Following tests by TechRadar, Surfshark has issued a patch to its new, proprietary VPN protocol, 'Dausos.' The update ensures the protocol now functions correctly on specific residential fiber connections, which were previously unable to handle the protocol’s packet overhead.

Earlier this week, we published an article that revealed Surfshark's post-quantum protocol was too bulky for the residential fiber lines we tested it on. That meant we could only access small, non-encrypted HTTP web pages — not ideal for a modern privacy protocol.

After sharing our technical data with Surfshark, the provider fast-tracked a fix. With the release of version 4.27.1, the protocol is fully functional and our initial speed tests have yielded some surprising results.

What went wrong?

When I went to test the new protocol earlier this week, I found I could only access small, unencrypted HTTP web pages and use existing connections (Google Sheets, WhatsApp, etc).

The culprit was a lack of optimization for PPPoE (Point-to-Point Protocol over Ethernet) connections. This specific configuration is the standard for millions of residential broadband users, particularly across the UK.

When we reached out to the company they acknowledged the issue, saying: "You seem to have an edge ISP case that our global teams haven’t caught." Our tests were conducted using a BT/EE connection — a group that serves more than 30 million customers and is the largest ISP in the UK.

The protocol has now been patched and works well even on these "edge" UK cases. So I finally could get on with what I had wanted to do all along and test the protocol's speeds.

Speed test analysis

In our initial tests, Dausos performed 5.8% faster than WireGuard. That's a notable achievement given the heavy computational overhead associated with post-quantum encryption. While it falls short of the 30% boost Surfshark initially claimed, it is a strong start for a protocol still in its infancy

While both protocols resulted in a 20-25% dip in raw download speeds compared to an unprotected line, the impact on upload speeds, latency, and jitter was negligible. On a high-speed fiber connection, this translates to a seamless experience where streaming and browsing remain almost indistinguishable from a non-VPN connection.

These impressive speeds serve to show why Surfshark performed the best in our more controlled speed tests where it was crowned the fastest VPN we've tested.

Speed test methodology

I used Cloudflare's speed test tool. from my home setup, connecting over Wi-Fi to a high-speed fiber connection. I ran each of the settings (No VPN, WireGuard and Dausos) five times sequentially and connected to the same Surfshark server each time. Any obvious outliers were discarded.

It is important to note that these figures represent a snapshot of performance at a specific moment. Network congestion and server load mean that results can fluctuate day-to-day, and users running these tests on different hardware or ISPs will see varying figures.

Despite these caveats, the results show a useful comparison between each protocol setting and as it's such a new tool, I'm sure we can expect even more impressive speeds in the future.

Ofcom appears to be facing a major enforcement challenge. Despite issuing £3 million in fines under the Online Safety Act, the regulator has recovered just £55,000.

With controversial platforms like 4chan now openly mocking the financial threats, Ofcom is being pushed toward its “option of last resort.” If deployed, these measures could test the UK’s ability to control the internet.

Ofcom’s powers

The Online Safety Act forces Ofcom to follow a strict statutory escalation process. When a website ignores corrective demands — like failing to impose age assurance measures — the regulator can issue progressively steeper fines.

If those fail to achieve compliance, Ofcom is left with its business disruption measures (BDM). These allow the regulator to order payment providers and advertisers to withdraw services, or force Internet Service Providers (ISPs) to block a site entirely via an Access Request Order (ARO).

To date, Ofcom has avoided these measures, with a spokesperson acknowledging that their use would represent a “significant regulatory intervention.” However, even if they are introduced, their impact may not be as straightforward as the regulator likely hopes.

The complicated business of BDM

Ofcom must secure a court order to impose business disruption measures which inevitably introduces uncertainty.

Fred Allen, Senior Associate at Kingsley Napley, told TechRadar that courts are likely to scrutinize whether a block is truly necessary or if a "less intrusive measure" could achieve the same goal.

