Banning VPNs to protect kids? Good luck with that
- Reference: 1753950549
- News link: https://www.theregister.co.uk/2025/07/31/banning_vpns_to_protect_kids/
- Source link:
The more creative wangled the "robust" selfie-based verification systems by [1]using the in-game selfie feature in the [2]Death Stranding sequel, which worked for Discord's k-ID system.
However the more obvious workaround was to simply install a VPN and browse the web as if from another country where such age verification laws don't apply. As has been widely reported, [3]including by this vulture's kettlemates , some VPN companies reported a 1,400 percent increase in sign-ups since the OSA came into force.
[4]
The idea of a total VPN ban was subsequently [5]floated , but how realistic or feasible would this be to implement?
How a ban could look
If you want the short answer, experts we spoke to were predictably dismissive. One told us that its "not gonna happen."
The government could pull various technical levers, such as banning the sale of VPN kit, but as people who spoke to The Register about the matter said, it would be like banning people from smoking in their own homes.
[6]
[7]
"You might not like it, but good luck enforcing it," said Graeme Stewart, head of public sector at Check Point Software. "The logistics are near-impossible. You could, in theory, ban the sale of VPN equipment, or instruct ISPs not to accept VPN traffic. But even then, people will find workarounds. All you'd achieve is pushing VPN use underground, creating a black market for VPN concentrators.
"The only way to do it is badly. You'd effectively be forcing ISPs to block legitimate encrypted traffic and, in doing so, you'd be regulating an entire industry out of existence. Worse still, you'd be legislating against cybersecurity and privacy."
[8]
Speaking of which, the UK's largest mobile network operator, EE, proudly announced this week that it was the first carrier to launch SIMs for under-18s that block access to "inappropriate content."
A clear play to capitalize on parents' newfound obsession with online safety, courtesy of the Act, this comes despite EE having offered parental controls for years, like most other providers.
EE is also now offering 30-minute online safety appointments for all families, regardless of whether they are a paying customer, in their retail stores so parents can drag their kids along to hear stuff they almost certainly know more about than their elders.
[9]
Beyond the drawbacks of an ISP-level content block Stewart mentioned, it is also likely that once one VPN is banned, there will always be another to block, and a game of cyber whack-a-mole would ensue.
Jake Moore, global cybersecurity advisor at ESET, told us that other methods could see the UK veering into enemy territory, not to mention a PR calamity.
"Although we shouldn't even consider adopting a route used by China, the Chinese use the technique of analyzing traffic patterns for VPN usage, but this requires expensive infrastructure and constant updates so again, not feasible," he said.
"Furthermore, many VPNs offer modes to make their traffic look like regular HTTPS anyway, making detection harder yet again."
To put it in his plainer terms: "Not gonna happen."
Scott McGready, co-founder of Damn Good Security, agreed that if UK ISPs started snitching on their customers' VPN usage, it would be "a very worrying position to be in" and the unintended consequences for legitimate users and businesses would be massive.
Potential impact of a VPN ban
McGready's point about affecting legitimate users is valid. A VPN ban would be a lazy way to achieve the government's aims, which as we understand aren't to limit privacy, but to quell access to online harms.
Officially, the UK wants to limit underage access to adult content, make it more difficult for harassers to hide behind privacy-preserving technologies, put an end to illegal streaming, and similar – not prevent people from using VPNs to protect themselves on public Wi-Fi networks, for example.
That's the government's line, anyway, although its [10]attack on end-to-end encryption might have you believe there is more to its ambition than that.
But how many people – beyond those with a solid understanding of cybersecurity – are really using VPNs to stay safe on public networks? Other than those whose employers demand they hook up to the corporate network using one?
A fair few, as it goes. According to a [11]Forbes Advisor poll , enhanced online privacy prevailed as the top use case for UK VPN users, although the same proportion (24 percent) of respondents said they used them to access restricted content as they did for work.
