The VPN panic is only getting started | The VergeSkip to main contentThe homepageThe VergeThe Verge logo.The VergeThe Verge logo.TechReviewsScienceEntertainmentAIHamburger Navigation ButtonThe homepageThe VergeThe Verge logo.Hamburger Navigation ButtonNavigation DrawerThe VergeThe Verge logo.Login / Sign UpcloseCloseSearchTechExpandAmazonAppleFacebookGoogleMicrosoftSamsungBusinessCreatorsMobilePolicySecurityTransportationReviewsExpandLaptopsPhonesHeadphonesTabletsSmart HomeSmartwatchesSpeakersDronesScienceExpandSpaceEnergyEnvironmentHealthEntertainmentExpandGamesTV ShowsMoviesAudioAIVerge ShoppingExpandBuying GuidesDealsGift GuidesSee All ShoppingCarsExpandElectric CarsAutonomous CarsRide-sharingScootersOther TransportationFeaturesVideosExpandYouTubeTikTokInstagramPodcastsExpandDecoderThe VergecastVersion HistoryNewslettersExpandThe Verge DailyInstallerVerge DealsNotepadOptimizerRegulatorThe StepbackArchivesStoreSubscribeFacebookThreadsInstagramYoutubeRSSThe VergeThe Verge logo.The VPN panic is only getting startedComments DrawerCommentsLoading commentsGetting the conversation ready...TechCloseTechPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All TechPolicyClosePolicyPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All PolicyReportCloseReportPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All ReportThe VPN panic is only getting startedThe UK government is facing calls to restrict children’s access to VPNs.The UK government is facing calls to restrict children’s access to VPNs.by Dominic PrestonCloseDominic PrestonNews EditorPosts from this author will be added to your daily email digest and your homepage feed.FollowFollowSee All by Dominic PrestonNov 27, 2025, 12:00 PM UTCLinkShareImage: Cath Virginia / The Verge, Getty ImagesDominic PrestonCloseDominic PrestonPosts from this author will be added to your daily email digest and your homepage feed.FollowFollowSee All by Dominic Preston is a news editor with over a decade’s experience in journalism. He previously worked at Android Police and Tech Advisor.After the Online Safety Act’s onerous internet age restrictions took effect this summer, it didn’t take long for Brits to get around them. Some methods went viral, like using video game Death Stranding’s photo mode to bypass face scans. But in the end, the simplest solution won out: VPNs.Virtual private networks have proven remarkably effective at circumventing the UK’s age checks, letting users spoof IP addresses from other countries so that the checks never appear in the first place. The BBC reported a few days after the law came into effect that five of the top 10 free apps on the iOS App Store were VPNs. WindscribeVPN shared data showing a spike in its user figures, NordVPN claimed a 1,000 percent increase in purchases that weekend, and ProtonVPN reported an even higher 1,800 percent increase in UK signups over the same period.This has not gone unnoticed in the halls of power. Murmurings have begun that something needs to be done, that the UK’s flagship child safety law has been made a mockery, and that VPNs are the problem.The OSA became UK law in 2023, but it took until July for its most significant measures to take effect. It requires websites and online service providers to implement “strong age checks” to prevent under-18s from accessing a broad swathe of “harmful materials,” mostly meaning pornography and content promoting suicide or self-harm. In practice, it means everything from porn sites to Bluesky now require UK users to pass age checks, usually through credit card verification or facial scans, to get full access. You can see why so many of us signed up for VPNs.Children’s Commissioner Rachel de Souza, a figure appointed by the government to represent children’s interests, told the BBC in August that access to VPNs was “absolutely a loophole that needs closing.” Her office published a report calling for the software to be gated behind the same “highly effective age assurance” that people are using them to avoid.“Nothing is off the table.”De Souza isn’t alone. The government has faced calls in the House of Lords to ask why VPNs weren’t taken into account in the first place, while a proposed amendment to the Children’s Wellbeing and Schools Bill would institute de Souza’s age-gating requirement. Even as far back as 2022, long before the Labour Party came into power, Labour MP Sarah Champion predicted that VPNs would “undermine the effectiveness” of the OSA, and called for the then-government to “find solutions.”A recent article by Techradar added to speculation that the government is considering action, reporting that Ofcom, the UK’s media regulator and enforcer of the OSA, is “monitoring VPN use” in the wake of the act. Techradar couldn’t confirm exactly what form that monitoring takes, though Ofcom insisted fears that individual usage is being tracked are unfounded. An anonymous spokesperson for Ofcom would only confirm to the site that it uses “a leading third-party provider,” and that the data is aggregated, with “no personally identifiable or user-level information.” (Anonymized data often isn’t, but of course, we don’t know whether that’s the case here.)Still, that research might be an important piece of the puzzle. While VPN use has clearly increased in the country since July, it’s less certain how much of that is coming from kids, and how much from adults reluctant to hand over biometric or financial data to log into Discord. Ofcom is researching children’s VPN use, but that work will take time.The government has always insisted that it isn’t banning VPNs, and so far that hasn’t changed. “There are no current plans to ban the use of VPNs, as there are legitimate reasons for using them,” Baroness Lloyd of Effra, a minister in the Department for Science, Innovation and Technology, told the House of Lords last month. Then again, she shortly added that “nothing is off the table,” leaving the specter of VPN restrictions still at large.