VPN usage in the UK, measured: the age-check era in numbers

The previous version of this page claimed that "approximately 16% of British internet users regularly use VPN services" and cited nobody. It also promised insights into a "landscape" and delivered a checklist of encryption protocols. Since it was written, the single largest natural experiment in VPN adoption anywhere in Europe happened in the UK, it was measured by the regulator itself, and the whole political argument it triggered has already run to a conclusion. So this page now does one job: it collects every documented number from the UK's age-check era in one table, and the ten-year chronology that led to it in another.

The one-line summary: on 25 July 2025 the Online Safety Act's age checks went live, UK daily VPN use nearly doubled to 2.2 million people and stayed there, and on 15 July 2026 the government decided, on the record, not to limit VPNs. Every claim in that sentence has a source below.

VPN usage in the UK: every documented number

Hold the third and fourth rows next to each other and the age-check era stops being a simple story. Sixty-nine million checks happened, so the system works at scale; a million more people a day are on VPNs than before the checks, and Ofcom's own report says it cannot establish how much of that rise is children, only that the evidence does not show children driving it. The children's rows are the quiet surprise: kids are about a tenth of VPN users, and among children who actually got past age checks, a VPN ranks fourth, behind simply lying about a birthdate. What ministers called a loophole was, on the measured evidence, mostly adults declining to hand identity documents to adult websites, and that reading is what ultimately won the policy argument in July 2026.

How the UK got here: 2016 to 2026

Eighteen rows, and the decade splits cleanly at 25 July 2025. Before it, UK age verification was a policy that kept failing: mandated in 2017, shelved in 2019, rebuilt by 2023. After it, everything compressed into one year: the surge, the Lords ban attempt, the consultation, and the July 2026 decision that ended the argument with VPNs untouched. The enforcement column tells its own story: nine fines in eleven months, from £20,000 to £1.35 million, every one of them against porn, nudification or forum services and not one against a VPN provider. The UK tested the question every age-verification regime eventually faces, whether to chase the circumvention tool, and became the first to answer no in writing.

So where does that leave a UK VPN user?

In the clearest legal position VPN users have had anywhere in the age-verification debate: the government examined restricting the tools and declined, in a minister's words, with the technology secretary's statement acknowledging their legitimate privacy and security uses. An adult running a VPN in the UK breaks no rule, whether the purpose is shielding browsing from the Investigatory Powers Act's connection-record retention, securing café Wi-Fi, or declining to hand ID to an adult site. The duties, and the seven-figure fines, sit entirely on the platforms. Our United Kingdom country page covers the practical setup, and our table of data retention laws in 16 jurisdictions puts the UK's 12-month connection-record rule beside the rest of the world. Le VPN's servers in 100+ locations include UK locations in London, Coventry and Kent, with 10 simultaneous connections and a 30-day money-back guarantee.

What changes next?

• Whether "not limiting VPNs" holds. The July 2026 decision was a policy choice, not a statute. A change of minister, or one bad news cycle about children and VPNs, could reopen it; the thing to watch is any new consultation naming VPN providers.
• Ofcom's next age assurance report. The first one produced the 2.2 million and 69 million figures and corrected the regulator's own earlier reading. The next cycle shows whether VPN use holds at double the old baseline as age checks normalise.
• The fine curve. Nine penalties from £20,000 to £1.35 million inside eleven months, with daily-penalty clauses now standard. Whether enforcement moves beyond adult sites to the file-sharing and forum services under investigation is the compliance story of 2027.
• Copycat regimes. The EU, Australia and several US states are building their own age-check rules with the UK as the test case. Each new regime reruns the same VPN question the UK just answered.