The only step the UK can take is to force ISP's to block these VPN's which will kick off a cat and mouse game and for the reasonable technical, getting around any VPN ban will be as easy as spinning up an EC2 outside the UK.
They can make it very difficult if they want, just look at China[1]. It's not impossible to get around, but it's not as easy as buying a random VPS, and following a tutorial for openvpn/wireguard.
[1] https://www.usenix.org/conference/usenixsecurity23/presentat...
Beyond straight government control, there's also the politics of all of it. China being a one party system doesn't really care if something is popular with the public but with the UK's parliamentary system, one wrong move and your party gets voted out of power.
But apparently that wasn't enough to stop the online safety act from being implemented in the first place? If voters okay with sites requiring intrusive id/face scans to access 18+ sites, they're probably also fine with ISPs requiring 18+ verification to use VPNs.
However, even if politicians / clueless administrators acknowledged their actions aren't doing much I don't see those people / groups reaching for any other tool other than "let's ban / legislate more".
There's no going back for some folks who are so clueless.
Alternatively, the UK could have a self-service whitelisting system, when a legal entity signs a contract stating that traffic inside the tunnel is also filtered, at the endpoints listed.
Also: The UK government, believe me, does not expect 16 year olds to be capable of spinning up EC2. And if somehow they do, how are they paying for it?
Countries like Iran and China have been trying to block VPNs for years, and all they are doing now is heuristics.
For example I can tunnel traffic over a TLS tunnel. How do you distinguish that with everything else?
If I spent a week setting up a VPN provider, I’d start with this: 99% is spread across 100 endpoints, 55% are cloudflare, and 45% are amazon/azure/google.
A special client mode would check for non-blocked IPs in your country and have those bypass the VPN.
Also, heuristics again: 99%+ of your traffic is going to the same two or three companies only. The owners of the endpoints are not very diverse, which is statistically extremely unlikely. Throttle you to 0.5mbps, so you won't be watching anything, and call it a day.
This is all political theater to bootstrap censorship.
They could start whitelisting money / credit card transfers, I guess. However, reputable VPN providers already accept envelopes full of cash and crypto, so I guess the UK would need to start reading all international mail, and block crypto.
At that point, people could just use tor to bootstrap the VPN account + payments.
History says teenagers will figure this stuff out before adults (due to infinite free time and infinite bragging rights for knowing how to do it).
Did you miss the part where every VPN port is blocked, and all other ports have heuristics in place to detect and throttle VPN-like patterns (e.g. 99%+ of traffic going to less endpoints than you can count on one hand), unless you're specifically whitelisted?
Many protocols can use https ports and packet envelope. Also, there's special censorship resistant VPN protocols, which work even in China despite its nigh-infinity money to block it via DPI
Speaking from personal experience, never underestimate a bored 16 year old with access to YouTube and a generous AWS free tier.
The anglo mind loves to be subjugated. They are the ultimate bootlickers.