On April 27, the U.K. Parliament quietly passed the Digital Economy Act 2017 before scurrying off for vacation. The act received Royal Assent the same day. What used to be reviled as the Digital Economy Bill is now law — and its effects stand to reach much farther than the Grand Old Empire’s borders.

Although the law does some very good things — like capping data charges on mobile phones, making 10mbs broadband a legal right for everyone and taking a bite out of online ticket scalping — the pornography-related clauses have gotten the most attention at home and abroad. Brits are justifiably concerned about their privacy and government censorship, and the rest of us are wondering who put the Crown in charge of the internet.

Here are a few of the things you need to know.

Mandatory age checks

Regardless where they are based, websites containing adults-only material must verify their visitors are 18 or older. How? No one knows yet, and won’t until an official “age-verification regulator” has been named. Right now, it looks like the British Board of Film Classification — analogous to the ratings division of the Motion Picture Association of America, except with more governmental clout — is at the top of Parliament’s list.

Who determines what material must be rated and how ages will be verified is less important, at least at the moment, than the consequences for failing to jump through the U.K. regulator’s hoops. Once the mechanism is in place (allegedly sometime next year), violators will be subject to fines of up to £250,000 (about U.S. $323,500) or as much as 5 percent of their revenue, whichever is larger. (How the regulator will determine revenue is anybody’s guess at this point.)

Sites that fail to comply with the age-check mandate may be blocked at the root, meaning they will be unreachable from U.K. IP addresses.

That’s not the worst of the penalties. The regulator also will have the authority to order payment processors, advertising networks and other service providers under British dominion to cut off the offenders, effectively starving them financially. Whether this tactic will work within an international framework is debatable, but some have suggested few payment processors, for example, will be willing to buck the British government for the sake of free speech or to protest heretofore unheard-of extraterritorial-jurisdiction overreach.

Tougher anti-piracy measures

The maximum jail sentence for copyright violators has been increased from two to 10 years. The provision is controversial, as some have argued the wording is vague and potentially could lead to an otherwise innocent user doing time because he watched a stream he didn’t know had been pirated.

One anti-piracy tool that received a good deal of discussion during the bill’s consideration did not make the cut: The government cannot fine search engines for failing to remove, obscure or demote links to pirated content.

Data sharing

This section of the act comprises a broad set of rules for sharing personally identifiable information about private citizens among government departments. The government claims the record-keeping will make departments run more smoothly and with less redundancy, but privacy advocates decry the potential for the government to build detailed, centralized dossiers about individual citizens. Critics say the proposed law may violate international human-rights accords by exposing internet users to breaches of privacy and interfering with free speech online.

Once again, how data will be collected and shared has not been defined and, in some people’s minds, that makes age-verification by porn sites all the more dangerous. The assumption is that Brits who wish to view porn online will need to provide some sort of government ID to verify their age. Privacy campaigners say it’s only a matter of time before pencil-pushers in government offices begin snooping into their neighbors’ porn-viewing habits. Some see more sinister potential for misuse of data, as the government, religious organizations and industry could use porn viewing as a basis for persecution.

Also remaining to be worked out is whether individuals will have any say in what information about them is collected and shared. Will they be able to correct errors in the records?