As British Prime Minister Keir Starmer announced a sweeping social media ban for under-16s by next spring, speculations have mounted that VPN services may be the next ones on the chopping block.
Concerns like these do not happen in a vacuum.
In his Monday announcement, Starmer said that more information on further restrictions will be shared next month.
Then, speaking to BBC Breakfast the day after, Technology Secretary Liz Kendall left no room for doubt when she said: "We will make further statements in July about VPNs."
As we wait to see what the Government decides to do next, let's look at how the debate has been unfolding and what's at stake for VPN users in the UK.
The VPN debate in the UK
Calls to close the 'VPN loophole' have been thrown across Palace of Westminster benches since mandatory age verification landed in the UK last July and led to a surge in VPN usage across the country.
Virtual private network (VPN) apps and similar tools can indeed make users look like they are browsing from outside the country, potentially helping them bypass age checks.
It's been difficult to determine whether this spike in usage is driven by adults unwilling to share biometric data or by children seeking out restricted content, but recent studies from groups like Childnet and Internet Matters suggest the balance may swing towards the former.
Nonetheless, the debate got so heated among politicians last year that the Government decided to include questions about potential age restrictions for VPNs in its online safety consultation, which ended in May.
In the meantime, though, the controversial Children’s Wellbeing and Schools Act has becaome law, introducing an obligation for all service providers to take "reasonable anti-circumvention measures".
This, alongside the newly proposed teen social media ban, could put increased pressure on UK lawmakers to further regulate the use of VPNs.
The risks of age restricting VPNs
In the consultation's accompanying report, the Government emphasizes the need to balance enforceable content restrictions without limiting the "legitimate and lawful use" of VPNs by adults.
However, when we took the online safety survey ourselves, we found that VPNs were mostly described in the questionnaire as circumvention tools rather than privacy products which is, of course, their prime purpose. It's a grossly simplistic take that's been concerning cybersecurity experts.
According to Proton VPN's Public Policy Manager, Romain Digneaux, lawmakers must take into consideration that VPNs are an essential tool for user privacy and security that millions of Brits rely upon daily.
"Imposing age restrictions on VPNs would only make it harder for law-abiding citizens to access tools that protect their privacy and security," Digneaux told TechRadar.
Do you know?
Evidence from Australia shows that using a VPN is not the primary circumvention method for under-16s to bypass the social media ban. Platforms failing to ask users to verify their age and age assurance systems incorrectly calculating a child's age are the main reasons teens are still active on these platforms.
VPN providers are aslo worried about the impact that potential age restrictions will ultimately have on their product. Most of them, in fact, operate under a strict no-log policy to collect as little information as possible about their users.
This is exactly why, according to Surfshark's Senior Product Manager, Justas Pukys, the prospect of age‑gating VPNs is so concerning.
"It would undermine the very privacy architecture these services are built on, mostly affecting ordinary users and reputable providers," he told TechRadar.
NordVPN's Privacy Advocates, Laura Tyrylyte, echoes these concerns. She told us:
"Restricting access to these tools, or requiring identity-linked access to them, would have consequences far beyond the negligible number of users who may seek to circumvent online restrictions."
Concerns aren't coming only from the companies building the VPNs, either.
Last month, Mozilla, the non-profit behind Firefox, warned the UK's Department for Science, Innovation and Technology that age-restricting VPNs "would undermine the privacy and security of all users," while failing to protect children.
The outcry follows a similar call from the wider tech privacy industry that came as the Children's Wellbeing and Schools Bill became law.
Is restricting VPNs even needed, and could it work?
While VPNs have proved themselves as useful tools to evade the mandatory UK age checks required to access so-called legal but harmful content under the Online Safety Act, it's still unclear if they will help at all to bypass the new social media ban.
As Windscribe's CEO, Yegor Sak, explains, this depends on how these restrictions are ultimately enforced. If a platform simply blocks users that are based on the UK network location, he explains, then a VPN is the right tool for the job.
"But if the check happens at the account level, app-store level, device level, payment level, or through identity verification, a VPN does not make a 15-year-old look 18. It doesn’t create an old account, a credit card, or a verified identity," Sak told TechRadar.
Right now, we know very little detail on how enforcement would look, but experts overwhelmingly expect the more robust, latter scenario.
Social media providers could also use a mix of account history, payment signals, facial estimation, identity vendors, device or app-store signals, and document checks.
Regardless of whether age-gating VPNs is actually needed to successfully implement the UK's teen social media ban — Australian lawmakers didn't think it was necessary, for what it's worth — it also remains to be seen whether such VPN restrictions would actually work in practice.
As we saw in Utah, which became the first US state to pass such requirements, it may be technically impossible to block all known VPN and proxy IPs. That's, at least, what NordVPN told TechRadar back in March, arguing that the only remaining option would be age-verifying every visitor globally, regardless of their actual location.
What's more, even the most draconian of restrictions aren't that effective. Take Russia, for example. The Kremlin has invested millions in building a sophisticated censorship system, but VPN services keep showing resilience by constantly adapting to new tactics.
It looks like UK lawmakers have many factors to consider for drawing the next steps in making the internet a safer place for children, then, and it appears it might be wise to take a look around before drawing up its plans.
For Sak from Windscribe, however, it should be enough to look at one single element.
"If a policy creates pressure to age-gate VPNs, that is a sign the policy is broken. You don't protect children by weakening privacy and security for everyone," he said.
VPN and privacy-conscious users in the UK will hope that this point remains right at the forefront of the discussion.
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!