He added that while the courts will “give weight to the opinion of an expert regulator” it will nonetheless "scrutinise carefully measures that restrict rights and freedoms.”

There is also the matter of commercial interests. Under the Online Safety Act, the entities targeted — including ISPs, advertisers, and payment platforms — can contest a ruling.

While it seems unlikely that a national broadband provider will head to court to defend people's right to access a controversial site like 4chan, the potential for protracted legal battles and rising costs may explain why Ofcom has been hesitant to move beyond financial penalties. However, there are other hurdles for Ofcom to consider.

The reality of website blocks

Attempting to block websites is also likely to cause the regulator headaches. Websites often rely on shared infrastructure and aggressive blocking can affect sites and services that aren’t involved.

Italy’s recent "Piracy Shield" initiative serves as a cautionary tale. Designed to block illegal sports streams in real-time, the system mistakenly took down legitimate services for hours.

Because a single IP address can be associated with hundreds of innocent websites, and shared Content Delivery Networks (CDNs) mean many services share the same infrastructure, singling out one site without affecting others requires more advanced blocking techniques like deep packet inspection (DPI).

The adoption of VPNs could also undermine any website blocks that are enforced. Andrew Kernahan, Head of Public Affairs at the Internet Service Providers’ Association (ISPA), stressed that blocking a website should be the regulator’s “last resort” and does not represent a “silver bullet.”

He also told TechRadar that while the “use of VPNs and encrypted traffic can undermine its efficacy, not all users are familiar with VPNs.”

Nevertheless, following website blocks, Ofcom and the Department for Science, Innovation and Technology (DSIT) would likely face a difficult choice. Rather than primarily being concerned with VPN use among children — as they are currently — the regulator would have to consider the impact of VPN use by the broader adult population.

Ofcom’s stance

Ofcom maintains that “if there is an ongoing breach of safety duties and if it is appropriate and proportionate for preventing significant harm to people in the UK, Ofcom can apply to a court for an order which would restrict or block access to a website.”

A spokesperson for the regulator added that it will “not hesitate” to use the powers, though acknowledged it would be significant “due to the impacts it has on the availability of services and information online for people in the UK.”

Regarding the low recovery of fines, the regulator is eager to stress that many of the deadlines to retrieve the funds have not yet passed and is expecting more to be received.

What’s next for the Online Safety Act?

Ultimately, the next phase of enforcing the Act is likely to be just as complex as those that have gone before it. If the regulator ramps up its enforcement and its "last resort" still hits technical limitations, it could force a dramatic rethink of how the UK handles VPN access and encrypted traffic. With that, digital privacy and access to information could be put at risk.

For the time being, Preston Byrne — the lawyer representing 4chan— remains unmoved by the escalating penalties. Last week, the platform responded to a new £520,000 fine notice by sending Ofcom an AI-generated image of a giant hamster.

In an email to TechRadar, Byrne made his stance clear: “If Ofcom wants to censor British citizens, it has that power,” adding that “my client's only regulator here is the First Amendment.”

“Ofcom's own data suggests that 1.4 million unique monthly UK users access 4chan's American servers every month. The UK free speech movement could certainly use 1.4 million new activists, particularly if those activists are 4chan users,” he said.

• Public bodies including Ofcom, Ofsted, and the NHS have all purchased VPN technology since the start of this government
• The combined value of awarded contracts is over £2 million
• The UK government says VPNs have "legitimate" purposes but that they must "deal with circumvention methods"
• MPs continue to claim expenses for enterprise and consumer VPN solutions

Update, March 20: Since the publication of this investigation, the Department for Science, Innovation and Technology (DSIT) published a contract that shows it is spending nearly £50,000 on a survey to understand how children are using VPNs. Details have been added below.

Politicians and public bodies have spent millions of pounds on VPNs while the government considers banning children from using the same technology.

The bodies in question include the schools inspectorate, Ofsted, regional police forces and local NHS departments. The list also features HM Revenue & Customs and Ofcom — the agency tasked with enforcing the Online Safety Act.

