Survey: 65% of UK parents worry about online strangers. Just 10% worry about VPN misuse.

New YouGov research finds that only around 1.4% of UK children use a VPN to access content meant for older people. Parents place far greater concern on contact from strangers, misinformation, screen time, and cyberbullying.

VPNs have become a recurring character in the UK’s child online safety debate. Whenever age checks or social media restrictions are discussed, the same assumption tends to follow: children will download a VPN, bypass the rules, and make the protections ineffective. Until now, that claim has often travelled further than the evidence.

New YouGov research for the VPN Trust Initiative (VTI), an industry group co-founded by ExpressVPN, surveyed 2,558 UK children aged 11 to 17, along with a parent or guardian of each child. It offers a detailed picture of how many children use VPNs, why they use them, how involved their families are, and what parents consider the most pressing online risks.

Fourteen percent of children said they had used a VPN during the previous 12 months.

Most young VPN users give at least one privacy-related reason for using one. Almost two-thirds have spoken to a parent or carer about VPNs. Meanwhile, parents are much more likely to worry about strangers contacting their children, misinformation, excessive screen time, or cyberbullying than about VPN use. Only around 1.4% of all children surveyed use a VPN to access content intended for older people.

The research doesn’t suggest that every use of a VPN by a child is harmless. It puts that use into proportion and points toward the risks families believe deserve the most attention.

Only 14% of UK children have used a VPN in the past year

VPN use is far from universal among UK children. When asked which online activities they had done during the previous 12 months, 90% said they had watched videos, 83% had messaged friends, 76% had played online games, and 72% had used social media. Fourteen percent had used a VPN.

Usage increased with age. Seven percent of children aged 11 to 12 had used one, compared with 14% of 13- to 15-year-olds and 23% of 16- to 17-year-olds.

Even among those who had used a VPN, use wasn’t always frequent. Just under half said they used one at least weekly. Across the full survey sample, that equates to approximately 7% of children.

6 in 10 young VPN users give a privacy reason

Thirty-nine percent said they wanted to protect their identity or location online. The same proportion wanted to keep personal information private, while 31% said a VPN helped them feel safer when using public Wi-Fi. Taken together, 61% selected at least one privacy-protection reason.

Privacy also matters to children who don’t use VPNs. Across the full sample, 56% said they were worried about their online privacy.

A young person wanting privacy is not in itself evidence that they’re doing something dangerous. Children use phones for conversations, searches, friendships, health questions, schoolwork, and parts of their lives they may not want displayed to everyone around them. They can need protection from harmful content or contact while also needing a reasonable degree of personal privacy.

Circumventing a safety control is a specific behaviour. Protecting personal information, securing a connection, or limiting who can see a location is something else. Effective policy needs to recognize the difference.

65% of parents worry about strangers, while 10% cite VPNs

Parents in the survey were not relaxed about their children’s lives online. Their concerns were simply concentrated elsewhere.

Sixty-five percent named inappropriate contact from strangers as one of their leading concerns. Misinformation and fake news followed at 57%, excessive screen time at 55%, cyberbullying at 50%, and scams or financial fraud at 30%. Ten percent selected the use of VPNs to access inappropriate content.

The survey records what parents worry about, rather than measuring the objective likelihood or severity of each harm. It nevertheless provides an important view of what families are seeing and discussing at home. Parents are looking at who can reach their children, what appears in their feeds, how long they spend online, and whether other users can deceive, bully, or exploit them.

Among young people who had used one, 65% had spoken about VPNs with a parent or carer. Forty percent first heard about VPNs through a parent, carer, or another family member, and 32% had their VPN set up by a parent.

Around 1.4% use a VPN to access content meant for older people

The survey also asked directly about the behaviour attracting the greatest political attention: using a VPN to access content meant for older people. YouGov asked young VPN users why they used one. One of the possible answers repeated wording used in Ofcom’s own research: “to access content meant for people older than me.”

Ten percent of children who had used a VPN selected that reason. As VPN users represented 14% of the full sample, the figure works out at around 1.4% of all children surveyed.

Ofcom’s separate research into children’s use of VPNs produced an equivalent estimate of approximately 3%. The surveys used different samples and should not be treated as identical, but both point in the same direction: some children use VPNs to reach older content, while the proportion of children doing so is small.

Another 8% of young VPN users said they had used one to get around controls set by a parent or carer. That behaviour deserves attention. It doesn’t justify treating every child who uses a VPN as though they are attempting to evade an age check.

Over half of young VPN users rely on a free app

The type of VPN children choose also deserves closer attention. Fifty-five percent of young VPN users said they mainly used a free VPN app. Twenty-seven percent used a paid subscription, while smaller groups used a VPN built into their device or one supplied by their school.

Paid use was usually supported by the family. Among children using a paid VPN, 87% said a parent or carer paid for it.

