• The UK government confirmed it will not limit VPNs
• Data reveals only 7-10% of teenagers use a VPN to bypass age checks
• Social media curfews, autoplay restrictions were also announced

The UK government has officially scrapped the idea of restricting virtual private networks (VPNs) to enforce its impending social media bans, delivering a massive victory for digital privacy advocates.

Speaking on BBC Breakfast today, the government confirmed a major U-turn on the subject, with Online Safety Minister Kanishka Narayan stating: "We decided not to limit VPNs."

This was further cemented in a written parliamentary statement by Technology Secretary Liz Kendall, who clarified that the government will not age-gate or ban the best VPN software because "VPNs have legitimate privacy and security uses."

The announcement ends fears that sweeping age verification laws could inadvertently break online privacy for millions of adults.

Cybersecurity experts and privacy groups previously warned that restricting these tools would be a disaster waiting to happen, prompting an open letter from the industry urging lawmakers to leave everyday privacy tools alone.

Privacy wins, but platforms face new rules

While VPNs are safe from a blanket government ban, the social media ban loophole hasn't been completely ignored.

Kendall confirmed the onus will now fall on social media platforms "to take robust steps to detect and prevent attempts by underage users to circumvent age assurance measures."

To achieve this, the government has tasked Ofcom and the Information Commissioner’s Office (ICO) to report by October on how platforms can better detect and prevent VPN use for age-check circumvention. The government also plans to engage directly with VPN providers regarding voluntary actions.

This shift in responsibility aligns with newly released government research.

A Department for Science, Innovation and Technology (DSIT) report revealed that while 26% of 11- to 17-year-olds use a VPN, findings show they do so primarily for privacy.

Only 7-10% use them to bypass age checks, whereas 45% simply enter a false date of birth.

Midnight curfews and AI limits

While everyday privacy tools have been spared, the government is pressing forward with strict new rules to combat digital addiction — that online commentators already deemed "ineffective and useless" — with the first regulations coming into effect in early 2027.

Following the upcoming blanket ban on social media for under-16s, new measures will ensure 16- and 17-year-olds don't face a sudden "cliff edge" of addictive features. Government consultation revealed that nearly one in three children actively want help managing their screen time.

Under the new rules, older teens will face default social media curfews from midnight to 6 am. Additionally, persuasive features like autoplaying videos and personalized infinite feeds will be switched off by default to make logging off easier.

"This is about giving these older children more choice and control over the feeds and reducing that sense that they can never switch off being online," Kendall stated.

The protections also extend to artificial intelligence.

The government will require mandatory breaks for under-18s using AI chatbots to prevent emotional dependency. Furthermore, lawmakers are working with health regulators, including the MHRA and DHSC, to consider banning therapy chatbots entirely if they provide dangerous or unverified mental health advice to minors.

• The US Treasury has sanctioned First VPN's administrator for aiding ransomware attacks on American infrastructure
• Another suspect was targeted for selling "cryptors" that cloak malware from security systems
• The move follows a May 2026 takedown by European law enforcement and the FBI that seized the VPN's infrastructure

The United States government has officially issued sanctions against the operators of a notorious free virtual private network, escalating a global crackdown on digital infrastructure used to facilitate ransomware attacks.

On Monday (July 13), the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) designated First VPN Service (also known as 1VPNS) and its Ukrainian administrator, Dmytro Rashevskyi, for abetting cybercriminals. The service, which has operated since 2014, was heavily favored by ransomware gangs targeting American hospitals, municipalities, and businesses.

While the best VPN services are designed to protect everyday consumer privacy, rogue networks like First VPN provided malicious actors with the tools to "hide the origins of their attacks, deploy malware, and manage exfiltrated data," according to a Treasury Department press release.

As part of the same action, the Treasury also sanctioned Yegeniy Vladimirovich Silayev, a Belarusian national accused of selling "cryptors" to ransomware operators.

While Silayev is not directly affiliated with First VPN, his inclusion in the sanctions package highlights a broader strategy of targeting the entire cybercriminal supply chain. Cryptors are tools specifically built to disguise ransomware as harmless files, preventing security systems from detecting or deactivating the malware.

A haven for cybercriminals

The US Treasury's latest move is an update to an ongoing international operation against First VPN.

In a massive May 2026 takedown, a coordinated effort led by European law enforcement agencies and the FBI successfully seized the service's website and server infrastructure.

