UK Consultation on VPN Age Restrictions Nears Conclusion

In March 2024, the Department for Science, Innovation & Technology (DSIT) launched the “Growing up in the online world” national consultation to gather evidence on protecting children online. The consultation follows the Children’s Wellbeing and Schools Act, which requires service providers to adopt “reasonable anti-circumvention measures” and has sparked debate over whether VPNs should face age-verification requirements.

TechRadar

The consultation has closed, and DSIT is drafting a report that could require age-gating for VPNs. Lawmakers warn that VPNs may be treated as “loopholes” that undermine online-safety rules, potentially obligating providers to verify users’ ages. The government has not yet released its final recommendations, leaving the scope of any new obligations uncertain.

TechRadar

Surfshark and NordVPN, two leading paid VPN services, oppose blanket age restrictions. Both note their services already block minors and argue that mandatory verification would force providers to collect personal data from all users, including journalists, abuse survivors, and remote workers. NymVPN CEO Harry Halpin doubts the technical feasibility of reliable age-gating, citing how easily children can bypass such systems.

TechRadar

Industry groups argue age-gating contradicts VPNs’ privacy purpose and is hard to enforce. They warn that strict verification could push users toward unregulated free VPN apps, increasing security risks. Critics also cite a chilling effect on free speech and political dissent if non-compliant VPNs face penalties.

TechRadar

• “Treating VPNs as a 'loophole' misunderstands their role and risks reducing online safety for the very users these proposals are meant to protect,” — Surfshark spokesperson

TechRadar

• “The compliance burden would fall on reputable, paid providers, while pushing determined users toward exactly those unregulated services that pose the real risk to children,” — Laura Tyrylite, NordVPN Privacy Advocate

TechRadar

• “This has been shown as children can easily fake a moustache to fool age-gating apps,” — Harry Halpin, CEO of NymVPN

TechRadar

• “We expect a measured, evidence-based outcome that does not treat VPNs as a threat,” — Surfshark spokesperson

TechRadar

Sources differ on age-verification feasibility. Halpin says current technology cannot reliably confirm ages, while Tyrylite suggests industry-led guidance could set trustworthy standards. The consultation does not disclose specific technical criteria or enforcement mechanisms, leaving compliance measurement unclear.

TechRadar

If age-gating is imposed, VPNs may need to collect data from all users, exposing journalists, abuse survivors, and remote workers to surveillance. Enforcement challenges could drive users to free, unvetted VPNs, raising malware and data-harvesting risks. The decision will set a precedent for regulating digital-privacy tools in child-online-safety policy.

TechRadar

DSIT is expected to publish its final recommendations in the coming months, outlining any new obligations for VPN providers. Industry groups plan to engage policymakers to shape an evidence-based framework that balances child protection with digital-privacy rights.

TechRadar