VPN firms and digital rights groups join forces to urge the UK government to leave VPNs alone

• 20+ digital rights groups and tech firms urge the UK not to restrict VPNs
• Age-gating VPNs would undermine the online privacy of millions, they warn
• Signatories believe VPN restrictions are ineffective, technically unfeasible

The UK government's ongoing debate around tightening online safety rules to protect kids has drawn fierce pushback from the global cybersecurity sector.

On July 9, a coalition of 24 major digital rights organizations and top VPN providers, including Amnesty International, ExpressVPN, NordVPN, Surfshark, and Mozilla, issued a stark warning to the UK government: leave VPNs alone.

In an open letter to the Secretary of State for Science, Innovation and Technology, Liz Kendall, the group stressed that while keeping kids safe is a shared goal, it must not come at the cost of breaking the internet's fundamental privacy infrastructure.

As lawmakers weigh up potential restrictions ahead of an expected online safety consultation update this month, the stakes for your digital privacy have never been higher.

If you currently use the best VPN to protect your personal data on public Wi-Fi or secure your connection while working remotely, new regulations could fundamentally alter how these tools work. Any move to force VPN providers into verifying the age of their users would require you to hand over sensitive personal data, effectively destroying the anonymity you pay to protect.

"Restricting VPNs would undercut security"

The heart of the coalition's argument is that virtual private networks (VPNs) are, first and foremost, essential security software.

"The challenge is ensuring measures strengthen child safety without weakening the privacy and security millions of people rely on every day, including children," the letter explains.

Beyond everyday consumers, the coalition notes that VPNs provide critical protection for vulnerable groups.

The open letter emphasizes that these tools are a lifeline for "human rights defenders and journalists, domestic abuse survivors, the LGBTQ+ community, and others at heightened risk online." As rights groups have noted previously, weakening this protection could actively infringe human rights.

Addressing the reality check of age verification head-on, the group didn't mince words about the dangers of ID checks.

"Age-gating VPNs would require everyone to surrender sensitive personal information simply to access tools designed to protect privacy," the letter states.

A technically unfeasible approach

Critics of the UK's proposed teen social media ban have repeatedly pointed out that restricting privacy tools is a flawed approach to child safety. The letter backs this up with hard data, pointing to Ofcom research which "found that only around 3% of children had used VPNs to access content meant for older audiences."

The coalition also highlights that teenagers will simply find other, lower-tech ways to bypass rules. "Evidence from Australia shows children are much more likely to get around age checks by not being asked, giving false information, or even drawing on a moustache," the letter adds.

Ultimately, the cybersecurity industry is warning that while restricting privacy tools is failing to protect kids, it will succeed in punishing regular users. "Blocking VPN traffic reliably is technically unfeasible," the letter warns, noting that it risks locking employers and schools out of the web, while pushing regular citizens toward "unregulated, data-exploiting services that are harder to oversee, leaving them less secure."

Rather than breaking encrypted tools, the coalition urges the government to focus its upcoming policies on the root causes of online harms, suggesting investments in "strong enforcement of platform obligations, better parental controls, investment in digital literacy, and safety- and privacy-by-design obligations."