UK coalition pushes back on VPN age checks: what's at stake

On 14 July 2026, the Open Rights Group published an open letter signed by more than twenty organisations—including the Electronic Frontier Foundation, the Internet Society, Mozilla, and the Tor Project—calling on UK ministers to rule out age verification and other restrictions on VPN services. The letter lands at a politically charged moment, as the government prepares legislation to ban social media for under-16s and is actively examining what officials have taken to calling "the VPN issue."

The outcome of that examination could directly affect how millions of UK residents protect their privacy online. If ministers decide VPNs should require age checks, the practical consequences would reach far beyond teenagers—touching businesses, journalists, security researchers, and anyone who uses a VPN on public Wi-Fi. This article looks at what is actually being proposed, what the coalition argues, and why the numbers behind the policy case look shaky.

We will not speculate about what the law will ultimately say, but we will lay out what is known so you can follow developments with a clear picture of what is at stake.

Why the government is looking at VPNs

The context is a broader political push to make the UK's online environment safer for children. The government has already signalled intent to restrict under-16s from social media platforms, and enforcement of that ban raises an obvious practical problem: a teenager who is blocked from Instagram on a UK network can, in principle, route around the restriction using a VPN.

That logic has led some ministers and officials to ask whether VPN access itself should be gated behind age verification. The reasoning, at a surface level, is straightforward—if a child cannot prove their age to use a VPN, they cannot use one to bypass platform controls. But critics argue that framing treats a privacy tool as if it were age-restricted content, and that the collateral damage would be significant.

What age verification for VPNs would actually mean

Age verification in this context would most likely mean that anyone wishing to download or activate a VPN service would need to supply proof of age—a passport scan, a driving licence check, or a similar document—before gaining access. The method is already used in the UK for online pornography under the Online Safety Act framework, and it is that model ministers appear to be considering extending.

The immediate problem is structural. To verify someone's age, a provider must collect and process an identity document or delegate that to a third-party age verification service. Either way, sensitive personal data is gathered precisely in order to access a tool whose core purpose is protecting personal data. The coalition's open letter describes this as forcing every user to "surrender sensitive personal information just to access privacy tools"—a formulation that captures the fundamental tension.

There is also a technical dimension. VPNs are not a single product class in the way a social media platform is. They are implemented across consumer apps, enterprise software, built-in operating system features, and open protocols. Designing an age-gate that applies consistently across that landscape—without creating enormous gaps or unintended consequences—would be a serious regulatory engineering challenge.

The coalition's core arguments

The open letter makes several distinct arguments, each worth examining on its own terms.

VPNs are critical infrastructure, not a loophole

The signatories stress that VPNs serve a wide population with entirely legitimate needs: businesses securing remote workers, journalists protecting sources, abuse survivors keeping their location private, and ordinary users securing their traffic on hotel or café Wi-Fi. Treating VPN access as a privilege that must be earned by proving your age conflates the tool with the misuse, in the same way that restricting kitchen knives would be a disproportionate response to knife crime.

If you are interested in the breadth of use cases VPNs genuinely serve, our overview of what a VPN is and does covers the fundamentals without any commercial spin.

The evidence for restricting VPNs is thin

This is arguably the most striking part of the coalition's letter. It cites Ofcom's own research, which found that only around 3% of children used VPNs to access age-restricted content. If that figure is accurate, VPN access is a marginal pathway—not a significant one. Imposing age verification on an entire infrastructure category to address a 3% edge case is a policy response that is badly out of proportion to the problem it claims to solve.

The coalition does not dispute that child safety online is a serious policy goal. It disputes that restricting VPN access is an effective or proportionate way to pursue it.

Better alternatives exist

Rather than age-gating VPNs, the letter proposes a set of measures the signatories consider more targeted and less harmful:

• Stronger platform enforcement—holding social media and content platforms to stricter account for the age-gating obligations they already have under existing law.
• Better parental controls—improving the tools available at device and network level, which can filter content without requiring identity checks on privacy infrastructure.
• Digital literacy investment—equipping children and parents to navigate online risks through education rather than blunt access restrictions.
• Privacy-by-design requirements—building data minimisation and child safety into platforms at a structural level, reducing the risk environment that makes restrictions feel necessary in the first place.

These are not novel ideas, but the letter argues they represent a more coherent approach than creating a bureaucratic barrier around a privacy tool used overwhelmingly by adults with legitimate purposes.

Who signed the letter—and why it matters

The list of signatories is worth pausing on. The Electronic Frontier Foundation is the most prominent digital rights organisation in the United States. The Internet Society is the body responsible for the development and stewardship of internet standards globally. Mozilla builds one of the most widely used browsers in the world. The Tor Project develops the anonymity network used by journalists, activists, and ordinary people under authoritarian surveillance.

These are not fringe voices. Their combined intervention signals that the proposal is being watched internationally, not just domestically. If the UK were to introduce age verification for VPNs, it would be breaking new ground in a direction that most democratic governments have not gone, and doing so against the explicit objections of organisations that have spent decades working on internet policy.

That does not mean the government will not proceed—political pressure around child safety is real and not easily dismissed. But it does mean that any minister moving forward would need to answer some pointed technical and proportionality questions.

The chilling effect on legitimate users

One aspect that the policy debate sometimes underweights is the chilling effect. Even if age verification were technically workable, the requirement to submit identity documents before using a VPN would deter a proportion of legitimate users—particularly those in the most vulnerable categories the technology is often meant to protect.

An abuse survivor using a VPN to keep their location private from a dangerous former partner is unlikely to feel comfortable uploading a passport scan to a third-party verification service. A journalist protecting a source may have good reasons not to create a verified identity trail linking them to a privacy tool. A foreign national living in the UK who lacks a UK driving licence or passport may simply be locked out.

Age verification systems also create honeypots. A database of identity documents tied to VPN subscriptions is an attractive target. Data breaches happen; the question is not whether but when. Mandating that sensitive identity data be collected in order to access a privacy tool introduces a new category of risk into an infrastructure that currently does not require it.

PremierVPN operates a strict no-logs policy—we do not record what you do online. Age verification legislation could place obligations on providers that fundamentally conflict with that principle.

What happens next

Ministers have not yet published formal proposals, and the government's position remains that it is "examining" the issue. The open letter is an attempt to shape that examination before it hardens into a consultation or a legislative clause. That is how civil society engagement with policy normally works—it is most effective before positions are set.

The Online Safety Act already gives Ofcom significant powers over online services, and the regulator's own research—cited in the letter—does not obviously support a VPN crackdown. Whether political momentum overrides that evidence base is the open question.

For UK users who rely on a VPN for privacy, remote work, or security on public networks, the practical advice for now is straightforward: keep an eye on developments, and be aware that the regulatory landscape may shift. If you want to understand what a VPN actually protects you from and how it works, our guide to what a VPN is is a good starting point. If you are using PremierVPN for remote work or general privacy, the tools and protection you have today remain fully operational.

Summary

The coalition's open letter makes a clear and well-evidenced case: VPN age verification would impose significant costs on a broad population of legitimate users in order to address a pathway that Ofcom's own data suggests accounts for 3% of children accessing restricted content. The proposed alternatives—platform enforcement, parental controls, digital literacy, privacy-by-design—address the same goal without gatekeeping privacy infrastructure.

Whether ministers find those arguments persuasive remains to be seen. What is clear is that the outcome will matter beyond any single product or policy—it will say something significant about whether privacy tools are treated as rights or as privileges in the UK's evolving online landscape. We will continue to follow this story and update our coverage as the government's position develops.