Banning children from VPNs and social media will erode adults’ privacy

A proposed new law banning children in the UK from using social media and virtual private networks (VPNs) would frustrate adults and erode their privacy, as they will have to verify their age to use a host of everyday sites and services, warn legal experts.

The UK’s Online Safety Act (OSA) came into force in July 2025, forcing websites to block children from seeing pornography and content that the government deems dangerous. The legislation was intended to make the internet safer, but tech-savvy children can easily sidestep the measures.

Facial-recognition technology designed to verify ages can be fooled by using screenshots of video game characters, and VPNs make it trivial to appear to websites as a user from another country where age checks aren’t mandated.

So news that the most visited porn website saw a 77 per cent drop in visits from the UK in the wake of the OSA should perhaps be taken with a pinch of salt – users are probably just changing settings to appear as if they are coming from countries where age checks are unnecessary.

Now, opposition peers in the House of Lords have proposed amendments to the upcoming Children’s Wellbeing and Schools Bill, which is currently making its way through Parliament, that appear to attempt to close these loopholes. But their broad wording means that they will probably affect far more than social media.

The bill was introduced by the Department for Education to support children in care and improve the quality of education. But digital rights expert Heather Burns says it has become a “monster”, with online safety clauses shoehorned into a largely unrelated law.

Debates on the bill have seen lawmakers “talking about online safety one minute and literally school milk the next”, says Burns. “They’ve basically piled outstanding grievances about the Online Safety Act into this bill.”

One amendment seeks to ban children under 16 from using social media, but defines it rather broadly as “user-to-user services”. This means that a host of other platforms will fall into the same category, including Wikipedia, WhatsApp, forums or even a shared family calendar.

Another amendment bans the use of VPNs for those under 16. Given how easy it is for age-verification tools to be fooled, this solution isn’t without obvious flaws.

“They’re dreadful amendments,” says Neil Brown at the law firm decoded.legal. He thinks the proposed legislation risks making a variety of everyday services illegal for children to use, while also forcing adults into mandatory age checks to use them, which risks exposing their browsing habits to the government or hackers, and to the public if the data is ever leaked. He is also sceptical of the core argument, which is that banning children from services makes them safer.

“I am absolutely unconvinced that banning children from social media is in any way the right way of solving it,” says Brown. “The bit that’s lacking to me, the massive gap in all this, is, can someone please set out clearly and concisely what is the problem that they are trying to solve?”

Brown says that there is a broad consensus that the OSA isn’t fit for purpose, but there are differing opinions on why: child safety campaigners say it doesn’t go far enough, while digital rights campaigners say it goes too far.

He is also doubtful that these amendments will make it through Parliament, as the Labour government has already said that it will consult separately on a VPN ban for children and on access to social media. Australia has already banned social media for those aged under 16, and the European Union is considering similar legislation.

James Baker, a spokesperson at the Open Rights Group, told New Scientist that the amendments would allow the secretary of state for the Department for Science, Innovation and Technology to add sites and services at will to a list that makes them fall under the department’s remit.

“That would require adults to hand over personal or biometric data to third-party providers to generate a digital age credential simply to access lawful content. Child safety is vital, but giving ministers sweeping powers to make communication conditional on digital ID is a profound and risky expansion of state control,” says Baker.

Burns warns that the legislation would leave a paper trail of citizens’ browsing habits, which can be risky either now or in the future. The US Congress’s Committee on Oversight and Government Reform recently demanded details of Wikipedia users who edited an article on the Israel-Palestine conflict, for instance.

“It’s this sort of witch hunt culture, and if Wikipedia had an age-verification system in place, they would have been able to pull up that data,” says Burns. “That is the future that some people in the UK seem to want by mandating an age ID check.”

The Department for Education, which proposed the bill, directed New Scientist’s questions about it to the Department for Science, Innovation and Technology, which didn’t respond.