Age checks blocked 40m visits a month but a third of teenagers use VPNs, Ofcom finds

Age checks introduced under the Online Safety Act are preventing about 40 million visits a month to pornography and other adult sites from UK users who cannot or will not prove they are over 18, Ofcom said in its first full-year review of the regime, but a third of 13- to 17-year-olds now say they use a virtual private network to get around the rules.

The regulator’s report, published on Friday, finds that traffic to the 20 largest adult sites from British IP addresses fell by 47% in the 12 months after age verification became mandatory in July 2025, and that the proportion of children aged 13 to 15 who reported seeing pornography in the past month fell from 38% to 19%. It describes the result as “a substantial and sustained reduction in harm”.

At the same time, 34% of teenagers told Ofcom’s researchers they had used a VPN to access blocked content, up from 11% before the rules took effect. Downloads of the five most popular VPN apps in the UK rose sixfold in the week the checks began and have remained at roughly three times their previous level. About 9% of teenagers said they had used an adult’s identity documents or face to pass a check.

“We said from the start that no system would be perfect, and it is not,” said Ofcom’s director of online safety, Deborah Finch. “What the evidence shows is that friction works. The teenager who stumbles across this material by accident is now protected. The determined 16-year-old with a VPN is harder, and we are honest about that.”

Ofcom has opened 61 investigations into platforms it believes have failed to implement adequate checks and has issued fines totalling £23m, the largest being £8.5m against an overseas video site that used a tick-box age declaration. Several smaller platforms have blocked UK users entirely rather than comply. The regulator said it had also forced three “nudification” apps out of the UK market.

The regime has drawn criticism from privacy campaigners, who argue that requiring millions of adults to upload passports or faces to third-party verification companies creates a serious data risk. Their case was strengthened in March when a breach at one verification provider exposed records relating to 400,000 users. Ofcom said the provider was not certified under its scheme and that platforms using it had been told to switch.

Parents’ groups were broadly supportive but questioned the VPN figures. “Ofcom is treating one in three teenagers using a VPN as a footnote,” said Rachel Dunmore of the campaign group Safer Screens. “It is the headline. Either the government regulates VPN providers, which it says it will not, or it accepts that the act protects children until they are about 14.”

The technology secretary said the government had “no plans to restrict VPNs” and that the report “vindicates a law that was written off as unworkable by people who are now very quiet”. Ofcom’s next phase of enforcement, covering the design of recommendation algorithms shown to under-18s, begins in January.