this post was submitted on 19 Feb 2026
1252 points (99.8% liked)
Privacy
8982 readers
749 users here now
A community for Lemmy users interested in privacy
Rules:
- Be civil
- No spam posting
- Keep posts on-topic
- No trolling
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
First: VPNs are also used by businesses to allow access for remote workers and sites to the company's internal network. In fact, this used to be their most common use and maybe still is.
Second: what's stopping a foreign VPN provider from offering a VPN service to UK customers without forcing them to identify themselves? If such a company doesn't have UK owners, workers or assets all that the UK authorities could do to enforce a court judgement against them is force British ISPs to block the IP addresses of that provider's VPN servers, which would easilly turn into an a whack-a-mole situation, more so if VPS providers started selling "easy personal VPN server setup" facilities for their virtual personal servers which would make that an insane whack-a-mole situation.
The "VPN server on a rented VPS" situation could easilly turn trully insane to try to block - there are A LOT of VPS providers outside the UK selling pretty cheap services good enough to run a personal VPN server and even without the VPS providers leaning into it by providing an out-of-the-box option (and merelly supporting Turnkey Linux images means having two linux server images that work as VPN servers out of the box), step by step instruction of how to make it work with normal server distros will soon emerge and become common knowledge amongst Britons with even just basic technical skills.
In summary, the UK is a pigmy trying to look like a giant when it comes to how much their laws will influence foreign VPN providers in a market which is pretty competitive and were there is no one dominant market participant which can be pressured to have an implementation "for UK customers only", and even if they found a way to enforce that law on all foreign VPN providers, that's not enough at a technical level to stop people altogether from having access to no-authentication VPN service since anybody can rent a VPS anywhere and run their own VPN server in it.
I agree that technically, this is almost impossible to implement. To begin with, traffic can be tunneled through a variety of protocols. I used to evade my school's filtering by tunneling over https, which was a form of VPN for the purposes of this discussion. It would be a game of whack-a-mole at best in order to identify 'rogue' VPN traffic out of the giant pile of normal encrypted sessions. Duration, maybe, but then the VPN software could just establish a new session to a new endpoint every random amount of time; VPNs become more expensive and slower, but don't go away.
Outlawing encrypted traffic altogether would break so much of the internet that it will never happen.
I'm a little tin-foil-hat about this right now, but I think this could be an anti-worker policy at least as much as it is anti-privacy. We keep talking about how all companies are using VPNs. What if this is being pushed to force all remote workers give up their privacy as a way to urge people back into offices. Company XYZ says, "You can still work remote, but the law says you'll have to do a biometric scan of your face every time/week/month in order to use the VPN."
And if companies get exempted somehow... then I've got a great idea for a new startup: "EnVeePee is a company which pays literally nothing to our contractors, and we expect them to be online for hours a day working really hard for us. We also expect them to contribute to the monthly pizza party."