The data suggests Brits aren't just looking for ways to stream the footy illegally, or access a few foreign shows on Netflix, although this undoubtedly drives a certain amount of subscriptions.
[12]UK VPN demand soars after debut of Online Safety Act
[13]UK Online Safety Act 'not up to scratch' on misinformation, warn MPs
[14]Does UK's Online Safety Act cover misinformation? Well, that depends
[15]Why UK Online Safety Act may not be safe for bloggers
They use VPNs to preserve personal security and privacy, too – legitimate, necessary use cases. To take that away would force the UK down a worrying path, aligning it with geopolitical adversaries.
Morally unconscionable?
Some countries that ban the use of VPNs include Russia, the United Arab Emirates, Iran, Saudi Arabia, Turkmenistan, Myanmar, Belarus, and China. That's not even an exhaustive list, but it shows the questionable company the UK would keep should it choose to ban VPNs.
A ban not only puts the UK on a concerning trajectory from a privacy and cybersecurity standpoint, but it is also unlikely to work in practice. Possible? Yes, but the practicality of policing such a ban would be challenging.
As shown by individuals in nearly all the aforementioned countries that outlaw VPNs, bans don't prevent use. People always find ways to circumvent such restrictions, as they do routinely and successfully in more authoritarian countries.
All a UK ban would do is provide the impetus for young people to learn how to circumvent the legislation by using outlawed privacy tech. They would find a way, they always do.
If restricting children's access to sensitive content is the aim of the game, parents need to be more proactive in making use of the existing network, device, and app-level controls available to them, not support a ban for technology that preserves privacy for all.
Communications regulator Ofcom told us on Monday that platforms covered by the OSA must not promote content that encourages the use of VPNs or means to circumvent age checks.
However, tech secretary Peter Kyle, following the furor he stoked after a [16]post comparing OSA opponents to sexual predators (which remarkably has still yet to be deleted), confirmed the UK has no current plans to ban VPNs.
He told Sky News on Tuesday that he will look "very closely" at how VPNs were being used and that the majority of Brits were playing by the rules.
A [17]digital petition to repeal the OSA has now reached north of 423,000 e-signatures at the time of writing, a figure well beyond the threshold triggering a Parliamentary debate on the matter.
UK Parliament is in recess until September, but a government response to the petition has already stated it has no plans to repeal the Act. ®
Get our [18]Tech Resources
[1] https://x.com/DanySterkhov/status/1948665431633404170
[2] https://www.theregister.com/2020/08/28/death_stranding/
[3] https://www.theregister.com/2025/07/28/uk_vpn_demand_soars/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aIs-vT419fmMafz2_HNVGwAAAA4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://order-order.com/2025/07/28/exc-labour-could-ban-vpns-after-online-safety-act-surge/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aIs-vT419fmMafz2_HNVGwAAAA4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aIs-vT419fmMafz2_HNVGwAAAA4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aIs-vT419fmMafz2_HNVGwAAAA4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aIs-vT419fmMafz2_HNVGwAAAA4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2025/03/03/opinion_e2ee/
[11] https://www.forbes.com/uk/advisor/business/vpn-statistics
[12] https://www.theregister.com/2025/07/28/uk_vpn_demand_soars/
[13] https://www.theregister.com/2025/07/11/online_safety_act_misinfo/
[14] https://www.theregister.com/2025/04/30/does_online_safety_act_cover/
[15] https://www.theregister.com/2025/02/06/uk_online_safety_act_bloggers/
[16] https://x.com/peterkyle/status/1950092871614230571
[17] https://petition.parliament.uk/petitions/722903
[18] https://whitepapers.theregister.com/
Re: Private or Work?
I guess you could have a system of approved endpoints.
Generally it's not NordVPN or SurfShark that business use, rather something like Cloudflare Zero Trust between their own private endpoints.
Re: Private or Work?
Easy workaround is to just create a virtual PC in a different zone in Azure/AWS etc. Then use that for browsing. No VPN, no recognisable traffic going via the UK.
