Here’s why age verification for VPNs in the UK is absurd to tech privacy pros

Concerned about under-18s using VPNs to bypass age checks on porn sites, the children’s commissioner for England now wants age verification for these tools as well. Experts warn this isn’t a good idea, to say the least.

In a new report, commissioner Dame Rachel de Souza said that even though exposure of children to pornography has increased since 2023, Ofcom’s new protections, requiring porn sites and other platforms hosting harmful content to implement robust age verification systems to prevent children from accessing them, should help.

“The protections for children under the Online Safety Act, which came into force on July 25th, could not have come soon enough,” wrote de Souza.

But she also said: “The office is concerned that even with the new rules, users will be able to circumvent restrictions through the use of Virtual Private Networks (VPNs). Within a day of the new rules being in place, VPN use in the UK was platformed as an easy work-around.”

Corporate interests vs child safety

De Souza also told BBC Newsnight later that children using VPNs freely was “absolutely a loophole that needs closing” and called for age verification on VPNs.

In the report, the commissioner is recommending for the government to “commit to exploring” what measures could be taken to prevent children from using VPNs to circumvent provisions in the Online Safety Act.

“This could be achieved by amending the Online Safety Act to bring in an additional provision which would require VPN providers in the UK to put in place Highly Effective Age Assurance to screen underage users and prevent them from accessing pornographic sites,” says the report.

Cybernews has already reported that more children in the UK say they’ve been exposed to pornography online before the age of 18 than in 2023, when the Online Safety Act was introduced.

Clearly, the report makes grim reading for lawmakers, and the government seems to be taking De Souza’s suggestion seriously.

“Let’s be clear: VPNs are legal tools for adults, and there are no plans to ban them. But if platforms deliberately push workarounds like VPNs to children, they face tough enforcement and heavy fines,” the government spokesperson said.

“We will not allow corporate interests to come before child safety. This is about drawing a line – no more excuses, no more loopholes. Protecting children online must come first.”

Will VPNs become surveillance tools?

The tech experts and privacy activists, however, now have reasons to worry. They warn the move to make VPN providers introduce age verification would hurt online freedoms – and the very point of VPNs.

“VPNs should not be required to implement age verification systems. If such systems are to be implemented, they must be designed to ensure that no data is collected, stored, or tracked,” Luke Murphy, tech writer at X-VPN, told Cybernews.

If major reliable VPN providers comply with the proposed changes, under-18s will probably shift to more covert platforms, which may expose them to even less safe content.

“Otherwise, it would undermine the very essence of VPNs as privacy tools and could even turn the internet into a place where privacy is traded for access – a future we must avoid at all costs.”

But what about the children? Well, if major reliable VPN providers comply with the proposed changes, under-18s will probably shift to more covert platforms, which may expose them to even less safe content.

“Protect your kids, but don’t let VPNs become surveillance tools. I hope we can solve this problem in a flexible, controllable, and privacy-first way, rather than sacrificing the anonymity of all users to plug a single loophole,” said Murphy.

Cameron Rimington, founder and CEO of IronPDF, agrees with Murphy that age verification for VPNs only sounds like a good idea in theory.

“At its most basic level, the point of VPNs is to offer privacy and anonymity, so needing age verification at all undercuts their raison d'être,” said Rimington.

“Not only that, but it will be child’s play for kids to just find free VPN services based in countries not subject to UK laws, effectively making the whole thing a complete waste of time, and possibly pushing them towards less safe choices.”

Where’s that parental responsibility?

Chris Hauk, consumer privacy champion at Pixel Privacy, explains: “Any time you upload information to any website, you run the risk of that information being exposed in a data breach, or being used in other ways to facilitate criminal activities.”

Hauk adds that proponents of the idea might also be underestimating the kids themselves. Young people under the legal age manage to buy or “get” smokes, vapes, or alcohol, for example, and there’s no reason to think they wouldn’t be ingenious online as well.

“Requiring ID will not prevent children from accessing content meant for adults, as all they need to do is scan Mommy or Daddy’s ID, or write down their credit card information, when the parents aren’t looking,” Hauk told Cybernews.

And it’s not just about privacy or security: logistics seem pretty much impossible, according to Rimington.

It would be extremely difficult to enforce age blocks on the VPN providers since VPNs are deployed in many different jurisdictions, and a number of them, of course, market themselves as having a privacy-first approach.

At the root of it is the attempt by the UK to solve the problem of parental responsibility by using technological barriers, a method that has never worked,

Cameron Rimington

“Demanding compliance from all VPN providers all around the globe is just not possible. It has many smaller providers that simply would not comply,” said Rimington, who also doubts that the larger ones would even entertain the idea of giving in to UK laws.

At the root of it is the attempt by the UK to solve the problem of parental responsibility by using technological barriers, a method that has never worked, adds the expert.

Instead of gutting critical internet privacy tools like VPNs, law enforcement would be better advised to focus on education and parental control tools that plug in at the device or router level.

“When I was a kid, my parents didn’t ask the phone company to block certain numbers or otherwise inure me from predatory solicitations. They taught me how to humanely use the phone,” said Rimington.