VPNs with servers in the United Kingdom

A technical capability notice requires an operator to build or maintain the ability to respond to lawful requests for data. The Investigatory Powers (Amendment) Act 2024 (Royal Assent 25 April 2024) inserted section 258A, under which the Secretary of State may require a relevant operator to notify proposed changes to its services; the government’s factsheet says the amendments also bring entities spread across the globe within the Act.

The Act does not mention VPNs, and whether a VPN operator holds such a notice, or is bound by one, is not established.

The Online Safety Act 2023, section 81 (in force since 17 January 2025), requires services that publish pornography to ensure, by age verification or age estimation that is highly effective, that children are not normally able to encounter it.

The Children’s Wellbeing and Schools Act 2026 received Royal Assent on 29 April 2026. The Lords voted in January 2026 for an amendment prohibiting VPN services to children (207 to 159, according to Reclaim The Net).

The Act as enacted does not mention VPNs; it inserts section 214A into the Online Safety Act, a power for the Secretary of State to require providers, by regulations, to prevent or restrict children’s access to specified services.

Yes. Section 127(1) of the Communications Act 2003, a summary offence, covers sending over a public network a message that is grossly offensive or of an indecent, obscene or menacing character. The Online Safety Act 2023 adds false communications (section 179, summary) and threatening communications (section 181, up to five years’ imprisonment), in force since 31 January 2024 for England, Wales and Northern Ireland.

Where a matter is reported, police should ask the platform to preserve the data as evidence; Crown Prosecution Service guidance calls for particular care before prosecuting how a person has expressed themselves on social media.

The Investigatory Powers Commissioner’s Office was created in September 2017 to replace three earlier oversight bodies. The Commissioner leads it with Judicial Commissioners who hold or have held high judicial office; they approve the most intrusive warrants after the Secretary of State, and inspectors check how authorities use their powers. It is funded by the Home Secretary but acts independently of government.

In Big Brother Watch and Others v the United Kingdom (Grand Chamber, 25 May 2021) the European Court of Human Rights held that the bulk interception regime and the regime for obtaining data from communications providers breached article 8, but not the regime for receiving material from foreign intelligence services. The UK is a party to the 1946 UKUSA signals-intelligence agreement, the basis of the Five Eyes.

The Investigatory Powers Tribunal hears challenges to these powers. In Apple Inc v Secretary of State for the Home Department (IPT/25/68/CH), on technical capability notices, it refused on 7 April 2025 to keep the bare details of the claim private. The order of the rows is the security score, and a server’s location is not a recommendation.