Who Is Responsible When Children Use VPNs To Access Banned Platforms?

The UK government has decided to ban social media platforms from offering services to children under 16 after all. The announcement comes after months of public discussion about children’s online safety and the effect social platforms have on young users.

More than 116,000 responses were submitted during a national consultation involving parents, children and specialists. According to the government, 9 in 10 parents backed a social media ban for children under 16. Two thirds of young people also agreed that children younger than 16 should not be allowed to use at least certain social media platforms.

Prime Minister Keir Starmer said, “Parents want to keep their kids safe and happy, but the online world has made that harder than ever.”

He continued, “I’ve heard first hand from families crying out for change and we will do right by them.”

The government expects legislation to reach Parliament before Christmas, and ministers expect the protections to begin in Spring 2027.

Starmer said, “That’s why we’re going further than any country in the world by banning social media for under-16s and putting protections in place to give kids their childhood back.”

Does A Social Media Ban Solve The Problem?

The government’s announcement looks mainly at social media platforms, but many people believe children’s digital lives extend far beyond just Instagram, TikTok and Snapchat.

Jason Michaelides, founder of parent founded tech company Orbiri, welcomed action from government, though he questioned how much a social media ban can achieve on its own.

He said, “Social media is just the tip of the iceberg. Banning it is a start, but without a plan for everything underneath, children are no safer than they were yesterday.”

Michaelides said children’s digital activity moves between many online environments throughout the day.

He said, “Social media platforms are one piece of a much bigger ecosystem keeping children glued to screens and families locked in daily battles they were never equipped to win alone. Children don’t live their digital lives just on TikTok and Snapchat. They move between messaging platforms, gaming spaces, live streaming and every other corner of the digital world that sits outside whatever list the government will publish.

“The harm is serious, it’s well-documented, and is deeper than Instagram and TikTok – the way content is relentlessly consumed and the lost opportunity cost of so many hours goes far beyond a few named apps. We know this because we’re hearing it directly from the parents and children taking part in Orbiri’s pilot in schools across London and the South East.”

People asking about gaming platforms, livestreaming services and messaging apps have become a big topic here. Government ministers have announced restrictions on livestreaming and communication between children and strangers through a broader group of online services.

Michaelides believes schools, parents and children need shared rules around smartphone use.

He said, “What will actually work isn’t a ban handed down from above to individual children. It’s collective action: schools, families and children working together around shared boundaries. Because when children are part of the decision and move together with their friends on safer smartphone usage, the rules don’t feel like punishment. They feel like something they own, like something everyone just does. And that changes everything.”

How Will Age Checks Work?

Enforcement has become one of the aspects of the proposal that people are speaking about the most.

The government intends to use highly effective age assurance measures and has asked Ofcom to examine the most effective methods for confirming that users are over 16.

That creates discussion around privacy and data collection. Parents want safeguards that work, though many people do not want platforms collecting unnecessary personal information.

Ricardo Amper, founder and chief executive of Incode, believes age verification can be carried out without storing large amounts of personal data.

He said, “What’s happening in the UK is part of a global shift toward protecting children online. When to act is a question for policymakers; how to do it well is a question for our industry — and the honest answer is that you don’t have to collect or store someone’s identity to confirm their age.”

Amper also explained how modern verification systems can work, saying, “If age can be estimated from a selfie, you don’t keep the photo. If a document is required, you need a date of birth and a face match, not the rest of what’s on it. Done right, age assurance protects children and privacy at the same time.”

Age verification will form a major piece of enforcement because ministers want to make it much harder for children to bypass restrictions.

What Happens Before Spring 2027?

The government views the ban as one measure aimed at children’s online safety.

Starmer said, “This is a line in the sand. Tech companies had their chance and failed, but we’re stepping in to protect children, back parents and set a new normal for future generations.”

Technology Secretary Liz Kendall also defended the government’s position.

