The UK abandons its plan to impose restrictions on VPNs.

      The UK appeared poised to impose stricter regulations on VPNs as part of its effort to enhance online safety for children. However, it has since reconsidered, citing its own research as the driving factor behind this change.

      Online Safety Minister Kanishka Narayan stated clearly on the BBC, “We decided not to limit VPNs.” A VPN conceals the true location of a user, allowing some to bypass age verification systems.

      This decision coincides with the introduction of a new midnight social media restriction for 16 and 17-year-olds, confirmed by Technology Secretary Liz Kendall in a written announcement, where she acknowledged that VPNs serve "legitimate privacy and security uses."

      What the research revealed

      The government had commissioned a survey of over 2,000 children, which revealed data that undermined the justification for a ban. Approximately one-quarter of 11 to 17-year-olds reported having used a VPN, primarily for privacy purposes rather than to circumvent rules.

      Only about 7% of children turn to VPNs to access age-restricted content; many more simply provide false information. Nearly half of those who evade age checks do so by entering an inaccurate date of birth, indicating that VPNs are not the primary method of bypassing restrictions.

      Shifting responsibility to platforms

      Instead of regulating VPNs, the government is placing the onus on platforms to ensure compliance. They are now tasked with implementing “robust steps” to identify and prevent underage users from evading age checks.

      Ofcom is set to report by October on what constitutes a credible over-16 age verification process. Additionally, the government has asked it, in collaboration with the data regulator, to explore how platforms can improve their detection of VPN usage. Ministers will also engage with VPN providers regarding possible voluntary measures and plan to “monitor this area closely.”

      A victory for privacy advocates

      This change represents a notable victory for digital rights organizations. A coalition of over 20 tech companies and activists, including Proton and Mozilla, had urged government officials to refrain from restricting VPNs. Mozilla cautioned that age-gating VPNs would lead to cybersecurity issues without effectively safeguarding children.

      Not everyone believes the broader strategy will succeed. Critics point out that the curfew and feature limites can be easily disabled, leaving a significant loophole—the government is, as one analyst remarked, “leaving the side door open.”

      This decision contrasts with global trends, especially as the UK prepares to implement a ban on social media for those under 16, while Australia’s adolescent restrictions have faced challenges due to VPN circumvention, and New Zealand has recently abandoned its plans for limitations. Even US courts are grappling with the complexities of regulating age verification on the internet. For the moment, Britain has opted for an evidence-based approach over a universal ban.