This bill has been in the workings through successive governments, you can blame all the main parties for this.
The principle is good, stop younger people being able to find digital material that is likely to harm their development. Like society should be doing with real world stuff.
Kids still find knives, and drugs because those who want to will find adults who are not vigilant or adults who take advantage of them. But generally, we protect kids.
The difficulty is that the principle is going to be hard to manage and MP want to show they understand and can fix issues without actually being experts.
The ISP's didn't want to take the responsibility to police access, so it is left to the content suppliers. But sites that have content that can damage developing minds are rarely going to be hosted by people who want to protect them. And sites that get money for their content, sell your data, or advertise the hell out of you and they don't want to lose revenue.
Meanwhile, the MP carry on with their very simple strap lines that are hard to implement.
My view is that this will stop a number of kids drifting into seeing malicious content as the bar has been raised. But many will work out how to get around them or find their parents run tools like VPN's and this will give them access.
On the otherside, as adults, we should understand what a personal VPN does because I keep seeing VPN companies advertise that they protect you from privacy and security issues which they don't exactly do.
In principle they protect your anonymity from local regulation, the government, that your ISP would have to follow but that means you are handing that information to a less regulated organisation.
This is trusting that the VPN company won't do things you think the ISP would do, and trusting both to not lose your personal details in a compromise or attack.
From the security side, a hacker, is unlikely to be sniffing your traffic on the internet, they are taking control of your machine or Attacker-In-The-Middle you to control your connection. A VPN doesn't stop these attacks, in fact a badly run private VPN is a great way to do Attacker-In-The-Middle.
A private VPN will offer some additional protection when you are on an untrusted network such as a guest Wi-Fi but being able to recognise when your connection is Attacker-In-The-Middle'd or only not sharing your details on public forums will probably also cover most of the threats. And they are good life lessons to learn that don't cost you anything a month.
What these private VPN tools do well, is route your traffic to another location to bypassing restrictions. If you run one and want to protect your kid from seeing bad stuff, don't let them use it.