VPN crackdowns won't solve age verification's failures
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
Governments are beginning to look beyond age verification itself and toward the tools people use to bypass it. In Australia, recently released Freedom of Information documents revealed the eSafety Commissioner wants technology companies to actively detect and block VPNs used to circumvent age checks. In the UK, Technology Secretary Liz Kendall has also suggested the government could revisit restrictions on VPNs.
Privacy-focused tech innovator and the creator of Aloha Browser.
Viewed individually, these proposals may seem limited. Taken together, they illustrate how VPNs are increasingly being treated as part of the enforcement problem, when in reality, they are part of the security infrastructure that businesses, journalists, remote employees and millions of ordinary users rely on every day. In the United States alone, half of the country’s remote workers use a VPN.
Age verification laws were introduced with the objective of making it harder for minors to access harmful content, but it produced an unintended consequence. Across multiple markets, growing numbers of users are turning to VPNs because they don't want to upload government IDs or facial scans to websites they neither trust nor expect to visit regularly.
Folding VPNs into the regulatory framework confuses the symptom with the problem. Banning or restricting VPNs rarely stops the underlying behavior. Instead, it pushes users toward less regulated workarounds while handing governments a new lever to tighten control over what citizens can access online. Having spent years building a privacy-first browser, I’ve learned that internet users adapt far faster than regulation.
Every proposal to restrict VPN use runs into the same technical problem. A VPN connection doesn't explain why someone is using it. A journalist protecting sources, a remote employee on a hotel network, and someone dodging an age check look identical from the network's side, and enforcement can't tell them apart.
Any enforcement mechanism built to catch age-check bypass has to sit on top of that same traffic, and it has no way to separate a teenager evading harmful content from an accountant filing a report over a hotel connection.
Stigmatizing VPNs further won't change the underlying demand either. People don't stop wanting privacy because a tool becomes less socially acceptable. They find another way to get both, often through channels with far less transparency than the ones being restricted.
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
The concern here is sharper because of where these laws tend to originate. Rules written in a few high-profile markets often become templates, and other governments treat them as proven models regardless of how well they work. If privacy tools must identify users to function, that expectation can eventually reach encrypted messaging, cloud storage, and other technologies businesses depend on daily.
A company that accepts identity checks on its VPN traffic today has little basis to object when the same logic gets applied to its encrypted messaging platform or its cloud storage provider tomorrow. The infrastructure being debated under the banner of child safety is the same infrastructure that keeps corporate communications and data secure.
An estimated 1.7 billion people worldwide use VPNs, a scale that should give policymakers pause before treating them primarily as a way to bypass age verification. For most users, VPNs are part of everyday internet security, protecting communications and safeguarding public Wi-Fi connections.
The spikes in VPN usage tell a consistent story. The largest surges follow political unrest, as seen during Myanmar's turmoil, or when a popular platform is suddenly blocked, as happened when Turkey restricted Wikipedia for several years.