Every NordVPN and ExpressVPN user in the UK could need to prove their age
Key Points
- The Children's Wellbeing and Schools Act 2026 requires UK regulations within 12 months prohibiting VPN services to children
- VPN providers will need to age verify every UK user using government-issued ID, facial scans or verified accounts
- 47% of UK adults have used a VPN, making the new rules a mainstream consumer privacy issue
- The government's online harms consultation closes 26 May 2026 and will shape the final VPN rules
UK users of major VPNs including NordVPN and ExpressVPN face mandatory age checks under the new Children’s Wellbeing and Schools Act 2026.
The Act, which received royal assent on 29 April , requires the Secretary of State to make regulations within a year prohibiting the supply of VPN services to UK children.
A cross-party group of peers tabled the amendment during the bill’s passage through the House of Lords, and the duty survived four rounds of ping-pong between the two chambers before becoming law.
Although the restriction targets the under 18s, VPN providers will, in practice, need to age-verify every UK customer to identify which users are children.
The Act calls for “highly effective” age assurance, which usually means uploading a government-issued ID, undergoing a facial age estimation scan, or linking a verified bank or mobile account through a third-party verification provider.
VPNs massively popular in the UK
VPNs have moved well beyond a niche security product and YouGov data shows 47% of UK adults have used a VPN at least once, with men (54%) more likely than women (41%) to have done so.
UK consumers commonly use VPNs for working from home, securing connections on public wifi, online banking when abroad, and accessing streaming libraries while travelling.
The leading consumer providers in the UK market, including NordVPN, ExpressVPN, Proton VPN, Surfshark and Mullvad, all fall within scope of the new rules.
Every paying UK subscriber will need to hand over personal documents or biometric data to remain a customer once the regulations take effect.
VPNs are not the only service in scope
The Act also gives ministers power to compel user-to-user services to use highly effective age assurance to keep under-16s off their platforms, and to direct internet service providers to restrict children’s access to particular services.
The Department for Science, Innovation and Technology has opened an online harms consultation covering social media age limits, VPN restrictions, livestreaming bans and curfews on app use.
The consultation closes on 26 May, after which the government plans to lay the secondary regulations needed to bring the new rules into force.
