To ask His Majesty’s Government what assessment they have made of the increased use of virtual private networks since the implementation of age verification requirements for access to primary priority content under the Online Safety Act 2023.
My Lords, the Government and Ofcom are monitoring the potential impact of circumvention techniques on the effectiveness of the Online Safety Act, especially since the child safety duties came into effect in July 2025. Services promoting VPN use to bypass age checks could face enforcement action. These duties represent a major milestone in protecting children online, making it harder for children to access harmful content. We must allow sufficient time for these measures to embed before considering further action.
My Lords, there are concerns and some misinformation circulating about VPNs and other aspects of the Act. In this light, is the Minister confident that the Act is still fit for purpose, and that platforms have a clear existing responsibility to prevent children bypassing safety protections? Does all this not mean that Parliament needs an early chance at post-legislative scrutiny of the implementation and operation of the Act to ensure, in particular, that it fulfils its aims of keeping users, particularly children, safe online while preserving free speech for adults?
My Lords, the Online Safety Act places very clear duties on platforms to protect children, including tackling methods of circumvention. The use of VPNs to bypass safeguards is a known risk, and platforms must act decisively. They are already required to assess such risks and implement proportionate measures. Ofcom will hold platforms to account. The Act requires Ofcom to produce and publish a report assessing how effective the use of age assurance has been and whether there are factors that prevented or hindered the effective use of age assurance. These will be published by June 2026.
My Lords, many people use VPNs for entirely legitimate purposes. Their use does not negate the protections of the Online Safety Act, particularly when it comes to keeping children safe online. We have seen a significant increase in the use of age-verification tools as UK users attempt to access age-restricted content. Since the child safety duties came into force, the Age Verification Providers Association has reported an additional 5 million age checks being carried out each day in the initial period. The Act is already driving real change and stronger protections for children.
My Lords, what estimate have the Government made since the implementation of these new regulations of the number of additional VPNs that are being taken up by users in the United Kingdom? If a figure is not immediately available, will the noble Lord write to me and let the House know?
My Lords, online providers now have a legal duty to protect children from harmful content. As I said earlier, VPNs are here to stay, and people use VPNs for entirely legitimate purposes. It does not negate the protections which the Online Safety Act has put in place. Those duties prevent children accessing the most dangerous material online, such as pornography and content promoting self-harm or eating disorders. They also protect children from other harmful content, including bullying, abuse or material that encourages dangerous stunts or risky behaviour. The Government will hold services to account. The era of platforms turning a blind eye to the risks that children face online is over.
My Lords, while the introduction of age checking has increased the use of VPNs, we must not automatically assume that the increase is entirely attributable to under-18s. On the contrary, Ofcom’s research suggests that only one in 10 VPN users is a child. The vast majority of children are benefiting from the protection from unwanted and unasked-for pornography that has hitherto been sent to them routinely.
However, it is likely that at least some of the increased use of VPNs by adults is the result of a legitimate concern that the introduction of age checks has not been accompanied by a rigorous focus on user privacy. Until privacy is central to Ofcom’s concern, it will always meet resistance to age checking. How many services have been referred by Ofcom to the ICO for failing to uphold users’ privacy rights while performing age checks? If the Minister does not have that information, will he commit to asking Ofcom to provide it and write to noble Lords who have an interest?
My Lords, Ofcom has clear enforcement powers against platforms that fail to implement highly effective age assurance. This includes issuing fines of up to £18 million or 10% of global revenue, whichever is greater. Ofcom is already using these powers, with investigations opened into at least 47 sites and apps that are suspected of non-compliance.
I will provide the noble Baroness the figures. On false communication offences, Ofcom has proceeded against 17 cases, of which 14 were convicted and sentenced. On the offence of threatening communication, Ofcom has taken action in 462 cases, of which 294 were convicted and 239 were sentenced. Platforms have legal duties under the Online Safety Act. If they fall short, particularly in protecting children, they will face serious consequences. We will not allow safety standards to be ignored.
My Lords, I was interested to read comments from Republican politicians over the weekend calling out the role of social media in polluting political discourse, particularly after the horrific events in America last week. Can we please recognise that we are pioneers in this country in terms of regulating platforms and that Ofcom is doing a terrific job? While parliamentary oversight is very important, can we please allow Ofcom the time to implement this very complex legislation and find time to applaud the effective job that it is doing?
My Lords, online safety regulation is a priority not only for this Government but for Governments around the world. A number of democratic nations are introducing legislation to better protect users from serious online harm, including child sexual abuse, terrorist content and misinformation. The UK’s approach is proportionate, transparent and rooted in the rule of law.
My Lords, as I am sure the Minister is aware, two of the duties in the Online Safety Act that are designed to safeguard free speech are those imposed on category 1 providers to not remove content of democratic importance and journalistic content. But those duties come into force only once Ofcom has drawn up a list of the category 1 providers and registered them. But Ofcom has not done that yet, which has led, I believe, to over-removal of content of democratic importance and journalistic content by the large social media platforms. Can the Minister tell us when Ofcom is likely to designate providers as category 1 so that those duties come into force and free speech is better protected?