UK Online Safety Act’s under-16 social media ban raises VPN and enforcement concerns

Act’s impact and enforcement challenges

The Online Safety Act (OSA), introduced three years ago to protect children and vulnerable adults online, has been described by VPN providers and charities as a 'heavy-handed approach' with only partial success. According to a report by UK regulator Ofcom, there has been no significant overall change in the share of children encountering harmful content since the Act’s introduction.

Enforcement has proven difficult, particularly for smaller platforms that lack the resources to comply or deliberately ignore the law. The Molly Rose Foundation, a UK-based charity, has warned that timid regulation could cost lives, emphasizing the need for stricter measures.

VPN usage and privacy concerns

VPN providers, including ExpressVPN and Proton, have raised concerns about the under-16 social media ban’s potential to drive under-18s toward unregulated or riskier platforms. Dr Peter Membrey, Chief Research Officer at ExpressVPN, noted that while VPNs can help users bypass restrictions, they are not a primary tool for children attempting to access restricted content.

Ofcom’s findings support this: only 7% of children used VPNs to access restricted materials when age verification was introduced in 2025. The majority of children cited privacy as their primary reason for using VPNs, rather than circumventing restrictions.

Research by telecom provider EE suggests that 42% of 11-15-year-olds may attempt to bypass the under-16 social media ban. VPN providers warn that restricting VPN access could expose users to unsafe alternatives, compromising their data and privacy.

Earlier reporting on age verification and VPNs

The UK’s push for age verification under the OSA aligns with earlier reports on Ofcom’s recommended methods for enforcing the under-16 social media ban. These measures aim to balance child protection with privacy but may require adults to verify their age, raising broader concerns about digital identity and surveillance.

Proton, a key player in the VPN and privacy space, has previously faced internal challenges over AI-driven workforce changes. The company’s public apology and reversal of its AI re-interview policy highlighted tensions between innovation and employee trust, a dynamic that could resurface as it navigates evolving regulations like the OSA.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

The UK’s Online Safety Act was designed to create a safer online environment for children, but its reliance on age verification and platform-level restrictions may be creating unintended consequences. For founders and operators in the digital privacy, cybersecurity, and social media spaces, the Act’s challenges highlight three critical lessons:

First, regulation that fails to account for user behavior—such as the use of VPNs or the shift to unregulated platforms—risks pushing users into riskier environments. This is particularly relevant for startups building compliance tools, who may need to anticipate workarounds rather than assume outright adherence.

Second, the Act’s uneven enforcement exposes a gap in the market for scalable, affordable solutions that help smaller platforms meet compliance demands. Founders in the regtech or legal tech space may find opportunities to build tools that simplify age verification, content moderation, or reporting without requiring extensive resources.

Finally, the debate over VPNs underscores a broader tension between privacy and safety. Companies like Proton and ExpressVPN are positioning themselves as allies of user privacy, but their warnings about unsafe alternatives reveal the risks of a fragmented regulatory approach. For startups in the privacy or cybersecurity sectors, this could mean an increased demand for products that balance compliance with user trust—particularly in markets where regulation is evolving.

Related on Lazyfounder

• ExpressVPN
• Proton
• Ofcom
• Ofcom outlines age verification methods for UK social media under-16s ban
• Proton CEO apologizes after AI workforce overhaul sparks backlash