The VPN panic has only just begun

After tough internet age restrictions under the Online Safety Act came into force this summer, it didn’t take long for Britons to get around them. Some methods have become widespread, e.g Using a video game Stranded deathPhoto mode to bypass face scans. But in the end, the simpler solution won out: virtual private networks (VPNs).

VPNs have been proven Remarkably effective in circumventing age checks in the UK, allowing users to spoof IP addresses from other countries so that the checks never appear in the first place. BBC I mentioned Just days after the law went into effect, five of the top 10 free apps on the iOS App Store became VPNs. WindscribeVPN shared data Showing a huge rise in its user numbers, NordVPN He claimed There was a 1,000 percent increase in purchases this weekend, and ProtonVPN reported an even higher 1,800 percent increase in subscriptions in the UK over the same period.

This did not go unnoticed in the halls of power. There are rumblings that something needs to be done, that the UK’s pioneering child safety law is being ridiculed, and that VPNs are the problem.

OSA It became UK law in 2023But it took until July for the most important measures to take effect. It requires websites and online service providers to implement “strict age checks” to prevent people under 18 from accessing a wide range of “harmful material,” which mostly means pornography and content that promotes suicide or self-harm. In practice, this means that everything from porn sites to Bluesky now requires users in the UK to pass age checks, usually through credit card verification or facial scanning, to gain full access. You can see why so many of us sign up for VPNs.

Children’s Commissioner Rachel D’Souza, a person appointed by the government to represent the interests of children. He told the BBC Last August, access to VPNs was “a loophole that absolutely must be closed.” Her office Published a report Advocating for programs to be protected by the same “highly effective age guarantee” that people are used to avoiding.

D’Souza is not alone. The government has Facing calls In the House of Lords to ask why VPNs were not taken into account in the first place, while a Proposed amendment To the Child Welfare and Schools Bill that would impose the age limit requirement introduced by De Souza. Even in 2022, long before Labor came to power, Labor MP Sarah Champion anticipation that VPNs “undermine the effectiveness” of the OSA, and called on the then government to “find solutions”.

A recent article by Takradar Adding to speculation that the government is considering action, Ofcom, the UK media regulator and enforcer of the OSA, is reportedly “monitoring VPN use” in the wake of the law. Takradar The exact form the monitoring takes cannot be confirmed, although Ofcom insists that fears of tracking individual use are unfounded. An anonymous Ofcom spokesperson would confirm to the site only that it uses a “leading third party provider”, and that the data is aggregated, with “no personally identifiable or user-level information”. (Anonymous data Often notBut of course we don’t know if that’s the case here.)

However, this research may be an important piece of the puzzle. While VPN use has clearly increased in the country since July, it’s uncertain how much of that comes from children, and how much from adults who are reluctant to hand over biometric or financial data to log into Discord. Ofcom is researching the use of VPNs for children, but this work will take some time.

The government has always insisted that it does not ban VPNs, and so far that has not changed. “There are no current plans to ban the use of VPNs, as there are legitimate reasons to use them,” Baroness Lloyd of Evra, Minister in the Department for Science, Innovation and Technology, said. He told the House of Lords last month. She then added back a little later that “nothing is off the table,” leaving the specter of VPN restrictions still at large.

A complete ban, such as requiring ISPs to block VPN traffic at the source, would be unlikely anyway. There’s no serious political outcry over this, and as the government itself admits, there are plenty of good reasons to use a VPN that have nothing to do with age restrictions on pornography.

“VPNs serve many purposes,” Ryan Polk, policy director at the Internet Society, told me. “Businesses use it to enable secure employee login; journalists rely on it to protect sources; members of marginalized communities use it to ensure private communication; everyday users benefit from online privacy and security; and even gamers use it to improve performance and reduce latency.”

Furthermore, everyone I asked agrees that blocking VPNs will be an uphill battle. “Blocking VPN use is technically complex and largely ineffective,” Laura Therrilet, head of public relations at Nord Security, told me. James Baker, director of the platform power and freedom of expression program at the Open Rights Group, puts it more simply: “It’s very difficult to stop people from using VPNs.”

Some have suggested that the government might require sites covered by OSA restrictions to block all traffic from VPNs, just as many streaming services already do. This brings its own complications though.

“Websites that deliver the content will face an impossible choice,” says Polk, because there is no reliable way to know whether a VPN user is originally from the UK or elsewhere. “They will have to either block all users from the UK (abandoning the market) or block all VPN users from accessing their website.”

This makes age-restricted VPNs the most likely outcome. The OSA already prohibits online platforms from promoting VPNs to children as a way to circumvent age verification checks, so expanding the law to include VPNs themselves may not be too much of a stretch. Technically, this would be the easier option to implement, but it still comes with downsides.

Both Tyrylyte and Baker warn that any attempt to limit VPN use would push people toward riskier behavior, whether that’s less reputable VPNs with poor privacy practices, or simpler forms of direct file sharing, like USB devices, that introduce new security risks. In a sense, this has already happened — they both point out that Nord and other paid VPNs require a credit card, meaning underage users are likely to flock to the free options, which Baker calls a privacy risk, “because they’re probably just selling your personal data.”

The UK was one of the first countries to implement age restrictions on the internet, but just as other states and countries have followed suit there, we can expect more governments to bring VPNs under scrutiny soon. Australia has banned the use of social media for those under the age of 16, the European Union is experimenting with its own restrictions, and various US states have imposed age limits on the Internet. As long as VPNs remain the most effective alternative solution, VPN limitations will be a moot point. And in the United States, they already are. Michigan Republicans did Suggest ISP level blocking on VPNswhile Wisconsin legislators are Discuss the proposal To require adult sites to block all VPN traffic.

Wherever you live, the VPN panic is just beginning.