These enterprise-grade VPNs are vital for securing public sector data. While they are not typically used to bypass content filters, they rely on the same encryption and tunneling protocols as the consumer brands currently facing regulatory scrutiny.

Other countries that have attempted to regulate the use of consumer VPNs — such as Russia's protocol blocking or Pakistan's national firewall — have inadvertently caused operational damage to businesses that rely on the same technology for "legitimate" purposes.

The findings follow reporting from Politico which revealed that British lawmakers, including senior government ministers, are expensing commercial VPN software.

James Baker, policy manager at the Open Rights Group, told TechRadar that the UK's reliance on VPN technology "demonstrates how important these tools are for cybersecurity across the modern internet."

Baker said that VPNs provide real security benefits and argued that young people should be free to "benefit from those protections too."

Public spending on VPN tech

A TechRadar analysis of public records shows that VPN-related deals since the current government took office have a combined value of over £2 million. While some of these contracts include VPN tools bundled within broader software packages, the scale of the investment signals widespread adoption.

In January 2025, Ofcom — the UK's primary communications regulator — spent nearly £40,000 on firewalls for a VPN replacement project. That same month, HM Revenue & Customs (HMRC) awarded a £30,000 contract for VPN technology to the IT firm Computacenter.

However, these figures are dwarfed by Ofsted's spending. The schools inspectorate — which is responsible for evaluating mobile phone policies in classrooms — has earmarked £490,000 for a "fully managed VPN service."

According to a market engagement notice published in January 2026, the agency is seeking a specialist provider to handle the end-to-end design, operation, and monitoring of its encrypted network until at least 2029.

Local government is also investing heavily. In December 2025, Kent County Council awarded nearly £300,000 to Bytes Software Services for "Checkpoint VPN" technology to facilitate remote access and secure its firewalls.

While these contracts focus on enterprise-grade solutions from B2B providers, the underlying technology remains the same. Whether it’s used by a government official or a teenager, the process of data encryption and tunneling is identical.

MPs' VPN expenses

Since the beginning of the current government, several MPs have expensed consumer VPN solutions. While Politico previously highlighted that senior ministers were expensing the software, TechRadar can now reveal other MPs claiming for VPN services since the start of this parliament:

Other MPs have expensed well-known consumer brands. While Politico highlighted that senior ministers were expensing the software, TechRadar can now reveal the full list of MPs claiming for VPN services since the start of this parliament:

• Sarah Champion (Labour): Norton Secure VPN (£29.49)
• Alex Sobel (Labour / Co-op): NordVPN (£83.99)
• Jonathan Reynolds (Labour / Co-op): NordVPN (£80.68)

The use of these tools by lawmakers highlights a potential contradiction in policy, as the government simultaneously explores age-restricting the very same technology for the general public.

The government's stance on VPNs

The UK government recently launched a landmark three-month consultation which specifically targets VPNs. The process is expected to inform new policies that could force consumer VPN providers to implement age verification measures to block children from using their services.

As part of this process, DSIT has published a contract showing a spend of almost £50,000 on a survey that will ask children about VPN use. According to the redacted contract — which is available on Contracts Finder — the government wants to understand the scope and methods of age-check circumvention.

The survey, which is scheduled to run between March and April, will also ask what motivates young people to use VPNs and, specifically, what 'privacy' means to them.

It's unclear how the government intends to distinguish between consumer and enterprise VPN solutions should they want to restrict access, given that both rely on the same underlying encryption and tunneling protocols.

One question in the government's survey asks respondents to consider the consequences of age-restricting VPNs for the "privacy and data" of all users, as well as the impact on "business costs, revenue, and innovation."

The Open Rights Group's James Baker suggests that the consequences could be far-reaching.

"Policies that treat widely used security technologies as inherently suspicious risk sending the wrong signal about the UK’s approach to cybersecurity," he said.

