Child online safety shouldn’t come at the cost of privacy

ExpressVPN has signed an open letter urging the UK Government to protect children online without weakening the privacy and security tools millions of people—including children—rely on every day.

Children deserve an internet that’s safer than the one they have today. They shouldn’t be pushed toward harmful content, contacted by adults they don’t know, profiled for profit, or left to navigate systems designed to hold their attention for as long as possible.

That’s why the debate around the UK’s proposed under-16 social media restrictions matters. The goal of protecting children online isn’t in question. The question is whether the measures being considered will reduce harm without creating new risks.

ExpressVPN has signed an open letter led by the VPN Trust Initiative and the Internet Infrastructure Coalition urging the UK Government not to restrict VPNs as part of its approach to children’s online safety. The letter brings together civil society groups, digital rights organizations, internet governance bodies, and VPN providers around a simple point: child safety, privacy, and security should strengthen one another rather than be treated as opposing goals.

VPNs are sometimes discussed in this debate as if they’re mainly tools for avoiding rules. That framing misses what VPNs are used for every day. They help people protect personal information on public Wi-Fi, enable secure remote work, support students accessing education networks, and help businesses and the UK Government itself protect their systems. They’re also important for people at heightened risk online, including journalists, human rights defenders, domestic abuse survivors, LGBTQ+ people, and young people who may need private access to trusted information or support. Put simply, consumer VPNs like ExpressVPN offer to individuals the same privacy and security protections that most businesses and institutions commonly use and often require.

Children need protection and privacy

The online harms facing children are real. Age-inappropriate content, unwanted contact, bullying, manipulative design, and algorithmic recommendations can all put young people at risk. Governments are right to demand more from the companies that build and profit from these systems.

But children’s safety isn’t only about blocking access. Children also have privacy and security needs of their own.

A young person in an unsafe or controlling home may use the internet to look for health information, contact a safeguarding service, or find support they can’t safely ask for offline. For that child, privacy is part of safety.

That’s why online safety policy needs to be careful about what it weakens. A measure designed to reduce one risk can create another if it makes trusted privacy and security tools harder to access.

The evidence should guide the response

The open letter points to research from Ofcom indicating that only a very small proportion of children use VPNs to access content meant for older audiences. Early evidence from Australia, which implemented its own social media ban for under-16s, suggests that VPNs are not the main route children use to get around age restrictions. In a University of Newcastle study, more teenagers said they bypassed restrictions using fake accounts than VPNs. That matters because policy should target the biggest sources of harm, not the obvious scapegoats.

The root causes of children’s online risk sit with the platforms that decide what content is recommended, how strangers can contact young users, what safety defaults apply, and how long products are designed to keep people engaged. Stronger age assurance may form part of the solution, but it can’t replace safer product design, stronger enforcement, and real platform accountability.

If the concern is that children can access harmful content, the first question should be whether platforms are applying their own rules properly. If the concern is harmful recommendations, the answer lies in recommendation systems. If the concern is adults contacting children, the answer lies in account controls, messaging features, moderation, and default safety settings.

Weakening VPN access doesn’t fix those problems.

Restricting VPNs would create new risks

Age-gating VPNs wouldn’t only affect children. In practice, it could require people to hand over sensitive personal information simply to use a tool designed to protect privacy.

That would create a serious trade-off for millions of legitimate users. Businesses, schools, public authorities, journalists, families, and individuals rely on VPNs to secure their connections and protect data. Any system that makes VPN access harder, less private, or less trustworthy risks weakening the security of the people it’s supposed to protect.

Restricting access to reputable VPNs could also push users, including young people, toward free VPNs and proxy services that are easier to find but less trustworthy. Many free VPNs offer weaker privacy and security protections, provide limited transparency around ownership and data practices, and may rely on advertising, tracking, or monetizing user data to operate.

That would create the opposite outcome policymakers are trying to achieve: children and adults pushed away from trusted cybersecurity tools and toward services that may expose more of their personal information.

Child protection and privacy can work together

ExpressVPN supports effective, evidence-based measures that reduce online harms. We also believe those measures should be proportionate, technically workable, and designed to preserve privacy and security.

Through our partnership with the Internet Watch Foundation, ExpressVPN prevents access across its network to verified domains dedicated to Child Sexual Abuse Material. The system uses a defined list of criminal domains without inspecting the content of people’s traffic or logging their browsing activity.

That work shows what better online safety can look like: specific, evidence-based, carefully limited, and built in a way that protects privacy rather than treating it as the enemy.

The right focus is platform accountability

Children deserve meaningful protection online. That means stronger enforcement against platforms that fail to apply age protections consistently. It means closer scrutiny of product features that recommend harmful material, encourage compulsive use, or allow unwanted adult contact. It means better digital literacy, better parental tools, and privacy-preserving age assurance where age checks are necessary. It doesn’t mean weakening cybersecurity tools used by millions of people for legitimate protection.

The UK has an opportunity to build online safety policy that’s both serious and careful. The Government should focus on measures that address the systems exposing children to harm, while preserving the privacy and security rights that make the internet safer for everyone.

A safer internet shouldn’t be a less secure one.