17.4 Threats to VPNs and circumvention

Status reviewed 15 July 2026. VPN use remains legal in the UK. The 2026 child-online-safety consultation examined restricting children's access to VPNs and age-checking VPN access, but no restriction had been enacted or adopted at this review date. A further government update on circumvention was expected by 16 July 2026.

Why VPNs became a talking point

For most of their history, virtual private networks were a quiet, ordinary tool: used by remote workers to reach office systems, by travellers on hotel Wi-Fi, and by the privacy-conscious to keep their browsing from their internet provider. They attracted little political attention. That changed in July 2025, when the Online Safety Act's age-check requirements took effect and VPN apps shot to the top of the UK download charts almost overnight. Because a VPN makes your connection appear to originate in another country, it causes many UK-specific age gates simply not to appear — and large numbers of adults reached for one rather than upload identity documents to view legal content.

That visible surge made circumvention a prominent policy issue. The government's Growing up in the online world consultation ran from March to May 2026 and explicitly asked about restricting children's access to VPNs, requiring everyone to pass an age check before accessing a VPN, and the effect on legitimate privacy and business use. Early government evidence also said the 2025 peak did not appear to be driven by children bypassing age assurance. Consultation questions are not law or an adopted policy, and the distinction should not be blurred.

Are VPNs legal in the UK?

Using a VPN is not generally prohibited in the United Kingdom. It is ordinary business and security infrastructure, and it can lawfully protect privacy or secure public Wi-Fi. The underlying conduct still matters: a VPN does not legalise unlawful material, fraud, unauthorised access, or any other offence. A service may also restrict location-changing in its contract even where doing so is not a criminal offence. Nothing on this page encourages illegal use or helping a child defeat a legal safeguard.

It is worth holding on to this clarity, because public discussion sometimes blurs it. A VPN is infrastructure. The same connection that lets an adult avoid handing a passport to an adult site also secures a journalist's source, a domestic-abuse survivor's location, and a business's confidential traffic. Any move to restrict VPNs has to reckon with the fact that they are woven into the legitimate functioning of the modern internet.

What a restriction could look like

"Restricting VPNs" can mean very different things. The live UK discussion in 2026 concerned children's access and age checks, not a general criminal ban. Other possible measures include app-store restrictions, duties on consumer VPN providers, or blocking known endpoints. Each has different legal, technical, privacy, accessibility, and business consequences. A restriction aimed only at children could still require adults to prove age, which is why its data-protection design matters.

Each step is progressively harder to implement and more damaging to legitimate use. Blocking known VPN endpoints is a game of whack-a-mole, since providers add new servers constantly and protocols are designed to be hard to identify. Requiring VPN providers to age-check would push privacy-conscious users towards providers outside any such requirement. Criminalising use would sweep in the vast majority of users who rely on VPNs for ordinary, lawful purposes. The likeliest near-term reality is not a ban but a continuation of political pressure, possibly some app-store friction, and rhetoric framing VPNs as a problem — which is itself worth watching, because rhetoric often precedes regulation.

Why a ban is hard, and why that is not the whole story

There are strong reasons to think a comprehensive VPN ban is impractical in a country like the UK. VPN technology is not a single product but a general capability built into operating systems, business tools, and open standards. Every large company depends on it for secure remote access. Blocking it wholesale would break ordinary commerce and remote work, and determined users could fall back on self-hosted servers and other tunnelling methods that are effectively impossible to eliminate without breaking the internet itself. Encrypted tunnels are too fundamental to modern computing to be cleanly switched off.

That said, "a full ban is hard" is not the same as "nothing will change", and complacency here would be a mistake. Authoritarian states do meaningfully suppress VPN use, not by perfect blocking but by raising friction, removing apps from official stores, and creating legal jeopardy that deters ordinary people while determined users persist. The risk in the UK is less a sudden prohibition than a gradual increase in friction and stigma: harder to find in app stores, age-checked themselves, framed as suspicious, and perhaps logged or flagged. The appropriate response is neither panic nor dismissal, but attention to the direction of travel — and a sensible choice of provider now, while the market is open.

Choosing a VPN wisely

If you use a VPN, the provider matters because you are moving trust from the local network and internet provider to the VPN company, as explained in 5.2 and the detailed phone guidance in 4.4. Choose clear ownership, a sustainable business model, precise logging claims, modern protocols, current independent assessments, and prompt security updates. Treat an unknown free VPN with particular caution: operating a network costs money, and the provider's funding and data use must make sense.

Pay attention to jurisdiction, but with realism. Where a provider is incorporated, where its servers sit, and where its staff are all shape what it can be compelled to hand over. A provider with no UK presence is less exposed to UK legal compulsion than one with a London office, though no jurisdiction is a guarantee. Consider keeping a paid subscription with a reputable provider established now, rather than scrambling later if the market becomes more restricted, and prefer providers that support modern, hard-to-block protocols. None of this makes a VPN a magic cloak; it makes it a sensibly-chosen tool whose limits you understand.

Beyond VPNs: other tools

A VPN is one option among several, and the right tool depends on purpose. Tor Browser is designed around a different anonymity model. Encrypted DNS protects name lookups but not the entire connection. Location-changing may affect whether a UK-specific gate is displayed, but it also creates terms-of-service and account-security issues and does not remove responsibility for the underlying conduct.

Each tool answers a different question, and stacking them blindly can reduce privacy by making you more distinctive, not less. The discipline this guide recommends is to be clear about what you are actually trying to achieve — hide browsing from your provider, change apparent location, resist targeted de-anonymisation — and to choose the minimum tool that meets that need. Reaching for the most powerful tool for a modest problem is a common mistake that adds friction and attention without adding safety.

A realistic posture

The accurate summary at this review date is narrower: VPNs remain legal and widely used; government has investigated child circumvention and possible age restrictions; no general or child-specific VPN restriction is yet in force. Use a reputable provider for lawful privacy, understand that it changes rather than removes exposure, and watch official policy rather than treating a consultation question as an imminent ban.

Primary sources: the government's 2026 consultation, its 15 June progress statement, and the 14 July research on children's circumvention.