“It’s very hard to stop people from using VPNs.”A full ban, such as by requiring internet service providers to block VPN traffic at the source, would be unlikely in any case. There’s no serious political outcry for one, and as the government itself admits, there are plenty of good reasons to use a VPN that have nothing to do with age restrictions on porn.“VPNs serve many purposes,” Ryan Polk, director of policy at the Internet Society, told me. “Businesses use them to enable secure employee logins; journalists rely on them to protect sources; members of marginalized communities use them to ensure private communication; everyday users benefit from online privacy and security; and even gamers use them to improve performance and reduce latency.”Besides, everyone I’ve asked about it agrees that banning VPNs would be an uphill battle. “Blocking VPN usage is technically complex and largely ineffective,” Laura Tyrylyte, Nord Security’s head of public relations, told me. James Baker, platform power and free expression program manager at the Open Rights Group, put it even more simply: “It’s very hard to stop people from using VPNs.”Some have suggested that the government could require sites covered by the OSA restrictions to block all traffic from VPNs, just as many streaming services already do. That brings its own complications though.“Websites that offer the content would face an impossible choice,” says Polk, because there’s no reliable way to tell if a VPN user is originally from the UK or somewhere else. “They would either have to block all users from the UK (abandoning the market) or block all VPN users from accessing their website.”That leaves age-restricting VPNs themselves as the likeliest outcome. The OSA already prohibits online platforms from promoting VPNs to children as a way of circumventing age checks, so extending the act to encompass VPNs themselves might not be too much of a stretch. Technically speaking, this would be the easiest option to implement, but it still comes with downsides.Both Tyrylyte and Baker warn that any attempt to limit VPN usage would push people toward riskier behavior, whether that be less reputable VPNs with bad privacy practices, or simpler forms of direct file-sharing, like USB sticks, that introduce new security risks. In a sense, that’s happened already — both point out that Nord and other paid VPNs require a credit card, meaning underaged users are likely flocking to free options, which Baker calls a privacy risk, “as they are likely just selling your personal data.”The UK was one of the first countries to implement online age restrictions, but just as other countries and states have followed in its footsteps there, we can expect more governments to put VPNs under scrutiny before long. Australia has banned social media for under-16s, the EU is trialling its own restrictions, and various US states have implemented age limits on the internet. As long as VPNs remain the most effective workaround, VPN restrictions will be a point of debate. In the US, they already are. Republicans in Michigan have proposed an ISP-level ban on VPNs, while Wisconsin lawmakers are debating a proposal to require adult sites to block VPN traffic entirely.Wherever you live, the VPN panic is only getting started.Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.Dominic PrestonCloseDominic PrestonNews EditorPosts from this author will be added to your daily email digest and your homepage feed.FollowFollowSee All by Dominic PrestonLawCloseLawPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All LawPolicyClosePolicyPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All PolicyPrivacyClosePrivacyPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All PrivacyReportCloseReportPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All ReportSecurityCloseSecurityPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All SecurityTechCloseTechPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All TechMost PopularMost PopularWyze’s new security camera watches your yard from inside your homeYou can play classic Nintendo games on these custom SNES-inspired Nike sneakersI’m officially done with YouTube KidsYou’re buying a Frame TV? It’s okay to cheap out a littleFirst there was nothing, then there was Hoto and FanttikThe Verge DailyA free daily digest of the news that matters most.Email (required)Sign UpBy submitting your email, you agree to our Terms and Privacy Notice. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.Advertiser Content FromThis is the title for the native adMore in Tech9Verge ScoreThe best Apple Watch to buyThe best Black Friday deals we’ve found on TVs, laptops, and moreApple TV pulls The Hunt over plagiarism accusationStrong iPhone 17 sales may push Apple ahead of Samsung this yearThese prebuilt PCs are about to cost more due to rising RAM pricesCampbell’s fired the VP recorded saying its meat ‘came from a 3D printer’The best Apple Watch to buyVictoria Song1:25 AM UTCThe best Black Friday deals we’ve found on TVs, laptops, and moreBrandon Russell and Sheena Vasani1:19 AM UTCApple TV pulls The Hunt over plagiarism accusationEmma Roth12:51 AM UTCStrong iPhone 17 sales may push Apple ahead of Samsung this yearStevie BonifieldNov 26These prebuilt PCs are about to cost more due to rising RAM pricesEmma RothNov 26Campbell’s fired the VP recorded saying its meat ‘came from a 3D printer’Emma RothNov 26Advertiser Content FromThis is the title for the native adTop Stories1:00 AM UTCStranger Things 5 begins with a frantic race to the finish lineNov 26First there was nothing, then there was Hoto and FanttikNov 26You’re buying a Frame TV? It’s okay to cheap out a littleNov 25The AI boom is based on a fundamental mistake1:19 AM UTCThe best Black Friday deals we’ve found on TVs, laptops, and more24 seconds agoArchitecting the year’s best family dramaThe VergeThe Verge logo.FacebookThreadsInstagramYoutubeRSSContactTip UsCommunity GuidelinesArchivesAboutEthics StatementHow We Rate and Review ProductsCookie SettingsTerms of UsePrivacy NoticeCookie PolicyLicensing FAQAccessibilityPlatform Status© 2025 Vox Media, LLC. All Rights Reserved

