The UK government has confirmed that it will not introduce age restrictions or other limits on access to VPN services, following concerns that the measures could weaken online privacy and cybersecurity.
The decision represents a significant change of direction. Earlier in 2026, the government said it was considering options to restrict children’s access to virtual private networks when VPNs were used to bypass online safety measures.
However, Online Safety Minister Kanishka Narayan has now stated: “We have decided not to limit VPNs.”
Technology Secretary Liz Kendall also confirmed the decision in Parliament, recognising that VPNs have legitimate privacy and security uses. Instead of regulating VPN providers directly, the government intends to place responsibility on social media platforms to prevent children from evading their age checks.
Why Was the UK Considering VPN Age Verification?
The proposed restrictions formed part of a wider government effort to prevent children from accessing inappropriate online content.
Under the Online Safety Act, websites and online platforms that publish pornography or other potentially harmful material must use “highly effective” age-assurance systems. These requirements led to a sharp increase in UK interest in VPNs after major age-verification provisions took effect in July 2025.
A VPN can conceal a user’s real IP address and make it appear that they are connecting from another country. This means someone in the UK may be able to avoid a website’s UK-specific age checks by connecting through a server overseas.
The issue became more politically important when the government announced plans to prevent children under 16 from using certain social media services from spring 2027. Ministers were concerned that children might use VPNs to get around the proposed social media restrictions.
In February 2026, the government said it was examining options to “age restrict or limit children’s VPN use” where VPNs undermined online safety protections.
An amendment proposed during the passage of the Children’s Wellbeing and Schools Bill would have gone further. It called on the government to prohibit the provision to children of VPN services that could facilitate the evasion of Online Safety Act age gates.
This raised the possibility that VPN providers could be required to verify a customer’s age before allowing them to use their services.
Why Did the Government Change Its Mind?
The government’s decision appears to have been influenced by evidence showing that VPNs are used for many legitimate reasons—and that avoiding age checks is not the main reason most children use them.
Government research into children’s online circumvention behaviour found that privacy and security were important motivations for VPN use. Only around one-fifth of children who used VPNs said they had used them to bypass age checks, equivalent to approximately 7% of children overall.
Responses to the government’s online safety consultation also warned that VPN age restrictions could:
- Push users towards unsafe or unregulated VPN services
- Place smaller VPN providers at a disadvantage
- Reduce competition in the VPN market
- Make legitimate privacy and security tools harder to access
- Create additional data-collection risks through mandatory age checks
The government’s consultation summary acknowledged these concerns, including the danger that restrictions could drive people towards less trustworthy alternatives.
Privacy organisations and VPN providers had also strongly opposed the proposal. Mozilla warned that age-restricting VPNs could undermine the privacy and security of all users while failing to protect children effectively.
VPNs Will Remain Legal and Accessible in the UK
For UK internet users, the most important point is that there are currently no plans to require age verification before purchasing or using a VPN.
VPN services remain legal in the UK, and adults and children will continue to be able to download and use them.
However, that does not mean VPNs are completely unaffected by the Online Safety Act.
Government guidance already states that platforms have a responsibility to stop children from bypassing safety protections. Content that specifically encourages young people to use VPNs or other tools to evade age checks may therefore be restricted or subject to enforcement action.
There is an important distinction between:
- Using a VPN for privacy, security, remote work, travel or access to services while abroad
- Deliberately promoting VPNs to children as a way to bypass legally required safety systems
The first remains lawful. The second may attract regulatory scrutiny.
Social Media Platforms Will Be Expected to Detect Circumvention
Rather than forcing VPN providers to identify or age-check their customers, the government plans to make online platforms improve their own systems.
Social media companies are likely to be expected to detect when users are attempting to bypass age restrictions, including through location-masking technologies.
Ofcom and the Information Commissioner’s Office are due to examine possible enforcement and detection methods. The government is also expected to speak with VPN companies about voluntary measures and tools that could help parents manage their children’s internet access.
The details will matter. Attempts to detect VPN connections can produce false positives, particularly because businesses, universities, security-conscious individuals and remote workers routinely use VPNs for legitimate purposes.
Blocking every connection associated with a data centre or VPN server would risk preventing genuine users from accessing ordinary online services.
A Victory for Online Privacy
The decision is good news for privacy-conscious internet users.
Requiring VPN companies to perform age checks would have created a serious contradiction: people often use VPNs to reduce the amount of personal information they expose online, yet they might have been required to provide personal information before accessing the privacy tool itself.
Depending on the system used, age verification can involve facial-age estimation, identity documents, mobile-network records or financial information. Even when the VPN provider does not receive the underlying identity data, users must trust another company to process it securely.
It would also have been difficult to apply the rules consistently. Established VPN providers might have complied, while lesser-known overseas services, browser extensions and self-hosted VPN tools remained readily available.
The result could have been that responsible users faced additional checks while determined teenagers simply moved to less secure services.
Could the Government Revisit VPN Restrictions?
The immediate threat of mandatory VPN age verification appears to have receded, but the wider debate is unlikely to disappear.
The effectiveness of the planned under-16 social media ban will be closely examined after it comes into force. If large numbers of children manage to bypass it, ministers could face renewed calls to regulate circumvention tools.
The government has nevertheless made a clear public commitment not to limit VPN access under its present plans. Reversing that position would require another substantial policy change and would probably face strong opposition from privacy groups, cybersecurity professionals and the VPN industry.
For now, the UK has chosen the more proportionate approach: regulate the platforms responsible for enforcing age restrictions without making millions of legitimate VPN users surrender more personal information.
What This Means for UK VPN Users
UK residents can continue using VPNs for legitimate purposes, including:
- Protecting internet traffic on public Wi-Fi
- Reducing tracking by websites and internet providers
- Securing remote-working connections
- Accessing UK services while travelling abroad
- Preventing websites from seeing their normal IP address
- Connecting safely to networks in other countries
The government’s U-turn does not remove the Online Safety Act’s existing age-verification requirements for adult websites, nor does it cancel the planned restrictions on social media use by children.
It does, however, mean the government has stepped back from placing an age gate in front of the privacy tools themselves.
That is a welcome outcome for UK internet freedom—and an acknowledgement that protecting children does not have to mean weakening everybody else’s privacy and security.
