Britain Doesn’t Have a VPN Problem. It Has an Age-Verification Infrastructure Problem.

That is the direction of Britain’s latest online-safety debate — and we are asking the wrong question.

The UK is moving toward tougher age restrictions online. According to the government’s own fact sheet, from spring 2027, under-16s will no longer be able to use certain social media services.

The government also openly acknowledges a problem: young people may try to get around age checks with VPNs. Research has been commissioned, with a further government update expected after that work. No blanket UK VPN ban has been announced, and the same official material recognises that VPNs have legitimate uses.

Good.

Then let’s have the real argument before panic turns into bad infrastructure.

The wrong question

Yes, a VPN can sometimes help someone bypass a badly designed age restriction.

But that does not make the VPN the root problem.

It makes the age restriction badly designed.

That distinction matters.

Because once a government starts treating every workaround as the next thing to restrict, it enters an endless game it cannot win.

Block one route. Users find another. Block that one. Another appears.

A teenager can use a VPN. Or someone else’s account. Or a shared device. Or an adult’s phone. The UK government’s own consultation material acknowledges several of these alternative routes.

Why is Britain trying to police every possible bypass instead of building one trustworthy way to prove age?

The missing infrastructure

That is the missing infrastructure.

And for years, governments have avoided owning it.

First, tell 18+ websites to verify people.

Fine.

Then tell social platforms to work out who is a child.

Fine.

Then discover that some users can route around location-based restrictions with VPNs.

So what comes next?

Make VPN providers verify age too?

At what point does the state stop writing rules for everyone else and provide one basic piece of infrastructure itself?

Because right now, the model is backwards.

The government creates the legal threshold. The website carries the verification burden. The platform carries the liability. The user carries the privacy risk.

And when the system can be bypassed, another piece of the internet gets blamed.

That is not a serious architecture.

It is responsibility being pushed downhill.

I am not arguing against age restrictions.

I am arguing that a serious age restriction deserves serious infrastructure.

What a better system could look like

Here is what that could look like.

The government — or a tightly regulated public identity framework authorised by law — verifies the foundational identity information.

Once.

It keeps responsibility for that sensitive layer.

Then, when an authorised service needs to know whether a person qualifies for something, it does not receive the person’s entire identity.

It gets the smallest possible answer.

16+? Yes or no.

18+? Yes or no.

That is it.

Apple does not need my passport history.

Google Play does not need a copy of every government record.

TikTok does not need my exact date of birth.

An adult website does not need to become a warehouse of identity documents.

A VPN company certainly should not need to know who I am merely because a teenager somewhere might misuse a tunnel.

The government keeps the foundational identity responsibility. Authorised systems receive a limited age credential. Services get eligibility, not identity.

That is the difference.

And no, Apple and Google have not already built this exact British system.

But the building blocks are no longer hypothetical.

Apple’s Declared Age Range framework can let apps request age-range information without necessarily receiving an exact birthdate. Google’s Play Age Signals API can return age-related signals for eligible users in applicable jurisdictions.

Read that again.

The technology industry is already experimenting with ways to answer:

“What age band is this user in?”

without always answering:

“Who exactly is this person?”

That is the direction Britain should be pushing harder.

Not toward more companies collecting identity.

Toward fewer companies needing it.

Imagine the practical difference.

A 14-year-old attempts to download an app legally restricted to older users.

The store receives an authorised age-status signal.

Download denied.

The app developer never sees a passport.

The VPN provider never becomes an identity checkpoint.

The user does not upload the same document to five unrelated companies.

For an 18+ service, the credential answers 18+. For a 16+ service, it answers 16+.

Different legal thresholds.

Same basic trust infrastructure.

Why targeting VPNs misses the point

And before someone says it: no, this would not solve everything.

App stores do not control the entire internet. Websites exist. Shared devices exist. Alternative app distribution exists. Old accounts exist.

Determined teenagers are, historically, quite good at finding buttons adults forgot about.

But that is not an argument for targeting VPNs.

It is the argument against pretending VPN restrictions solve the problem.

A VPN block is not a silver bullet either.

The difference is that an age-credential layer attacks the actual problem — proving eligibility — while a VPN restriction attacks one current method of avoiding it.

One builds infrastructure.

The other plays whack-a-mole.

And the case for caution becomes even stronger when you look at the government’s own evidence.

The official UK consultation recognises VPNs as tools with legitimate uses including remote work, business access, privacy and data protection. It also says early evidence did not indicate that the surge in VPN usage after age-assurance requirements was primarily driven by children trying to bypass those checks.

That should matter.

A lot.

Because if you are considering restrictions on a general-purpose security and privacy technology, the burden of proof should be high.

“Someone could misuse it” is not enough.

Someone can misuse encrypted messaging. Someone can misuse cloud storage. Someone can misuse a browser. Someone can misuse a rented server.

The internet is full of dual-use tools because general-purpose technology is, by definition, general purpose.

And VPNs do more than help someone watch a foreign streaming catalogue.

They support remote access. Cross-border work. Corporate networks. Privacy on hostile connections. Sensitive communications.

The government knows this. Its own material says so.

The responsibility problem

Which brings us back to the uncomfortable part.

This debate is not really about whether children need protection.

They do.

It is not about whether age limits should be enforceable.

If Parliament creates them, they should be.

The question is who should carry the basic responsibility for making those limits technically credible.

So far, the pattern has been remarkably convenient for the state.

Create the rule. Push verification onto adult websites. Expand obligations across platforms. Discover circumvention. Look at VPNs. Push responsibility outward again.

But if age is becoming a legal key to the digital world, then age eligibility is becoming infrastructure.

And governments do not get to demand infrastructure-level outcomes while permanently outsourcing the infrastructure-level responsibility.

Build a system where the state can attest the minimum fact required.

Let authorised app marketplaces and services consume a narrow 16+ or 18+ signal.

Keep raw identity data away from as much of the public internet as possible.

Make privacy minimisation part of the architecture, not a promise buried in a policy page.

Then deal separately with genuine circumvention.

Because right now, Britain risks doing the opposite:

asking more private companies to know more about us because the government built less than it should have.

That is the real contradiction.

A country worried about online privacy should not solve age verification by multiplying identity checkpoints.

A country worried about cybersecurity should not casually turn a security tool into a suspect category.

And a government worried about children should not confuse a visible workaround with the underlying failure.

Why should a VPN company need to know who I am because the state refuses to provide one basic fact — whether I am old enough?

Protect children.

Enforce the law.

But build the missing infrastructure first.

Because Britain does not have a VPN problem.

It has a government-responsibility problem disguised as a technology problem.