A landmark piece of legislation that could reshape how VPNs are used in the United Kingdom has become law. The Children’s Wellbeing and Schools Act 2026 received Royal Assent on 29 April 2026, granting the Secretary of State sweeping new powers to restrict children’s access to internet services — including, potentially, Virtual Private Networks. With the government’s public consultation on VPN age restrictions closing on 26 May 2026, UK VPN users have just weeks to make their voices heard.
What the New Law Actually Does
The Children’s Wellbeing and Schools Act 2026 (CWSA) is a wide-ranging piece of legislation covering everything from free school breakfast clubs to children’s social care. But buried within its online safety provisions is a clause that has significant implications for every VPN user in the UK.
The Act inserts a new section — s.214A — into the Online Safety Act 2023, granting the Secretary of State the power to:
- Prevent “relevant children” from accessing specified internet services or their functionalities
- Restrict children’s access to specific features of online services
- Amend the age of digital consent from the current 13 years old to anywhere between 13 and 16
Crucially, the Act does not ban VPNs outright — not for adults, and not even for children yet. What it does is create the legal framework for the government to act swiftly once the ongoing consultation concludes. Parliamentary Under-Secretary of State Olivia Bailey confirmed during the April 27 Commons debate that “under any outcome we will impose some form of age or functionality restriction for children under 16.”
The bill’s final parliamentary stages were dramatic. The legislation ping-ponged between the Commons and Lords four times in April alone, with the House of Lords repeatedly pushing for a harder social media ban for under-16s. The Commons ultimately backed the government’s more flexible approach — granting ministers powers to act, rather than mandating a specific ban in the legislation itself.
The VPN Consultation: Three Weeks Left to Respond
Running in parallel with the new Act is the government’s “Growing Up in the Online World” consultation, launched on 2 March 2026 by the Department for Science, Innovation and Technology (DSIT). This consultation closes on 26 May 2026 — just three weeks away — and directly asks the public about VPN restrictions.
The consultation poses pointed questions, including:
- Which tools are children currently using to bypass online safety rules?
- Should the government restrict children’s access to VPNs, or focus on education instead?
- Should everyone be required to pass an age check to access a VPN, if it prevents children from using them?
- How could age checks on VPNs be made technically workable?
The backdrop to all of this is a surge in VPN usage that followed the Online Safety Act’s age verification requirements coming into force on 25 July 2025. Daily active VPN users in the UK temporarily doubled — from around 650,000 to over 1.4 million — as people sought to bypass mandatory age checks on adult websites and social media. Ofcom, the UK’s communications regulator, has been monitoring this trend using a third-party tool and reported that usage later stabilised at around 980,000 daily users by the end of 2025. Notably, Ofcom’s own research suggests that only one in ten VPN users is a child.
Background: How Did We Get Here?
The push to regulate VPNs for children has been building since the Online Safety Act came into force. In January 2026, the House of Lords passed an amendment to the Children’s Wellbeing and Schools Bill — backed by 207 votes to 159 — that would have directly prohibited VPN providers from offering services to under-18s. That amendment, championed by Lord Nash and supported by campaigners including actor Hugh Grant, was ultimately rejected by the Commons, but it set the tone for the debate.
The government’s position has consistently been that it does not want to ban VPNs for adults. A DSIT spokesperson stated that the consultation is designed to ensure any measures are “targeted and proportionate” and that the government recognises VPNs serve legitimate purposes, including protecting privacy and security online.
However, critics remain unconvinced. Wikipedia co-founder Jimmy Wales called the proposals “an embarrassment,” while digital rights group Big Brother Watch described them as a “draconian crackdown.” Cybersecurity experts have warned that enforcing VPN restrictions would be technically extremely difficult — potentially requiring deep-packet inspection technology similar to China’s “Great Firewall” — and that the VPNs easiest to block are often those with the strongest privacy protections for legitimate users.
What This Means for UK VPN Users
For the millions of UK adults who use VPNs for entirely legitimate reasons — protecting their privacy on public Wi-Fi, accessing geo-restricted content, securing remote work connections, or shielding their browsing from ISP data retention under the Investigatory Powers Act — the Children’s Wellbeing and Schools Act 2026 raises serious questions.
In the short term, nothing changes. VPNs remain completely legal in the UK, and no new restrictions are in force. The Act simply creates the powers; the regulations that would actually implement any restrictions must still be developed, consulted upon, and approved by Parliament.
The government has set itself a tight timeline: a statutory progress report must be presented to Parliament by 29 July 2026, and any regulations must be laid before Parliament by 29 July 2027 at the latest. Ministers have indicated they want to move faster, aiming to lay regulations by the end of 2026.
The most likely outcome, based on the consultation questions and government statements, is age verification requirements for VPN providers — meaning users would need to prove they are adults before accessing a VPN service. This would represent a fundamental change to how VPNs operate, potentially requiring users to submit ID documents or biometric data, and would undermine the anonymity that makes VPNs valuable in the first place.
There are also practical concerns for specific groups:
- Remote workers: Corporate VPNs are explicitly outside the scope of the proposed restrictions, but the line between consumer and business VPN use is not always clear.
- Privacy-conscious users: Any mandatory age check creates a data trail — the very thing VPN users are often trying to avoid.
- Vulnerable individuals: Campaigners have warned that mandatory ID requirements could put transgender people, domestic abuse survivors, and human rights activists at risk.
- Travellers: UK residents using VPNs abroad, or visitors using UK-based VPN services, could face unexpected complications.
If you want to influence the outcome, the government’s consultation is open until 26 May 2026. You can respond directly via the DSIT consultation page on GOV.UK. Digital rights organisations including the Open Rights Group and Big Brother Watch have published guidance on how to respond.
The Road Ahead
The Children’s Wellbeing and Schools Act 2026 marks a significant moment in UK internet regulation. For the first time, a sitting government has the legal tools to restrict access to VPNs — even if it has not yet chosen to use them. The next few months will be critical: the consultation closes in May, Ofcom is due to publish a report on age assurance effectiveness in June 2026, and the government has promised a “clear position before the summer.”
Whether that position will protect the privacy of the UK’s estimated 47% of adults who have used a VPN, or prioritise child safety measures that critics say are technically unenforceable, remains to be seen. What is certain is that the legal landscape for VPN use in the UK has changed — and the debate is far from over.
Sources: UK Parliament — Children’s Wellbeing and Schools Act 2026; Two Birds Law — Royal Assent Analysis; Hansard — Commons Debate, 27 April 2026; TechRadar — VPN Consultation Coverage; Digital Watch Observatory
