Articles / Privacy Law

930 words

  • uk-law
  • vpn
  • ad-blockers
  • pecr
  • uk-gdpr
  • computer-misuse-act

Can a Website Legally Block You for Using a VPN or Ad Blocker?

Yes, in almost every case. A website is a private service, and nothing in UK legislation that I know of stops its owner refusing visitors who use a VPN or block adverts. The interesting questions are around the edges: how the site detects you, what you agreed to, and what happens if you work around the block.

This is general information, not legal advice. Where something is my reading rather than settled law, I say so.

The default: a site can refuse anyone it likes

There is no right of access to a website. A site can say "no VPNs", "disable your ad blocker to continue" or "UK visitors only", and it is not breaking any statute by doing so. Being blocked is not, by itself, a legal wrong.

Discrimination law does not change that. The Equality Act 2010 protects specific characteristics such as disability, race and sex. "Uses a VPN" and "runs uBlock Origin" are not on the list. A block could become a problem if it hits a protected group in a way the site cannot justify, but that is a stretch for an ordinary VPN rule.

How sites actually spot you

VPN detection is guesswork based on the IP address. Sites buy reputation lists, check whether the address belongs to a datacentre network, or notice that hundreds of accounts share one address.

Ad-blocker detection is more direct. A typical script adds a bait element or requests a known ad URL, then checks whether it vanished or failed:

const bait = document.createElement("div");
bait.className = "adsbox ad-banner";
bait.style.height = "1px";
document.body.appendChild(bait);

// Cosmetic filters usually hide or remove the element.
const blocked = bait.offsetHeight === 0 || !document.body.contains(bait);
bait.remove();
if (blocked) showAdblockWall();

That script reads state from your browser. Hold that thought, because it matters for PECR below.

Quick detour: why VPN blocking catches innocent people

Hang on, this bit is genuinely daft. Many home broadband customers sit behind carrier-grade NAT, so dozens of households share one public IPv4 address. To a reputation system that looks exactly like a VPN exit.

The same goes for corporate gateways, university networks and Tor. A "no VPN" rule often blocks people who have never heard of a VPN, and the site has little legal duty to care.

Where the law does bite

Contract and consumer law

If you are a paying customer, the terms matter. Blocking you mid-subscription for something the terms never prohibited could be a breach of contract. A term that lets the provider cut you off for any reason, with no refund, could be challenged as unfair under Part 2 of the Consumer Rights Act 2015. How that plays out depends on the wording and the facts.

For a free site, there is usually no contract to breach in any useful sense.

PECR and ad-blocker detection

Regulation 6 of the Privacy and Electronic Communications Regulations 2003 restricts storing information on, or gaining access to information stored in, a user's device, unless the user consents or an exemption applies. A script that probes your browser to find out whether you block ads arguably falls within that wording.

Whether it does is contested. I am not aware of a UK court or ICO decision that settles it, and recent changes to the PECR exemptions (from the Data (Use and Access) Act 2025) do not obviously cover detection for advertising revenue. Treat it as an open argument, not a rule.

UK GDPR and IP addresses

An IP address is usually personal data, so blocking by IP is processing. A site would normally rely on legitimate interests, such as fraud prevention and security, which UK GDPR recognises. That is a low bar for a simple block.

Article 22 (automated decisions with legal or similarly significant effects) is unlikely to apply to being refused a news article. It could matter more if an automated VPN flag locked someone out of a bank account.

Working around a block: the Computer Misuse Act question

Ad blocking is you controlling your own browser. I see no credible offence there.

Switching IP address after a site has explicitly banned you is murkier. Section 1 of the Computer Misuse Act 1990 covers unauthorised access, and a site could argue that a deliberate ban withdrew your authorisation. I know of no UK prosecution on those facts, and in practice this ends in an account closure, not a criminal case. Even so, "I used a VPN to dodge a ban" is not a position I would want to test.

Using a VPN to get around a geoblock on a streaming service is normally just a breach of terms, which is a civil matter between you and the provider.

The Online Safety Act twist

Age checks changed the mood. Services under the Online Safety Act must protect children, and Ofcom's guidance expects them to consider how children might evade age assurance. That is a duty on services, not an offence for users: using a VPN is still lawful.

Some platforms now treat VPN traffic as a signal to ask for extra age checks. That is a business choice, not something the Act obviously requires of every site.

What you can do if it bothers you

  • Ask the site what data it collected to reach the decision, using a subject access request.
  • For a paid service, read the terms, then complain in writing and ask for a refund if the block was not allowed for.
  • If an ad-block wall seems to run tracking or detection scripts before you have consented, you can raise it with the ICO.
  • Otherwise, leave. Plenty of sites accept that readers have ad blockers, and the block is often a sign of what the site thinks of its audience.
← All articles