We recently found out that the UK Government is spending millions on VPNs despite ongoing discussions about VPN bans for children.
While most of those uses are related to corporate VPNs – which are widely used to allow access to internal intranets and secure resources while working from home – many cases are related to consumer VPNs.
“The main conflict that your research highlights is hard to ignore. The UK government is spending millions on VPN technology to protect its data while testing policies that would restrict the same technology to everyone.”
Comparison problem
“It is encouraging to see Government and regulators such as Ofsted and Ofcom approving the use of VPNs,” began David Peterson, General Manager of Proton VPN.
“Their investment highlights the role of VPNs as important cybersecurity and privacy tools.”
But, as pointed out by Pete Membrey, Chief Research Officer at ExpressVPN, “Consumer VPNs use the same basic technology. [as corporate VPNs] for the same purpose.”
“If VPNs are trusted to protect government systems and sensitive data, it’s hard to justify denying individuals access to the same protections.”
So why limit the availability of these tools to consumers if they are trusted at high levels?
As Membrey notes, “secure network access is not an exclusive right reserved for institutions.”
The biggest problem of the Government
The government’s main concern remains age verification. But, as Windscribe’s Sak puts it, “kids are smart” and “will find strategies to work with any technological limitation”.
VPN adoption has increased after the arrival of age verification measures in the UK. Proton VPN recorded spikes of over 1400%, while several unreliable VPNs also topped the app stores.
These unscrupulous providers are notorious for being able to infiltrate their target networks. They are often distributed through social media links on forums, without official confirmation of their safety.
Limiting reputable VPN providers may backfire…”
David Peterson, General Manager of Proton VPN
As Sak suggests, the more VPN restrictions are in place, the more likely children will be constantly exposed to them. However, instead of being directed to reliable solutions, they were directed to more dangerous products, with safer VPNs with better reputations that adhere to the new rules.
This problem will also extend beyond children. As David Peterson of Proton explains:
“Limiting reputable VPN providers may result, pushing privacy-conscious users into more obscure alternatives, some linked to authoritarian regimes known to exploit user and company data through mysterious surveillance.”
In our research, it became clear that despite the corporate solutions available, many senior figures, including Labor MPs, were using consumer VPNs instead.
These same solutions are the ones that can be restricted to children if the negotiations are successful.
VPNs would be required to break their no-logs policies to identify and isolate users’ activity and ID, a move that no provider would support. This will also compromise the security capabilities these tools are designed to achieve.
The answer to the VPN industry
Fixing the problem may require different approaches outside of borders because, as Sak notes, “kids face real online threats that VPNs actively protect against.”
Removing VPN protection leaves children with greater opportunities to be exposed to tracking, data collection, and malicious content – all of which can have major consequences for their lives.
“Government power can be better used in helping parents understand and use the tools that are already available to them,” continued Sak.
“Protecting children is the responsibility of parents, not the law.”
According to Sak, the proposed solutions, such as locking VPNs after years of testing, can have the opposite effect – “asking privacy tools to become surveillance tools”.
Currently, there is little that VPNs themselves can do to address these issues. Providers such as NordVPN and ExpressVPN have introduced parental control functionality to provide secure restrictions for families.
The technology will also still exist to allow secure age verification within VPNs themselves, and, even if it were, Membrey notes, “Restricting access doesn’t remove the risk — it shifts it to users, leaving them exposed to the Internet without facing hidden harm.”
