The UK government is considering restrictions on children’s access to virtual private networks as part of an online safety consultation. The consultation asks whether all users should face age checks if that would prevent children from using VPNs.
Mozilla opposed VPN restrictions in a May 5 statement, saying mandatory age verification and limits on the tools threaten privacy, security, expression and access to information. It said it had joined a coalition of 19 digital rights organizations and technology providers urging UK policymakers to protect those rights. Mozilla called for action on content moderation, data practices and deceptive design.
VPNs have become part of the age verification debate because they can mask indicators of a user’s location. In the United States, Pornhub’s response to state age-verification laws has included blocking access by location, which VPN users can attempt to circumvent.
Proposals target circumvention
The UK consultation asks about the privacy, business and practical consequences of age-restricting VPNs. It says measures to address circumvention should be proportionate and should not restrict adults’ legitimate, lawful use of the tools.
England’s Children’s Commissioner, Dame Rachel de Souza, has urged the government to explore requiring UK-based VPN providers to implement highly effective age assurance to prevent children from accessing pornography.
In a separate statement, de Souza called for online services to identify VPN users likely to be in the UK and require them to prove their age. She said VPNs can benefit cybersecurity, are widely used by businesses and individuals, and should not be restricted for adults.
Increased demand leaves users’ ages uncertain
VPN providers reported increased demand after UK age-check requirements took effect in July 2025. Proton VPN general manager David Peterson said the service had experienced a sustained 1,800% increase in daily sign-ups.
De Souza acknowledged that it was not known whether under-18s had driven the rise in UK VPN use. The March 2026 government consultation also said early evidence did not suggest children seeking to bypass age assurance were responsible for the peak.
Different approaches to age assurance
France’s data protection authority, CNIL, says Arcom’s framework requires an independent verification provider and, after a transition period, at least one “double anonymity” option on affected pornography sites. Under that design, the site receives proof that a user is an adult without learning their identity, while the verification provider does not learn which site the person visits.
California has adopted an approach involving operating systems and app stores. In an October 2025 signing message for AB 1043, Governor Gavin Newsom said providers would collect age information at account creation and supply it to developers.
The European Commission has developed an age-verification blueprint for member states to adapt. The Commission says its design lets users prove they meet an age threshold without revealing their exact age, identity or other personal details.
Security consultant Paul Moore raised allegations about an Android test implementation in April 2026. He said facial images extracted from identity documents were stored as unencrypted files and could remain on a device if verification failed or was interrupted. He also alleged that changes to local configuration data could reset PIN protections or bypass biometric authentication.