Prior to the takedown, Rashevskyi aggressively marketed First VPN on dark web forums. To lure cybercriminals, he promised total anonymity and boasted that the network "does not keep logs of users' identities or activities, and that it refuses to cooperate with law enforcement investigations into illegal activity originating from the servers it rents to customers".

According to the US Treasury, Rashevskyi went to great lengths to keep the operation running. He utilized false identities, such as "Maksim Sorin" and "Roman Chabanenko," to "buy infrastructure from companies that might otherwise refuse to do business with him because of complaints of abuse from internet service providers about illegal activity originating from 1VPNS servers".

Disrupting the cybercriminal ecosystem

This latest wave of sanctions was coordinated alongside the United Kingdom's Foreign, Commonwealth & Development Office (FCDO) and carries severe consequences for the designated individuals.

Under the new sanctions, all property and interests belonging to Rashevskyi and Silayev within the US are blocked, and US citizens are strictly prohibited from engaging in any transactions with them. Beyond the immediate financial freeze, OFAC sanctions serve as a massive reputational blow designed to choke off future revenue streams.

By focusing on the service providers and tool suppliers who facilitate these attacks, rather than just the ransomware operators themselves, authorities are aiming to maximize their impact and disrupt multiple gangs at once.

"Under President Trump's leadership, Treasury is using every available tool to disrupt the cybercriminal ecosystem and protect the American people," said Gene Lange, who is performing the duties of the Under Secretary for Terrorism and Financial Intelligence. "We will continue targeting the actors who enable ransomware attacks against Americans and our critical infrastructure".

• Government report shows British kids mainly use a VPN to improve their privacy
• Only a fifth of VPN users use the tech to bypass age verification
• Pretending to be older is the most common way to dodge age checks

As the debate surrounding potential VPN restrictions heats up in the UK, a government report has cast doubt on whether such drastic measures are justified.

According to the study commissioned by the Department for Science, Innovation and Technology (DSIT), digital privacy is the primary driver behind VPN use among British children.

Content unblocking ranks as the second most common motivation, with children using the tools to access specific apps and media from other countries.

Crucially, the desire to bypass mandatory age checks ranks much further down the list, with only about a fifth of young VPN users actively using the software to evade age checks. This equates to just 7% of all British children using a VPN to access restricted platforms.

These findings challenge the narrative that restricting VPNs is vital to enforcing current age verification laws and the government's proposed under-16 social media ban.

The government is set to share evidence of its public consultation on children's online safety and VPNs this month.

In response to requests for comment, a spokesperson for DSIT shared a press release that confirms that "VPNs play a limited role in circumventing age check."

"As platforms implement more robust age verification to comply with the newly announced restrictions, many of the common routes used to bypass age checks today will become increasingly difficult," they continued.

Kids and VPNs: What the DSIT report found

Following a nationwide survey of over 2,000 young people aged 11 to 17, researchers at BMG Research discovered that familiarity with virtual private networks among British children is high.

58% of children surveyed reported that they are aware of the software, while roughly a quarter of all respondents admitted to using a VPN in their lifetime.

The underlying motivations of these young users appear to challenge the argument in favor of stricter controls.

Among active VPN users, 30% state they use the software specifically to secure their online privacy. This aligns with warnings from digital rights advocates who argue that restricting VPN access could strip vital security tools away from minors.

And while young people do use these apps to bypass content restrictions, the study shows they are primarily interested in evading regional entertainment geoblocks or school network restrictions rather than maliciously outsmarting age verification.

Bypassing age checks ranks fifth on the list of motivations. These findings mirror separate YouGov research commissioned by the VPN Trust Initiative, which revealed that a mere 1.4% of surveyed minors use a VPN specifically to access platforms meant for older demographics.

So how do children actually bypass age checks?

It seems that British children have found much simpler workarounds to evade online controls than using a VPN.

Over half of the children surveyed admitted they simply migrate to different platforms, with 37% choosing websites that completely lack age verification and 34% opting for services known to enforce weak, easily tricked checks.

Posing as an adult remains the most common tactic, with roughly 63% of those who bypass checks admitting they pretended to be someone older.

Specifically, 45% do so by giving a false date of birth during self-declaration checks, while a notable minority (11%) use their parents' or relatives' identification details.

The findings follow a stark warning to Downing Street from a coalition of more than 20 tech firms and privacy advocacy groups, which urged policymakers to protect digital rights and ensure that VPN tools remain unrestricted.

