UK won’t ban VPNs, puts onus on platforms to prevent age check circumvention

UK Technology Secretary Liz Kendall has published an official statement outlining the government’s positions on children’s wellbeing and safety online, which includes online age assurance policies. The statement introduces the second part of the government’s response to its public consultation, “Growing up in the online world” – which Kendall says is “the next step in our commitment to fundamentally reset expectations of what is safe and suitable for children online while ensuring young people are equipped to thrive in the digital world.” New measures joining the social media age minimum announced in June include restrictions on time of use and persuasive design, new rules for AI chatbots, and a retort to critics who say biometric age assurance tools are easy to circumvent with virtual private networks (VPNs). Night-night for social media Kendall says the consultation results showed that nearly 1 in 3 children want help managing their screentime. In response, new regulations will require social media services to apply “sensible default protections for 16- and 17-year-olds.” “These will include default overnight restrictions, with alerts and push notifications muted during a curfew period of midnight to 6 a.m., and default restrictions at all times on persuasive features such as autoplay and personalised recommender feeds to reduce infinite scrolling and make it easier for teenagers to log off.” This is in keeping with global regulatory trends, which increasingly target the addictive design features of social media as a major problem, and look to steer the digital ship in the direction of privacy- and safety-by-design. Therapy chatbots getting a closer look The furor around AI chatbots has settled somewhat after apps like ChatGPT were linked to a rash of teen suicides . However, part of that has been regulators catching up with the technology. Kendall says the new rules prescribe regular breaks for chatbot use, and that work is ongoing to determine the intervals at which such breaks should be mandatory. The secretary is careful to toe the political and technological line in acknowledging the benefits chatbots can offer children. Nonetheless, emotional dependence on chatbots has become an issue for some – and, in some cases, had tragic consequences, when kids have turned to AI for therapeutic advice. As such, the government will work with the Department for Health and Social Care and the Medicines and Healthcare products Regulatory Agency (MHRA) to “take stronger action on chatbots that may pose risks to children, through harmful, inaccurate or unverified mental health advice.” Moreover, “we will ensure the regulatory system for AI medical devices supports children to access trusted, evidence-based support. This will ensure that, where children seek medical advice, children and their parents can be sure it meets certain standards and is safe.” On VPNs, Kendall agrees with AVPA – finally With all the hand-wringing that has been done over circumvention and the issue of VPNs, it is mildly comical that Kendall has ultimately opted to listen to the age assurance sector, which has often pointed out that IP addresses are only one signal that contains data about the location of a user – and that, especially on social media, there are plenty of others that can easily be factored into a highly effective age check . “VPNs have legitimate privacy and security uses and we will therefore not age-gate or ban them,” says Kendall’s statement. “We have always been clear that some children will try to get around the new social media requirements . While it is not possible to entirely eliminate this, requiring the use of highly effective age assurance is one of the best ways to make a meaningful difference.” That now means there will be “an onus on platforms in scope of the new restrictions to take robust steps to detect and prevent attempts by underage users to circumvent age assurance measures.” To that end, Kendall has added to her request that Ofcom report by October on what highly effective age assurance looks like for determining whether someone is over 16, with a new request that Ofcom report on “what more services can do to detect and prevent VPN use on their platforms.” This move, while welcome, may also have the age assurance industry wondering why it wasn’t listened to in the first place: the Age Verification Providers Association ( AVPA )’s position has always been that the possibility of circumvention does not nullify the law. It labels the idea that VPNs exist, any age assurance system will fail “the VPN fallacy .” Which is to say, just because you can quite easily stab someone, that’s no reason to legalize stabbing. Rather, it is on those governed by the law to follow it, on the governing to enforce it, and, in this case, on platforms covered by age assurance laws to do everything they can to comply. (Metaphorically, not selling knives to children.) Per AVPA’s website, VPNs are not kryptonite to age assurance . “In practice, there are ways to detect and address circumvention and there is no need to even consider banning VPNs outright.” “Digital services using age assurance to remain compliant, can do so by detecting VPN use, assessing risk using behavioural clues, and giving flagged users the option to verify their age or prove their location.” Now is the teachable moment for online literacy Finally, and also in keeping with emerging global models for child online safety, the UK is pledging to increase support for digital literacy. “Online safety is a critical component of Relationships, Sex and Health Education where the curriculum has already been strengthened for the next school year,” Kendall says, noting that the government is also dedicated to “supporting children and young people beyond the classroom through youth organisations, libraries, community groups and civil society partners.” On this file, new proposals are on the way. Kendall floats the idea of developing age-appropriate guidance for parents and children on “recognizing positive content, using trusted sources and navigating online spaces safely.” It may publish best practice principles for industry on the availability, discovery and visibility of high-quality content for children. And it will “further develop the Kids Online Safety Hub as the government’s principal source of trusted guidance and practical support.” “We are now moving at pace to implement our proposals , with the first regulations on the ban to be laid before the end of the year and coming into effect in early 2027,” Kendall says. “The government is clear that this is not the end of the story, and that we will not hesitate to take further measures where needed to ensure children’s safety and wellbeing, while enabling them to benefit from the opportunities that digital technologies provide, so that every child gets the best start in life.”

