Home › Guides · Updated 21 October 2026

Online Safety Act age checks and VPNs: what UK users need to know

How the Online Safety Act's age checks work since July 2025, what the law says about VPNs, the age-check methods sites can use, and how to protect your privacy when asked to prove your age.

Since the summer of 2025, many people in the UK have been asked to prove their age before viewing some websites and parts of social media apps. Interest in VPNs rose at the same time, and with it a lot of confusion about what is legal, what the rules actually require and what a VPN does or doesn't change. This guide sets out what the Online Safety Act requires, what the government and Ofcom have said about VPNs, and how to handle age checks with your privacy in mind.

This is general information, not legal advice.

What changed on 25 July 2025?

Under the Online Safety Act, Ofcom's rules mean that from 25 July 2025, all sites and apps that allow pornography need strong age checks so that children can't access it. Ofcom also expects the riskiest services to use strong age checks to protect children from content about suicide, self-harm and eating disorders, and other harmful material.

The key practical change is that ticking a box to say you are over 18 is no longer enough. Ofcom says it is not assessing individual pieces of content or telling services to remove legal material; its stated role is to stop children seeing harmful content, not to stop adults accessing legal content.

How sites can check your age

Ofcom lists several methods a site may use, either itself or through a specialist age-check company. They include:

• Facial age estimation: you show your face in a photo or video and software estimates your age.
• Open banking: you allow an age-check service to confirm with your bank that you are over 18.
• Digital identity services, such as digital ID wallets.
• Credit card checks: since you must be over 18 to hold a credit card, a valid card indicates an adult.
• Email-based age estimation, which looks at where your email address has been used, such as with banks or utilities.
• Mobile network operator checks: confirming whether your number has age filters applied.
• Photo ID matching: comparing an ID document with a live image of you.

All of these are set out in Ofcom's explainer for users, which also says the process should be technically accurate, robust, reliable and fair, and that you should be able to read a statement explaining which checks a site uses.

Are VPNs legal in the UK?

Yes. The government's own explainer states plainly that VPNs are legal in the UK. The Online Safety Act's duties fall on online platforms, not on individuals using privacy tools. For more on the wider legal position, see our guide: Is it legal to use a VPN in the UK?

What the law does do is make platforms responsible for preventing children bypassing protections. According to the same GOV.UK explainer, that includes blocking content that promotes VPNs or other workarounds specifically aimed at young users, and platforms that deliberately target UK children and promote VPN use could face enforcement action. Ofcom's guidance on highly effective age assurance sets out what services must do in more detail.

Does a VPN get around age checks?

A VPN changes the IP address websites see, which can make your connection appear to come from another country. That may change which version of a site you are shown. It does not make age checks disappear, for several reasons:

• many services identify UK users by signals other than IP address, such as the account's country, payment details or app store region;
• signing in to an existing account links your activity to that account wherever the connection appears to come from;
• services have duties to tackle circumvention, as the government's explainer sets out.

It is also worth thinking about trust. A VPN routes all of your traffic through the provider's servers. Choosing a provider just to avoid an age check, especially a free one with an unclear business model, can mean handing your browsing to a company you know little about. Our VPN checklist covers what to look for, and what a VPN can and cannot hide explains its real limits.

Protecting your privacy during age checks

Age checks involve personal data, so it is reasonable to be careful. The government says the measures platforms use must confirm your age without collecting or storing personal data unless absolutely necessary. It gives the example of facial estimation tools that estimate age from an image without saving it or identifying you, and notes many third-party services can simply tell a platform whether you're over 18.

Data protection law still applies. Ofcom says the Information Commissioner's Office (ICO) regulates data protection and that it may refer providers to the ICO if it has concerns. In March 2026 the ICO and Ofcom published a joint statement on age assurance to help services meet both their online safety and data protection obligations.

Practical steps:

• Read the site's age-check statement before you start, and choose the method that shares least about you. An estimate or a yes/no answer from your bank or mobile network reveals less than uploading a passport.
• Check who is doing the check. If a third-party provider is used, its name should be shown. Look for its privacy notice.
• Be wary of look-alike pages. Scammers can copy age-check screens to harvest ID documents or card details. Only verify on the site you meant to visit, and never send ID by email or chat.
• Don't reuse passwords on any account you create for verification.

Enforcement: what happens to platforms that don't comply

Ofcom can fine services that fail to comply up to £18 million or 10% of qualifying worldwide revenue, whichever is greater. In the most serious cases it can ask a court to impose measures on third parties such as internet providers, which could lead to a site being blocked or restricted in the UK.

For parents

The government's explainer expects platforms to make sure strangers have no way of messaging children and that children aren't recommended accounts to connect with. Age checks are one layer. Device-level parental controls, filters offered by your broadband provider and talking to children about what they see online remain important, because no single tool catches everything.

The bottom line

• VPNs are legal in the UK, and the Online Safety Act regulates platforms, not VPN users.
• Since 25 July 2025, porn sites and the riskiest services must use strong age checks; a tick box no longer counts.
• A VPN doesn't reliably remove age checks, and an untrustworthy VPN can create bigger privacy problems than the check itself.
• When you do verify, pick the method that reveals least and make sure you're on the genuine site.

Sources and further reading

• Ofcom: Age checks for online safety: what you need to know as a user
• GOV.UK: Keeping children safe online: changes to the Online Safety Act explained
• Ofcom: Guidance on highly effective age assurance (PDF)
• ICO: Joint statement from ICO and Ofcom on age assurance

Facts and links checked on 21 October 2026. Spotted an error? Tell us and we will correct it.