On June 21, 2026, Science and Technology Secretary Liz Kendall told BBC Breakfast: "We will make further statements in July about VPNs and further restrictions." The announcement came days after the government unveiled an Australia-style social media ban for under-16s, bundled with promises of overnight curfews for 16-17-year-olds and new chatbot restrictions. The VPN comment was brief. Its significance is not. For months, the UK has been building a legislative architecture capable of restricting children's access to entire categories of internet infrastructure. July's statement will reveal whether ministers intend to use it.
What Parliament Actually Agreed
The Children's Wellbeing and Schools Act 2026 is the centrepiece. It bans named platforms — Snapchat, TikTok, YouTube, Instagram, Facebook, and X — from offering services to under-16s, with implementation expected in Spring 2027. But embedded in the Act, at Section 70, is a broader discretionary power: ministers can restrict children's access to any specified internet services via secondary legislation, without requiring new primary legislation, and without being required to demonstrate harm to children before acting.
The Lords had tried something more direct. On January 21, 2026, the House of Lords passed Amendment 92 to the bill, which would have required the Secretary of State to prohibit VPN providers from offering services to UK children within 12 months of the Act passing. An outright ban. On March 9, 2026, the House of Commons voted 321-106 to reject that amendment. The government's stated rationale: it did not want to pre-empt an ongoing consultation on how children actually use VPNs. But rather than removing the ministerial power, the final Act retained Section 70's broad discretionary reach.
The result is an unusual legislative architecture: Parliament explicitly rejected a hard VPN ban, yet left ministers with the power to impose one by secondary legislation — with less parliamentary scrutiny than the rejected amendment would have received. A government consultation closed on May 26, 2026. Ofcom's statutory age-assurance report is due in late July. Kendall's July statement lands in the same window.
The Case Ministers Will Make
The circumvention concern is genuine and deserves a straight hearing. Within days of the social media ban announcement, UK searches for VPNs surged 165 percent. Children do use VPNs to bypass age verification and geographic blocks. Kendall herself acknowledged on BBC Breakfast: "Many people want to use VPNs for privacy — that is important — but we know that some children use them to get around restrictions." The government's decision to commission evidence before legislating is, in principle, procedurally sound, and public appetite for firm action is real: nine in ten UK parents backed the social media ban in government consultations.
A government that had built robust age verification infrastructure and found VPNs systematically undermining it at scale would have legitimate grounds for targeted remedies. That is the strongest version of the argument for action.
Why Blanket Restriction Would Fail
The problem is that Section 70 does not require targeting. The Open Rights Group, responding to the March 2026 vote, warned that the ministerial power could be used to ban children from "any other website or online services" of a government's choosing — without requiring proof of harm first. Its campaign director, James Baker, described it as handing ministers authority to restrict the internet wholesale, bypassing both Parliament and Ofcom.
Any VPN restriction aimed at under-17s would face two compounding failures. First, enforcement: thousands of VPN providers operate globally, the vast majority beyond UK jurisdiction. Blocking known VPN IP address ranges — the mechanism available to ISPs — is a game of whack-a-mole that determined teenagers routinely win. Australia imposed its social media ban; two-thirds of Australian teens reportedly continue accessing restricted platforms through workarounds. If that pattern holds for VPNs, ministers would have built expensive surveillance infrastructure achieving near-zero effect.
Second, collateral damage. VPNs are foundational tools for journalists, corporate security teams, remote workers, and LGBTQ+ young people navigating hostile domestic environments. The Electronic Frontier Foundation has argued there is no reliable, privacy-preserving method of age-verifying VPN users — any age check requires collecting identity data from all users, adult and minor alike, before the minor can be excluded. The UK's age verification industry remains unregulated; over 400 security and privacy academics have called for a moratorium on age assurance deployment pending scientific consensus on its feasibility. Requiring adults to submit biometric or identity data to unaccountable third-party providers, as the price of accessing privacy infrastructure, is a significant and largely unremarked departure from the UK's internet policy baseline.
What Proportionate Regulation Looks Like
The sequencing matters. Ofcom's statutory age-assurance report, due late July 2026, will set out evidence on what age verification achieves, where it fails, and where VPN circumvention is a systematic problem versus a residual one that tightens as platform-level enforcement matures. No secondary VPN legislation should precede that evidence base.
Proportionate action would target obligations at platforms — requiring effective age verification at the service level, with circumvention addressed through platform technical countermeasures — rather than treating VPN infrastructure as the primary threat. Any Section 70 restrictions should carry sunset clauses, require Ofcom to certify demonstrated harm before regulations are laid, and face affirmative rather than negative parliamentary procedure, so that MPs actually vote on specific measures rather than simply fail to object within a deadline.
The July Test
The real question July's statement must answer is not whether the government acts on VPNs, but how. Secondary legislation with broad scope and minimal scrutiny would establish a governance precedent — restrict internet infrastructure by decree, harm threshold optional — that future governments could apply far beyond child safety. A targeted, evidence-grounded approach subject to Ofcom oversight and parliamentary affirmation would show that Section 70's power can be used carefully.
Liz Kendall told BBC Breakfast the balance involved is "really important." In July, the UK public will find out whether she means it.