statement: UK policymakers must prioritise addressing the roots of online harm, not undermining the open web