"Creating uncertainty around core internet infrastructure could undermine the UK’s reputation as a stable and credible place for digital businesses and security innovation."

Despite repeated requests for comment regarding the findings in this investigation, the Department for Science, Innovation and Technology (DSIT) did not provide a response.

Speaking to TechRadar last month, a spokesperson said that the government recognizes that "VPNs serve legitimate purposes, including protecting privacy and security online" and that any measures will be "targeted and proportionate."

Correction (March 23, 2026): A previous version of this article incorrectly included Labour MP Yuan Yang in a list of lawmakers expensing VPNs. The expenses related to a "Virtual Phone Network" which was categorized similarly in public disclosure records. References to Ms. Yang have been removed.

Today, the UK launched its landmark children's digital safety consultation — an initiative that could have dramatic repercussions for VPN use across the country.

The Department for Science, Innovation & Technology (DSIT) is calling for evidence from parents, industry, and the public to understand how technology impacts children's wellbeing and to ensure online experiences are "safe and enriching."

The survey — which will help inform upcoming government policy — includes questions about whether VPNs should be age-restricted and what impact introducing mandatory age checks would have on the wider population.

In the accompanying report, the government acknowledges that "no approach is a silver bullet" and emphasizes the need to balance enforceable content restrictions without limiting the "legitimate and lawful use" of VPNs by adults.

The consultation also questions whether social media access should be restricted by age and if "addictive" design features — including autoplay and infinite scrolling — should be banned for minors.

What does the consultation ask about VPNs?

The specific questions regarding VPNs and other circumvention methods demonstrate that the government is seriously considering mandatory age checks for VPN apps.

However, they also show that officials are weighing the potential repercussions for everyday users. For example, the consultation explicitly notes the "privacy implications" for the wider population if age verification becomes a requirement for all.

The five questions about VPNs are:

• Circumvention methods: Which tools are children currently using to bypass online safety rules?
• Government priorities: How should the government reduce circumvention — increased education, restricting children’s access to VPNs, or other methods?
• Universal age checks: To what extent do you agree that everyone should be subjected to age checks to access a VPN if it prevents children using them?
• Assessing impact: What would the impact of age-restricting VPNs be on the wider population?
• Enforceability: How should the government make age checks on VPNs effective and workable?

The reaction

Following months of deliberation, today's launch is the most concrete demonstration of the government's interest in restricting access to VPNs. Speaking to TechRadar last month, a DSIT spokesperson said:

"We recognize that VPNs serve legitimate purposes, including protecting privacy and security online. That's precisely why we're consulting to make sure we get this right – we want to hear from all stakeholders, including VPN providers and digital rights organizations, about how any measures can be targeted and proportionate."

This approach is mirrored in the consultation report, which acknowledges that "there are many reasons that children may wish to use a VPN." The document specifically cites the "enhanced data protection" provided when connecting to public Wi-Fi and the "extra level of security" for online banking as legitimate benefits for younger users.

The consultation follows a proposal from the House of Lords that called for a total ban on the technology for children. While that amendment was overturned in favor of this evidence-gathering phase, VPN companies have already said they are "open to meaningful dialogue."

However, critics have argued that any policies designed to restrict VPNs could put "vulnerable people in immediate danger" and that such measures are unworkable without an "extreme level of digital authoritarianism."

Have your say

If you want to share your views on the potential for VPN age checks, the government’s consultation is open for three months, closing on May 26, 2026.

Take part: You can complete the official survey at GOV.UK.

Sign the petition: There is also a petition calling on the government to reject any proposals that would restrict or ban the use of VPNs for children "because of the impact this would have on other VPN users."

NordVPN's exclusive deal for TechRadar readers is ending today. You can get this top-rated VPN for $2.88 a month for 28 months, instead of the standard 27 months that was advertised over Black Friday weekend.

While the total upfront cost remains the same, you'll be getting one additional free month when claiming the offer through the links below.

