VPN and proxy on a child's device

A VPN app on the child’s device puts every request inside an encrypted tunnel. The home router sees only the encrypted flow to the VPN provider. The destination inside the tunnel is invisible.

A VPN app is one tap to install. Uninstalling it is also one tap. A router-side filter cannot tell what is going on, and a child who knows what they are doing can defeat a router-only plan in under a minute [source: www-rfc7754-filtering].

This page explains what a VPN does on a child’s device, what parents can recognise, and what does and does not work as a countermeasure [source: esafety-vpn-faq-2026].

Why this matters

Ofcom reports that around one quarter of GB children aged 11 to 17 had used a VPN in the six months before March 2026. Five percent reported using one to reach older-age content or features [source: ofcom-age-assurance-2026].

Among Australian children aged 10 to 15 who still held age- restricted social-media accounts, 7.4% reported VPN use among the methods they used to retain access [source: esafety-smma-2026].

These are the children a router filter was meant to cover. The router is the wrong layer for this gap.

Definition

A VPN, in this page, is a virtual private network client on the device. It encapsulates the device’s traffic inside an encrypted tunnel to a VPN provider. The home router sees only the tunnel [source: saferinternet-technischer-kinderschutz].

A proxy, here, is an intermediary service the device sends requests through. A web proxy is reached by URL. A SOCKS proxy is reached by configuration. Both have the same effect for the home router: the router sees only the proxy [source: www-rfc7754-filtering].

iCloud Private Relay is Apple’s encrypted relay for Safari. It works in much the same way as a VPN from the router’s point of view [source: saferinternet-technischer-kinderschutz].

Scope

This page covers consumer VPN apps, browser-based proxy services, and iCloud Private Relay. It does not cover enterprise-style VPN configuration delivered through mobile device management; that is a different threat model and a different surface [source: saferinternet-technischer-kinderschutz].

It does not cover encrypted DNS alone. Encrypted DNS is covered in Encrypted DNS and what parents see.

What parents can recognise

A VPN app leaves traces on the device that an attentive parent can see:

• A VPN app icon that is not one of the household’s normal apps.
• A “VPN” or “Active connection” indicator in the device status bar, when the device is on the home Wi-Fi.
• An entry under the device’s VPN settings that names a provider the household has not configured [source: saferinternet-technischer-kinderschutz].

iCloud Private Relay is configured under the device’s iCloud settings. It shows as a privacy feature, not as a third-party VPN [source: saferinternet-technischer-kinderschutz].

Browser-based proxies leave traces too. A web browser configured to use an explicit proxy will show the proxy in its connection settings. A child’s browsing history may include proxy-hosting domains the household has not visited [source: www-rfc7754-filtering].

How common VPN use is among minors

The UK and Australia both publish measurements. The numbers are large enough that a parent should plan for VPN use, not treat it as exceptional [source: esafety-vpn-faq-2026].

The eSafety Commissioner’s FAQ for the adult-content code says that services are expected to consider VPN users when preventing workarounds of age protections [source: esafety-vpn-faq-2026].

That sentence is a regulator’s acknowledgement that VPN use is a known path around network-layer controls, and that the controls that matter are the service-side controls, not the network-side ones [source: esafety-vpn-faq-2026].

What VPN detection can and cannot do

Network-side VPN detection is a research field, not a product category. Encrypted-traffic classifiers can identify some VPN protocols and some general “VPN-like” patterns. The accuracy drops when the network conditions differ from the training conditions [source: rfc9490-mten].

Three honest limits to keep in mind:

• A classifier’s “VPN probability” is not proof of intent. Some VPNs are legitimate.
• A new VPN protocol can defeat a classifier trained on older protocols [source: rfc9490-mten].
• A browser-based relay may not look like a VPN to any classifier.

eSafety’s framing is consistent with this: VPN detection is one signal among several, not a verdict [source: esafety-vpn-faq-2026].

What does not work as a countermeasure

A router-side block on a VPN provider’s IP range is maintenance work, not a defence. The provider adds new IPs. The user switches to a different provider. The user uses a less-known protocol that the blocklist does not cover [source: www-rfc7754-filtering].

