Agencies Failed Three Girls in Southport and the UK Wants to Ban VPNs as an Answer

Key Takeaways

• The Southport Inquiry Phase 1 report, published April 13, 2026, concluded the murders of Elsie Dot Stancombe, Alice da Silva Aguiar, and Bebe King were entirely preventable, with agencies failing Axel Rudakubana at almost every opportunity.
• Buried in its recommendations, the report called for Phase 2 to consider age verification for VPN software to stop children bypassing the Online Safety Act's social media protections.
• The VPN restriction proposal is not new: the House of Lords voted 207-159 in January 2026 to ban VPNs for under-18s, and UK MPs have debated VPN age-gating for months.
• None of the proposed internet restrictions address why police, social care, Prevent, and education agencies each had documented evidence of the attacker's danger and closed their files anyway.

What the Southport Inquiry Is and What It Found

On July 29, 2024, Axel Rudakubana walked into a children's Taylor Swift-themed dance class in Southport and murdered three young girls: Elsie Dot Stancombe, Bebe King, and Alice da Silva Aguiar. Ten others were physically injured and sixteen more left with psychological wounds that will not close on a schedule anyone controls. Following Rudakubana's conviction, the Home Secretary established the Southport Inquiry in April 2025 to produce a definitive account of what happened and why.

The Phase 1 report landed on April 13, 2026, running to 763 pages across two volumes and delivering 67 recommendations. Its central finding is the one that should have prompted the most serious reckoning this country has seen in years: the murders were entirely preventable. Police, social care, Prevent, healthcare, and education agencies all had documented evidence of Rudakubana's danger going back to 2019. They failed repeatedly to share that information across systems, to escalate risk assessments appropriately, or to keep cases open until the underlying danger was resolved.

The VPN Recommendation Nobody Should Be Surprised By

Tucked into those 67 recommendations is a line that has generated more parliamentary enthusiasm than almost anything else in the report. Phase 2, the inquiry says, should consider age verification for VPN software and other options to stop VPNs being used to circumvent the age-related protections in the Online Safety Act 2023.

The Online Safety Act's child safety duties came into force on July 25, 2025, requiring highly effective age checks on social media, adult content platforms, and a wide range of other services. VPN downloads in the UK surged by over 1,000% in the days following rollout. The House of Lords voted 207-159 in January 2026 to ban VPNs for anyone under 18 as an amendment to the Children's Wellbeing and Schools Bill, and the inquiry has now handed that campaign the institutional legitimacy it was looking for.

Only 1 in 10 VPN users is a child, per Ofcom's own data, with Baroness Kidron acknowledging in the Lords debate that much of the VPN surge was adults with legitimate privacy concerns about handing biometric data to third-party verification services.

Treating the Symptom With Surveillance Infrastructure

The VPN recommendation has nothing to do with Axel Rudakubana. He had an al-Qaeda manual, ricin seeds, and three machetes, with Prevent referrals going back years and police contacts dating to October 2019, when he admitted to officers he had taken a knife to school on ten separate occasions and would have used it.

Social care involvement, healthcare assessments, and school records all documented his fixation with extreme violence. The inquiry's own findings show that Lancashire Constabulary failed to transfer his case to Merseyside Police, that his vulnerable child investigation was closed without information being properly shared, and that risk was systematically diluted as it passed between agencies.

None of that failure was caused by VPNs. None of it will be fixed by age-gating them. The VPN recommendation does not appear in the sections on policing failure, Prevent failure, social care failure, or healthcare failure. It appears in the Phase 2 scope covering the role of the internet and social media in influencing violence-fixated individuals, with essentially no connection to what the Phase 1 findings established about why this attack happened.

I find it telling that the recommendation attracting the most political momentum from this report is the one requiring the least institutional accountability. Adding VPN age checks to the Online Safety Act's existing social media ban architecture does not require anyone to explain why documented warning signs failed to stop a teenager from murdering children. It just requires more infrastructure on top of the internet.

Fix the Agencies, Not the Internet

VPN restrictions are unenforceable for the same reason every previous attempt has stalled. Motivated children find the next tool within hours, as they did when the Online Safety Act first came into force. Adults lose privacy infrastructure they rely on for remote work, secure communications, and protection from data harvesting, and by Ofcom's own figures only around 10% of VPN users are children to begin with. Labour has made clear it supports further restrictions, and the political momentum here is entirely decoupled from whether any of it works.

What the Southport Inquiry actually established is that three girls died because people in positions of authority saw danger, documented it, and closed the case. That is the accountability gap this report opened, and the loudest legislative response to it is a VPN ban. I think that tells you everything you need to know about which failure the government is actually interested in addressing.

The only honest answer to the inquiry's own central finding is structural reform of the agencies that failed, with consequences for the people who ran them, not a surveillance layer on top of an internet that had nothing to do with why Elsie, Alice, and Bebe are no longer with us.