The UK’s Online Safety Act has triggered one of the most dramatic surges in VPN adoption ever recorded in Britain. Within minutes of the law’s age verification provisions taking full effect, VPN providers reported sign-up spikes of up to 1,800% from UK users — a clear signal that millions of Britons are turning to privacy tools to navigate the new digital landscape.
What Happened: Age Verification Goes Live
The Online Safety Act, which received Royal Assent in October 2023, requires websites hosting adult content to implement “highly effective” age verification checks before granting access. After a phased rollout throughout 2024 and 2025, the enforcement deadline arrived on 25 July 2025, with Ofcom — the UK’s communications regulator — gaining full powers to fine non-compliant platforms up to £18 million or 10% of worldwide revenue.
The methods platforms are using to verify age vary widely and have proved deeply controversial. Users are being asked to submit government-issued photo ID, take selfies for AI-powered facial age estimation, provide credit card details, or consent to checks via their mobile network operator. For many, handing over such sensitive personal data to dozens of websites felt like an unacceptable privacy trade-off — and they responded by downloading VPNs in record numbers.
Proton VPN reported a sustained surge of 1,400–1,800% in UK sign-ups, with its app briefly becoming the number-one free download on the UK Apple App Store. NordVPN confirmed a 1,000% spike in purchases from British users. Windscribe and AdGuard VPN also reported major increases. Sensor Tower data showed that VPN downloads on iOS in the UK grew an average of 100% day-over-day in the four days following the law’s implementation, with five VPN apps breaking into the top 10 on the UK App Store.
Why Britons Are Reaching for VPNs
The appeal of a VPN in this context is straightforward: by routing internet traffic through a server in another country, a VPN masks a user’s UK IP address, making it appear as though they are browsing from a jurisdiction where the age verification requirements do not apply. This allows adults to access content without submitting personal documents to third-party verification services.
Privacy advocates argue this response is entirely rational. Centralising sensitive identity data — passports, driving licences, facial scans — across hundreds of websites creates significant data breach risks. The Open Rights Group and other digital rights organisations have long warned that the age verification regime, however well-intentioned, creates a surveillance infrastructure that could be exploited or misused.
It is worth noting that using a VPN to bypass age verification is currently legal in the UK. The Online Safety Act targets platforms that host content, not individual users who choose to access it. Ofcom has confirmed it has no powers to prosecute individuals for using VPNs, though it has warned that children who bypass age checks via VPNs would not benefit from the Act’s child safety protections.
Parliament Debates the VPN Question
The scale of the VPN surge has not gone unnoticed in Westminster. In January 2026, the House of Lords voted to include a provision in the Online Safety Act that would ban VPN providers from offering services to under-18s in the UK. More significantly, on 2 March 2026, the UK government launched a consultation titled Growing Up in the Online World, which explicitly asks whether universal age checks should be required to access VPN services themselves.
The proposal has drawn fierce criticism from cybersecurity experts, civil liberties groups, and the technology industry. Critics point out that requiring VPN providers to verify the age of all UK users would be technically complex, potentially unenforceable for overseas providers, and would undermine the legitimate privacy and security uses of VPNs — including by journalists, activists, remote workers, and businesses. Peter Kyle MP, the minister responsible for technology policy, has stated that the government has “no plans to ban VPNs,” though the consultation suggests the question remains live.
Corporate VPNs used for business remote access are explicitly exempt from any proposed age verification requirements, a distinction that has highlighted the challenge of crafting legislation that targets consumer use without disrupting enterprise security infrastructure.
What This Means for UK VPN Users
For UK residents, the Online Safety Act’s age verification regime represents a significant shift in how the internet works in Britain — and VPNs have moved from a niche privacy tool to a mainstream consumer product almost overnight. Here is what you need to know:
- VPN use remains legal. Adults in the UK are free to use VPNs to protect their privacy online, including to access content without submitting personal data to age verification systems.
- Choose a reputable, paid VPN. The surge in demand has also driven downloads of free VPN apps, many of which have poor security practices and may log or sell user data. Security researchers have warned that some free VPNs act as data brokers. Established providers with clear no-logs policies — such as Proton VPN, Mullvad, or ExpressVPN — are far safer choices.
- Watch the parliamentary debate. The government consultation on VPN age verification closes in mid-2026. If you rely on a VPN for privacy or security, it is worth following this debate closely and considering responding to the consultation.
- Understand the limits. A VPN protects your IP address and encrypts your traffic, but it is not a complete privacy solution. Ensure your chosen provider does not keep connection logs and is based in a jurisdiction with strong privacy laws.
The broader picture is one of a government grappling with the unintended consequences of internet regulation. The Online Safety Act was designed to protect children from harmful content — a goal few would dispute. But its implementation has accelerated VPN adoption on a scale that may ultimately make parts of the law harder to enforce, while simultaneously pushing millions of users towards privacy tools they may not fully understand.
As the EU prepares to introduce its own age verification framework in 2026, the UK’s experience is being watched closely by policymakers and digital rights advocates across Europe. Britain has, perhaps inadvertently, become a live experiment in what happens when a democratic government tries to regulate online content — and its citizens push back with technology.
Sources: WIRED | TechRadar | Cybernews | BankInfoSecurity | PPC.land