She said, “Today we take a bold and significant step, towards creating a safer, healthier life online, for our children and future generations.”

Kendall continued, “Tech companies have had countless opportunities to keep children safe, yet they have failed to act. That is why we are a taking power away from the tech giants and putting it back in parents’ hands.”

Discussion around enforcement, privacy, messaging services and gaming spaces will continue as the legislation moves through Parliament.

Michaelides believes ministers now need to explain how the policy will work in practice.

He said, “Real enforcement can’t be left to the platforms that profit from keeping children engaged, or to exhausted parents fighting this battle household by household. And any approach that stops at legislation, without the longer-term framework needed to build genuine digital resilience for when restrictions eventually lift, isn’t solving the problem. It’s delaying it.”

He finished with a message for government:

“So while Starmer said a lot of the things that parents have been waiting to hear today, the problem is that’s all he did. Words without a plan aren’t a policy. They’re a press release. We welcome the ambition. Now show us the plan.”

What About Loopholes Such As VPN Use?

I’ve asked experts what they think will happen should kids start to use VPNs to try bypass these restrictions. What happens when they do, and who would be responsible here? This is what experts say…

Our Experts:

• Elmer Morales, Founder and CEO, koder.com
• Andrew Zack, Policy Director, Family Online Safety Institute, Family Online Safety
• Andrew Tran, Director and Senior Fraud Lawyer, LegalByte.
• Kasey Klenda, Attorney-at-Law, Partner, Shull & Klenda

Elmer Morales, Founder and CEO, koder.com

“Banning social media for kids without addressing VPNs is like locking the front door and leaving the window wide open.

“Yes, children will use VPNs to get around the ban. That is not a prediction. That is already happening. Tech-savvy teenagers figured out VPNs long before this legislation existed. The ban accelerates adoption among younger and less tech-savvy kids because now there is a reason to learn.

“The responsibility question is more complicated than most people want to admit. VPN companies are not children’s platforms. They exist to provide privacy and security for legitimate users worldwide. Holding them liable for how minors use their product is like holding car manufacturers responsible for teenagers who sneak out with the keys.

“That said, the hands-off approach is not sustainable either. The platforms being bypassed, the VPN providers enabling access, and the device manufacturers putting this technology in children’s hands all have a role to play. Waiting for government regulation to solve this is a losing strategy. The technology moves too fast.

“The real answer is that no single ban, platform, or tool is going to protect children online. What actually works is a combination of technical controls, digital literacy education, and parental engagement. Legislation that ignores how children actually behave with technology is not child protection. It is political theater.

“The UK ban is well intentioned. But without a credible enforcement mechanism that accounts for VPN circumvention, it will not achieve what it promises.”
 

Andrew Zack, Policy Director, Family Online Safety Institute, Family Online Safety

Does the social media ban mean that kids will just start overusing VPNs?
“Circumvention of bans is difficult to address, as we’ve seen since Australia’s under 16 social media ban went into effect in December 2025. FOSI’s recent research in Australia shows that enforcement has been inconsistent so far. Since the ban went into effect, 50% of surveyed children ages 10-15 kept access to at least one of their social media accounts. The eSafety Commissioner is aware of the large number of under 16s who still have access to their accounts and has committed to continuing to work with tech companies to improve compliance.

“We are disappointed that the UK announced plans to move forward with an under 16 social media ban with additional restrictions up until age 18. As FOSI noted in comments submitted to the UK’s DSIT, “FOSI generally does not support sweeping bans of technologies, instead favoring more targeted and proportional restrictions.” Online risks and harms are real, and can be addressed through more targeted protections such as user safeguards, risk-based and proportional age assurance, and safety by design requirements including safer default settings. Instead of deliberately targeting risky features, bans focus on prohibiting access — not actually making online platforms and environments safer for users.