Re: Private or Work?
People under authoritarian regimes always found workarounds. That never meant the system was acceptable - just that people were forced to survive it.
In the USSR, samizdat (hand-copied banned books) spread underground because censorship was total. In East Germany, people built illegal radio receivers in walls to listen to Western news. In Maoist China, people whispered criticism in code or wrote letters they never sent. In Iran, people use Tor, proxies, or burn phones to get past internet blocks - all just to read or speak freely.
None of those workarounds were signs of freedom. They were desperate responses to repression.
So when someone in the UK says, “just create a virtual PC in another region,” as a fix for overreaching surveillance or censorship, it’s worth asking: Why should we need to? That’s not a solution. That’s a red flag. A free country doesn’t make you tunnel your traffic to dodge your own government.
Britain is not immune to authoritarian creep - it just wears a nicer suit. Rights erode slowly, then all at once. Ask anyone who’s lived through it.
Re: Private or Work?
Easy workaround is to just create a virtual PC in a different zone in Azure/AWS etc. Then use that for browsing. No VPN, no recognisable traffic going via the UK.
750 hours per month might not be enough for some people..... or the 100GB limit on their remote connection. ;)
Seriously, AWS offer free tier for training and to lure people into taking more services. They will soon notice if loads of free EC2 resource is taken up by people running a just a browser.
Re: Private or Work?
I run a VPN between my home and a family member's home. Not for any particularly nefarious purpose but because its another level of tinkering and it makes devices on both LAN's accessible from both locations. I'd be exceptionally p'd off if I had to register to become an "approved" end point and to be frank if I could do it then so could anyone so it would be pointless. One end point is inside A&A so I hope they would kick up sh*t if that was proposed.
Re: Private or Work?
If the law -- which I do not condone -- was written correctly then it would be the provider's responsibility to not only verify their "customers" but identify those trying to circumvent the verification. So if I arrive at a site via a VPN (perish the thought...) then its up to them to do what Netflix and BBC do and kick me off. No need to meddle with all the other legitimate uses of VPN's.
So the law is either knowingly flawed -- but at least we did something, unknowingly flawed -- those tech guys are sooo tricksy, look what they did to us, or its part of a planned ratcheting up of controls -- and I'd prefer not to go down that particular conspiracy theory rabbit hole...
It's all about government surveillance
Nothing more.
Re: It's all about government surveillance
No, there is not an agenda - our government is not that clever. It's pure knee-jerk and like most such legislation it's poorly conceived and ultimately just rather annoying.
Boradcast TV channels restrict their content with geo-limits based on IP origin. They do it for contractual reasons. But I want to maintain my French comprehension orale skills, so I use VPN to watch French mainstream TV, which strictly speaking I shouldn't. But Camping Paradis and HPI isn't going to corrupt my delicate mind.
This week the streams, that were always very smooth, have started to degrade and become a bit stuttered from time to time. On one occasion my breakout server in France became overloaded and I couldn't connect. This is all thanks to the surge in use by ham shankers and the government pushing them down that route.
So I expect my VPN service price to increase as the provider has to upgrade their cloudy box in France, and the bandwidth between UK and France.
By the way, those people lamenting the loss of TdF to PayWall TV in the UK might consider a VPN to watch France.TV 2 and 3, which do excellent coverage.
"So I expect my VPN service price to increase as the provider has to upgrade their cloudy box in France"
One would hope that the fees from additional users would provide the funds for that. Assuming of course that fee is above zero.
Their competitive pricing is probably based on the predicted use, like a gym doesn't have the capacity to host all its members at once.
Now the ham shankers are involved, the behaviour of users changes, not just the number.
No
"That's the government's line, anyway, although its attack on end-to-end encryption might have you believe there is more to its ambition than that."
Nefarious is the word you were looking for, not ambition.
Re: No
have you believe there is more to its nefarious than that.
That makes no sense.
