The UK Online Safety Act Drove a 147% VPN Spike. Here's What Researchers Warn.

When the UK's Online Safety Act began requiring age checks on adult sites and some social platforms on 25 July 2025, a lot of people suddenly went looking for a VPN for the first time. On 16 October 2026, researchers from Newcastle University and the University of Edinburgh published numbers showing how big that rush was. Their main warning wasn't about the law, though. It was about the people downloading VPNs: "most lack the know-how to spot risky providers." This article covers what the study found and gives you a practical checklist for telling a VPN that protects you from one that sells you.

What the Study Found

The team, led by Lei Shi (Newcastle), with Dr Maxim Kolomeets (Newcastle) and Dr Tuğrulcan Elmas (Edinburgh), analysed Google Trends data and Reddit discussions around the date the age checks came into force. The paper will appear in Proceedings on Privacy Enhancing Technologies.

None of this is surprising on its own. Any time a government puts up a new online barrier, VPN interest jumps. What makes the study worth reading is its focus on who those new users are. Many are not privacy enthusiasts. They are ordinary people installing whatever comes up first in an app store search.

Are VPNs Legal in the UK?

Yes. No UK law prohibits using a VPN, and the Online Safety Act doesn't ban them. Policy is still moving, though. In January 2026 the House of Lords voted 207–159 for an amendment aimed at restricting VPN provision to under-18s, and Ofcom has said it will go after the promotion of VPNs as tools for evading the Act. Legitimate use isn't the target. Using a VPN to secure your connection, protect your privacy on public WiFi, or work remotely is entirely lawful.

The Privacy Paradox

The researchers point to an uncomfortable trade-off. Age verification asks people to hand over sensitive data: face scans, ID documents, payment details. That makes people more privacy-conscious, so they reach for a VPN. But some VPN services track and share user data with third parties, so a person trying to protect their privacy can end up giving their whole browsing history to an unknown company.

This isn't hypothetical. A separate 2026 academic study of 281 free Android VPN apps found widespread tracking, traffic leaks, and even unencrypted data across apps with a combined 2.4 billion installs.

Red Flags of a Risky VPN

• No clear owner. If you can't find the company name, country, and a real contact address, walk away.
• Vague or missing no-logs policy. "We respect your privacy" isn't a policy. Look for a specific list of what is and isn't collected. See what a real no-logs policy looks like.
• Excessive permissions. A VPN has no reason to ask for your contacts, SMS, call logs, or Accessibility access.
• Outdated protocols. PPTP or unnamed "proprietary encryption" is a warning sign. Modern apps use WireGuard® or OpenVPN. Our VPN protocols guide explains the difference.
• Lots of ad and tracker SDKs. Free is fine, but a free VPN packed with third-party trackers is making money from you.

A 5-Minute Vetting Checklist

1. Install from an official store. Avoid APKs from random sites or links posted in comment sections.
2. Read the privacy policy's "what we collect" section, not the marketing page.
3. Check the permissions before you tap Install, and again in Android Settings › Apps afterwards.
4. Run a leak test once you're connected. Our VPN leak test guide takes about two minutes.
5. Confirm there's a kill switch so your real IP isn't exposed if the tunnel drops. See how kill switches work.

Frequently Asked Questions

Related Articles