The government's fact sheet on banning social media for under-16s promised a VPN research update 'in July.' The report landed on time, and found VPN users among children are already more likely to run into the harms the ban is meant to stop.
Estimated reading time: 6 minutes
In short. On 19 June 2026 the government's own fact sheet on banning social media for under-16s added a question about children using VPNs to get around age checks, and promised: "We will provide an update on this in July." DSIT delivered, publishing a 2,299-child survey on 14 July 2026 that found a quarter of children have used a VPN, and that VPN users who bypass an age check are more likely, not less, to run into harmful content afterwards. The fact sheet has been edited twice since and still says the update is coming; it has never once mentioned the report exists. Three documented mistakes: four stars.
On 19 June 2026, four days after the government announced it would ban social media for under-16s, its official fact sheet on the change grew three new questions, among them the obvious one: won't children just use a VPN to get around it? The answer promised evidence, not reassurance: "We are aware of concerns that children may attempt to circumvent age checks, including through the use of Virtual Private Networks (VPNs). That is why we have commissioned research to better understand how children are using VPNs and the risks involved... We will provide an update on this in July" [1].
The update arrived, on time. On 14 July 2026, the Department for Science, Innovation and Technology published "Children's circumvention behaviours online," a survey of 2,299 young people aged 11 to 17, run with BMG Research and deliberately oversampled for VPN users so the results would be reliable [3]. It is exactly the research the fact sheet promised. The fact sheet has never mentioned it. Two further edits later, most recently on 18 September 2026, its answer to the VPN question still reads, word for word, "We will provide an update on this in July" [1].
What the research actually found
That would be a filing oversight if the report had nothing to say. It does. A quarter of children aged 11 to 17 (26%) have used a VPN in their lifetime, rising to 31% among 16- and 17-year-olds (page 7) [3]. Most say they use one for privacy (30%) or to reach games, apps or content generally (27%), not specifically to dodge age checks. But a fifth of VPN users, equivalent to 7% of all children, say they use one specifically to reach age-restricted websites, apps or games (page 7) [3].
Whatever the motive, VPN use changes the odds of actually getting past a check. Among children who have tried to bypass an age check, the success rate is 56% for those who have used a VPN, against 33% for those who have not, a gap the report says cannot be fully explained by VPN users skewing older (page 8) [3]. And among children who did bypass a check, 64% of lifetime VPN users went on to encounter harmful content afterwards, compared with 43% of those who bypassed without ever having used a VPN (page 9) [3]. The report is careful to note this association cannot be fully explained by age either.
The report also puts a number on how big this already is under the current, lighter rules. Citing Ofcom's own monitoring, it records that daily active users of VPN apps in the UK temporarily doubled to around 1.5 million after the Online Safety Act's child safety duties took effect in July 2025, before falling back to around 900,000 by November, while cautioning that "it was not clear whether this spike was driven by children or adults seeking to avoid age checks" (page 4) [3]. Circumvention at population scale, in other words, is not a hypothetical risk for the under-16 ban to plan around. It has already happened once, under a weaker regime than the one due in Spring 2027 [1].
A fact sheet that stopped tracking its own research
The fact sheet's silence on the report is not for lack of opportunity. It was edited on 17 July 2026, three days after the report's publication, to add five entirely new questions, including one on AI chatbots and mandatory breaks [2]. It was edited again on 18 September 2026, swapping the word "recognition" for "estimation" in the section on age checks for adults [2], a wording that survives in the current text [1]. Neither edit touched the VPN answer, and the word "circumvention", the report's own title, appears nowhere on either the fact sheet's summary page [2] or its full text [1]. A parent reading the fact sheet today has no way of knowing the government's promised evidence exists at all, let alone what it found.
That gap matters because the answer the fact sheet does give elsewhere leans on the same unresolved question. On age verification generally, it says: "Ofcom will set out in the coming months different options for effective forms of age assurance for proving whether someone is over 16 that are accurate, robust, reliable, and fair" [1]. The circumvention report is the government's own evidence base for exactly that design question, evidence showing that among the age checks children rate as most effective, the advanced ones like facial age estimation and government ID upload, over a third of children who encountered them still went on to bypass some check successfully (page 8) [3]. Whatever Ofcom sets out will have to answer to findings the fact sheet does not currently acknowledge exist.
The claims, tested
| The document's own words | What the evidence actually shows | Verdict |
|---|---|---|
| "We will provide an update on this in July" (added 19 June 2026) [2] | DSIT published "Children's circumvention behaviours online" on 14 July 2026, exactly as promised [3] | Promise kept, on schedule |
| The fact sheet's own answer, unchanged through two later edits (17 July, 18 Sep 2026) [2] | Still reads "We will provide an update on this in July," with no link to or mention of the report [1] | The public-facing promise was never closed out |
| Implicit assumption behind the ban: restricting access reduces children's exposure to harm | The government's own research finds VPN users who bypass a check are more likely to encounter harmful content afterwards, not less (64% vs. 43%, page 9) [3] | The mechanism is not yet shown to work as intended |
The mistakes, counted
The fact sheet's answer on VPN circumvention is two months out of date, despite two later edits (1). Added 19 June 2026 promising a July update [2], it was left untouched by edits on 17 July and 18 September 2026 that changed other parts of the same document [2].
The fact sheet never links to or names the report it promised (2). "Children's circumvention behaviours online" [3] exists, was published on time, and is absent from both the fact sheet's summary page [2] and its full sixteen-question text [1].
The research that did land complicates, rather than confirms, the ban's central assumption (3). Children who use a VPN to bypass an age check are more likely to encounter harmful content afterwards than those who bypass without one, 64% against 43% (page 9) [3], a finding the fact sheet's optimistic framing of age assurance does not engage with.
Credit where due
The research itself is not a token gesture. A nationally representative sample of 2,299 children, boosted specifically for VPN users and cognitively tested beforehand with children and parents, is a serious piece of primary evidence-gathering, not a survey commissioned to be forgotten (page 5) [3]. It was delivered on the exact date promised, not quietly late the way several other government commitments tracked on this site have been. And the report is candid about its own limits: it flags the risk of self-reported data being over- or under-stated, and says explicitly that some questions were deliberately worded to avoid teaching children how to change their apparent location, rather than to maximise a headline number (page 5) [3]. Commissioning honest research and publishing it on schedule is exactly what the fact sheet said would happen. The only thing missing is the fact sheet noticing.
Verdict
Four stars, from three documented mistakes. This is not a case of a promise quietly slipping past its deadline, the more common failure mode on this site; DSIT did the work and hit the date. The mistake is narrower and, in its way, more basic: a public-facing answer that still tells readers evidence is pending, two months after that evidence was published, with no link connecting the two documents at all. The report itself, once found, is not the reassurance the fact sheet implies is coming. It shows a ban aimed at reducing harm being planned against a backdrop where the exact tool likely to be used to evade it is already, on the government's own numbers, associated with more harm, not less.
Sources
- Fact sheet: New rules to protect children online, GOV.UK, Department for Digital, Culture, Media and Sport and Department for Science, Innovation and Technology, first published 15 June 2026, last updated 18 September 2026
- Fact sheet: New rules to protect children online (publication page and update history), GOV.UK, first published 15 June 2026, last updated 18 September 2026
- Children's circumvention behaviours online, Department for Science, Innovation and Technology and BMG Research, 14 July 2026