> We could argue on the technical feasability all day, as non-kvm qemu does not need any special permission to run a VM (albeit dog slow).

That's assuming the permission is for "use of kernel-mode hardware virtualization" rather than "installation of virtualization apps".

Notice that if the kid can run arbitrary code then any of this was already a moot point because then they can already access websites in other countries that don't enforce any of this stuff.