• 20+ digital rights groups and tech firms urge the UK not to restrict VPNs
• Age-gating VPNs would undermine the online privacy of millions, they warn
• Signatories believe VPN restrictions are ineffective, technically unfeasible

The UK government's ongoing debate around tightening online safety rules to protect kids has drawn fierce pushback from the global cybersecurity sector.

On July 9, a coalition of 24 major digital rights organizations and top VPN providers, including Amnesty International, ExpressVPN, NordVPN, Surfshark, and Mozilla, issued a stark warning to the UK government: leave VPNs alone.

In an open letter to the Secretary of State for Science, Innovation and Technology, Liz Kendall, the group stressed that while keeping kids safe is a shared goal, it must not come at the cost of breaking the internet's fundamental privacy infrastructure.

As lawmakers weigh up potential restrictions ahead of an expected online safety consultation update this month, the stakes for your digital privacy have never been higher.

If you currently use the best VPN to protect your personal data on public Wi-Fi or secure your connection while working remotely, new regulations could fundamentally alter how these tools work. Any move to force VPN providers into verifying the age of their users would require you to hand over sensitive personal data, effectively destroying the anonymity you pay to protect.

"Restricting VPNs would undercut security"

The heart of the coalition's argument is that virtual private networks (VPNs) are, first and foremost, essential security software.

"The challenge is ensuring measures strengthen child safety without weakening the privacy and security millions of people rely on every day, including children," the letter explains.

Beyond everyday consumers, the coalition notes that VPNs provide critical protection for vulnerable groups.

The open letter emphasizes that these tools are a lifeline for "human rights defenders and journalists, domestic abuse survivors, the LGBTQ+ community, and others at heightened risk online." As rights groups have noted previously, weakening this protection could actively infringe human rights.

Addressing the reality check of age verification head-on, the group didn't mince words about the dangers of ID checks.

"Age-gating VPNs would require everyone to surrender sensitive personal information simply to access tools designed to protect privacy," the letter states.

A technically unfeasible approach

Critics of the UK's proposed teen social media ban have repeatedly pointed out that restricting privacy tools is a flawed approach to child safety. The letter backs this up with hard data, pointing to Ofcom research which "found that only around 3% of children had used VPNs to access content meant for older audiences."

The coalition also highlights that teenagers will simply find other, lower-tech ways to bypass rules. "Evidence from Australia shows children are much more likely to get around age checks by not being asked, giving false information, or even drawing on a moustache," the letter adds.

Ultimately, the cybersecurity industry is warning that while restricting privacy tools is failing to protect kids, it will succeed in punishing regular users. "Blocking VPN traffic reliably is technically unfeasible," the letter warns, noting that it risks locking employers and schools out of the web, while pushing regular citizens toward "unregulated, data-exploiting services that are harder to oversee, leaving them less secure."

Rather than breaking encrypted tools, the coalition urges the government to focus its upcoming policies on the root causes of online harms, suggesting investments in "strong enforcement of platform obligations, better parental controls, investment in digital literacy, and safety- and privacy-by-design obligations."

• Proton launches a map to show how age verification laws spread globally
• Proton CEO said these laws will lead to "the death of online privacy"
• Alternatives to prevent digital safety are possible, Proton argues

It feels like an eternity ago, but it has only been less than a year since Australia made global headlines by introducing the world's first nationwide under-16s social media ban. Even longer, perhaps, since mandatory age verification checks have landed in the UK.

Over the past 12 months, however, mandatory age-verification regulations have been spreading rapidly across the world. The era of anonymous browsing — and perhaps the very concept of online privacy — may be quickly coming to an end.

To keep pace with these seismic changes, Proton — the Swiss-based company behind one of the best VPN and secure email services on the market — has launched an interactive map tracking the global spread of age verification laws.

While these laws continue to provoke criticism from scientists, tech experts, and digital rights advocates, Proton aims to ensure that the public remains properly informed by providing timely updates as new legislation advances.

Proton's age verification map

Proton's age verification map provides a real-time overview of where these measures are being introduced and how they are being implemented.

Clicking on any country reveals information about the progress of legislative proposals in that region, with the tool offering a detailed overview of the different approaches adopted by governments regarding age verification legislation.

A glance at the map is enough to show just how rapidly laws are proliferating.

In Europe, for example, 18 countries have already implemented or proposed age verification requirements targeting adult content. Fifteen of these have already introduced measures specifically aimed at social media platforms.

On the other side of the pond, 49 US states have put forward proposals, and 27 have successfully implemented mandatory age checks for websites with harmful content for minors. In addition, many states have either successfully implemented or are considering parental consent or verified age mechanisms for mainstream social apps.

