Is a VPN Legal in the UK? Online Safety Act and the VPN Ban Debate (2026)

Yes, using a VPN is legal in the UK, for adults and children alike, as of October 2026. No UK law bans personal VPN use, and the Online Safety Act doesn't mention VPNs at all. In July 2026 the government settled a year of debate when it said: 'We will not ban or age-gate VPNs.' A House of Lords vote to ban VPNs for under-18s was overturned by the Commons in March 2026.

Below is what the Online Safety Act requires and from whom, what happened to each VPN proposal, and what it all means for you today. Every date links back to an official record. This is general information, not legal advice.

Is a VPN legal in the UK?

Yes. VPNs are lawful to buy, install and use in the UK. The government's own 2026 consultation describes 'the legitimate and lawful use by adults of tools such as Virtual Private Networks (VPNs)'. Its July 2026 response went further, saying the government would neither ban VPNs nor require age checks to use them.

Two limits apply, as they do everywhere. Using a VPN doesn't make an unlawful act lawful; an offence is still an offence whatever connection you use. And private rules still bind you: an employer can ban VPNs on work devices, and a streaming service can refuse VPN connections or end your account under its terms. Neither of those is a criminal matter.

What the Online Safety Act requires, of sites, not users

The Online Safety Act 2023 became law on 26 October 2023. It puts duties on online services, mainly user-to-user platforms, search engines and pornography sites, not on the people who use them. We checked the full current text on legislation.gov.uk: the words 'VPN', 'virtual private network' and 'circumvent' don't appear in it.

The duties that set off the VPN debate came in two stages. From 17 January 2025, pornography publishers had to check users' ages under section 81. From 25 July 2025, according to the government's consultation document, 'highly effective age assurance' became mandatory for services likely to be accessed by children.

The penalties fall on companies. Under Schedule 13 of the Act, the maximum fine is £18 million or 10% of the provider's qualifying worldwide revenue, whichever is greater. The government's explainer adds that senior managers can face criminal action if their company ignores Ofcom's information requests. In the most serious cases, with a court's agreement, Ofcom can require payment providers, advertisers and internet providers to stop working with a site. Nothing in that list applies to an individual who uses a VPN.

Why VPNs entered the debate

When age checks arrived, many people looked for a way round them, and VPNs were the obvious one. A VPN makes a connection appear to come from another country, where a UK age check may not apply. The government's figures, citing Ofcom, show daily UK VPN users rising from about 650,000 before 25 July 2025 to over 1.4 million in mid-August 2025, before falling back.

That spike is what campaigners pointed to. But the government's own document adds that 'early evidence does not suggest the peak in VPN use was driven by children seeking to bypass age assurance processes'. In its July 2026 response it noted that children mostly get round age checks with simpler methods, such as entering a false birthdate or borrowing someone else's account.

The under-18 VPN proposals: the Lords amendment and the 2026 consultation

The closest the UK came to restricting VPNs was an amendment to the Children's Wellbeing and Schools Bill. On 21 January 2026 Lord Nash moved an amendment titled 'Action to prohibit the provision of VPN services to children in the United Kingdom'. The House of Lords passed it by 207 votes to 159. It would have required the government, within 12 months, to make regulations banning VPN services for anyone under 18. Those regulations could have required VPN providers to age-check everyone connecting from the UK.

The amendment didn't survive. On 9 March 2026 the House of Commons voted 321 to 106 to disagree with it, and on 25 March the Lords chose not to insist on it. The Children's Wellbeing and Schools Act 2026 became law on 29 April 2026 without any VPN clause; we searched its text. Instead it gave ministers a general power, as a new section 214A of the Online Safety Act, to restrict children's access to specified online services after a consultation.

That consultation, 'Growing up in the online world', ran from 2 March to 26 May 2026. It asked directly whether 'Everyone should go through age checks to access a VPN if it would prevent children using them'. In its response, published on 15 July 2026, the government said no: 'We will not ban or age-gate VPNs.' It said that requiring everyone to pass age checks for a VPN 'would impose significant compliance costs, affect the privacy of millions of legitimate adult users, and create new security vulnerabilities'.

What the evidence says about children and VPNs

The consultation drew more than 116,000 responses, and the evidence the government published cuts against a ban. It cites Internet Matters research finding that 8% of children had used a VPN in the past twelve months, and that 66% of those did so to protect their personal data. Childnet found that 38% of child VPN users surveyed used one to stay safe online and protect their privacy.

On getting round age checks, the government's response quotes Internet Matters again. 32% of children admitted bypassing age checks, but the commonest methods were entering a fake birthdate (13% of 9-16-year-olds) and borrowing someone else's account (9%), not VPNs. Asked what to prioritise, 38% of respondents favoured more education for children, against 34% who favoured restricting children's access to VPNs.

One consultation response the government quoted put it plainly: banning VPNs 'would remove these protections without making children meaningfully safer'. The government chose to target the platforms where age checks matter instead.

What Ofcom and the government will do instead

The government chose a set of softer measures. It has asked Ofcom to research what services can do to detect and limit circumvention on their platforms, including through VPNs. It says in-scope services 'must take robust steps to prevent, detect and respond to underage circumvention'. Its consultation summary also puts 'an onus on social media companies to detect and prevent VPN use among under-16s to access their services'.

VPN providers aren't regulated by any of this, but the government 'call[s] on VPN providers to engage with government on making their products safer and less accessible to children without parental consent'. It also plans practical guidance for parents on how VPNs work at home. And it left the door open: it says it is 'prepared to take further action on this, should evidence show that circumvention is not being tackled adequately'.

In practice, that means the pressure lands on the platforms. A social network may block or question connections from known VPN addresses for users it believes are under 16. That's the platform meeting its duties. It isn't a law against you using a VPN.

What it means for UK users today

For adults, very little changes. You can keep using a VPN for privacy on public Wi-Fi, for work, or while travelling. Some UK sites may still ask for age verification, and some may treat VPN connections with suspicion, but that's their compliance choice.

For parents, the government's message is that VPNs aren't the main way children get round age checks, and that banning them would remove real privacy protections. If you want to manage VPN use at home, router and device-level parental controls are the tools, and the promised government guidance should help.

If you're choosing a VPN in the UK, choose on privacy and trust rather than on 'bypassing' anything. Our best VPN for the UK guide ranks five providers on UK server cities, audits and prices in pounds. Proton VPN is Swiss-based and has a free plan without a data cap, and NordVPN has had its no-logs claims independently assessed six times, the last four by Deloitte, most recently in late 2025. Mullvad accepts anonymous payment and pays us no commission. Travelling further afield? Our VPN rules by country guide covers places where the law is strict.

How the UK compares

The UK is now firmly among the countries where VPNs are legal and unrestricted for individuals, alongside most of Europe and North America. Its debate was about children's access to adult and social media content, not about controlling information. That is a different question from the one travellers face in places like China, where only approved VPN services are authorised, or the UAE, where VPNs are legal but misuse carries heavy fines. Our guides to China and the UAE cover those rules, and the countries that restrict VPNs list covers the rest.

Edge cases

• Under-18s: there's no law stopping a teenager using a VPN. Some platforms may block suspected under-16s on VPNs to meet their own duties.
• Schools and employers: they can ban VPNs on their networks and devices. Breaking those rules can bring disciplinary action, but it isn't a crime.
• Streaming services: BBC iPlayer is UK-only by its terms, and services can block VPNs. That's a contract matter between you and the service.
• Future changes: section 214A lets ministers make regulations without a new Act. Any VPN-related change would most likely come through regulations under that power, so watch for them.