The VPN panic is only getting started.

The UK government is facing increasing pressure to restrict children’s access to VPNs following a wave of circumvention attempts around the recently implemented Online Safety Act. By November 27, 2025, the situation had escalated to a near-crisis point, with numerous individuals exploiting loopholes in the law.

The Online Safety Act, enacted in 2023, aimed to protect children from harmful online content, primarily pornography and material promoting self-harm. The Act required websites and online service providers to implement “strong age checks” to prevent under-18s from accessing these materials. This fundamentally involved verifying a user’s age, typically through credit card verification or facial scans. The immediate reaction was widespread adoption of VPNs, which enabled users to spoof their IP addresses from other countries, effectively bypassing these age checks.

Within days of the law’s implementation, the extent of this circumvention became alarmingly clear. Reports emerged from the BBC indicating that five of the top 10 free iOS App Store apps were VPNs. WindscribeVPN reported a spike in user figures – a 1,000 percent increase in purchases during a single weekend, while NordVPN documented an even more dramatic 1,800 percent increase in UK signups. These figures underscored the scale of the problem and highlighted the government’s failure to anticipate this level of exploitation.

The surge in VPN usage was swiftly recognized as a significant issue. Calls for intervention began circulating within the Houses of Lords, questioning why VPNs hadn't been accounted for in the initial design of the legislation. A proposed amendment to the Children’s Wellbeing and Schools Bill sought to address the loophole by implementing age-gating requirements for VPNs, echoing the approach utilized for other online platforms. As far back as 2022, Labour MP Sarah Champion had predicted the “undermining effect” of VPNs on the OSA, urging the then-government to find solutions. Techradar’s subsequent article further fueled speculation surrounding Ofcom’s monitoring of VPN usage, although Ofcom insisted that individual user data was anonymized, fueling further distrust.

Despite the government’s insistence that it wasn't banning VPNs – citing “legitimate reasons” for their use – the situation remained precarious. Baroness Lloyd of Effra, a minister in the Department for Science, Innovation and Technology, confirmed this in the House of Lords last month. However, she conceded the “nothing is off the table” sentiment, solidifying the potential for restrictions.

Research highlighted the complexity of addressing the VPN issue. Laura Tyrylyte, head of public relations at Nord Security, emphasized the “very hard” nature of stopping VPN usage, while James Baker, program manager at the Open Rights Group, succinctly stated that it’s “very hard to stop people from using VPNs.” The core problem, as many observers pointed out, lay in the widespread use of VPNs for legitimate purposes – secure business access, journalist protection, safeguarding marginalized communities, and general online privacy.

Furthermore, some sources indicated that the adoption of VPNs was, in part, driven by concerns over data collection and privacy, as some VPNs require credit card verification, potentially posing a risk to underaged users. The Internet Society’s Ryan Polk warned about the technical complexities and ineffectiveness of simply blocking VPN traffic, highlighting the potential for users to gravitate toward riskier alternatives.

As of November 27th, 2025, the situation was characterized by escalating concerns and a sense of urgency. The UK’s attempt to protect children online had inadvertently created a significant vulnerability. It was clear that some form of intervention, likely involving restrictions on VPNs themselves, was inevitable. The broader implications extended beyond the UK, with similar legislation being implemented in Australia and inquiries being conducted in the EU and the United States, suggesting a global trend towards regulating online access for minors. This underscored the fundamental challenge – balancing the need for online safety with the protection of fundamental freedoms and user privacy.