Installation was more mixed. Thirty-two percent of all young VPN users had a parent set it up, while 26% downloaded one themselves from an app store and 23% downloaded one from a website.

Price alone doesn’t establish whether a VPN is trustworthy. A free service is not automatically unsafe, just as payment does not automatically guarantee good privacy practices. Parents should look at who owns the service, what information it collects, which permissions its app requests, how it makes money, and whether its security and privacy claims have been independently tested.

An app-store listing makes software easy to obtain. It’s not a substitute for understanding the company or its data practices.

This is also a risk policymakers should consider before making reputable privacy services harder to access. Children who want a VPN are unlikely to stop finding apps altogether. Any restriction should be tested against the possibility that it leaves the least transparent options within easiest reach.

Safety settings fall away as children get older

Parental controls change sharply as children get older. Sixty percent of parents of 11- to 12-year-olds said they had activated content filters on their child’s devices. That fell to 40% among parents of 13- to 15-year-olds and 20% among parents of 16- to 17-year-olds. By ages 16 to 17, 52% of parents reported having no parental controls in place at all.

Some reduction is appropriate. A 16-year-old should have more independence than an 11-year-old, and permanent surveillance isn’t a healthy substitute for trust.

The findings point to a handover that families need to manage deliberately. As technical controls are relaxed, children still need to know how to deal with unwanted contact, suspicious requests, manipulated information, scams, and pressure to share images or personal details. The safety conversation needs to mature with them rather than disappear with the settings.

That matters particularly on phones. Among children who regularly used social media, 88% accessed it through a phone. Only 3% shared that phone with family members. For most teenagers, the device where the greatest part of their online social life takes place is also their most personal device.

What parents should check before the new school year

Parents can’t see every message or control every app, but they can close the gaps this research brings into view. Before the school year starts, focus on who can contact your child, what their phone reveals, which privacy tools they use, and whether they know where to turn when something goes wrong.

Check who can contact your child

Review who can send messages, add them to groups, view their stories, or see when they are online. Stranger contact was parents’ leading concern, yet these settings can change when an app updates or a child creates a new account.

The aim isn’t to inspect every conversation, but to make sure a stranger can’t reach a child as easily as a friend can.

Review what their phone reveals

Look at location sharing, public profile information, photo permissions, contact syncing, and which apps can access the camera or microphone. Do it together and explain what each setting changes.

Privacy controls work better when a child understands them than when they are simply switched on without discussion.

Ask what a VPN is being used for

The most likely answers in this survey were privacy, entertainment, public Wi-Fi, or gaming. Asking directly gives parents a chance to understand the reason, check which provider is being used, and discuss any attempt to get around household rules without treating the VPN itself as proof of wrongdoing.

For any privacy or security app, check the provider, permissions, ownership, privacy policy, and independent security record.

Agree what happens when something goes wrong

Children need to know that telling an adult about a threatening message, unwanted image, scam, or stranger will not automatically result in punishment or the loss of their phone.

Where a nude or sexual image of somebody under 18 has been shared online, the IWF and Childline’s Report Remove service can help the young person report it and seek its removal. Suspected child sexual abuse imagery can also be reported confidentially to the IWF. A child in immediate danger should be reported to the police.

Targeting a defined harm doesn’t require weaker privacy

The online harms described by parents in this research are serious. The response should be equally serious and precise.

ExpressVPN’s work with the Internet Watch Foundation provides one example of what that can look like. Through the Not on My Network initiative, ExpressVPN restricts access across its global network to domains the IWF has verified as being dedicated to child sexual abuse material.

The OpenBoundary system operates at the DNS level. When a user requests one of the verified domains, the connection is rejected. ExpressVPN does not inspect the contents of general user traffic, perform deep-packet inspection, or log browsing activity as part of the process.

That system addresses one narrow and clearly defined form of harm. It can’t solve stranger contact, harmful recommendation systems, cyberbullying, or every route through which children encounter illegal material.

Its wider value lies in the principle behind it: identify the harm precisely, use verified evidence, apply a proportionate intervention, and preserve privacy outside that specific boundary. The same discipline should guide the debate around children and VPNs.

This research shows that VPN use among UK children exists, that some use them to circumvent controls, and that parents should understand which services are installed on their children’s devices. It also shows that the scale of age-related circumvention is much smaller than the public debate often implies, that privacy is a leading motivation, and that many families are already involved.

Children deserve online protections that deal with the harms they actually face. They also deserve privacy and security tools that don’t treat their entire digital lives as suspicious.

Methodology

All figures, unless otherwise stated, are from YouGov Plc. The total sample consisted of 2,558 children aged 11 to 17 and a parent or guardian of each child. Fieldwork was conducted online between June 5 and June 22, 2026.

The figures were weighted and are representative of all UK children aged 11 to 17 by age, gender, region, Index of Multiple Deprivation, and ethnicity.