Dame Rachel de Souza, the Children’s Commissioner for England, has put a single, uncomfortable image in front of ministers: children sidestepping new legal safeguards by using ordinary privacy tools. It sounds almost absurd, a teenager downloading a VPN app to watch material the law intended to block, yet it is precisely the loophole her office says is being exploited. The warning cuts two ways: it is about technology and about the human duty to stop treating policy as a checkbox exercise.
The facts that animate this debate are stark. After the Online Safety Act and fresh age-verification rules aimed at porn sites, some traffic to major adult platforms plunged, a sign the measures can work, but a new survey and analysis show exposure to sexual content among young people has not fallen as hoped; in fact, many reported encountering porn even earlier than before. That surge has sharpened the commissioner’s focus on circumvention tools such as virtual private networks (VPNs) and other software that mask location and identity.
Related article - Uphorial Podcast
To understand why a figure like Dame Rachel is sounding the alarm, you have to look at the person as much as the policy. A former headteacher turned national advocate for children, de Souza has spent years listening to young people, not as data points but as voices. Her approach is pragmatic and moral: where she sees a gap between a child’s lived reality and the protections adults promise, she steps in. That blend of education experience and public stewardship gives weight to a simple argument: laws that protect only on paper are false comforts if real kids can easily get around them.
But the problem is slippery. VPNs are legal, widely used tools that protect privacy, enable remote work, and allow people in repressive states to access banned information. Any policy aimed at “stopping VPNs” must avoid throwing out the broader right to privacy. The commissioner’s point, and where the debate needs nuance, is not to criminalize VPNs but to force platform and infrastructure providers to think about age assurance in a less siloed way. If age checks on porn sites are nullified by standard consumer tools, then the architecture of safety has been built on sand.
So what does meaningful action look like? The discussion now ranges across options: stronger enforcement against platforms that deliberately point users toward circumvention, guidance or regulation that nudges VPN providers to adopt age-appropriate protections for under-18 accounts (without degrading privacy for adults), and better sex education in schools so young people understand both the harms and the ethics of what they find online. It is a messy policy, and it must be. Child safety is not a technical problem alone; it is a social and educational one.
There is also a cultural story here. For many teenagers, the internet is where identity, curiosity, and peer pressure collide. Criminalizing curiosity is not the answer; neither is pretending that legislation will by itself alter behaviour. The commissioner’s campaign is a call for alignment: law, technology, and parenting must pull in the same direction. When that happens, tools designed to protect adults won’t become loopholes that expose children.
Dame Rachel’s message is straightforward but urgent: don’t let good intentions stop at legislation. If ministers want to protect children, they must close the loopholes that turn privacy tools into access routes to harm, and they must do it without sacrificing the legitimate uses of those same tools. The work ahead is diplomatic, technical, and moral: translating a law into safer childhoods in a world where the next workaround is always a download away.
