On 21 January 2026, the House of Lords voted in favour of an amendment that would require VPN providers to apply age-verification checks to their users — effectively barring anyone under 18 from using the encrypted tunnels that millions of British adults rely on for, among other things, avoiding their own government’s gaze. The vote barely registered. A Wednesday. A whip’s job. But it marked the moment Britain’s online safety project stopped pretending it was about children and started admitting it was about controlling what adults do in private.

The amendment — tacked onto the Online Safety Act’s rolling implementation — instructs Ofcom to explore requiring VPN providers to deploy the same facial scans, photo-ID uploads, and credit-card checks already mandated for pornographic websites since July 2025. The logic is, on its face, straightforward: if adult-content sites must verify ages, what stops a 15-year-old from firing up a VPN, routing through Amsterdam, and bypassing the whole regime? Close the loophole. Never mind that the loophole is the entire internet.

The Architecture That Outlasts the Panic

Regulatory creep is a known quantity. What begins as a child-safety measure on one class of content migrates, with the quiet inevitability of a gas leak, to everything else. The Online Safety Act’s age-assurance duties landed first on the largest adult-content websites — Pornhub, XVideos, the usual suspects. By this spring, Ofcom was already reporting that social media platforms, dating apps, gaming services, and messaging tools were “starting to implement, or have plans to implement” age checks. The possessive pronoun in that sentence is doing heavy lifting: nobody wants to implement facial scans for their users. They do it because the regulator has made the alternative — liability, fines, criminal exposure for executives — unthinkable.

Now the Lords want VPNs in the net. And once VPNs are in, what’s left outside? Encrypted DNS? Tor? Any protocol that obscures the user’s identity from the state becomes, by definition, a child-safety risk — because it might let a child see something the state has decided they should not see. The category absorbs everything. A senior engineer at a mid-sized VPN provider, reached over Signal during his team’s sprint planning, put it plainly: “We’re not a content platform. We don’t host anything. The amendment asks us to become a check-point for a problem we don’t create, using data we don’t hold, for a regulator that can fine us 10% of global turnover if we get it wrong. It’s not a compliance ask — it’s an extinction event for anyone under £50 million in revenue.”

The 10% figure is real — it’s the maximum penalty under the Online Safety Act’s enforcement provisions. For a mid-sized VPN provider operating on thin margins, that number is not a fine; it is liquidation.

What the Lords’ Debate Actually Revealed

The January amendment was moved by Lord Leong, the government whip in the Lords — meaning this was not some backbench rebellion or a cross-party moment of moral clarity. It was the government’s own position, delivered through the usual channels, with the usual absence of public debate. The Hansard record shows the discussion consumed less than an hour. Lords raised concerns about overreach. The amendment passed anyway.

The telling detail was not the vote count but the framing. Supporters of the amendment described VPNs not as privacy tools — the thing millions of adults use to keep their banking sessions encrypted on coffee-shop WiFi, or to stop their employer reading their personal email, or to evade data-scraping by a vindictive ex — but as “gateways to harm.” The noun shift matters. A tool becomes a gateway the moment you stop asking what it does and start asking only what it might allow. Fire doors are gateways to arson, if you squint hard enough.

The Real Cost Falls on Adults Who Aren’t Evading Anything

Here is the part the debate skips: age verification is not a toggle. It is a data-collection pipeline. Under the Online Safety Act’s framework, the “highly effective” age checks demanded by Ofcom mean facial age-estimation, government-issued photo ID, or credit-card verification. Each method produces a trail. Each trail is, under the Investigatory Powers Act 2016, accessible to the state.

A 42-year-old woman in Birmingham who uses a VPN to keep her medical-research browsing private from data brokers is not trying to circumvent a porn ban. But under the January amendment’s logic, she will still need to upload her passport to a VPN provider — a company that, unlike her NHS trust, has no statutory duty of care to protect her data — simply to prove she is old enough to read what she already has the right to read. The child-protection rationale collapses on contact with the actual user base. Adults are the collision.

One contractor I spoke to outside a job site in Manchester put it more bluntly: “I use a VPN because my ex-wife’s solicitor once tried to subpoena my browsing history in a custody dispute. Nothing illegal. Just private. Tell me which bit of my driver’s license I’m supposed to hand to a company registered in Panama so a regulator in London feels good about itself.”

He has a point. The amendment’s supporters have not answered it.

The Quiet Convergence

What makes the January vote worth revisiting in June — six months on, with Ofcom’s implementation deadlines creeping closer — is that it reveals a convergence the government has not acknowledged in plain language. Age verification and surveillance are, technically, the same infrastructure. The same biometric databases. The same identity-proofing APIs. The same third-party verification vendors. The difference is only the sign on the door: one says “child safety,” the other says “national security.” But both read the same data.

Britain is building a system in which every adult activity online — reading, watching, speaking, searching — defaults to an identity-checked state. The VPN amendment is not the end of that project, but it is the moment the scaffolding became visible. And the scaffolding looks less like a child-safety fence and more like a perimeter wall with one gate, and a lot of people in Whitehall holding the only keys.

You do not need to be a libertarian to find that uncomfortable. You only need to have ever done something online that was legal, private, and none of the government’s business. Which, if the polling is any guide, is most of the adult population. Including, one suspects, a few members of the House of Lords.

Sources