Virtual private networks (VPNs) have long been used to hide location and protect online privacy. But since the introduction of the Online Safety Act last year, the old technology has suddenly found itself thrust into the spotlight and placed at the centre of a growing political debate.
While an outright ban isn’t currently being proposed, after a surge in VPN downloads following the introduction of age checks for adult websites last year, the government is now exploring whether to expand these age checks to VPNs as well.
On 2 March, the Department for Science, Innovation and Technology launched a public consultation on digital safety. The inquiry asks the public their views on whether universal age checks should be required to access VPNs and what impact such measures could have on ordinary users who rely on the service for privacy and security.
The consultation specifically asks how children are currently bypassing online safety rules, including whether VPNs are being used as a circumvention tool. It also asks whether any restrictions could realistically be enforced and whether there are any unintended consequences of employing age checks on VPN services.
Cybersecurity experts say restricting VPNs would be difficult to enforce. “While you might compel ‘friendly’ VPN providers based in UK-partner countries to comply with not offering VPNs to children, there are many VPN and proxy solutions globally, some in countries that may be harder to legally compel,” says Corey Nachreiner, chief security officer at WatchGuard Technologies.
Nachreiner says attempts to block VPNs would likely turn into an ongoing game of cat-and-mouse as proxy and private VPN providers changed their network and encryption protocols, or even traffic patterns to combat fingerprinting and this sort of blocking.
These providers, Nachreiner adds, will likely advertise evasive features to get past technical VPN blocking. “The VPNs that are easiest to block are, unfortunately, the most legitimate ones used by businesses or that have valuable privacy features for adults and children alike,” he says.
Pierre Noel, field chief information security officer at cybersecurity firm Expel, says VPN technology is also designed to blend in with normal internet traffic, which makes it difficult to detect or block. “VPNs are adept at masking themselves as standard web communications,” he says. “It will be challenging for the UK government to determine whether a connection is from a ‘legit’ originator or a minor trying to bypass age-verification controls.”
Digital rights campaigners have also questioned whether restricting VPNs would improve online safety. “There is little evidence that young people are using VPNs to bypass digital ID checks imposed by the Online Safety Act,” says James Baker, platform power programme manager at the Open Rights Group. “The government’s proposals to age gate them will have little impact on children’s online safety but will deter adults from using them or force people to hand over personal documents or biometric data to companies.”
The “Growing up in the online world” digital safety consultation will remain open until 26 May 2026, after which the government will review responses before deciding whether further action is needed.
For more, read our explainer on what a VPN is and what it does
