Privacy advocates can breathe a sigh of relief. The UK government has ruled out plans to ban or restrict virtual private networks (VPNs) after the technology found itself thrust into the spotlight following the introduction of the Online Safety Act last year.

While it never seemed like an outright ban was on the cards, the government began exploring whether to expand age verification to VPNs in March, following a surge in VPN downloads after age checks were introduced for adult websites.

On 2 March, the Department for Science, Innovation and Technology launched a public consultation on children's online safety. As part of the consultation, the government sought views on whether social media should have a minimum age limit, whether there should be restrictions on design features that encourage excessive use, and whether the use of VPNs should be restricted.

Specifically, the government looked to find out whether universal age checks should be required to access VPNs and what impact such measures could have on people who rely on the services for privacy and security. It also explored how children are bypassing online safety rules, including whether VPNs are being used to circumvent age checks, whether any restrictions could realistically be enforced and whether age verification for VPN services could have unintended consequences.

On 15 July, the government published its response to the consultation, unveiling a raft of new online safety measures to protect children online. These included a default midnight-to-6am social media curfew for 16 and 17-year-olds, restrictions on features such as autoplay and personalised recommendation feeds, mandatory breaks for under-18s using AI chatbots and a commitment to explore further safeguards.

As well as those measures, the government confirmed that VPNs would not be banned or age-gated. “VPNs have legitimate privacy and security uses and we will therefore not age-gate or ban them," said then-Technology Secretary Liz Kendall.

However, the government said it would require platforms covered by the new rules to take “robust” steps to detect and prevent underage users from using VPNs to bypass age assurance measures when the regulations come into force in early 2027.

An independent study commissioned by the government into children's circumvention behaviours found relatively little evidence that children were using VPNs to bypass age checks. Although 26 per cent of children said they had used a VPN before, only 7 per cent said they did so to access age-restricted websites, apps or games. Just 10 per cent said they had used location-changing tools to bypass age verifications.

Read more: Best VPNs, reviewed

Cybersecurity experts told The Independent that any attempt to restrict VPNs would have been difficult to enforce. "While you might compel 'friendly' VPN providers based in UK-partner countries to comply with not offering VPNs to children, there are many VPN and proxy solutions globally, some in countries that may be harder to legally compel," said Corey Nachreiner, chief security officer at WatchGuard Technologies.

Nachreiner said any attempt to block VPNs would likely have become an ongoing game of cat-and-mouse as providers changed their networks, encryption protocols and traffic patterns to avoid detection. “The VPNs that are easiest to block are, unfortunately, the most legitimate ones used by businesses or that have valuable privacy features for adults and children alike,” he said.

Another challenge in restricting VPNs is that they are specifically designed to blend in with ordinary internet traffic, making them difficult to detect. “VPNs are adept at masking themselves as standard web communications," said Pierre Noel, field chief information security officer at cybersecurity firm Expel, adding that it would have been challenging for the UK government “to determine whether a connection is from a 'legit' originator or a minor trying to bypass age-verification controls”.

The government has asked Ofcom to work with the Information Commissioner's Office to research what more online services can do to identify VPN use and engage with VPN providers on voluntary measures. It says it will keep the policy under review and reserves the right to introduce further action if new evidence suggests it is needed.

For more, **read our explainer on what a VPN is and what it does **