UK locked into third-party age checks as MPs claim VPNs on expenses
- Paul Francis
- Aug 11, 2025
- 3 min read
The UK’s new Online Safety Act has introduced sweeping age verification rules for a wide range of digital services. From social media platforms to music streaming apps, users now face requests to prove their age through ID uploads, facial scans or other forms of verification.
The majority of these checks are being handled by specialist third-party companies, often based overseas. They act as intermediaries, confirming whether a user is old enough to access certain content. In many cases, they do not share the full ID with the platform, instead sending back a simple “pass” or “fail”.
How the system works
Under the new law, platforms must ensure that children cannot access content deemed harmful. That includes explicit music lyrics, violent games, pornography, gambling, and online discussions of subjects such as eating disorders or suicide.
To meet this “highly effective” requirement, most companies have opted not to build their own systems. Instead they have signed contracts with external providers such as Yoti, Persona and Kids Web Services. These services use techniques like:
Scanning an official document such as a passport or driving licence.
Estimating a user’s age through a selfie analysed by AI.
Linking to government databases or credit card checks.
Some verification companies promise to delete personal data within days. Others may retain information for months or years, raising concerns among privacy advocates. Critics point out that once this infrastructure is in place, it could, in theory, be used for purposes beyond child safety.
MPs’ VPN expenses draw attention
While the public adjusts to this new reality, attention has turned to how some politicians manage their own online access.
A POLITICO review of parliamentary expenses found that several MPs, including Business Secretary Jonathan Reynolds, claimed subscriptions for virtual private networks (VPNs). Reynolds expensed a two-year NordVPN subscription in April 2024. Other MPs, such as Labour’s Sarah Champion and Alex Sobel, and Conservative MPs Gareth Davies and Chris Heaton-Harris, have also claimed for VPN services.
VPNs encrypt internet traffic and can hide a user’s location, making them harder to track. They are often used by businesses and journalists to protect sensitive information. However, they can also bypass regional restrictions, including those imposed by age-verification systems.
The revelation has sparked criticism online, with some pointing out the apparent contradiction between MPs approving legislation that pushes the public into using third-party age checks while themselves claiming tools that can avoid such checks.
What it means for ordinary users
For people who rarely think about online privacy, the combination of mandatory age verification and rising VPN usage can seem confusing. In practical terms, the new rules could mean:
You may need to upload official documents or scan your face to access websites you have used freely for years.
Your personal data may be handled by a company you have never heard of and which may be outside the UK.
Content you regard as harmless could still be blocked unless you verify your age.
Some smaller websites may block UK visitors altogether rather than invest in compliance systems.
Meanwhile, VPNs remain legal in the UK, but their usage is being monitored more closely. Providers have reported sharp rises in new subscriptions since the age verification rules came into effect. Privacy campaigners warn that this creates a two-tier internet where tech-savvy or wealthier users can pay for workarounds while others cannot.
The bigger picture
Supporters of the law, including many parents’ groups, argue that the measures are long overdue to protect children in an increasingly digital world. The government insists that the age checks are proportionate and that privacy is being respected.
Opponents counter that the approach is heavy-handed, ineffective against determined users, and potentially damaging to free expression. They also highlight that the involvement of overseas verification companies gives the UK little control over how data is stored or processed.
As the Online Safety Act’s child safety duties become fully enforceable, the divide between public compliance and private circumvention may continue to grow. The irony that some MPs are expensing VPNs while the public is told to trust age-checking systems has not been lost on critics.
For the average person, the choice is stark. Accept a new layer of ID checks to keep using familiar online services, or follow the lead of some elected representatives and invest in a VPN — with all the technical know-how and potential legal scrutiny that entails.
