17.4 Threats to VPNs and circumvention

Status reviewed 1 September 2026. VPN use remains legal in the UK. In its July response to the children's online-safety consultation, the government said it would not ban or age-gate VPNs. Instead it asked Ofcom to research how in-scope services can detect and mitigate circumvention, called for engagement with VPN providers, and kept possible further action under review.

Why VPNs became a talking point

For most of their history, virtual private networks were a quiet, ordinary tool, used by:

• remote workers reaching office systems;
• travellers on hotel Wi-Fi;
• privacy-conscious people keeping their browsing from their internet provider.

Hardly anyone in politics noticed them. That changed in July 2025, when the Online Safety Act's age-check requirements took effect and VPN apps shot to the top of the UK download charts almost overnight.

Because a VPN makes your connection appear to come from another country, many UK-specific age gates simply do not appear. Large numbers of adults reached for one rather than upload identity documents to view legal content.

That visible surge made circumvention a policy issue. The government's Growing up in the online world consultation ran from March to May 2026 and explicitly asked about:

• restricting children's access to VPNs;
• requiring everyone to pass an age check before accessing a VPN;
• the effect on legitimate privacy and business use.

Three separate documents followed, and they are not the same thing:

• Government research (14 July): the 2025 download peak did not appear to be driven by children bypassing age assurance.
• The consultation evidence summary: recorded sharply divided public and stakeholder views. It was evidence about responses, not a government decision.
• The government response: this is the policy decision. It rejected a VPN ban and age gate at this stage while keeping a focus on circumvention.

Are VPNs legal in the UK?

Yes: using a VPN is not generally prohibited in the United Kingdom. It is ordinary business and security infrastructure, and it can lawfully protect privacy or secure public Wi-Fi.

The caveats:

• The underlying conduct still matters. A VPN does not legalise unlawful material, fraud, unauthorised access or any other offence.
• A service may restrict location-changing in its contract, even where doing so is not a criminal offence.

Nothing on this page encourages illegal use or helping a child defeat a legal safeguard.

Hold on to this clarity, because public debate sometimes blurs it. A VPN is infrastructure. The same connection that lets an adult avoid handing a passport to an adult site also protects a journalist's source, a domestic-abuse survivor's location and a business's confidential traffic. Any move to restrict VPNs has to reckon with how deeply they are woven into the legitimate internet.

What a restriction could look like

"Restricting VPNs" can mean very different things. The live UK policy is about children's circumvention, not a general criminal ban. The government:

• has asked Ofcom to research what in-scope services can do to detect and mitigate circumvention on their own platforms, including VPN-based circumvention;
• says it will engage VPN providers about making products less accessible to children without parental consent;
• plans practical guidance for parents.

These are research, engagement and guidance measures, not a prohibition on having or using a VPN.

Other interventions remain technically possible but are not current adopted policy:

• Blocking known VPN endpoints: hard to sustain, because providers add servers and protocols can be hard to classify.
• Making providers age-check: adults would have to prove their age to use ordinary privacy infrastructure, and users could drift to providers beyond the rule.
• Criminalising use: would hit business and personal-security uses as well as circumvention.

The government says it is prepared to consider further action if industry does not tackle circumvention adequately. That reservation is not legislation or a defined future measure.

Why a ban is hard, and why that is not the whole story

There are strong reasons to think a comprehensive VPN ban is impractical in a country like the UK:

• VPN technology is not one product but a general capability built into operating systems, business tools and open standards.
• Every large company depends on it for secure remote access; blocking it wholesale would break ordinary commerce and remote work.
• Determined users could fall back on self-hosted servers and other tunnelling methods that are effectively impossible to eliminate without breaking the internet itself.

Encrypted tunnels are simply too fundamental to modern computing to switch off cleanly.

But "a full ban is hard" is not the same as "nothing will change", and complacency would be a mistake. Authoritarian states do meaningfully suppress VPN use, not through perfect blocking but by raising friction, removing apps from official stores, and creating legal jeopardy that deters ordinary people while determined users carry on.

The UK risk is less a sudden prohibition than a gradual rise in friction and stigma: harder to find in app stores, age-checked themselves, framed as suspicious, perhaps logged or flagged.

The right response is neither panic nor dismissal. Watch the direction of travel, and choose a provider sensibly now, while the market is open.

Choosing a VPN wisely

If you use a VPN, the provider matters, because you are moving trust from the local network and your internet provider to the VPN company. More on that in 5.2 and the detailed phone guidance in 4.4.

Look for:

• clear ownership;
• a sustainable business model;
• precise logging claims;
• modern protocols;
• current independent assessments;
• prompt security updates.

Be especially wary of unknown free VPNs. Running a network costs money, so the provider's funding and use of your data need to make sense.

Jurisdiction matters, but be realistic about it. Where a provider is incorporated, where its servers sit and where its staff are all shape what it can be compelled to hand over. A provider with no UK presence is less exposed to UK legal compulsion than one with a London office, though no jurisdiction is a guarantee.

Worth considering:

• keep a paid subscription with a reputable provider set up now, rather than scrambling later if the market tightens;
• prefer providers that support modern, hard-to-block protocols.

None of this makes a VPN a magic cloak. It makes it a sensibly chosen tool whose limits you understand.

Beyond VPNs: other tools

A VPN is one option among several, and the right tool depends on the job:

• Tor Browser is built around a different anonymity model.
• Encrypted DNS protects name look-ups, but not the whole connection.
• Location-changing may affect whether a UK-specific gate appears, but it raises terms-of-service and account-security issues and does not remove responsibility for the underlying conduct.

Each tool answers a different question, and stacking them blindly can reduce privacy by making you more distinctive, not less.

Be clear what you are actually trying to do (hide browsing from your provider, change your apparent location, resist targeted de-anonymisation) and pick the minimum tool that does it. Grabbing the most powerful tool for a modest problem adds friction and attention without adding safety.

A realistic posture

The accurate summary at this review date is narrower than the headlines:

• VPNs remain legal and widely used.
• The government has rejected banning or age-gating them at this stage.
• Ofcom research, provider engagement and parental guidance are planned.
• Services may nonetheless be expected to address circumvention on their own platforms.

Use a reputable provider for lawful privacy, understand that it changes your exposure rather than removing it, and watch official policy rather than treating a consultation question or a research commission as an imminent ban.

Primary sources: the government's July 2026 consultation response, consultation evidence summary, and 14 July research on children's circumvention.