Mozilla has fired a warning shot at UK regulators, urging them to keep their hands off Virtual Private Networks (VPNs).
The US non-profit, best known for making the web browser Firefox, has submitted a formal response to the Department for Science, Innovation, and Technology's recent consultation on age-restricting VPNs. In a public submission, Mozilla wrote that age-restricting VPNs "would undermine the privacy and security of all users" and "would be technically unenforceable and counterproductive."
- GB News viewers can secure a subscription to ExpressVPN for just £1.99
- Or subscribe to rival supplier NordVPN for £2.29
- We've compared the best VPN deals in our comprehensive guide
The organisation argued that limiting access to VPNs could ultimately expose younger users to greater online risks rather than shielding them from harm. Mozilla continued: "Restricting young people’s access to these tools would therefore work directly against their privacy and safety online. It would remove a layer of protection from precisely the users the Government is seeking to protect, while doing nothing to address the platform conduct that generates harm in the first place. The protections children need are protections from the platforms collecting their data, not restrictions on the tools they use to shield themselves from that collection."
Mozilla launched a built-in VPN feature directly inside Firefox for UK desktop users in March 2026
|FIREFOX
The Government's consultation follows the UK Government's roll-out of the Online Safety Act last summer — adding strict age verification barriers to thousands of popular websites, forums, and social media services. Britons must verify their age by providing a passport scan, a facial scan, or entering credit card details.
Prime Minister Keir Starmer says the government is "laying the groundwork for further action," though any major changes like mandatory age checks for VPN providers will still need Parliament's approval before becoming law.
For those who don't know, VPNs use military-grade encryption to hide the websites that you visit — as well as the amount of time spent on them.
However, Mozilla argues this approach fundamentally misses the point and would create massive new data vulnerabilities.
Research from Internet Matters published last December also found that just 8% of children had actually used a VPN in the previous year. And of those who did, two-thirds were doing so to protect their personal data.
A follow-up study from the Australian eSafety Commissioner doubled down on these findings by concluding that only 7% of young VPN users were trying to get around age restrictions.
LATEST DEVELOPMENTS
Mozilla stated: "Students regularly connect to public or school networks for homework and research; VPN protection is a proportionate response to the genuine security risks this can create. VPNs are also commonly used in educational settings for accessing private institutional networks, a purpose that is clearly legitimate.
"Young people are particularly vulnerable to online tracking, targeted advertising, and the risks that flow from personal data being collected and processed for commercial purposes without adequate consent or transparency."
Children who have been able to bypass age checks have entered a fake birthdate or borrowed a parent's login details. Some have even fooled facial estimation tools by drawing on fake facial hair.
Major changes like mandatory age checks for VPN providers will still need Parliament's approval before becoming law
|PEXELS
If the UK pushes ahead with mandatory age checks for VPNs, every single user would need to hand over sensitive identity documents just to access basic privacy protection. This means in addition to young people, millions of adults would need to submit personal data before accessing tools specifically designed to reduce tracking and data collection.
Mozilla warns that this would also create an irresistible target for hackers. They point to the 2023 Discord data breach as a cautionary tale, where 70,000 user ID photos were leaked after the platform collected identity documents at scale.
Mozilla wrote: "Age estimation using biometrics carries additional risks: facial estimation systems often underperform for people with darker skin tones, women, and those with non-binary or non-normative facial features due to biased or limited training datasets."
Rather than restricting core privacy tools, Mozilla is urging regulators to focus on enforcing existing online safety rules.
The company argued that platforms should be held accountable under the UK’s Online Safety Act, which already requires companies to assess and mitigate risks linked to harmful content and addictive platform features. Tech firms like Sony have begun rolling out age checks in the UK.
Some VPN providers, such as Surfshark, already prohibit users under 18 from using their services, and the requirement for a paid subscription with a valid payment method serves as an additional safeguard against underage use.
Mozilla also backed the use of on-device parental controls, which allow parents to block specific websites and downloads directly on a child’s device. The organization said these measures offer a more targeted solution than broad restrictions that could affect millions of adult users.
Beyond technical safeguards, Mozilla said improving children’s online safety will require greater investment in digital literacy and support systems. The company called for practical resources for parents and educators, stronger mental health support for young people affected by online harms, and more open discussions between children and trusted adults about navigating digital spaces safely.
When you activate a VPN, advertisers, trackers, and hackers are blind when they attempt to track your web history | SORA | GB NEWS The UK isn't alone in suddenly viewing VPNs with suspicion. Denmark recently floated anti-piracy legislation broad enough to spark fears that VPN usage could become legally risky, though ministers quickly insisted that wasn't the intention. Across Europe, these privacy tools are increasingly being treated as obstacles to enforcement rather than routine security software.
Meanwhile, the tech industry is moving in the opposite direction. Mozilla launched a built-in VPN feature directly inside Firefox for UK desktop users earlier this year, joining a broader browser trend toward integrating privacy protections that previously required separate apps.
***All products and promotions are independently selected by our experts. To help us provide free impartial advice, we will earn an affiliate commission if you buy something. Click here to learn more