But this pattern stretches way beyond Europe and North America. In the Asia-Pacific region and the emerging markets of Latin America, governments are targeting a wide range of channels, including adult websites, social media platforms, online gaming platforms, and apps.

The death of privacy worldwide?

Andy Yen, founder and CEO of Proton, strongly argued that requiring every user to provide their identifying information is simply tantamount to "the death of privacy online."

He is not alone in holding these views. Many privacy advocates and digital rights organizations argue that current age verification methods encourage the growth of surveillance while compromising users' privacy.

Critics also point to past failures in ensuring the security of sensitive data. Breaches involving Discord's third-party age verification service affecting over 70,000 users or the EU’s age verification app, allegedly hacked in two minutes, are just a few examples of the scale of the problem.

The picture looks even bleaker when one considers that many experts from youth organizations and children’s charities seem to agree that such methods could have harmful effects on young people browsing the Internet.

As opposition continues to grow — from scientists calling for the suspension of mandatory age verification to gaming groups and digital rights activists joining forces to prevent the erosion of Internet freedom — Yen argues that alternatives are possible.

Proton advocates for a different approach to child protection. One that does not compromise the very concept of online privacy and is based on client-side processing, with results that are fully anonymized thanks to end-to-end encryption and publicly accessible open-source code.

"We simply can’t afford to get this wrong. Who stands to benefit? The same tech giants who build today’s privacy nightmare," Yan said.

• Australian eSafety Commissioner views VPN detection as a "reasonable step" for tech companies enforcing age limits
• The watchdog notes that service providers must prevent workarounds under new industry codes
• Australia's position mirrors a growing global debate surrounding age assurance and VPNs

Australia's internet watchdog is keeping a close eye on VPN services as the country steps up its efforts to enforce strict online age verification rules.

According to documents obtained by The Guardian under freedom of information (FOI) laws, the Australian eSafety Commissioner expects tech platforms and service providers to actively block workarounds that allow users to bypass age-restricted content and social media bans.

The internal documents explicitly detail how the government plans to approach these privacy tools under its Unlawful Material Codes and Standards. Under the Codes, the documents state, "service providers must take reasonable steps to prevent workarounds like VPNs so eSafety will look at this when considering compliance with codes."

For everyday web users, this raises a troubling question: could turning on a virtual private network (VPN) to protect your personal data soon flag you as a circumventor?

As cybersecurity protections increasingly find themselves in the crosshairs of child safety regulations, digital privacy advocates are sounding the alarm.

The push for VPN detection

Under the new codes, the Australian government is placing the burden directly on industry providers to prevent the exposure of age-restricted material, defined by regulators as Class 1 and Class 2 material.

Because a VPN encrypts your internet traffic and spoofs your IP address, it can easily make you appear as though you are browsing from a different country, bypassing local geoblocks and age gates. That's exactly why VPN downloads skyrocketed after Australia enforced mandatory age verification for adult content last March.

However, Australian authorities are confident that platforms can counter this.

According to the FOI documents, the government's ongoing Age Assurance Technology Trial has convinced regulators that network detection is feasible. The documents note that "the Department of Infrastructure, Transport, Regional Development, Communications, Sport and the Arts knows that tech companies can tell when a VPN is in use."

Consequently, the eSafety Commissioner is treating the detection of these tools as a fundamental requirement. The internal log clarifies that "this is similar to eSafety’s regulatory guidance for the social media minimum age, where eSafety considers VPN detection as a reasonable step to prevent underage users from having an account."

A global ripple effect?

Australia is far from the only country struggling to balance child safety legislation with the right to online privacy. The debate over whether to treat VPNs as essential security software or mere circumvention tools is heating up worldwide.

Recent analysis of Australia's age verification rules suggests that trying to plug these "loopholes" could severely compromise the digital safety of the broader population. In fact, some experts argue that demanding that platforms actively block VPN connections sets a dangerous precedent for civil liberties.

The ripple effect is already visible across Europe.

As the EU launches its own age verification initiatives, regulators are increasingly signaling that VPNs might be next in line for restrictions. Similarly, the shifting role of VPNs in the UK has prompted rigorous discussions about whether incoming social media bans could lead to VPN restrictions.

Ultimately, the eSafety Commissioner’s plan highlights a growing reality: as governments worldwide roll out strict age assurance mandates, child safety measures and VPN use are on a collision course.

Whether everyday Australians will still be able to freely protect their data on public Wi-Fi without being blocked from their favorite sites remains to be seen.