The statement
In a written statement to Parliament on July 15, 2026, Technology Secretary Liz Kendall closed the door on one of the most technically fraught ideas floated during the UK's rollout of the Online Safety Act's child-protection duties: restricting VPNs. "VPNs have legitimate privacy and security uses and we will therefore not age-gate or ban them," Kendall told MPs. Instead, she asked Ofcom to report by October 2026 on what "highly effective age assurance" looks like for determining whether someone is over 16, and — working with the Information Commissioner's Office where needed — to research what platforms themselves can do to detect and prevent VPN-based circumvention.
This matters because the VPN question had become the pressure point in the UK's age-assurance regime. The consultation behind this decision, Growing Up in the Online World, explicitly asked whether activating or purchasing a VPN should itself require age verification — a proposal that would have turned every UK internet user's privacy tool into a regulated product.
The steelman for restricting VPNs
Child-safety advocates have a genuine case here, and it deserves a fair hearing before dismissal. Ofcom's own July 16, 2026 statutory report on age assurance found that more than 69 million age checks were completed across regulated pornography, dating, and social media services in the second half of 2025 — a 23-fold jump from the prior six months — and that the share of children encountering "highly effective" checks rose from 25% to 43% over that period. If a meaningful slice of under-16s can simply route around that entire system with a free browser extension, the argument goes, the UK is spending enormous regulatory and compliance effort on a control that motivated teenagers can defeat in seconds. That is not a frivolous concern, and it is the reason VPN restrictions stayed on the table as long as they did.
Why the government backed off anyway
The government's own commissioned research undercuts the premise that VPNs are the primary failure mode. In the gov.uk study Children's Circumvention Behaviours Online, published alongside this statement, 26% of UK 11-17-year-olds report having ever used a VPN, and 39% say they have successfully bypassed an age check at least once. But when you look at how children who bypassed checks did it, VPNs are a minor contributor: 63% got through by simply lying about their age, while only 10% of all children used a location-changing tool of any kind. Just 22% of VPN-using children — 7% of all children surveyed — say they used one specifically to reach age-restricted content. The dominant weakness in the system is porous self-declaration and tick-box checks, not encrypted tunneling.
That data lines up with what the Age Verification Providers Association has called the "VPN fallacy" — the assumption that because circumvention tools exist, age-assurance law is unenforceable. UK and Australian regulators have separately found that weak verification methods, not VPN use, are the primary compliance gap: Ofcom's report criticized social media companies for failing to properly enforce even their own minimum-age rules, irrespective of VPNs.
Open Rights Group's technical case reinforces the practical problem with a ban. VPN functionality ships built into every major operating system; anyone can spin up a private VPN on a cloud server in minutes; and enforcement would require the kind of "intrusive traffic analysis" that undermines the privacy protections age assurance is supposed to preserve. A VPN restriction would burden the millions of adults who use VPNs for legitimate security — securing public Wi-Fi, protecting against harassment, reaching services while traveling — while remaining trivially evadable by the same technically fluent teenagers it targets.
The right call, with one caveat
Kendall's decision is the proportionate one: it targets the actual point of failure (weak, easily-gamed verification flows) rather than banning a general-purpose privacy tool because a minority misuse it. Punishing all UK VPN users for a circumvention pathway that gov.uk's own data shows is secondary to simple lying would have been regulatory overreach dressed up as child protection.
The caveat is what October's Ofcom report actually recommends. "What more services can do to detect and prevent VPN use on their platforms" could mean modest, proportionate signals — flagging inconsistent location and payment data for a stronger secondary check — or it could mean pushing platforms toward the same intrusive traffic-pattern detection ORG warns against, just relocated from state mandate to platform obligation. Ofcom folding this into the rapid assessment ahead of the under-16 social media ban raises the stakes further, since that assessment will shape binding regulations Kendall intends to introduce by year's end. The government was right not to ban VPNs outright; whether it holds that same proportionality line when platform-level enforcement design lands in October is the next test.