I think it was pretty clear from the start that this was just a stepping stone in their war on encryption. After all, why ban VPNs if you can force providers to backdoor them instead.
I've read this week, either on somewhere like here or Reddit, that someone got round the age verification by downloading a photo of a driving licence found after a quick search.
The people this is designed to block access to are the most technical literate people of their generation, ever. We should be hiring tehm to do pen testing.
423K e-signatures - government response has already stated it has no plans to repeal the Act
Democracy in motion. Well done on telling the peons that you don't give a damn about either their opinion or their votes.
Re: 423K e-signatures - government response has already stated it has no plans to repeal the Act
Brown envelope is more powerful than a vote.
Labour grandeur
A Labour MP wakes in the night, eyes wide, heart pounding: “Someone, somewhere, is talking. Unmonitored. Unverified. Uncontrolled.” They fumble for their phone to check the stats - still no kill switch for Telegram. Still no dossier on who’s watching what. Power is leaking through the cracks, and they feel it.
The Online Safety Act isn’t about kids. It’s not even about safety. It’s a tool of digital feudalism - a pact between government and tech monopolies. In exchange for entrenching their platforms as gatekeepers, the state gets the crown jewel: the infrastructure of surveillance. It’s corporate fascism by design - control masquerading as care.
And it’s cheered on by power-drunk bureaucrats and MPs whose worldview is indistinguishable from a DSM diagnosis. Delusions of omnipotence, paranoia about dissent, obsessive need for control. They don’t understand VPNs, encryption, or protocols - but they understand this: people are slipping out of reach.
To them, private conversation is sedition. Anonymity is deviance. And bypassing their systems is heresy.
This is the same logic that animated the Stasi, the CCP, and the ayatollahs - not because Britain is “just like them,” but because power, once unaccountable, converges. Always.
The UK isn’t banning VPNs yet - but it’s floating the idea, conditioning the public, preparing the ground. The message is clear: liberty is now conditional. And the people demanding your compliance aren’t defenders of democracy - they’re middle managers of a digital panopticon, desperate to stay relevant.
This isn’t a safety bill. It’s a permission slip for tyranny - wrapped in childproof branding and sold to a frightened, distracted and beaten up public.
IT Crowd anyone?
Since he enjoys slinging accusations around . . .
His real name is _Peter Fyle_ !
There is only one way, has always been only one way, and always will only be one way
Educate the kids about sex and relationships.
Be constructive
I can understand that perhaps the Online Safety Act needs constructive criticism. But I have no time for the kowtowing to US Big Tech that just wants to walk all over us.
More important, British ideas of free speech are different from American ideas. Britain has always recognised that slanderous or criminal speech should be restricted. It is outrageous American imperialism that they dictate their own ideas on free speech to the rest of the world.
Just remember, it is an official UK government position that if you aren't a wholehearted supporter of the OSA, you are a kiddy fiddler. Expect the Police to be knocking on your door any minute.
I think the governments aim was an end of online anonymity, so they can track what everybody does online, every webpage you visit, every social media post, every phone call. They probably already have a long list of online profiles that they would like to put real names against.
People who care about privacy are not going to trust online identity verification services with their sensitive documents, and will undoubtedly start using VPN services as a workaround. The governments next step therefore will be requiring VPN providers to check the identity of their users.
I get the feeling that this is the thin end of the wedge and over time it will be extended to more and more sites until eventually you need to prove your ID in order to do anything online at all.
It makes sense not to ban VPN but...
... when has common sense or advice from technical experts ever held back knee-jerk tech legislation before in the UK. We have a long history of ignorant politicians shouting "what about the children" and making stupid decisions that deny the reality of how things actually work.
"instruct ISPs not to accept VPN traffic. But even then, people will find workarounds."
VPNs already do this through obfuscation, masking OpenVPN/Wireguard traffic behind other protocols.
Private or Work?
How do you differentiate between work based VPN's required for remote working and private VPN's used for other things?