UK Votes to Ban VPNs for Minors as Social Media Crackdown Expands

On January 21, 2026, the UK House of Lords voted 207 to 159 to ban VPN services for anyone under 18. The amendment, numbered 92 of the Online Safety Act 2023, passed with cross-party support and represents one of the most direct attacks on VPN technology by any Western democracy.

Six months later, the UK went further. On June 15, 2026, the government formally announced a social media ban for under-16s, requiring platforms including Instagram, TikTok, YouTube, and X to verify user ages before granting access. The two measures are now deeply connected: the VPN ban is positioned as the mechanism that prevents minors from bypassing the social media restrictions.

What the Lords actually voted on

Amendment 92 of the Online Safety Act mandates that ISPs deploy technical measures to detect and block VPN connections made by users under 18. Practically, enforcing this is a significant challenge. The amendment does not specify how providers are supposed to identify which user is using a VPN, or how to determine that user’s age.

Critics from digital rights groups were quick to point this out. The Open Rights Group called the measure “technically unenforceable without mass surveillance infrastructure.” The Electronic Frontier Foundation noted that blocking VPN traffic at the ISP level would require deep packet inspection, a technology used by authoritarian governments to control internet access.

Despite these objections, the vote passed by a 48-seat margin, reflecting a broader political consensus in the UK that protecting children online justifies significant constraints on internet infrastructure.

The social media ban context

The Lords’ vote did not happen in isolation. Since Ofcom updated the Online Safety Act in July 2025 to include new age-verification requirements for adult content platforms, UK VPN usage has roughly doubled. Ofcom reported that daily active users of VPN apps in Britain reached approximately 1.5 million after the update, up from around 750,000 before.

That surge alarmed regulators. The UK Children’s Commissioner publicly described VPNs as “a loophole that needs closing.” The French Minister Delegate for Digital Affairs said VPNs were “the next topic on my list,” suggesting the regulatory push is not unique to Britain.

The social media ban announced in June accelerates this dynamic. Under the new regulations, platforms must use age verification (passport scans, facial recognition, or credit card checks) before allowing users to create or access accounts. The rules are expected to come into force in Spring 2027.

Ofcom has been asked to conduct a rapid feasibility study on verification methods. Critics have raised concerns about data security, particularly around facial scans and biometric databases held by private platforms.

How this affects VPN users

For adult VPN users in the UK, the immediate impact is limited. The Lords’ amendment targets under-18s specifically, and most major VPN providers are incorporated outside British jurisdiction. NordVPN (Panama), ProtonVPN (Switzerland), and Mullvad (Sweden) are not subject to UK enforcement orders in any straightforward way.

The longer-term risk is precedent. If the UK successfully implements VPN restrictions for minors, it normalizes deep packet inspection as a regulatory tool. Other age-verification regimes, including those targeting online gambling, could follow a similar model and gradually expand the categories of users affected.

There is also a practical concern for teenagers who rely on VPNs for legitimate privacy purposes: shielding their browsing from school networks, protecting themselves from data-harvesting apps, or accessing news content from authoritarian family contexts. A blanket age-based ban makes no distinction between these uses and circumvention of content restrictions.

Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.

VPN providers respond

ProtonVPN’s CEO Andy Yen was among the most vocal critics. In a blog post, he argued that “verification laws are turning VPNs from privacy tools into liabilities.” He specifically criticized the UK bill as a “danger to political discourse,” noting that journalists and activists who happen to be under 18 would lose access to tools they depend on.

Mullvad, which already accepts anonymous account creation and cash payments, said it would continue operating under its existing privacy model regardless of UK legislation, since it does not collect data that could verify user ages.

NordVPN pointed users to its privacy policy audit history and noted that its no-logs infrastructure means it would have nothing useful to share with enforcement bodies even under a legal order.

What happens next

The Online Safety Act amendment still requires implementing regulations before it can be enforced. The government has not set a date for these regulations to be laid before Parliament. Given the complexity of the technical implementation and the expected legal challenges from digital rights organizations, enforcement in 2026 seems unlikely.

The social media ban is further along. Platforms have been notified, Ofcom’s rapid study is underway, and the Spring 2027 target gives companies roughly 12 to 18 months to build compliant systems.

Both measures will face legal challenges. Liberty UK has already announced it intends to seek judicial review of Amendment 92, arguing it is incompatible with Article 8 of the European Convention on Human Rights (the right to privacy), which remains incorporated in UK law despite Brexit.

For now, VPN services remain fully legal and accessible in the UK for users of all ages. Whether that remains the case in 2027 depends on how effectively the government can navigate the substantial technical, legal, and civil liberties obstacles in its path.

Keep reading: Is a VPN Legal? Country-by-Country Guide for 2026 and Age Verification Laws and VPNs: The Global Crackdown Explained.