Online Safety Act 2023: Virtual Private Networks

Baroness Kidron Excerpts

Monday 15th September 2025 Lords Chamber

[Lord Leong (Lab)]

My Lords, online providers now have a legal duty to protect children from harmful content. As I said earlier, VPNs are here to stay, and people use VPNs for entirely legitimate purposes. It does not negate the protections which the Online Safety Act has put in place. Those duties prevent children accessing the most dangerous material online, such as pornography and content promoting self-harm or eating disorders. They also protect children from other harmful content, including bullying, abuse or material that encourages dangerous stunts or risky behaviour. The Government will hold services to account. The era of platforms turning a blind eye to the risks that children face online is over.

[Baroness Kidron (CB)]

My Lords, while the introduction of age checking has increased the use of VPNs, we must not automatically assume that the increase is entirely attributable to under-18s. On the contrary, Ofcom’s research suggests that only one in 10 VPN users is a child. The vast majority of children are benefiting from the protection from unwanted and unasked-for pornography that has hitherto been sent to them routinely.

However, it is likely that at least some of the increased use of VPNs by adults is the result of a legitimate concern that the introduction of age checks has not been accompanied by a rigorous focus on user privacy. Until privacy is central to Ofcom’s concern, it will always meet resistance to age checking. How many services have been referred by Ofcom to the ICO for failing to uphold users’ privacy rights while performing age checks? If the Minister does not have that information, will he commit to asking Ofcom to provide it and write to noble Lords who have an interest?

[Lord Leong (Lab)]

My Lords, Ofcom has clear enforcement powers against platforms that fail to implement highly effective age assurance. This includes issuing fines of up to £18 million or 10% of global revenue, whichever is greater. Ofcom is already using these powers, with investigations opened into at least 47 sites and apps that are suspected of non-compliance.

I will provide the noble Baroness the figures. On false communication offences, Ofcom has proceeded against 17 cases, of which 14 were convicted and sentenced. On the offence of threatening communication, Ofcom has taken action in 462 cases, of which 294 were convicted and 239 were sentenced. Platforms have legal duties under the Online Safety Act. If they fall short, particularly in protecting children, they will face serious consequences. We will not allow safety standards to be ignored.