VPNInfobaseAs far as the sources we read show, the Online Safety Act 2023 puts its age-check duties on the services that host or publish content, not on people who use a VPN. The Act’s text, as published on legislation.gov.uk and searched on 2 October 2026, never uses the words “VPN” or “virtual private network”. On 15 July 2026 the Technology Secretary said in a written statement, as quoted by Biometric Update, that the government will “not age-gate or ban” VPNs and expects platforms to detect and prevent circumvention. This is a reading of public documents, not legal advice.
Who the Act’s duties fall on
- Services that let children reach harmful content. Section 12 requires user-to-user services likely to be accessed by children to use “age verification or age estimation (or both)” to stop children encountering the most harmful content, in a way that is “highly effective at correctly determining whether or not a particular user is a child” (s.12(4) and (6)).
- Services that publish pornography themselves. Section 81(2) and (3) require the same kind of check so that children “are not normally able to encounter” regulated provider pornographic content.
- Ofcom. Section 157 obliges Ofcom to report on how age assurance has been used and whether anything has “prevented or hindered” it. That is the report published on 15 July 2026.
None of those sections creates a duty for an individual to avoid a VPN, or an offence for using one. Ofcom’s own report says VPNs “are used across the UK for a variety of reasons including privacy and security” (paragraph 7.66). The Act is long: this page does not claim to have read every provision for indirect effects, only that a text search of the whole Act found no mention of VPNs.
What the guidance says about VPNs
Ofcom’s two guidance documents each contain a sentence aimed at services, not users. The Part 5 guidance (pornography services, 16 January 2025, paragraph 4.60) and the Part 3 guidance (user-to-user and search services, 24 April 2025, paragraph 4.37) both say that providers “should not publish content on their service that directs or encourages UK users to circumvent the age assurance process or the access controls, for example by providing information about or links to a virtual private network (VPN) which may be used by children to circumvent the relevant processes”. The Part 5 guidance also lists, among things that weigh against an age check being highly effective, a service that “explicitly and deliberately encourages or enables child users to circumvent” its checks, “e.g. by providing a link to and recommending the use of a VPN”.
That wording is guidance (“should”). It concerns a service pointing children to a VPN, not a VPN company existing or an adult using one.
Dated statements and developments
| Date | Source | What it says about VPNs | What it does not say |
|---|---|---|---|
| 16 Jan 2025 | Ofcom, Part 5 guidance | Services should not link to or provide VPN information that helps UK users avoid checks (para 4.60) | No rule on users or VPN providers |
| 24 Apr 2025 | Ofcom, Part 3 guidance | Same sentence for user-to-user and search services (para 4.37) | No rule on users or VPN providers |
| July 2025 | Ofcom report, paragraph 2.11 and 7.67 | The section 12 duties for user-to-user services came into force; the report counts VPN use from 25 July 2025 | Ties no legal duty to VPN use |
| 15 Jan 2026 | Ofcom FOI reply 02108307 | Ofcom buys app data from a supplier it names as Apptopia (direct award) to understand VPN usage over time; the data “does not include any personal data, only aggregate data” | Contract details and the exact data collected were withheld under the FOI Act, section 43(2) |
| 15 Jul 2026 | Ofcom, statutory report under section 157 | Estimated daily UK VPN users 2.2 million, against 1.2 million before 25 July 2025 (Similarweb app data extracted 7 May 2026); a quarter of children aged 11 to 17 had used a VPN in the previous six months (March 2026 study); 5% said they used one to reach age-restricted content or features | Ofcom says the data cannot show how much of the rise is children, and its evidence “does not currently show” the increase is due to children trying to bypass checks (para 7.64) |
| 15 Jul 2026 | UK Parliament written statement HCWS254, as quoted by Biometric Update | “VPNs have legitimate privacy and security uses and we will therefore not age-gate or ban them”; “an onus on platforms in scope of the new restrictions to take […] steps to detect and prevent attempts by underage users to circumvent age assurance measures” (all as quoted by Biometric Update, not read at source); the Technology Secretary asked Ofcom to report by October on “what more services can do to detect and prevent VPN use on their platforms” | Reported wording only: parliament.uk, Hansard and GOV.UK copies all refused our reader on 2 October 2026, so check the exact words at the parliament.uk link |
The Ofcom report gives 15 July 2026 as its publication date on its cover; some press coverage says 16 July. We use Ofcom’s own date.
What this means for a UK reader
- Using a VPN. Nothing in the Act text or Ofcom’s two guidance documents that we read targets an adult user, and the written statement says VPNs will not be age-gated or banned. Services can still decide how to treat visitors they believe are in the UK, and a service may ask for an age check however you connect. Whether a site accepts a VPN connection is the site’s choice; we have not tested any.
- Providers and jurisdiction. A VPN company’s home country does not by itself decide whether a UK-facing service must run an age check; that duty sits with the service you are trying to use. Each provider’s stated base is in VPN jurisdiction explained, and who runs each one is in who owns your VPN.
- Choosing a provider. Audit and logging facts that do not depend on any law are in the audit tracker and best VPN for privacy. If you are new to the tool, start with what is a VPN.
- Elsewhere. The US position, where one state wrote VPNs into law, is in the US state VPN laws tracker.
- Watch for. The Ofcom report requested for October on VPN detection by services, and the planned under-16 social media rules mentioned in press coverage. Both are reported by press and not yet read in a primary text.
Method
Read on 2 October 2026: the Online Safety Act 2023 as published on legislation.gov.uk (sections 12, 81 and 157, plus a text search of the whole Act for “VPN” and “virtual private network”, no hits), Ofcom’s Part 3 and Part 5 guidance PDFs, Ofcom’s 15 July 2026 report and summary page, and Ofcom’s FOI reply of 15 January 2026. The parliament.uk written statement page returned an access block, so its wording rests on press quotation and should be checked at source. We did not read every Ofcom code or Hansard debate, and laws and guidance change. This page summarises public documents and is not legal advice; a solicitor is the right person for your own situation. Reviewed every 90 days. NordVPN is the one provider we earn commission on (disclosure).