Mozilla warns UK: Banning VPNs for kids hurts privacy

Mozilla pushes back on UK age‑gating plan

Mozilla lodged a formal response to the Department for Science, Innovation and Technology’s consultation on digital‑safety measures for young people. The tech nonprofit argues that forcing age checks on virtual private networks would cripple a core privacy tool for everyone.

The submission, posted in August 2026, cites the Online Safety Act’s age‑assurance requirements and warns that “blunt interventions like mandatory age assurance and restricting access to tools like VPNs are not effective.” Mozilla frames the issue as a clash between protecting minors and preserving fundamental online rights.

The UK’s proposed age‑gate on VPNs

The UK government is exploring legislation that would require VPN providers to verify a user’s age before granting access. The move is meant to stop minors from bypassing age‑verification screens that many online services now impose under the Online Safety Act.

Proponents claim the policy would curb under‑age exposure to harmful content by blocking a common circumvention method. Critics, however, point out that VPNs also shield users from tracking, censorship, and corporate profiling. The consultation asks for evidence on how age‑gating would improve safety without collateral damage.

Why VPNs matter beyond the teen crowd

A VPN masks a device’s IP address, encrypts traffic, and prevents network‑level observers from building a profile of a user’s habits. Workers use them to reach corporate resources, activists rely on them to evade surveillance, and ordinary citizens employ them to sidestep geographic restrictions.

Mozilla’s brief notes that “young people are particularly vulnerable to online tracking, targeted advertising, and the risks that flow from personal data being collected and processed for commercial purposes without adequate consent.” Denying them VPNs would hand the power back to trackers and advertisers, making the very harms the policy seeks to address more acute.

Recent privacy slip‑ups highlight the stakes

The urgency of Mozilla’s warning is underscored by a string of recent privacy failures. Adobe’s Digital Editions e‑book client was found to log every document in a user’s library and transmit the data in clear text, a practice that runs afoul of the 2011 Reader Privacy Act. Likewise, a macOS‑based demo showed that the Privacy & Security pane can lie: an app labeled “blocked” still accessed the Documents folder after the user granted consent via a hidden TCC prompt.

These incidents illustrate how easy it is for software to undermine the privacy expectations of users, even when operating systems claim robust protections. If a simple VPN can restore a baseline of anonymity, stripping it away leaves users exposed to the very vulnerabilities demonstrated by Adobe and Apple.

Alternatives that already harden the stack

For engineers and power users unwilling to rely on commercial VPNs, open‑source projects like GrapheneOS offer a mobile operating system built from the ground up with sandboxing, exploit mitigations, and a tightened permission model. GrapheneOS deliberately excludes Google Play services, opting instead for a sandboxed compatibility layer that can run Play apps without granting them system‑wide privileges.

On the desktop side, QubesOS continues to champion compartmentalization. A recent security advisory (QSB‑118) disclosed an arbitrary‑code‑execution flaw in the copy‑to‑VM error‑reporting channel, prompting a rapid patch. While the bug was technical in nature, the response demonstrated how a community‑driven security stack can react faster than proprietary ecosystems when privacy is on the line.

What to watch

The next round of the UK consultation is slated for early 2027. Stakeholders will be looking for concrete data on how age‑gating VPNs affects both minors and the broader user base. Keep an eye on the Department for Science, Innovation and Technology’s final report and any amendments to the Online Safety Act. Parallelly, watch how privacy‑focused OS projects like GrapheneOS and security‑centric desktops such as QubesOS evolve their threat models—those developments will shape the tools users turn to when official channels tighten.