UK Rules Out Banning VPNs: Online Safety Act Consultation Results
After six months of public consultation, the UK government has delivered its verdict on one of the most debated questions around the Online Safety Act — the fate of VPNs. The result: the services stay unrestricted, while online platforms are told to police age-check bypassing themselves.
What happened
On March 2, 2026, the UK's Department for Science, Innovation and Technology (DSIT) launched a consultation on children's online safety. One question was blunt: should universal age verification be required to access VPN services themselves? The trigger was a sharp spike in VPN downloads right after the Online Safety Act's mandatory age checks kicked in for adult content.
On July 15, the government published its response. Social media got a default midnight-to-6am curfew for 16 and 17-year-olds, restrictions on autoplay and personalized recommendation feeds, and mandatory breaks for under-18s using AI chatbots — but VPNs were left alone. "VPNs have legitimate privacy and security uses and we will therefore not age-gate or ban them," said then-Technology Secretary Liz Kendall.
Why the government backed off
An independent study commissioned by the government looked at how children actually bypass age checks. The result: 26% of children said they'd used a VPN before, but only 7% did so specifically to reach age-restricted websites, apps, or games; just 10% used location-spoofing tools at all.
Cybersecurity experts interviewed by The Independent explained the technical side too: a VPN is designed specifically to blend in with ordinary traffic. Blocking "bad" providers without also hitting legitimate business traffic and ordinary privacy-conscious users is essentially impossible in practice — it would turn into an endless cat-and-mouse game, with providers changing protocols and encryption faster than regulators could react.
What happens now
The responsibility shifted from VPNs themselves to the platforms. Online services covered by the new rules (taking effect in early 2027) must take "robust" steps to detect and prevent age-check bypassing via VPN. Regulators Ofcom and the ICO were told to research VPN-detection methods and hold voluntary talks with providers. The government explicitly left the door open to revisit the policy if new evidence emerges — the topic isn't closed for good, but there's no outright ban.
What it means for users
This is another case — after the EU court's March ruling on the Anne Frank diary (see our earlier coverage) — of a government body publicly affirming VPNs as a legitimate privacy tool rather than a gray area. At the same time, the push to detect VPN traffic isn't going away: platforms will keep trying harder. For everyday users, that's one more reason to pick a service with an honest logging policy, clear jurisdiction, and its own servers — not a free proxy of unclear origin.