Age verification laws are making users turn to unsafe free VPNs

When governments worldwide began enforcing their age verification laws, many people turned to VPNs (virtual private networks) to circumvent privacy-invasive ID verifications. In an effort to save money, many people ended up using free VPN services, which allowed them to bypass local restrictions. Unfortunately, these services do not bring about more privacy – quite the contrary, they often put your data in danger by analyzing your traffic and selling it to other companies.

Sadly, many people don’t realize the risks of free VPNs, instead believing that overcoming the intrusive ID checks forced by the governments will secure their online lives. In this article, I explore the issues with age verification and analyze the potential risks of using a free VPN.

Background

Age verification laws have been introduced in multiple locations around the world. Among these jurisdictions were 19 US states, including Utah, Texas, and Louisiana, France, and Australia. However, perhaps the most impactful age verification law was introduced in the United Kingdom.

In 2023, the UK parliament passed the Online Safety Act, a robust law covering issues related to safety in the online space. Its biggest provision came into effect in July 2025, when the UK began demanding that social media sites verify users’ age by forcing them to provide images of themselves or of their documents.

While designed to protect minors, it has been criticized for effectively killing online anonymity, with some claiming that even the minors it was designed to protect were becoming more exposed to giving their data to third parties.

After the ban came into power, VPN downloads in the UK skyrocketed, topping UK charts on the Apple App Store. Unfortunately, many of these apps were free VPNs that didn’t really solve the privacy concerns the users may have had. Similar occurrences took place in other jurisdictions that introduced such laws.

The hidden dangers of free VPNs

While a free VPN may sound attractive, as is often the case with free things on the internet, there is a catch. Much like free social media, free VPNs have to recuperate their costs somewhere. Most often, they do so by selling the data they gather when users are browsing, which other companies use for marketing purposes.

However, in the past, we’ve seen even more egregious privacy breaches from top free VPN providers. For example, on top of being found to share data with third parties, Hotspot Shield was found to be injecting advertisements into users’ browsers by using the same technique that is used by cybercriminals to execute malicious code. Not only that, but it also redirected eCommerce traffic through its partner network, thus earning commissions for sales that it didn’t really make.

Even worse was the 2015 case of Hola VPN, which turned devices using its free VPN service into what was essentially a botnet. It then sold that botnet’s bandwidth as a paid service through its web scraping platform Luminati (now Bright Data). The same mechanism also allowed users to execute code on devices in the network.

Free VPNs promise privacy – but can you trust them?

If you’re currently using a free VPN, you might’ve checked its privacy policy when reading this article. And if you did, it’s very likely that the privacy policy claims that the provider doesn’t track your usage. That doesn’t mean that you can breathe a sigh of relief, though.

Claiming to hold no logs is quite easy for a VPN company. You put the claim in your privacy policy, and that’s basically all. There’s no way for the end user to know whether your claims are true. That’s why top premium VPN providers regularly hire independent auditing companies to verify their no-logs claims. Most free VPNs do not commission such audits, meaning that their claims will depend on your trust in the company providing the service.

For example, I took a look at the privacy policy and terms of use of the most popular free VPN on the Apple App Store. The first thing I noticed is that the app doesn’t list an address for the company owning it, limits contact to email, and has very unspecific terms of service.

In comparison, paid VPNs have terms of service spanning over 18 articles, with multiple paragraphs under each. Of course, this is also due to the question of payment, but overall, the legal documents are far more professional, and cover far more issues than the free VPN’s legal framework.

Where are free VPNs based?

After seeing the first example, I checked the top 10 results for “free VPN” on the App Store, and only four of the services listed an address for their companies. The others were created by companies with generic names and no listed jurisdiction or address.

This is also crucial, as the jurisdiction where a VPN is registered will also influence the government oversight it is subject to. Most VPN experts advise you to use VPNs that are not registered in Five, Nine, and Fourteen-Eyes alliance member countries. This is because these are more likely to force VPN providers registered in their jurisdiction to hand over any data they have.

Not knowing where a VPN is registered, in turn, makes it hard to verify whether the jurisdiction it's based in is safe. On top of that, considering the risks of free VPNs, not knowing where one is based will make it difficult for you to make any claims should they violate your privacy or agreement.

Free VPNs won’t protect your personal data

While the instinct to use a VPN to protect your personal information from age verification is definitely valid, using a free VPN may make things worse. Age verification attacks your anonymity, but identity verification services are far more reliable at keeping your data private than generic companies from unknown locations. It’s also unlikely that age verification companies will turn your computer into a botnet or sell your data to advertisers.

What’s more, free VPNs may be using outdated encryption protocols, further endangering your personal information and allowing for data leaks during browsing. Finally, some free VPNs are simply scams, with Google recently warning about an uptick in free VPNs being used to deliver malware to devices.

That’s why, if you want to protect your identity online, you should instead choose a premium VPN that has an audited no-logs policy, based in a jurisdiction with privacy-friendly laws, and known by users and reviewers alike. Make sure to also download it from a verified source. That way, you’ll ensure your data is safe while you browse online.

While I understand cost might be a serious concern, you should think about it this way – would you accept a free lock for your front door from a stranger? Or would you rather pay for a new one? The price of a premium VPN is relatively low compared to the safety it brings. Especially that many of them also add extra features, like internet threat protection or a password manager in bundles, further securing your online activity.

Choose safety over savings: avoid free VPNs

Age verification laws have put a dent in internet privacy around the world. However, if you want to avoid giving your personal information to third parties, you shouldn’t use a free VPN, as you may actually leak more information than you would by verifying your age.

With a history of data leaks, selling user information, or even allowing the injection of malicious code, free VPNs do not have a good reputation. The fact that most of them are hidden behind unknown companies, with lazily written agreements and privacy policies, definitely doesn’t help gain any trust. In the case of VPNs, “free” actually means that you’re paying with a different currency – either your data or your safety.

That’s why, if you want to safely browse the internet, you should instead opt for a premium VPN. While the price might seem prohibitive, especially given that the best deals are based on large one-time payments, it’s definitely worth it. I treat premium VPNs as an investment. After all, fixing a large data leak may cost you way more money than what equates to a few dollars a month.