- Ofcom is monitoring VPN usage following the introduction of the Online Safety Act
- Your third-party tool appears to have AI capabilities
- Despite the security, concerns about privacy and accuracy remain.
UK communications regulator Ofcom told TechRadar that it is using an anonymous third-party tool to monitor VPN usage in the UK.
The agency responsible for implementing the Online Safety Act declined to reveal the name of the platform. However, it appears to have artificial intelligence capabilities and, despite assurances that no personal information is accessed, privacy concerns remain.
this comes later a technology minister,Baroness Lloyd told the UK House of Lords that “nothing is off the table” when it comes to protecting children online, although she acknowledged there are “no current plans to ban the use of VPNs.”
Open Rights Group, a leading UK civil society organisation, warns that any attempt to restrict VPNs would have “a negative impact on freedom of expression and privacy”.
What did Ofcom say?
We contacted Ofcom and asked them to clarify how they access information about VPN usage in the UK. Here is the statement we received by email:
“We use a leading third-party provider, which is widely used in the industry, to collect information about VPN usage. The provider combines multiple data sources to train its models and generate usage estimates. The data we access and use in our analyzes is completely aggregated at the application level, and no personally identifiable or user-level information is ever included.”
Although Ofcom has been transparent about the existence of VPN monitoring, this is the first time it has provided information outlining the methods it is using.
Unfortunately, however, the agency’s response raises more questions than it answers.
What didn’t Ofcom say?
While the use of a third-party provider is not surprising, the fact that Ofcom refuses to identify who it is raises concern.
Ofcom has not responded to our follow-up request for additional information. That means there is no way for the public to know whether the data provider is a company with a track record of protecting people’s privacy or one known for using invasive surveillance techniques.
Ofcom’s statement also suggests that it relies on a tool with AI capabilities (as it “combines multiple data sources to train its models”), but the exact functions of the platform remain hidden.
Since there are so many potential sources of this data (from Internet Service Providers (ISPs) to website administrator logs), it is nearly impossible to evaluate the potential accuracy of platform or privacy credentials without additional details.
Similarly, while identifiable information may be excluded from the data that Ofcom analyzed, there is nothing to suggest that the data is not in re-identification risk.
Finally, the fact that a regulator is using tools (and therefore presumably spending money and resources) to specifically track the public’s use of software designed to improve digital privacy is likely to raise alarm bells. No matter how well-intentioned, tracking VPN usage risks undermining their purpose as a privacy tool.
Why monitor VPNs?
VPNs pose a problem for the UK government and Ofcom, specifically regarding the controversial Online Safety Act, because VPNs allow people to bypass age checks. They do this by connecting to a VPN server in a different country where those age checks are not performed.
By Ofcom’s own estimatesThe number of daily VPN users rose to around 1.5 million following the introduction of mandatory age checks on adult websites earlier this year. However, without additional transparency about how the agency arrived at this figure (which may have relied on the same secret tool) it is impossible to say how accurate it is.
Ofcom understandably wants to monitor VPN usage to determine whether the new legislation is working as intended. The problem is that the method you use may be inaccurate or actively threaten people’s privacy.
An increase in the number of people using VPNs also does not necessarily mean that they are evading the law. “It’s important to note that VPNs can also help protect children’s safety online; they’re not just used to bypass content blocking,” says James Baker, program director at Open Rights Group.
Several VPNs now offer blocking adult sites as part of their subscription plans, including NordVPN and Surfshark, the latter of which recently introduced its Web Content Blocker tool specifically for child protection.
NordVPN’s tool automatically restricts access to adult websites and helps identify malicious websites while you browse. Surfshark can prevent children from accessing a wide range of inappropriate material, as well as offering protection against malware and phishing sites.
What’s next?
Without greater transparency, it is impossible to know exactly what data Ofcom is analyzing and how it could shape the future of the Online Safety Act.
To help get a clearer picture, we also contacted the government department responsible for the legislation, the Department of Science, Innovation and Technology (DSIT), but it ignored our requests for comment.
Despite this lack of communication, a blanket ban on VPNs remains highly unlikely. It would be incredibly unpopular, almost impossible to implement, and certainly expensive.
But using tools to monitor how people in the UK use VPNs is certainly setting a worrying precedent – a precedent more often associated with repressive governments than liberal democracies, according to Baker.
He told TechRadar that most analytics platforms that analyze VPN data show that “VPN usage has been lower in countries that have a higher degree of online freedom and higher in more repressive regimes like China, Russia, or the United Arab Emirates.”
Without greater transparency from the government (and its agencies that oversee laws such as the Online Safety Act), speculation that the UK is sliding towards digital authoritarianism will continue.
