Warning: long post ahead, so TLDR; we don't really know how this is going to evolve or who is or is not going to be doing age verification, and it's up to each site to decide whether to comply or risk getting into trouble. You as an individual can get around it using a VPN. For now.
Generally, the Online Safety Act applies to 'user-to-user' services, that is, any service that allows users to upload content that can be seen by other users. Think Facebook, Twitter, Instagram, Discord etc. However, certain duties in the Act apply to all sites, including the duty to prevent children from viewing 'inappropriate' content. All forms of porn are regarded as inappropriate for children in the scope of the Act, and any site providing porn to end-users that has a 'substantial' number of UK users is obliged by the legislation to use technical means such as age verification to achieve this.
What does 'substantial' mean? Whatever uk.gov wants it to mean.
That's the theory. The reality seems to be, if you're big enough that the UK government knows who you are, you need to comply. If you aren't, you can probably fly under the radar, at least until they do. Maybe there will be some kind of campaign by Ofcom to find literally every porn site on the internet and send them a nasty letter telling them they better comply or else. Or maybe there won't. We just don't know yet.
Sites that don't fly under the radar have two options, basically: implement age verification, or block the UK entirely. Though in a world where VPNs are a thing, eventually I'm sure TPTB will decide that just blocking UK IP addresses isn't good enough to stop Tommy Teenager from seeing your filth.
Silly-Sausage Also whether this shite requires a one off verification which is recorded via a 'cookie' or a site by site verification ?
Well, every site uses a third party for this, and there are several of them. Some of the AV providers have a 'multi-pass' system where, once verified, you can just give your pass ID to any site that needs it, but that relies on those sites all using that same AV provider. There's no universally-recognised AV token that works everywhere. Generally, you can assume that you'll have to do this at least once for every porn site (and social media service) you visit. Generally it seems like there's no easy way to get verified without creating an account and being logged in. If there were, you'd probably have to verify on each visit. One of the goals here seems to be to eliminate 'anonymous' use of porn sites since this provides an easier route for kids to access porn.
For VR apps in the headset, I imagine that the way it'll work is that they won't stream content unless your account is age-verified, if that site is doing AV for UK users. If you visit a porn site inside the headset in the Meta browser or otherwise you will doubtless get the same AV prompts as on a regular browser, but there isn't a way to do AV from inside the headset, so again you'll have to have an account at that site and be logged in and age-verified to access the content in your headset. Obviously, for local downloaded content you don't have to do anything.
For sites that you pay for, since you will have a credit card or Paypal account or similar associated with your subscription, that in itself should count as valid age verification, I believe (but again, IANAL nor do I play one on TV).
In principle this shouldn't result in the government having a list of the porn videos you watched. The AV providers are all at pains to point out that they only tell the site whether you're over 18 or not, they don't get any kind of data back on what you do on the site, and the selfies or ID photos you provide are not supplied back to the site. They usually say they don't keep these photos, although if you read the T&Cs they invariably all say they can keep them if they want to and basically do what they want with them, including selling them to data brokers etc. Sites don't have any kind of obligation to provide any data to the government that they weren't already mandated to do if served with an appropriate legal order, which is basically anything and everything.
That said, the NSA and related TLAs already know what you do online anyway, because they get that data from the tech companies and their own mass surveillance programmes. Short of using TOR for everything and keeping up elite-level opsec without a single mistake, you can't be truly anonymous on the internet. But for 999,999 people out of a million, the TLAs could care less about who you are or what you do, and unless you become a state-level threat or a target for a major law enforcement agency, they never will.
The UK is not alone here - some other countries have already done this or are in the process of doing it, and the EU is putting it into a directive which all EU states will have to implement. Several US states are doing it, and there was a recent Supreme Court decision (I don't recall the details) that will make it easier for them to do so, so expect a lot more of that.
As far as freedom of speech under successive UK governments goes: the UK has never had individual freedom of speech as a right. We have general freedom of expression, but it is circumscribed, and the government and/or the courts get to decide what that means, since we have no written constitution. The US has the right to freedom of expression enshrined in their constitution, but tell that to the people who are getting arrested for things they say on social media. Basically, previously liberal democracies the world over are trending towards authoritarianism, they only differ in how quickly and how far. Frankly, I expect it to get worse.
