For internet users in the UK, January 2026 has brought a bizarre digital paradox. On one hand, police and national security experts are urging the public to use Virtual Private Networks (VPNs) to stay safe. On the other, Parliament is voting on measures that could make getting one as invasive as applying for a mortgage. This ‘identity crisis’ in British policy is creating a direct conflict between cybersecurity and online safety regulation.
The security mandate: “Use a VPN”
If you listen to technical experts, the message is clear: VPNs are essential. The National Cyber Security Centre (NCSC) provides Device Security Guidance which frames VPNs as a pillar of modern infrastructure. They advise that a properly configured VPN is vital for protecting data, especially for the UK’s millions of remote workers.
Frontline law enforcement agrees. The Metropolitan Police advise the public that if you use public Wi-Fi, you should “only use it with a Virtual Private Network enabled.” Similarly, the South East Cyber Resilience Centre (SECRC) warns of public Wi-Fi dangers, recommending VPNs to prevent hackers from intercepting passwords or banking details.
The legislative push: a digital iron curtain
Despite this advice, the UK is moving towards an Australia-style social media ban. This approach carries a high cost for digital freedom. By mandating age-verification for VPNs, the government is effectively constructing a digital iron curtain.
On 21 January 2026, the House of Lords voted 207 to 159 to back an amendment to the Children’s Wellbeing and Schools Bill to prohibit VPN services for under-18s. The Conservative-led amendment (92) seeks to prohibit VPN services for children specifically to block evasion of Online Safety Act (OSA) age-gating; it passed 207 to 159 largely along party lines – Conservatives in favour, Labour opposed – but may struggle in the Commons given Government resistance. The OSA’s broad scope already affects diverse websites beyond pornography, making age verification highly contentious.
This would require providers to implement ‘highly effective age assurance’ – such as ID scans or facial AI – for all users, essentially ending anonymous browsing in the UK.
Countries such as China, Russia, Belarus, Iran, Iraq, North Korea, Turkmenistan, and the UAE have already banned or heavily restricted VPNs, often requiring government approval or imposing fines and imprisonment for unauthorised use. The UK should not descend to the level of these authoritarian regimes by imposing similar controls on a vital privacy tool.
Balancing the advice to use VPNs for security with efforts to protect children from harmful content is far too complex for blunt age-gates that compromise everyone. The Online Safety Act has already negatively impacted adults by increasing barriers to privacy tools and exposing them to greater cyber risks.
However, political leadership remains conflicted. Prime Minister Keir Starmer has expressed hesitation regarding a total ban for under-16s, citing clear advantages for minors in using social media responsibly. These platforms help young people stay connected with family – including relatives abroad – through video calls and messaging; support education via group chats for schoolwork, homework sharing, and collaborative study; and foster social development by building supportive networks. Starmer has told MPs that he believes these platforms can be beneficial, drawing from their value to his own teenage children and highlighting a rift between the Prime Minister’s personal view and the aggressive legislative push from the House of Lords.
The human cost: impact on LGBT+ and marginalised groups
One of the most significant criticisms of mandatory ID requirements is the disproportionate impact on the LGBT+ community, particularly transgender individuals. Many trans people possess government IDs that do not reflect their affirmed name or gender. Forcing a user to upload a passport featuring a deadname to access a privacy tool is a form of forced outing that can compromise their safety. Additionally, biometric age estimation (facial AI) has higher error rates for trans and non-binary faces, often misgendering users or locking them out of services entirely. Anonymity is a lifeline for many; removing the ability to use a VPN anonymously cuts off access to support forums that may be restricted under new ‘safety’ filters.
Impact on government policy and reputation
This shift marks a fundamental change in the UK’s digital strategy and its international standing. We are witnessing a clash between regulators pushing the Online Safety Act and security experts at the NCSC. While one arm tries to ‘gate’ the internet, the other warns that restricting security tools weakens national resilience. Human rights groups argue that by normalising ID requirements for privacy tools, the UK provides a ‘legislative blueprint’ for authoritarian regimes. If a G7 nation declares anonymous browsing a loophole, it becomes harder to criticise other nations for restricting internet freedoms.
The case for the EU’s Digital Services Act
As argued previously, instead of an exclusionary ‘Iron Curtain,’ the UK should mirror the EU’s Digital Services Act (DSA). The DSA focuses on platform accountability rather than forcing individuals to hand over biometric data for every app. Mirroring this would avoid a ‘splinternet’ effect, ensuring UK citizens retain access to global tools. Furthermore, the EU is exploring ‘digital wallets’ that verify age without sharing a user’s full identity or deadname with the platform. The DSA protects minors by banning predatory advertising without breaking the encryption protocols that the NCSC and Police rely on for national security.
Why the system is considered broken
The contradiction is stark. By making it harder to access a VPN, the government may leave adults more vulnerable to cyber-fraud – the very thing the Met Police warn against – in a flawed attempt to stop teenagers from bypassing age-gates. Technologists argue that you cannot age-gate a protocol without destroying the privacy of every citizen.
The solution for the UK is to rejoin the digital single market. There is no need for the UK to lead on internet regulation to protect people from harmful content when collaborative EU frameworks already address these challenges effectively, and without compromising privacy tools like VPNs. As the government’s consultation continues until April 2026, the question remains: will the UK choose robust cybersecurity and human rights, or a digital wall its own experts warn against?