An “automatic VPN detection” feature in a consumer router is, at best, an early-warning signal. It is not proof, and it is not a substitute for a device-side control [source: rfc9490-mten].

What does work

Three controls survive a VPN app on the child’s device:

• Device-side rules. Screen Time on iOS, Family Link on Android. They run on the device, not on the network, and they continue to enforce time limits, app restrictions, and content filters regardless of which network the device is on [source: saferinternet-technischer-kinderschutz].
• Account-side rules. A Netflix profile PIN, a YouTube Restricted Mode lock, a Roblox content maturity level. These attach to the account, not the device or the network.
• Service-side rules. A service that detects VPN use and applies age assurance at the service is the layer eSafety expects providers to use [source: esafety-vpn-faq-2026].

The three layers overlap. The home router is the layer they all back up.

How to notice it stopped working

A VPN or proxy that is in use does not announce itself on the network. The page the parent thought was blocked loads.

Three signals:

• The device shows a VPN indicator in the status bar that was not there before [source: saferinternet-technischer-kinderschutz].
• A DNS test from the device resolves through a different resolver than the family resolver.
• A blocked page loads on the home Wi-Fi, and the page also loads on a foreign network.

To distinguish these from a configuration mistake:

• Test the block from a known device on the home Wi-Fi, with mobile data off and no third-party VPN installed. If the page is blocked here, the rule is working.
• Check the device’s VPN settings for an entry the household has not added.
• Ask the child, calmly, what apps are on the device. The answer often matches the icon list [source: saferinternet-technischer-kinderschutz].

Talking about it

VPNs are also a privacy tool, used by adults for legitimate reasons: school networks, travel, public Wi-Fi, journalism. Treating a VPN app as evidence of wrongdoing is a category error [source: esafety-vpn-faq-2026].

State the rule. “If you want a VPN on your phone, we will set it up together. A third-party VPN app without a parent knowing is not OK.”

State what the rule is not. “It is not a complete block on every VPN. That is impossible at the network layer. The rule is that the household knows what is on the phone.”

A child who is invited to discuss a privacy tool is more likely to ask before installing. A child who is forbidden to ask is more likely to install without asking [source: saferinternet-technischer-kinderschutz].

Re-check the device settings once a year. A new phone, a new OS update, a new app can each reset the defaults [source: saferinternet-technischer-kinderschutz].

Related wiki pages

The article on Encrypted DNS and what parents see covers the protocol layer that hides the destination.

The article on MAC randomisation breaks device rules covers the related problem of device identity on the router.

The honest limits page, What the network layer cannot do, lists the gaps the network layer leaves open.

Sources

• esafety-vpn-faq-2026 — Australian eSafety Commissioner, FAQ on access to adult content. Regulator expectation that services consider VPN users when preventing workarounds [source: esafety-vpn-faq-2026].
• ofcom-age-assurance-2026 — Ofcom, UK age-assurance report 2026. VPN-use measurement among 11 to 17 year-olds [source: ofcom-age-assurance-2026].
• esafety-smma-2026 — Australian eSafety Commissioner, SMMA evaluation July 2026. VPN use as a method used to retain age-restricted account access [source: esafety-smma-2026].
• saferinternet-technischer-kinderschutz — Austrian Safer Internet Centre. Documented layered-defense guidance and the source of the verbatim provider-quoted gaps [source: saferinternet-technischer-kinderschutz].
• www-rfc7754-filtering — IETF, RFC 7754. Scope, granularity, and efficacy of blocking, including proxies and relays [source: www-rfc7754-filtering].
• rfc9490-mten — IETF, RFC 9490, IAB M-TEN workshop. Encrypted-traffic classification limits as a parental-control complication [source: rfc9490-mten].

[source: esafety-vpn-faq-2026] [source: ofcom-age-assurance-2026] [source: esafety-smma-2026] [source: saferinternet-technischer-kinderschutz] [source: www-rfc7754-filtering] [source: rfc9490-mten]