In a significant decision for privacy advocates, the UK government has announced that it will not pursue a ban or age restrictions on virtual private networks (VPNs). This move follows extensive public consultation and a growing spotlight on online safety concerns, particularly in light of the Online Safety Act introduced last year. As VPN usage surged, the government explored the implications of age verification on these tools, ultimately opting to uphold their legitimate use.
Consultation and Response
The discussion around potentially banning or restricting VPNs gained traction in March, spurred by a rise in their downloads after age verification measures were implemented for adult websites. The Department for Science, Innovation and Technology launched a public consultation aimed at understanding the implications of such actions on user privacy and security.
The consultation sought input on various topics, including the necessity of an age limit for social media platforms, features that might promote excessive use among minors, and whether age verification should extend to VPN services. The objective was to assess how children might circumvent online safety protocols and the effectiveness of potential restrictions.
On 15 July, the government released its response, unveiling a suite of online safety initiatives designed to protect children. These included a midnight-to-6am social media curfew for 16 and 17-year-olds, restrictions on autoplay and personalised recommendation features, and mandatory breaks for users under 18 engaging with AI chatbots. Notably, however, VPNs were not included in these restrictions.
The Government’s Stance
“VPNs have legitimate privacy and security uses and we will therefore not age-gate or ban them,” stated then-Technology Secretary Liz Kendall. Despite this affirmation, the government has mandated that platforms implement robust measures to prevent underage users from using VPNs to bypass age verification when the new regulations take effect in early 2027.
A government-commissioned independent study revealed minimal evidence that children were using VPNs to evade age checks. While 26% of surveyed children had used a VPN, only 7% admitted to doing so for accessing age-restricted content, with just 10% employing location-altering tools to circumvent age verification.
Challenges of Enforcement
Cybersecurity experts have raised concerns about the practicality of restricting VPN use. Corey Nachreiner, Chief Security Officer at WatchGuard Technologies, highlighted the difficulties in enforcing such restrictions. “While you might compel ‘friendly’ VPN providers based in UK-partner countries to comply, many VPNs operate globally, particularly in jurisdictions that are less straightforward to regulate,” he explained.
Nachreiner further cautioned that any attempts to block VPNs could lead to an ongoing struggle as providers adapt their technologies to avoid detection. “The VPNs easiest to block are often the most legitimate, used by businesses and individuals who value privacy,” he added.
Pierre Noel, Field Chief Information Security Officer at Expel, echoed these sentiments, noting that VPNs are designed to blend seamlessly with standard internet traffic, complicating efforts to identify their use. “It would have been a challenge for the UK government to ascertain whether a connection originates from a legitimate user or a minor attempting to bypass age-verification controls,” he stated.
Ongoing Review and Future Steps
In light of these complexities, the government has tasked Ofcom to collaborate with the Information Commissioner’s Office to explore further strategies for identifying VPN use. They will also engage with VPN providers to encourage voluntary measures aimed at ensuring compliance and safeguarding minors. The government has indicated that it will keep the situation under review and may introduce additional actions if new evidence warrants it.
Why it Matters
The decision to forgo a VPN ban is a victory for privacy advocates and users who rely on these tools for secure and confidential internet access. In an age where online safety is paramount, this move recognises the legitimate uses of VPNs while also committing to the protection of children online. As the digital landscape continues to evolve, balancing privacy rights and safety regulations will remain a critical challenge for governments worldwide.