Three years after the Online Safety Act, could the under-16 social media ban put VPNs back in the firing line?

Last week marked three years since the UK Government enacted the Online Safety Act (OSA). Now, the impending UK under-16s social media ban and questions over the effectiveness of current measures threaten to push VPNs back into the spotlight.

Speaking to TechRadar, VPN providers said the law has been a “heavy-handed approach” that’s only been “partly” successful.

But some aspects have seen success. Companies now have obligations to proactively detect and remove child sexual abuse material (CSAM), several specific harms were criminalised, and penalties have been introduced for non-compliance – although not all have been paid.

With Ofcom announcing steps for an under-16 social media ban last week, VPN providers are warning that repeating the same age-gating playbook will only backfire.

‘No significant overall change’

The Online Safety Act was introduced to protect children and vulnerable adults online. But, as Dr Peter Membrey, Chief Research Officer at ExpressVPN, notes, the bill has so far only been “partly” successful.

“The Act has put children’s online safety firmly on the agenda, which matters. But Ofcom’s own report this month found no significant overall change in the share of children encountering harmful content, so there’s more work to do,” he explained.

This view is supported by several charities, including the Molly Rose Foundation, which warned that “timid regulation will cost lives.”

Much of the problem comes down to enforcement. While it’s simple enough for larger platforms to monitor content and their users, some smaller sites struggle to implement (or deliberately ignore) the law and slip through the net of checks.

Age verification measures are another case in point: if a mainstream site introduces age-gating checks, a child may just find a smaller site.

As a Proton spokesperson explained: “Under 18s are being driven towards riskier, unregulated sites and apps – ones that pose greater risks than the very sites the Online Safety Act is trying to protect them from.”

The VPN dilemma

VPNs became a major talking point when age verification landed as part of the Act in 2025.

Primarily, this was due to concerns about people circumventing the legislation. And, with VPN downloads surging the moment age verification arrived, it’s hardly surprising they became a focal point for regulators.

However, the government’s own research has dispelled the myth that VPNs are to blame. According to a Department for Science, Innovation and Technology (DSIT) report, only 7% of children used VPNs to access restricted materials.

The main reason children cited using VPNs? Privacy. And as age verification measures have spread, people’s privacy concerns have risen, too.

A spokesperson from Proton said that because age checks require sensitive data to be sent to unknown third parties, they “create a goldmine for hackers.”

So, could the introduction of age checks for social media scheduled for early 2027 lead to an increase in demand for VPNs and a return to the same debate as earlier this year?

Will the social media ban change anything?

So far, much of the focus has been on Ofcom’s intended enforcement methods – bank cards, passport photos, and so on. But EE research suggests 42% of 11-15-year-olds will try to circumvent the ban.

Although VPNs are unlikely to bypass account-level ID checks, they may once again find themselves in the spotlight with young people looking to explore any method they think might work.

Both ExpressVPN and Proton warned against imposing restrictions on VPNs, with Membrey saying that VPNs could “work alongside” legislation to boost digital safety.

Meanwhile, Romain Digneaux, Public Policy Manager at Proton, warned that restricting VPNs “harms everyone who uses them, leaving their data exposed and driving users towards dangerous, often free VPNs.”

Either way, it seems increasingly likely that the debate around VPNs, child safety online, and digital security may soon reignite. As Digneaux notes, “we haven’t seen the last of this.”