Joint Letter: Protect VPNs

Digital Privacy
Joint Letter: Protect VPNs
Dear Secretary of State,
Protect children online without making the Internet less secure
Protecting children online is an objective we all share. The challenge is ensuring measures strengthen child safety without weakening the privacy and security millions of people rely on every day, including children.
As organisations committed to a safe, secure, and rights-respecting internet, we are concerned by suggestions that the Government restrict virtual private networks (VPNs). VPNs are cybersecurity tools. They help people protect personal information on public Wi-Fi, enable secure remote working, allow students to access education networks safely, and help small businesses protect their systems. VPNs are essential for human rights defenders and journalists, domestic abuse survivors, the LGBTQ+ community, and others at heightened risk online.
The evidence does not support assumptions that young people use VPNs to bypass age restrictions. Ofcom’s research found that only around 3% of children had used VPNs to access content meant for older audiences. Evidence from Australia shows children are much more likely to get around age checks by not being asked, giving false information, or even drawing on a moustache.
Restricting VPNs would undercut the security and privacy of millions, without making children safer. Age-gating VPNs would require everyone to surrender sensitive personal information simply to access tools designed to protect privacy. Blocking VPN traffic reliably is technically unfeasible, and risks blocking employers, schools and public authorities using VPNs from accessing parts of the web. This would push people away from compliant and reputable VPN providers toward unregulated, data-exploiting services that are harder to oversee, leaving them less secure.
The Government should focus on policy interventions that address the root causes of online harms: strong enforcement of platform obligations, better parental controls, investment in digital literacy, and safety- and privacy-by-design obligations.
Children deserve an Internet that is safe, private, and secure. Those objectives should reinforce one another, not come into conflict.
Yours sincerely,
• Amnesty International
• Big Brother Watch
• Defend Digital Me
• ExpressVPN
• Global Partners Digital
• Index on Censorship
• Internet Infrastructure Coalition
• Internet Society
• Internet Society UK
• lnternews
• IPVanish
• Liberty
• Mozilla
• Mullvad VPN
• Mysterium VPN
• NordVPN
• Open Rights Group
• Proton
• Reporters Without Borders
• Stop Killing Games
• Stop Killing Internet
• Surfshark
• Tuta
• VPN Trust Initiative

Facts Only

* Organizations include Amnesty International, Big Brother Watch, Defend Digital Me, ExpressVPN, Global Partners Digital, Index on Censorship, Internet Infrastructure Coalition, Internet Society, Internet Society UK, Inews, IPVanish, Liberty, Mozilla, Mullvad VPN, Mysterium VPN, NordVPN, Open Rights Group, Proton, Reporters Without Borders, Stop Killing Games, Stop Killing Internet, Surfshark, Tuta, and VPN Trust Initiative.
* VPNs are described as cybersecurity tools for protecting personal information on public Wi-Fi, enabling secure remote working, allowing safe access to education networks, and system protection for small businesses.
* Ofcom’s research found that only about 3% of children had used VPNs to access content meant for older audiences.
* Evidence from Australia suggests children bypass age checks by not being asked, providing false information, or using physical cues like a moustache.
* Restricting VPNs would undermine the security and privacy of millions without making children safer.
* Age-gating VPNs would necessitate users surrendering sensitive personal information.
* Reliably blocking VPN traffic is technically unfeasible.
* Blocking VPN traffic risks excluding employers, schools, and public authorities from accessing parts of the web.

Executive Summary

Organizations advocating for a secure, rights-respecting internet express concern regarding suggestions that governments should restrict Virtual Private Networks (VPNs). VPNs are positioned as essential cybersecurity tools that facilitate activities like protecting personal information on public Wi-Fi, enabling secure remote work, and providing safe access to education networks. Advocates argue that restricting VPNs would undermine the security and privacy of millions without improving child safety. They contend that age-gating VPNs would require users to surrender sensitive information simply to access privacy tools, and reliable blocking of VPN traffic is technically unfeasible, risking the exclusion of legitimate users like employers and educational institutions. Instead, advocates propose focusing on policy interventions addressing root causes of online harm, such as platform obligations, parental controls, digital literacy, and safety-by-design mandates.

Full Take

The central tension in this argument resides between an immediate perceived security risk—the potential use of VPNs by minors—and a broader commitment to digital rights and infrastructural integrity. The argument moves from specific concerns about age-gating VPN access to a systemic critique of governmental control over digital infrastructure. The assertion that blocking VPN traffic is technically unfeasible introduces a necessary complexity: technological feasibility must be weighed against ideological objectives.
The narrative pivots on establishing a hierarchy of priorities: whether restrictive measures targeting VPNs provide proportionate security gains or impose unacceptable costs on overall digital security, privacy, and access for the general populace. This structure implicitly frames the debate not as "VPNs vs. Safety," but as "Control over Access vs. Security by Design." The implication is that technological solutions (like age-gating) are insufficient substitutes for structural policy changes focused on platform accountability and user education.
The pattern detected involves framing a technological tool (VPN) as an amorphous threat that must be curtailed, rather than analyzing the specific mechanisms of data flow or access control. This utilizes emotional appeal regarding vulnerability while simultaneously grounding the argument in technical limitations regarding enforcement. The core assumption is that restricting a means of privacy protection will invariably lead to worse outcomes for vulnerable groups online, suggesting a pattern related to justifying state intervention by positioning it as the only means to ensure universally safe and private digital environments.
Bridge Questions: If the focus shifts from restricting the tool itself to mandating specific data handling protocols within VPN services, what verifiable mechanisms could enforce privacy while maintaining infrastructure openness? How should the public differentiate between actual security risks posed by anonymization versus the necessity of robust access controls in regulated environments? What are the tangible, measurable metrics that define a "safe and secure" internet for children that do not conflict with existing principles of digital freedom?