The question is not really whether people should use a VPN. The bigger question is why ordinary people are increasingly being pushed towards one in the first place.
Britain is entering an age where more of the internet is being placed behind checks, gates and conditions. A person may visit a lawful website and find themselves asked to prove their age, scan their face, provide ID, use a digital identity service, verify through a bank card, or pass some other form of age assurance before they can continue.
This is often presented as a child protection issue, and protecting children online is a legitimate aim. Children should not be left exposed to harmful content, and parents should have the tools to restrict what their children can access. But the method matters.
If the answer to online safety is to make everyone prove who they are, then the rights of adults are affected too. Privacy does not stop being important just because a law has a good sounding purpose.
The Internet Is Becoming Less Private
Under the Online Safety Act, the UK has moved towards stronger age checks and online safety duties across a wider range of services. Pornography sites are one part of that, with strong age checks required to stop children accessing adult content. But the direction of travel does not stop there. Social media platforms, video sharing services, search services and recommendation systems are also being pulled further into the regulatory net.
Ofcom has already made clear that age assurance can include methods such as photo ID matching, facial age estimation, credit card checks, mobile network checks and digital identity wallets. It has also said tech firms must act to stop algorithms recommending harmful content to children, and in 2026 it stepped up scrutiny of TikTok and YouTube over how their recommender feeds are made safe for younger users.
That does not mean every website will ask every visitor for a passport or a face scan but it does mean the direction of travel is clear. More services are being pushed to identify, classify or age check users, and more platforms are being pressured to change what people can see, search for, or be recommended.
This is where the public concern begins. A private person browsing lawful content should not be treated as suspicious by default. The internet should not become a place where access to normal information, discussion, entertainment, social media, video platforms or adult legal content requires people to surrender more and more personal data.
Protecting Children Should Not Mean Tracking Everyone
The protection of children is important, but it should not be used as a blank cheque to weaken privacy for the whole population. Children can and should be protected through parental controls, device settings, router-level restrictions, app-store controls, supervised accounts, school safeguards and other tools that place responsibility closer to the child’s actual environment.
That approach is different from building a system where every adult is repeatedly challenged to prove they are allowed to look at lawful content.
There is a basic principle at stake here. Adults should not have to identify themselves to the digital world simply to exercise lawful rights. Reading, watching, researching, communicating and browsing privately are ordinary activities. They should not become activities that require permission.
Data Held Is Data at Risk
Every new check creates another point of risk. If a service asks for ID, face scans, card details, account information or third-party verification, then data has to be processed somewhere. Even where companies claim not to store the full data, the system still depends on trust, security, technical competence and compliance.
That is not a small concern. Data leaks happen. Systems fail. Companies change hands. Third parties are breached. Information gathered for one purpose can later be misused, exposed, expanded or combined with other data.
The ICO and Ofcom have already had to issue joint guidance on age assurance because services must comply with both online safety law and data protection law. That alone shows the tension. Age checks are not just a safety question. They are also a privacy and data protection question.
The more often people are asked to prove who they are online, the more normal it becomes for private browsing to be linked to identity. That should concern anyone who values privacy, regardless of whether they personally use the affected sites.
The Path of Least Resistance
There is also a practical risk. When lawful websites become inconvenient, intrusive or difficult to access, some users will look for the path of least resistance. That may mean they avoid the site completely. It may mean they turn to VPNs. It may mean they look for alternative sites with fewer checks, weaker standards or less oversight.
That matters because convenience shapes behaviour. The easier option often wins, even when it is not the safer one.
If regulated websites become harder to use than unregulated alternatives, then the policy may push some users away from the very services that are more likely to follow UK rules. That would be a strange result. A system designed to make the internet safer could end up encouraging people towards corners of the web where protections are weaker, standards are lower, and accountability is harder to enforce.
This is not an argument for accessing illegal material or evading the law. It is about lawful activity, lawful privacy and the consequences of designing systems that ordinary people find intrusive or unreasonable.
A VPN Is Not the Real Issue
A VPN can be a legitimate privacy tool. People use VPNs for work, travel, security on public Wi-Fi, reducing tracking, protecting their connection, and keeping more of their browsing private. There is nothing inherently suspicious about wanting privacy online.
But the debate should not be reduced to VPNs. The real issue is not the tool. The real issue is the environment that makes the tool feel necessary.
When people feel they need extra protection to browse normally, that says something about the direction of the internet. When privacy begins to look like a workaround, the problem is not the public. The problem is the system being built around them.
The Real Question
“To VPN or not to VPN” is not the question.
The question is whether Britain wants an internet where lawful adults are repeatedly asked to prove themselves before they can access lawful content. It is whether child protection can be achieved without treating the entire population as something to be monitored. It is whether privacy remains a normal right, or becomes something people are expected to justify.
Children should be protected online. That does not mean every adult should be pushed through digital gates, identity checks and face scans. A free society should be able to protect children without making private lawful browsing feel abnormal.
Privacy is not suspicious. It is not a loophole. It is not something people should have to apologise for wanting.
The right to privacy matters most when systems are being built that quietly remove it.