NordVPN is our #1 choice and is the best VPN service on the market thanks to its consistent performance in our speed tests, huge server network, and its independently audited no-logs policy.

While the official holiday shopping window has well and truly ended, this added incentive is still live until the end of the day, offering a final opportunity to lock in 2025's best price before the new year.

To get the deal, ensure you click through using our links to apply the discount code. You might not see the fourth added month until you get to checkout, but verify that you see the bonus time added at the Order Summary stage.

All of these 2-year bonus plans still come with NordVPN's standard 30-day money back guarantee, which means you'll have a month-long chance to test the service's speeds and unblocking capabilities risk free.

Like all the top VPNs, NordVPN is stacked with features, though we advise users to assess which tier offers the best value for their specific threat model. The more expensive of the tiered plans you choose, the more you get, but the core privacy protection remains consistent.

Compare the full NordVPN price plan comparison below. An extra free month for TechRadar readers is available on every 2-year subscription.

• Ofcom says more information needed about VPN use in UK
• VPN usage data is acquired from mobile intelligence firm, Apptopia
• FOI documents show nearly £500,000 spent on internet monitoring tools

Ofcom has announced today that it will continue to gather information about VPN use in the UK to help "guide thinking and decisions about whether there is a need for further action in this area."

In its first report on the state of online safety since the introduction of the Online Safety Act, the agency acknowledges that there has been "considerable public debate" about young people using VPNs to bypass age checks.

The regulator confirmed it will expand its "evidence base" by engaging directly with youth panels and surveying families on their familiarity with VPNs. This data will be combined with ongoing monitoring of VPN adoption trends across the UK.

Ofcom has also confirmed that its data on daily VPN use is sourced from Apptopia, an app intelligence platform, after previously refusing to disclose the source of its data.

In response to a Freedom of Information (FOI) request filed by TechRadar, Ofcom revealed it has spent close to £500,000 on internet monitoring software and services since 2022.

Ofcom's information gathering continues

Alongside its technical monitoring, Ofcom has announced it is launching an advisory panel with the Children’s Commissioner for England "to hear directly from children" about their use and experience of the internet. This will include gathering insights on their use of VPNs.

Additionally, the agency has added questions on VPNs to its Children and Parents Media Literacy Tracker – a long-running annual survey designed to track habits, literacy, and understanding of media in the UK. A report on the data and analysis from this is expected in May 2026.

All of these information-gathering exercises are intended to build Ofcom's "evidence base" and will inform its decision on whether further action on VPNs is required and what it considers to be "proportionate."

TechRadar has reached out to Ofcom to ask whether restrictions could be placed on VPNs following this process, but we are yet to hear back from the agency.

FOI reveals internet monitoring spending

Prior to the publication of Ofcom's report, TechRadar filed a Freedom of Information (FOI) request to obtain information about how the regulator was gathering data on VPN use in the UK. In response, the agency revealed it was accessing data from Apptopia, SimilarWeb, and Ipsos Iris.

The request also disclosed that Ofcom had spent almost £500,000 on internet monitoring software and services since 2022, figures that exclude the current financial year.

We have reached out to Ofcom regarding its budget for these services in 2025/26 and will update this article when additional information becomes available.

Despite the fact that a Virtual Private Network (VPN) is, by its very name, supposed to be private, some VPNs keep logs of users. This is common with free VPNs which often do so to sell data to third parties or create a profile for targeted advertising. Not all logging is quite so sinister, however. Some VPNs keep logs to monitor performance or to enforce usage limits.

Browsing the web is like taking a stroll on a beach. Every step you take (or website you visit), leaves a footprint that can be tracked. Your IP address acts like a digital footprint, revealing your approximate location and potentially your identity. You can use a VPN to hide your tracks and browse privately, as a VPN encrypts the data you send over the internet, making it unreadable to unauthorized users. VPNs also help prevent third parties such as your ISP, hackers, or snoopers from intercepting sensitive information, be it your passwords or credit card details.