“Even key voices in the UK, including Ian Russell — who has been impacted by social media harms more deeply and personally than most people in the world and recently shared his experience at FOSI’s European Forum in Brussels have expressed questions and doubts about this path forward.”

Can or should VPN use by minors even be stopped?
“Policymakers considering restrictions or regulations related to youth VPN use must carefully balance children’s rights to privacy, free expression, and access to information with broader online safety goals. We believe additional research is needed to better understand how young people use these tools, identify child-appropriate and reliable VPN services, and explore approaches that support both safety and digital rights. While there may not yet be a clear consensus solution, these issues warrant thoughtful, evidence-based consideration.

Do VPN companies have responsibility here?
“Privacy and cybersecurity are not FOSI’s core area of expertise. However, as VPNs increasingly intersect with online safety, we recognise that some VPN services are more trustworthy and secure than others, and that young people’s use of VPNs raises legitimate concerns when such tools are used to intentionally bypass online safety features, parental controls, or age-appropriate protections. This is an area that warrants further research and careful, evidence-based policy consideration.”

Andrew Tran, Director and Senior Fraud Lawyer, LegalByte

“As Director and Senior Fraud Lawyer at LegalByte, I advise businesses, institutions, and “individuals on cybersecurity, digital regulation, online safety, privacy, and emerging technology risks. My work regularly involves assessing the legal, technical, and policy implications of internet technologies, including VPNs, age-verification systems, online platforms, and digital compliance frameworks.

“The introduction of age-based restrictions on social media platforms will almost certainly increase interest in VPNs among younger users. Whenever access controls are introduced online, a proportion of users will attempt to circumvent them, and VPN technology is one of the most accessible tools available for doing so.

“The more important question is whether responsibility should fall on VPN providers when children use their services to access restricted platforms. In most cases, VPNs are legitimate privacy and security tools used by businesses, individuals, journalists, and organisations to protect communications and personal data. Their primary purpose is not to bypass age restrictions, even though they can be used in that way.

“From a legal and policy perspective, responsibility is likely to remain shared among multiple stakeholders. Social media platforms are responsible for implementing effective age assurance measures, parents retain an important role in supervising online activity, and regulators are responsible for establishing clear compliance frameworks. Placing sole responsibility on VPN providers would be challenging because VPN companies generally have limited visibility into the content or services users access once traffic is encrypted.

“A key issue is whether policymakers want VPN providers to become active gatekeepers of online behaviour. Requiring VPN operators to monitor destinations, inspect user activity, or verify ages would fundamentally alter the privacy model on which many VPN services are built. Such measures could create significant privacy, security, and enforcement concerns of their own.

“The reality is that technological restrictions alone rarely eliminate access. Historically, users who are determined to bypass controls often find alternative methods. The more sustainable approach is likely to combine age assurance mechanisms, platform accountability, parental oversight, digital literacy education, and proportionate enforcement rather than relying on any single technology provider to solve the problem.

“The debate ultimately highlights a broader challenge facing online safety regulation: balancing child protection objectives against legitimate expectations of privacy, security, and open access to technology. VPN providers are part of that discussion, but they are unlikely to be the sole or primary solution.”

Kasey Klenda, Attorney-at-Law, Partner, Shull & Klenda

“It is possible that some children are simply going to use the VPNs available to them and find a way to access the social media platforms they are not allowed on. That does not mean that those restrictions have failed. Laws are created to minimise risk. The question is how to balance child safety, privacy, parental involvement, and access to legitimate technology.

“I do not think that responsibility lies exclusively with VPN companies. VPNs have many legitimate and useful purposes, like privacy protection as well as cybersecurity. Social media providers, parents, policymakers and the technology industry all contribute to safer online experiences for young users. I find a balanced solution consisting of realistic age-verification measures, parental awareness, digital literacy tools and education and enforcement by platforms themselves.

“Technology is not a complete solution. True long-term success relies on helping children to understand internet use safely, and providing families and platforms with the tools that enable responsible use.”