The United Kingdom’s Prime Minister, Sir Keir Starmer, has signalled a shift in internet regulation that could have major implications for online privacy. As part of a wide-ranging online safety review, the UK government is exploring measures that would limit children’s access to virtual private networks (VPNs) and potentially require users to verify their identity before using these privacy tools. This idea is currently under public consultation and has sparked strong reactions from privacy advocates and civil liberties experts.
The debate reflects broader concerns about how far governments should go in restricting digital tools in the name of protecting children. While the intent behind online safety legislation is to prevent minors from accessing harmful content, critics warn that introducing mandatory ID checks for VPNs could erode personal privacy and edge the UK closer to digital surveillance.
Why the UK Government Is Proposing Age Checks for VPNs?
Under the government’s review, officials are consulting on whether to “age restrict or limit children’s VPN use” where those services might be used to bypass age verification systems that are part of the Online Safety Act framework. So far, there is no law yet that forces VPN users to provide ID, but the discussion includes age assurance mechanisms that would effectively require proof of identity or age.
This consultation is part of a package of ideas that also looks at social media age limits and the regulation of AI chatbots. Ministers have said they want to make sure children are not able to evade protections designed to shield them from harmful material online.
Those in favour of the proposals argue that unrestricted VPN access can undermine online safety controls by letting underage users appear to be adults or located outside the UK. But privacy defenders see this as a dramatic stretching of governmental powers into tools that are widely used by adults for legitimate privacy and security reasons.
VPN ID Checks Raise Privacy and Free Speech Concerns
VPN services are a fundamental technology for maintaining digital privacy by masking users’ locations and encrypting internet traffic. People use VPNs for a variety of reasons, including protecting personal data on public Wi-Fi networks, accessing services securely while travelling abroad, and shielding themselves from intrusive tracking. Requiring identity verification to use a basic privacy tool would be unprecedented in the UK and much of the democratic world.
Privacy advocates have already criticised the idea, describing it as a draconian crackdown on civil liberties rather than a narrow safety measure. They argue that collecting or verifying identity information just to access a privacy tool creates a dangerous precedent. Once governments start regulating privacy technologies with identity checks, some warn that it could lead to broader constraints on digital freedom of expression and anonymous communication.
These concerns resonate beyond the UK. In other countries where age checks have been introduced for online services, VPN usage has surged as people look for ways to preserve anonymity and access content without revealing personal information.
The Slippery Slope Toward a Surveillance State
The heart of the criticism lies in fears that building a system where everyone’s identity must be confirmed to access a core internet privacy tool could normalize digital surveillance. If VPN providers must verify age with official IDs, opponents say it could pave the way for other mandatory identity systems across the internet.
For example, if the government demands groups one, such as VPN users or social media accounts, to prove who they are, what’s to stop expanding this to more services in the future? What begins as a policy aimed at protecting children could inadvertently create infrastructure that tracks how individuals browse, communicate, and interact online.
The UK already enforces rigorous age checks for some content under the Online Safety Act 2023, including age verification for access to adult material and stricter controls on platforms that host user content. These earlier measures drew criticism from digital rights organisations, who warned against privacy intrusions even before this new VPN discussion began.
As of writing, neither a VPN ban nor mandatory ID checks exist in UK law. What is happening now is a public consultation where industry groups, privacy organisations, parents, and internet users are invited to provide feedback on the proposals. The government will review those responses and may introduce legislation later this year based on the consultation outcomes.
VPN companies themselves have expressed willingness to engage with the government on this topic, signalling that the industry hopes to influence the direction of any rules that might be introduced.
The debate continues to highlight a key tension in digital policy: how to safeguard children online without undermining the privacy, security, and freedoms of all internet users.
