Kendall blasts ‘unacceptably slow’ online safety laws as VPN loophole grows
Liz Kendall has admitted parliament is moving “unacceptably slow” on regulating online platforms, as ministers face questions over whether teenagers will simply use VPNs to dodge the UK’s incoming under-16 social media ban.
Speaking to the Science, Innovation and Technology Committee on Wednesday, the tech secretary said the eight-year journey from the first ideas behind the Online Safety Act to full implementation “doesn’t cut the mustard”.
“The thing that has struck me most in this area since becoming secretary of state is how, despite the best efforts of our parliamentarians, the process is unbelievably and probably unacceptably slow”, Kendall told MPs.
“If you just look at how long it took from the initial idea – it’s not even yet totally fully implemented – the Online Safety Act has taken eight years. I mean, that is just not good enough.”
The government has been preparing to legislate before Christmas for an “Australia-plus” ban on social media platforms offering services to under-16s, with protections expected to come into force in spring 2027.
Platforms expected to be caught include TikTok, Instagram, Snapchat, X, Facebook, Reddit, YouTube and others, while ministers are also considering restrictions on livestreaming, stranger contact, infinite scrolling and overnight access for older teenagers.
Kendall said the ban was not a substitute for wider online safety duties, admitting children would try to bypass the rules.
“We know from Australia when they brought a ban, that kids will try and get round it and succeed,” she said. “Even when we put in highly effective age verification measures… children will try and many will succeed to get around the ban.”
She added: “This is not an either/or. We expect all of the measures in the Online Safety Act still to be fulfilled.”
VPN loophole clouds ban
Searches for VPNs surged 165 per cent overnight after the ban was announced, according to data previously seen by CityAM, suggesting teenagers were already looking for workarounds before the regime had even been designed.
VPNs allow users to mask their location by routing traffic through another server, potentially helping under-16s access platforms from jurisdictions where restrictions do not apply.
Chris Field, chief marketing officer at Yoti, told CityAM: “The question of whether or how VPNs are regulated is a matter for the government and regulators. Yoti’s role is to provide effective, privacy-preserving age assurance technology.
“Children are often highly motivated to find ways around restrictions. If they can’t use one route, they’ll look for another. The focus shouldn’t be on a single tool but whether platforms have effective, proportionate anti-circumvention measures in place.”
Field added: “We expect regulators to ask tougher questions. Rather than simply asking whether measures exist, they’ll want evidence that those measures are effective.”
Kendall insisted ministers would not water down the policy before it had begun. “I’m not going to lift a ban before we’ve even legislated for it,” she told MPs. “They had their chance to make it safe, and they failed. So we are stopping them from making their platforms available to children.”
The tech secretary also said she hoped to return before recess with further measures, including possible overnight curfews for 16 and 17-year-olds and default breaks in infinite scrolling.
The problem for ministers is that every tougher age check comes with a privacy trade-off. Ofcom is assessing technologies including facial age estimation, digital ID, financial data and telecoms data. Around one in ten under-16s lack passports, making document-based checks alone difficult.
Yoti chief executive Robin Tombs previously told CityAM: “If you don’t have minimum standards, the market just falls apart. If you make it too easy to get around some of the checks, the whole thing falls apart because it’s the weakest link that all the kids will go to.”
He added: “You can do an age check without identifying someone.”
The row comes as Google prepares to allow IP addresses to be used for advertising measurement in the UK and Europe from August, a move that has reignited concern over fingerprinting and online profiling. The ICO previously described Google’s reversal on fingerprinting as “irresponsible”.