UK Lords Vote to Ban VPNs for Minors

What happened: On January 21, 2026, the UK House of Lords voted 207-159 to ban VPN services for anyone under 18. They also backed mandatory device-scanning software on phones and tablets, and a social media ban for under-16s. These amendments to the Children's Wellbeing and Schools Bill now head to the House of Commons.

Three Privacy Nightmares in One Bill

The UK's upper legislative chamber had a busy Tuesday. In a single sitting, the House of Lords passed amendments that would:

Ban VPNs for minors: VPN providers must verify the age of all UK users. Anyone under 18 gets blocked. Passed 207-159.
Ban social media for under-16s: Australian-style restrictions requiring "highly effective" age verification. Passed 261-150.
Mandate device surveillance software: All smartphones and tablets sold in the UK must include "tamper-proof system software" that scans for child abuse material.

Each of these proposals has serious privacy implications on its own. Together, they represent a fundamental shift in how the UK approaches digital privacy, treating every citizen as a potential suspect whose devices must be monitored.

The VPN Ban: "Highly Effective" Age Verification Required

Under the amendment, VPN providers must implement age assurance for all UK users. The watchdog OFCOM would produce guidance, and the government would establish "a monitoring regime with enforcement powers and penalties for non-compliance."

Here's the problem: "highly effective" age verification means government ID or facial biometrics. You know, the exact things VPNs are supposed to help you avoid sharing.

Think about that for a second. To use a tool designed to protect your privacy, you'd first have to surrender your identity to verify you're old enough. It's like requiring a credit check before you can buy a safe.

The peers who proposed this wrote in their explanatory note: "This new clause would require the Secretary of State to take action to promote and protect children's wellbeing, and to further support child protective measures in the Online Safety Act, by prohibiting the provision to children in the United Kingdom of VPN services which can facilitate evasion of OSA age-gating processes."

Translation: Kids might use VPNs to get around age restrictions on websites, so let's require ID checks for everyone.

Mandatory Device Scanning: Your Phone as Government Informant

The most alarming amendment requires all smartphones and tablets sold in the UK to include built-in surveillance software. The text specifies that devices must have "tamper-proof system software which is highly effective at preventing the recording, transmitting (by any means, including livestreaming) and viewing of CSAM."

Let's translate what this means technically:

Client-side scanning: Every photo you take, every video you record, every image you receive would be analyzed by software running on your device
Unremovable by users: The "tamper-proof" requirement means you couldn't disable it
Beneath end-to-end encryption: This scanning happens before encryption, making E2E protections meaningless for images

Germany tried something similar. Their 2024 data showed 48.3% of CSAM scanning reports were false positives. Half of all flags were innocent images wrongly flagged as illegal. Now imagine that system running on every phone in Britain.

The Scope Creep Problem

Once this infrastructure exists, the definition of what gets scanned can expand. A system built to detect one category of illegal content today can search for other material tomorrow. Extremist content. Copyright violations. Political dissent. The architecture for mass surveillance would already be in place.

Apple proposed similar client-side scanning in 2021. After security researchers and privacy advocates raised alarms about the exact same scope-creep concerns, Apple quietly shelved the plan. The UK government apparently learned nothing from that episode.

Social Media Ban: 261-150

The third major amendment, proposed by Conservative Lord Nash (a former schools minister), passed with the widest margin: 261 to 150, majority of 111. It would ban under-16s from social media entirely.

Lord Nash didn't mince words: "The evidence is now overwhelming as to the damage that this is causing" to children's health, cognitive ability, and educational outcomes.

Baroness Cass, a paediatrician, supported the amendment with: "The first duty of Government is not to consult, it is to act."

The government had proposed a three-month consultation instead. Filmmaker Baroness Kidron shot that down: "A consultation is the playground of the tech lobbyist."

The bill attracted high-profile support. Actor Hugh Grant, singer Peter Andre, and organizations including Parentkind and Mumsnet signed a letter backing the social media restrictions.

What Happens Next

These amendments now go to the House of Commons through a process called "ping-pong," where the two chambers negotiate until they agree on final text. MPs could reject or modify these provisions.

The government has been resistant. Technology Secretary Liz Kendall announced the three-month consultation that peers voted to bypass. Lord Nash called it "unnecessary, misconceived and clearly a last-minute attempt to kick this can down the road."

If the amendments survive and become law:

VPN providers would have 12 months to implement age verification
Device manufacturers would need to install scanning software on phones sold in the UK
Social media platforms would need "highly effective" age gates blocking under-16s

The Privacy Implications

Let's be clear about what's being proposed here. The UK government wants:

Every VPN user to submit ID proving their age
Every phone to scan its contents and flag "suspicious" images to authorities
Every social media platform to verify user ages through biometrics or government ID

This isn't protecting children. It's building a surveillance infrastructure that treats every citizen as a suspect. The same lawmakers proposing this are the ones conducting a consultation on expanding facial recognition, while already using facial recognition for a decade without democratic authorization.

The VPN amendment is particularly cynical. VPNs are used by journalists, activists, domestic abuse survivors, and anyone else who needs to protect their communications. Requiring ID verification defeats the purpose entirely, and creates a database of everyone who uses privacy tools.

If You're in the UK

The consultation on facial recognition runs until February 12, 2026. You can submit feedback here.

Contact your MP about the Children's Wellbeing and Schools Bill before it reaches Commons debate. WriteToThem makes this easy.

Organizations opposing these measures include Big Brother Watch, Open Rights Group, and the EFF. Their campaigns need public support.

The Bigger Picture

The UK is building a surveillance state in plain sight. Facial recognition consultations. Device scanning mandates. VPN restrictions. Age verification requirements. Each piece justified individually, protect children, catch criminals, verify ages, but together forming something far more comprehensive.

Other countries are watching. What passes in the UK often spreads to allied nations. The Online Safety Act became a template for Australia. These amendments could become templates for the US, Canada, and EU.

If device scanning becomes normalized in one major democracy, the pressure builds on tech companies to implement it everywhere. And once that infrastructure exists on your phone, it's there forever, waiting to be repurposed for whatever the next government decides is dangerous.

Published: January 22, 2026