The VPN panic is only getting started

After the Online Safety Act’s tougher internet age restrictions came into effect this summer, it didn’t take long for Britons to catch on. Some methods went viral, such as using video games death strandingPhoto mode to bypass face scan. But in the end, the simplest solution prevailed: VPN.

Virtual private networks have proven remarkably effective in circumventing UK age checks, allowing users to spoof IP addresses to other countries so that the checks never show up in the first place. Days after the law came into effect, the BBC reported that five of the top 10 free apps on the iOS App Store were VPNs. WindscribeVPN shared data showing a surge in its user figures, NordVPN claimed a 1,000 percent increase in purchases that weekend, and ProtonVPN reported a 1,800 percent increase in UK signups over the same period.

This went unnoticed in the corridors of power. There are rumblings that something needs to be done, that key UK child protection laws have been made a travesty, and that VPNs are the problem.

OSA becomes UK law in 2023, but its most important measures took until July to take effect. It requires websites and online service providers to implement “strong age checks” to prevent people under 18 from accessing a wide range of “harmful materials”, meaning mostly pornography and material promoting suicide or self-harm. In practice, this means everything from porn sites to BlueSky now require UK users to undergo an age check, usually credit card verification or a facial scan, to gain full access. You can see why so many of us signed up for a VPN.

Children’s Commissioner Rachel de Souza, a person appointed by the government to represent the interests of children, told the BBC in August that access to VPNs was “absolutely a loophole that needs to be closed.” His office published a report calling for the software to be placed behind the same “highly effective age assurances” that people are using them to avoid.

De Souza is not alone. The government has faced calls in the House of Lords to ask why VPNs were not taken into account in the first place, while a proposed amendment to the Children’s Welfare and Schools Bill would set out de Souza’s age-gating requirement. Even in 2022, long before the Labor Party came to power, Labor MP Sarah Champion predicted that VPNs would “undermine the efficacy” of OSHA, and called on the then government to “find a solution”.

A recent article by techradar Adding to speculation that the government is considering action, the report said Ofcom, the UK media regulator and enforcer of OSA, is “monitoring VPN usage” in the wake of the act. techradar It could not be confirmed what form the monitoring actually takes, although Ofcom stressed that fears of personal use being monitored are unfounded. An unnamed Ofcom spokesperson would only confirm to the site that it uses “a leading third-party provider”, and that the data collected contains “no personally identifiable or user-level information.” (Not often with unknown data, but of course, we don’t know if that’s the case here.)

Still, that research may be an important piece of the puzzle. While VPN use has clearly increased in the country since July, it’s less certain how much of that is coming from children, and how much is adults reluctant to hand over biometric or financial data to log into Discord. Ofcom is researching children’s VPN use, but that work will take time.

The government has always insisted that it is not banning VPNs, and there has been no change in this so far. “There are no current plans to ban the use of VPNs, as there are legitimate reasons to use them,” Baroness Lloyd of Afra, the minister at the Department of Science, Innovation and Technology, told the House of Lords last month. Then, he quickly added that “nothing is off the table”, with the specter of VPN restrictions still looming large.

Complete bans, such as requiring Internet service providers to block VPN traffic at the source, would be unlikely in any case. There’s no serious political outrage to anyone, and as the government itself admits, there are many good reasons to use a VPN that have nothing to do with age restrictions on porn.

“VPNs serve many purposes,” Ryan Polk, policy director at the Internet Society, told me. “Businesses use them to enable secure employee logins; journalists rely on them to protect sources; members of marginalized communities use them to ensure private communications; everyday users benefit from online privacy and security; and even gamers use them to improve performance and reduce latency.”

Furthermore, everyone I’ve asked about it agrees that banning VPNs will be an uphill battle. “Blocking VPN use is technically complex and largely ineffective,” Laura Tyrellite, head of public relations for Nord Security, told me. James Baker, platform power and free expression program manager at the Open Rights Group, put it even more simply: “It’s very hard to stop people from using VPNs.”

Some have suggested that the government could require sites that fall under OSA restrictions to block all traffic from VPNs, as many streaming services are already doing. However this has its own complications.

“Websites serving content will face an impossible choice,” says Polk, “because there is no reliable way to tell whether a VPN user is originally from the UK or from somewhere else.” “They either have to block all UK users (quit the market) or block all VPN users from accessing their website.”

This leaves age-restricted VPNs as the only possible outcome. The OSA already prohibits online platforms from promoting VPNs to children as a way to avoid age checks, so expanding the act to include VPNs might not be too much of a stretch. Technically speaking, this would be the easiest option to implement, but it still has some shortcomings.

Both Tirelight and Baker warn that any efforts to limit VPN use will push people toward riskier behavior, whether it’s less reputable VPNs with poor privacy practices, or simple forms of direct file-sharing, like USB sticks, which introduce new security risks. In a way, this has already happened — both point out that Nord and other paid VPNs require a credit card, meaning younger users are gravitating toward free options, which Baker calls a privacy risk, “because they’re potentially selling your personal data.”

The UK was one of the first countries to implement online age restrictions, but as other countries and states have followed in its footsteps there, we can expect more governments to take VPNs under scrutiny soon. Australia has banned social media for under-16s, the European Union is testing its own restrictions, and various US states have imposed age limits on the internet. As long as VPNs remain the most effective solution, VPN restrictions will remain a matter of debate. In America, they already are. Republicans in Michigan have proposed an ISP-level ban on VPNs, while Wisconsin lawmakers are debating a proposal to require adult sites to block VPN traffic entirely.

Wherever you live, the VPN panic is just getting started.