Government · UK · Department for Science, Innovation & Technology (DSIT)
39% of UK Children Have Bypassed an Online Age Check
New DSIT research finds many UK children are already getting past the online age checks introduced under the Online Safety Act. Nearly 4 in 10 children aged 11 to 17 (39%) say they have bypassed an age check at least once, and around a fifth now use a VPN.
Source published Summarised
Read the full report from Department for Science, Innovation & Technology (DSIT)
Key findings at a glance
- 39% UK children aged 11 to 17 who say they have got around an online age check at least once, according to DSIT's July 2026 research.
- 53% Children who have attempted to bypass an age check in total, combining the 39% who succeeded with the 14% who tried without success.
- 22% Children who say they have used a virtual private network (VPN) in the last 3 months.
- 26% Children who have used a VPN at some point in their lifetime, rising from 17% of 11- to 12-year-olds to 31% of 16- to 17-year-olds.
- 58% Children who have heard of VPNs, showing broad awareness of location-changing tools among under-18s.
- 64% Share of child VPN users who use one at least weekly, so usage is frequent rather than occasional.
- 7% All children who say they use a VPN specifically to reach age-restricted websites, apps or games.
- 37% Children who deliberately chose a website, app or game because it had no age check at all.
- 78% Children who have encountered some form of age check online, so most under-18s now meet age gating regularly.
- 45% Children who have met an advanced check such as facial age estimation, government ID upload, payment card verification or a third-party app.
- 63% Share of children who bypassed a check who did so by posing as someone older, the single most common method.
- 71% Success rate among children who set up a VPN themselves, well above the 33% success rate for children who have never used a VPN.
What the report covers
This is DSIT's July 2026 evidence review into how children aged 11 to 17 experience online age assurance, why some get around it, and how they use VPNs. It was commissioned by the Department for Science, Innovation and Technology and carried out by BMG Research, surveying 2,299 young people across the UK. The study sits directly against the child safety duties of the Online Safety Act 2023, which since July 2025 have required in-scope services to use highly effective age assurance to keep children away from the most harmful content.
The headline is that age gating is now widespread but far from watertight. Most children (78%) have met some form of age check, yet 53% have tried to get around one and 39% have succeeded at least once. The weakest checks are the most common: over half of children have met a simple tick box (57%) or been asked to type a date of birth (56%), and a majority (54%) think the tick box does not work.
VPN use is the other half of the picture. Around a quarter of children (26%) have used a VPN, 22% within the last 3 months, and use climbs sharply with age. For marketers, this matters well beyond online safety, because the same behaviours that defeat an age check also quietly distort location targeting and analytics. It also connects to the wider identity-verification shift we covered in our report on how 77% of UK adults have used a digital ID service.
What this means for UK marketers
The obvious reading of this report is a policy one: age checks leak. The more useful reading for marketers is about where young audiences actually are and how reliably you can reach and measure them.
Start with targeting and measurement. If 22% of children are using a VPN in any given three-month window, and adult VPN use spiked to around 1.5 million daily UK users after the child safety duties landed, then a meaningful slice of your UK traffic is arriving with the wrong apparent location. That inflates the direct and unknown-location buckets in analytics, softens the accuracy of regional and city-level targeting, and makes geo-based bid adjustments blunter than they look on paper. If your reporting shows a creeping rise in traffic that cannot be placed, VPN adoption is now part of the explanation, not just missing referrers.
Second, reach to under-18s is fragmenting by design. More than a third of children (37%) have deliberately picked a platform because it had no age check, and the government has signalled its intention to stop social media platforms serving under-16s. Brands that market to teenagers, or to families, should assume the addressable young audience on mainstream platforms will shrink and scatter, and plan channel mix around that rather than last year's assumptions. Our digital marketing services increasingly treat platform reach to younger cohorts as a moving target rather than a fixed given.
Third, if you advertise anything age-restricted, from alcohol to gambling to certain financial products, this is a compliance flag. Platform-level age gates are demonstrably porous: 63% of children who bypassed a check simply posed as someone older, and self-declaration checks are the ones children rate least effective. Treat platform age assurance as one layer, not the whole safeguard, and keep your own verification and creative-suitability standards firmly in place. The strength of public feeling behind these rules is real, as our earlier report on how 89% of parents back a social media age cap made clear.
How they got the data
The research was commissioned by DSIT and conducted by BMG Research. A total of 2,299 young people aged 11 to 17 completed the survey: a nationally representative sample of 2,029, plus a boost of 270 who had used a virtual private network (VPN) in the previous 3 months. The boost respondents were folded into the main sample and weighted to match the nationally representative incidence of VPN use, and the overall sample is representative by age, gender, country and socioeconomic group.
The questionnaire was developed jointly by BMG Research and DSIT and cognitively tested with 10 children and their parents before launch. Surveys were served to a parent or guardian first before the device was passed to the child. DSIT notes the findings are intended to build the evidence base for its own and Ofcom's work, and do not represent government policy.
Government · UK
Read the full report
From Department for Science, Innovation & Technology (DSIT) · published 14/07/2026