Is a VPN Legal in the UK? Online Safety Act and Age Checks

Is a VPN legal in the UK?

Yes. No law in the United Kingdom stops adults or children from buying, installing or using a VPN. Nothing in the Online Safety Act 2023 changes that.

The Act regulates the companies that run websites and apps. Services that host pornography or other content harmful to children must stop UK children from reaching it. Since 25 July 2025, that has meant highly effective age checks, such as photo ID, facial age estimation or a bank or card check. The duties fall on the services, and Ofcom enforces them. Ofcom can fine a company up to £18 million or 10 percent of global revenue.

A VPN changes where you appear to be connecting from. If you connect to a server outside the UK, a site that applies age checks only to UK visitors will usually not ask. That is why VPN downloads surged the week the checks began. Tom’s Guide reported that Proton VPN saw UK sign-ups rise by more than 1,400 percent above its baseline from 25 July 2025. Other providers reported similar spikes.

None of this is unlawful for an adult. It may still breach a site’s terms of service, and a platform that detects evasion can restrict the account.

What changed in 2026

The surge raised the question of whether VPNs themselves should be restricted. That question went to Parliament and then to a public consultation.

On 9 March 2026 the House of Commons considered amendments from the House of Lords to the Children’s Wellbeing and Schools Bill. Lords Amendment 37 would have written new restrictions covering social media, VPNs and phones in schools directly into the Bill. The Commons rejected it by 321 votes to 106. The government argued that it should not get ahead of the consultation it had opened a week earlier.

In a separate vote the same day, the Commons rejected a Lords proposal to ban under-16s from social media. The government’s alternative was a power for ministers to restrict children’s access to parts of social media and chatbots. It said this power could include age-restricting or limiting children’s VPN use.

The consultation, “Growing up in the online world”, ran from 2 March to 26 May 2026. It asked directly whether children’s access to VPNs should be restricted. The government published its response on 15 July 2026. On VPNs, it committed to “an onus on social media companies to detect and prevent VPN use among under-16s to access their services”. It did not announce age checks for VPN apps, licensing of VPN providers, or any restriction on adult use.

Two pieces of official research came out the same week. The first was a survey of 2,299 young people for the Department for Science, Innovation and Technology. BMG Research carried it out in May 2026. It found that 26 percent of 11- to 17-year-olds had used a VPN, and 22 percent had done so in the previous three months. Among 16- and 17-year-olds, lifetime use rose to 31 percent.

Children who had used a VPN gave these reasons:

• 30 percent: keeping their activity private
• 27 percent: accessing certain sites or games
• 25 percent: watching videos from other countries
• 22 percent: reaching age-restricted sites

The second was Ofcom’s report on the use of age assurance, which covered the first six months of the duties. Age assurance means the methods a service uses to check or estimate a user’s age. The report found that compliance by regulated services had improved but was uneven. It recommended measures involving app stores, operating systems and device makers.

What a VPN changes, and what it does not

A VPN moves your apparent location and hides your traffic from your network. Your IP address is the number that websites see for your internet connection. Age checks keyed to UK IP addresses do not trigger when you connect through a foreign server.

A VPN does not:

• change the law that applies to you
• remove age checks that a service applies to all users, wherever they are
• stop a platform from using other signals to decide that you are in the UK or under 18

Those signals include the account’s payment card, phone number or stated age. Sites that verify age at the account level, rather than by location, are not affected by a VPN.

For adults, the practical risk is contractual, not criminal. A service whose terms forbid evading age assurance can suspend an account. For parents, the relevant development is the government’s plan to require social media companies to detect under-16s using VPNs. It is likely to arrive through secondary legislation or Ofcom codes, not through VPN providers. Secondary legislation means rules that ministers make under powers in an existing Act.

Enforcement so far

Ofcom’s enforcement has been aimed at services. It has opened investigations into pornography providers and other platforms for failing to put effective age checks in place. In 2026 it fined an adult-site operator £1 million for not complying. No enforcement action has been taken against a VPN provider or a VPN user for the act of using a VPN. There is no legal basis for one.

Will VPNs be banned in the UK?

Nothing currently before Parliament would ban them. The March 2026 vote rejected the amendment that came closest to restricting VPNs. The July 2026 government response chose to act through social media companies, not VPN providers. Ordinary adult use has never been in question.

Two things could still change. The first is the method platforms must use to detect under-16s on VPNs, which Ofcom is expected to develop in codes of practice. The second is any future measure aimed at app stores. We re-check this page at least every 30 days and record each development in the timeline above.

Related

• VPN laws and age-verification tracker for other countries
• Age verification and VPNs: the global picture
• Best VPNs for privacy