The practice of data logging is concerning, particularly when logs link to your identity. Even the best VPN services can suffer a data breach with personal information surfacing on the dark web and used to commit identity theft. Browsing data may even be shared with governments which, in countries with widescale online censorship, could result in legal consequences.

What data might a VPN collect?

The data a VPN collects starts with signup. In the majority of cases, this is nothing nefarious. Most VPNs require you to provide an email address for communications and payment information for billing purposes.

Here’s some of the data a VPN may collect:

Connection logs

A VPN may keep connection logs to troubleshoot issues or to manage and optimize their network. Many VPNs keep connection logs although not all are identifying. Those that are should only be temporary and deleted at the end of each session. Types of connection logs include:

• IP addresses: Your original IP address and the IP addresses you’ve been assigned by the VPN. This is identifying and if logged, should only be done so temporarily.
• Timestamps: A record of when you connect and disconnect from the VPN servers. This information alone isn’t identifying.
• Server information: The VPN server to which you connect. Like timestamps, this information alone isn’t enough to identify you as a user.

Usage logs

Usage logs help enforce data limits, particularly in the case of free VPNs. However, VPNs keeping activity logs (the websites you visit) are best avoided as this data can identify you. Examples of this information include:

• Bandwidth usage: Monitoring the amount of data transferred during a session. This is non-identifying.
• Activity logs: A record of websites visited and data downloaded. Any VPNs keeping such logs should be avoided.

Device information

It’s not uncommon for VPNs to keep device information. However, as with connection logs, this may be to help a VPN provide better support or improve performance. This on its own is non-identifying and self-explanatory, examples of such information could be:

• Device type
• Operating system
• App version

How to find out what data your VPN is collecting

There are multiple avenues to find out if a VPN is collecting your data:

1. Read the VPN's privacy policy

Look for sections on data collection and how that data is used. Often the difference between a quality VPN and a shady service is how accessible and easy to understand this information is.

2. Check for third-party audits

An increasing number of VPNs are subjecting their logging policies to independent audits in order to verify their no-logs claims. These audits should be carried out by reputable security or accounting firms. For example, NordVPN’s no-logs policy has been audited by Deloitte.

3. Contact customer support

Privacy policies don’t always make for the easiest or most intelligible reading. If you have any doubts, get in touch with your VPN’s support. Their responsiveness and transparency can be an indicator of how seriously they take your privacy.

In exploring the above, you may encounter some warning signs. Here are a few to look out for:

• Vague privacy policy: A VPN privacy policy should be specific about the data that it does and doesn’t collect. Any vagueness (such as using broad terms) is a red flag.
• Free VPN service: Free VPNs often make money by logging and selling user data. Use caution with free VPNs and be sure to verify how they fund their free service.
• Inconsistent claims: Some VPNs have claimed to operate no-logs policies only for it to be proven otherwise. Be suspicious if there are inconsistencies between the VPN’s privacy policy and other sources.
• VPN provider location: A VPN may operate out of a country that compels it to keep logs. Check where your VPN is headquartered and how that may impact privacy.

Does data collection always put you at risk?

No, not all data collection puts you at risk. Some data is non-identifying and used for legitimate purposes such as managing a server network or enforcing connection limits. Yet some information, be it IP addresses or browsing history, can identify you. That’s why privacy policies are so important because they can help you determine if a VPN meets your privacy needs.

Why is a privacy policy important?

A VPN’s privacy policy is essential when trying to find out if your VPN is collecting your data. It does the following:

1. Informs you about data collected (connection logs, usage logs, or personal information)
2. Explains why this data is collected (for service improvement, security, or legal compliance)

A quality VPN privacy policy will raise awareness and build transparency through the use of clear, detailed language.

Not everyone will mind if a VPN logs some non-identifying data. The level of acceptable logging depends on your individual privacy requirements. Knowing where to look (as well as the warning signs to look for) helps you avoid any VPNs that are likely to compromise your privacy.