The UK government has decided against restricting virtual private networks (VPNs) after its own research found that most children use them for privacy rather than to bypass age checks, with ministers instead placing greater responsibility on online platforms to enforce age assurance.
Why VPNs Came Under Scrutiny
The issue arose as the UK rolled out tougher online safety rules requiring websites and apps hosting adult content to introduce stronger age verification. Some campaigners argued that children could simply use VPNs to disguise their location or identity and bypass those checks, prompting calls for restrictions on VPN services themselves.
However, the government decided to investigate how children were actually circumventing age restrictions before introducing any new controls, commissioning research to understand how VPNs were being used in practice.
Why The Government Changed Course
The decision follows research commissioned by the Department for Science, Innovation and Technology (DSIT) into how children use VPNs and attempt to bypass online age restrictions. The findings challenged one of the key assumptions behind proposals to limit VPN use.
The nationally representative study of more than 2,000 children aged 11 to 17 found that around a quarter (26 per cent) had used a VPN. However, privacy was the most common reason for doing so, with 30 per cent of VPN users saying they used one to keep their online activity private. Just 22 per cent of VPN users, equivalent to around 7 per cent of all children surveyed, said they used a VPN specifically to access age-restricted websites, apps or games.
By comparison, the research found that pretending to be older was a far more common way of bypassing age checks. Among children who had successfully circumvented age verification, 63 per cent said they had done so by posing as someone older, most commonly by entering a false date of birth.
Privacy Versus Circumvention
The findings appear to have played a significant role in shaping government policy. Online Safety Minister Kanishka Narayan confirmed the decision while speaking on BBC Breakfast, saying: “We decided not to limit VPNs.”
Technology Secretary Liz Kendall reinforced that position in a written ministerial statement, explaining that VPNs have “legitimate privacy and security uses” and confirming that the government would not seek to age-gate or restrict access to them.
The research also highlighted how widely privacy is valued by younger internet users. Overall, 86 per cent of children surveyed said it was important that their online activity remained private, while 81 per cent of VPN users said using one made them feel safer online.
Responsibility Moves To Online Platforms
Rather than restricting privacy tools themselves, the government has decided that online platforms should bear greater responsibility for preventing children from getting around age assurance requirements.
Under the new approach, platforms will be expected to take “robust steps” to detect and prevent under-age users circumventing age checks. Ofcom has been asked to report by October on what robust age assurance should look like for older teenagers, while Ofcom and the Information Commissioner’s Office will also examine how platforms can better identify attempts to use VPNs to bypass age restrictions.
The government has also said it intends to engage directly with VPN providers about possible voluntary measures while keeping the issue under review.
A Win For Privacy Campaigners
The decision has been widely welcomed by digital rights organisations and cyber security experts, many of whom had argued that restricting VPNs would have created far wider problems than it solved.
VPNs are widely used by businesses to secure remote access to company systems, protect sensitive communications, encrypt internet traffic on public Wi-Fi and help safeguard employees travelling internationally. They are also commonly used by journalists, activists, researchers and individuals seeking greater online privacy.
The government’s own research supports that broader picture. Many children reported using VPNs for reasons unrelated to age-restricted content, including accessing services available in other countries, protecting their personal information and improving online privacy.
The findings suggest that attempting to restrict VPNs would have affected many legitimate users while doing relatively little to prevent children bypassing online age restrictions.
What Does This Mean For Your Business?
For businesses, the government’s decision provides welcome certainty that VPNs continue to be recognised as legitimate cyber security tools rather than technologies primarily associated with bypassing online controls.
The wider lesson extends beyond VPNs themselves. As governments introduce new AI, online safety and digital regulation, there is growing recognition that effective policy needs to be evidence-led rather than based on assumptions about how technology is used. In this case, the government’s own research showed that privacy, not circumvention, was the main reason children were using VPNs.
Organisations should therefore continue encouraging the appropriate use of VPNs as part of a wider cyber security strategy, particularly for remote working and secure communications. At the same time, businesses that provide online services should expect increasing scrutiny over how they verify users’ ages and prevent circumvention, as regulators place greater responsibility on platforms rather than on the privacy technologies that many legitimate users rely upon.