UK Technology Secretary Liz Kendall has published an official statement outlining the government’s positions on children’s wellbeing and safety online, which includes online age assurance policies. The statement introduces the second part of the government’s response to its public consultation, “Growing up in the online world” – which Kendall says is “the next step in our commitment to fundamentally reset expectations of what is safe and suitable for children online while ensuring young people are equipped to thrive in the digital world. ”New measures joining the social media age minimum announced in June include restrictions on time of use and persuasive design, new rules for AI chatbots, and a retort to critics who say biometric age assurance tools are easy to circumvent with virtual private networks (VPNs).Night-night for social mediaKendall says the consultation results showed that nearly 1 in 3 children want help managing their screentime.

In response, new regulations will require social media services to apply “sensible default protections for 16- and 17-year-olds. ”“These will include default overnight restrictions, with alerts and push notifications muted during a curfew period of midnight to 6 a.m., and default restrictions at all times on persuasive features such as autoplay and personalised recommender feeds to reduce infinite scrolling and make it easier for teenagers to log off. ”This is in keeping with global regulatory trends, which increasingly target the addictive design features of social media as a major problem, and look to steer the digital ship in the direction of privacy- and safety-by-design.

Therapy chatbots getting a closer lookThe furor around AI chatbots has settled somewhat after apps like ChatGPT were linked to a rash of teen suicides. However, part of that has been regulators catching up with the technology. Kendall says the new rules prescribe regular breaks for chatbot use, and that work is ongoing to determine the intervals at which such breaks should be mandatory.

The secretary is careful to toe the political and technological line in acknowledging the benefits chatbots can offer children. Nonetheless, emotional dependence on chatbots has become an issue for some – and, in some cases, had tragic consequences, when kids have turned to AI for therapeutic advice. As such, the government will work with the Department for Health and Social Care and the Medicines and Healthcare products Regulatory Agency (MHRA) to “take stronger action on chatbots that may pose risks to children, through harmful, inaccurate or unverified mental health advice.

”Moreover, “we will ensure the regulatory system for AI medical devices supports children to access trusted, evidence-based support. This will ensure that, where children seek medical advice, children and their parents can be sure it meets certain standards and is safe.”On VPNs, Kendall agrees with AVPA – finallyWith all the hand-wringing that has been done over circumvention and the issue of VPNs, it is mildly comical that Kendall has ultimately opted to listen to the age assurance sector, which has often pointed out that IP addresses are only one signal that contains data about the location of a user – and that, especially on social media, there are plenty of others that can easily be factored into a highly effective age check.

“VPNs have legitimate privacy and security uses and we will therefore not age-gate or ban them,” says Kendall’s statement. “We have always been clear that some children will try to get around the new social media requirements. While it is not possible to entirely eliminate this, requiring the use of highly effective age assurance is one of the best ways to make a meaningful difference.

”That now means there will be “an onus on platforms in scope of the new restrictions to take robust steps to detect and prevent attempts by underage users to circumvent age assurance measures. ”To that end, Kendall has added to her request that Ofcom report by October on what highly effective age assurance looks like for determining whether someone is over 16, with a new request that Ofcom report on “what more services can do to detect and prevent VPN use on their platforms.

”This move, while welcome, may also have the age assurance industry wondering why it wasn’t listened to in the first place: the Age Verification Providers Association (AVPA)’s position has always been that the possibility of circumvention does not nullify the law. It labels the idea that VPNs exist, any age assurance system will fail “the VPN fallacy. ”Which is to say, just because you can quite easily stab someone, that’s no reason to legalize stabbing.

Rather, it is on those governed by the law to follow it, on the governing to enforce it, and, in this case, on platforms covered by age assurance laws to do everything they can to comply. (Metaphorically, not selling knives to children.)Per AVPA’s website, VPNs are not kryptonite to age assurance. “In

practice, there are ways to detect and address circumvention and there is no need to even consider banning VPNs outright. ”“Digital services using age assurance to remain compliant, can do so by detecting VPN use, assessing risk using behavioural clues, and giving flagged users the option to verify their age or prove their location. ”Now is the teachable moment for online literacyFinally, and also in keeping with emerging global models for child online safety, the UK is pledging to increase support for digital literacy.

“Online safety is a critical component of Relationships, Sex and Health Education where the curriculum has already been strengthened for the next school year,” Kendall says, noting that the government is also dedicated to “supporting children and young people beyond the classroom through youth organisations, libraries, community groups and civil society partners.”On this file, new proposals are on the way. Kendall floats the idea of developing age-appropriate guidance for parents and children on “recognizing positive content, using trusted sources and navigating online spaces safely.”

It may publish best practice principles for industry on the availability, discovery and visibility of high-quality content for children. And it will “further develop the Kids Online Safety Hub as the government’s principal