The UK House of Lords has voted to extend “age assurance” requirements, effectively age verification mandates, to virtual private networks (VPNs) and a wide range of online platforms under the Children’s Wellbeing and Schools Bill.

The decision deepens the reach of the already-controversial Online Safety Act, linking child safety goals to mechanisms that could have severe effects on private communication and digital autonomy.

Under the existing Online Safety Act framework, “user-to-user services” include almost any online platform that enables individuals to post, share, or interact with content from others.

This definition covers social networks, messaging apps, forums, and online gaming services. Only a few forms of communication, such as email, SMS, MMS, and one-to-one live voice calls, are explicitly excluded.

While political messaging around the vote often described the move as a “social media ban for under-16s,” the actual scope is considerably wider.

In effect, most interactive online platforms would now need to collect and verify age data from users, even where those services are not primarily aimed at children.

This represents a major expansion of identity checks across digital infrastructure, once considered neutral or privacy-protective, and one of the most disciplinarian proposals in the West.

Two key amendments advanced during the Lords debate on January 21.

Amendment 92 (“Action to Prohibit the Provision of VPN Services to Children in the United Kingdom”) requires VPNs that are “offered or marketed to persons in the United Kingdom” or “provided to a significant number of persons” to implement age assurance for UK users.

The measure passed by 207 Content votes to 159 Not Content votes.

Amendment 94a (“Action to Promote the Wellbeing of Children in Relation to Social Media”) mandates that all regulated user-to-user services introduce age assurance systems to prevent under-16s from “becoming or being users.” This proposal passed with 261 Content votes to 150 Not Content votes.

Both amendments will proceed to the Bill’s next stage, the third reading in the House of Lords.

Two other amendments, both more technologically intrusive, were discussed but rejected.

Amendment 93, introduced by Lord Nash, would have compelled smartphone and tablet manufacturers, distributors, and importers to install “tamper-proof system software which is highly effective at preventing the recording, transmitting (by any means, including livestreaming) and viewing of CSAM using that device.”

The only plausible way to enforce such a measure would be through constant, automated inspection of every photo, video, and stream on a device. This form of surveillance would have converted personal devices into continuous content monitors, raising severe privacy and accuracy concerns, including potential false positives.

Lord Nash stated: “On Amendment 93, I have had a constructive discussion with Ministers on this issue and more discussions are in progress, so I will not push that to a vote today.”

Amendment 108, proposed by Lord Storey, would have required user-to-user services “likely to be accessed by children” to set their own minimum age thresholds and use age assurance to enforce them.

He argued that a single blanket ban under Amendment 94a was overly rigid. “Having different minimum ages for different platforms would be a better solution,” he said, maintaining that his version would be more effective in practice.

Neither of these amendments passed, leaving Amendments 92 and 94a as the only ones to advance.

The discussion highlights a deepening push within UK legislation to merge digital identity checks with online participation.

While described as safeguarding children, the changes embed a new layer of identity verification across tools once used for privacy, such as VPNs.

These services, designed to conceal personal browsing data and protect against profiling, would now face obligations to verify who their users are. This is a contradiction that could erode one of the few remaining shields for private internet use.

For now, the most invasive surveillance measure, client-side scanning, has been set aside. However, the fact that it was seriously considered indicates continuing interest in embedding scanning mechanisms directly into personal devices.

Whether similar proposals reappear during the third reading remains to be seen.