Campaigners have warned that restricting the use of Virtual Private Networks (VPNs) in the UK is ‘technically unworkable’ and poses a threat to privacy, cybersecurity, and freedom of expression, flying in the face of mounting pressure for a Government-led crackdown.

Open Rights Group’s latest briefing paper, VPNs and the Online Safety Act, argues that restrictions on VPNs would have little impact on online safety for under-18s, despite the UK Government’s flagship digital safety law requiring platforms to block content that promotes VPNs specifically aimed at young users.

The use of VPNs has soared since age verification requirements under the Online Safety Act were introduced at the end of July, resulting in calls to restrict VPN use so that under-18s can’t get around age assurance checks. 

One prominent critic has been the English children’s commissioner, Dame Rachel de Souza, who told BBC Newsnight that VPN use by minors was “absolutely a loophole that needs closing”.

However, Open Rights Group (ORG) claims that children aged 6–12, who are the primary focus of online safety reforms, are ‘highly unlikely’ to use VPNs, especially where parental controls are in place.

Restricting younger users’ ability to access VPNs will have little impact, ORG argued, citing the Online Safety Act Network, which claims that ‘the vast majority’ of children will not be downloading a VPN to access online content, while the effort required to install, configure, and pay for a VPN remains a significant barrier for children.

Meanwhile, tech-savvy teenagers who are determined to see adult content are finding other ways to get around age verification, for instance, by using proxy sites, Tor, borrowed account credentials, or simply accessing content on alternative platforms. 

Instead, ORG said that the increase in VPN downloads suggests that adults are wary of sharing their personal information with age assurance providers, companies they are mostly unfamiliar with, going against many years of cybersecurity advice.

The report suggests that policymakers address the low trust in age assurance providers by implementing higher privacy standards, with ORG urging the Government to recognise the positive role VPNs can play online, for example, in protecting against threats such as data theft, DDoS attacks, and identity fraud, and allowing for freedom of expression and access to information.

Recommended

• Last Call for Online Age Checks as Deadline Looms
• Women’s Dating Safety App Hacked in Data Breach
• Ofcom Cracks Down on Weak Age Verification

Far from protecting the most vulnerable, the report suggests that restricting VPNs could ‘inadvertently criminalise legitimate use by children, parents, teachers, and communities’.

Added to that, the study claims an moves to introduce age-checks on VPNs are also technically unfeasible, because VPN traffic can look identical to ordinary encrypted web traffic with detection relying on blacklists of commercial VPN servers, often incomplete and easily outpaced by new services. 

“Ideas such as age-gating VPNs would put teenagers using public wi-fi networks at higher risk of cybercrime, and expose their IP addresses to online predators,” said James Baker, ORG’s platform power programme manager.

“VPNs are an important cybersecurity tool. They help businesses, politicians, journalists and members of the public protect their data and communications.”