When the UK government pitched its Online Safety Act (OSA), citizens were told the new rules would protect children from accessing pornography. But is there more to this act than meets the eye?
The Electronic Frontier Foundation warned that the legislation was a slippery slope to harming the very people it was meant to protect. Privacy advocates also believe that the policy could be used to stifle political speech and lay the groundwork for vast new databases of personal data. It could also push kids into much darker areas of the internet.
Nearly 500,000 citizens signed a petition asking the government to repeal the Online Safety Act. Bizarrely, multiple ministers suggested that questioning the law was siding with predators, even likening them to Jimmy Savile, to shut down debate.
Since coming into effect on July 25th, Spotify and Xbox have joined the increasing list of companies rolling out age checks in the UK. Elsewhere, Australia has announced it would restrict YouTube access for anyone under 16.
On a personal note, while browsing a football accumulator subreddit to get hyped for the new season, I was prompted to verify my age by taking a series of police style mugshots. It asked me to look left, look right, stare into the lens. To view a thread about Premier League bets. Welcome to the new internet. So, how exactly did we get here?
🌐 The result? Just as we predicted.
undefined Institute of Economic Affairs (@iealondon) July 30, 2025
X, Reddit, Bluesky, and Discord have already rolled out age verification checks.
Even Spotify have introduced age verification, and Wikipedia may be next to follow. pic.twitter.com/QQUtJjTOkG
Death Stranding meets digital resistance.
A failure to enforce OSA measures could see companies fined up to £18 million or 10% of their global revenue. Some might even be blocked entirely within the UK. Ofcom, the country's media regulator, has made it clear: no more prioritising engagement over child safety. As Dame Melanie Dawes put it, companies must "comply with age-check, or face the consequences."
Where there's a wall, there's usually a way around it, and this time, it came from an unlikely hero: Norman Reedus. Or rather, his digital doppelgänger. Within days of the OSA rules going live, a workaround started circulating on social media. UK gamers discovered they could bypass Discord's selfie-based age verification system using Reedus's character from the video game Death Stranding.
In the game's photo mode, Sam Bridges, a photorealistic, middle-aged deliveryman, could be made to look directly into the camera, blink, and even open his mouth. Enough, it turns out, to trick Discord's AI into thinking a real adult was present.
The same trick worked on Reddit's verification system, run by Persona. A quick tilt of the in-game camera, a couple of facial gestures, and NSFW subreddits were unlocked, all without ever showing a real face. It was cheeky, clever, and it was a small victory against the government.
👀As PCGamer reports, Brits are using Death Stranding photomode and selfies of Sam Bridges to bypass Discord's age checks under the UK’s Online Safety Act.
undefined Koneteo | Video Games (@koneteo_studio) July 25, 2025
Just another win for Kojima's ultra-realistic visuals 😅#ps5 #gaming #deathstranding #deathstranding2 pic.twitter.com/bDL6cXqZjp
Of course, not every platform fell for the ploy. Bluesky, for instance, uses facial analysis firm Yoti, whose technology seemed capable of distinguishing a game render from a real human face. Instagram, which also uses Yoti, is likely just as resilient.
But the fact that this exploit worked on two major content platforms, both with third-party verification systems, suggests that the infrastructure underpinning the OSA might not be as airtight as regulators hoped.
VPNs surge as digital exit routes
For those unwilling to gamble with Norman Reedus or hand over their ID, another tool remains evergreen. Following the enforcement of the OSA, UK-based sign-ups to ProtonVPN soared by over 1,800%. VPN apps raced up the charts on the UK App Store and Google Play.
The logic is simple. If you can make it look like you're browsing from another country, the UK-specific restrictions vanish. Porn sites stop blocking content. Social media platforms stop demanding selfies. The digital gatekeeper doesn't see you standing there and buys a little more time before age verification inevitably spreads everywhere.
The UK government hasn't yet moved to ban VPNs. Such a decision would be legally fraught and politically radioactive. When politicians suggest that only criminals use VPNs, it shows a lack of knowledge of the technology.
VPNs have legitimate uses, from remote work, secure browsing, to even circumventing censorship in repressive regimes. But their role in helping users sidestep the OSA does raise uncomfortable questions for lawmakers. If users can teleport out of the fenced-in UK web, what's the point of building the fence?
Industry insiders suggest that VPN IPs could become the next target for blocking or throttling, especially for unverified users. But any attempt to criminalise or restrict VPN use would likely provoke even louder backlash than the OSA itself.
VPN group sees demand rise 1,800% as Britons seek to evade online safety law
undefined Alan D Miller (@alanvibe) July 28, 2025
We should not have to jump through hoops to speak freely
Repeal the Online Safety Act
No to Digital ID
Yes to Digital Bill of Rights
Insist together https://t.co/dCb3CCBR0p pic.twitter.com/ulzVvU2S93
Age gating goes global
While the UK has drawn the spotlight, it's not alone in this push. Across the world, governments are introducing their forms of age restriction, each with a local twist, but rooted in the same sales pitch of protecting children from viewing inappropriate content.
Australia is on track to ban under-16s from using social media altogether. As of December 2025, platforms like Instagram, TikTok, and YouTube will need to enforce strict age limits, locking out younger users entirely.
Zooming out, the global picture looks uneven. In the US, nearly half of all states have introduced their own age-check laws for adult content. Louisiana even offers a state-run digital ID app for users to verify themselves.
France, on the other hand, is taking a stricter stance. Regulators have moved to block adult sites that don't comply with age verification demands. Courts have backed them. Meanwhile, the European Union is testing a coordinated, privacy-preserving prototype app for age checks, voluntary for now, but seen by many as a stepping stone toward a world where age gating is becoming standard, not an exception.
Who's this really for?
Behind the rollouts, fines, and tech tricks lies a bigger question. Who benefits from all this? Advocates argue it's a necessary correction. Governments have sat back for too long, they say, while tech giants have allowed harmful content to reach kids. The tools may be imperfect, but inaction is worse.
Whichever side of the fence you find yourself on, the reality is that third-party systems are gathering identity data that can't distinguish Norman Reedus's video game face or even something generated by Garry's Mod from a real one. What happens when it misidentifies a teenager as an adult or vice versa?
If every controversial subreddit, health forum, or educational channel requires ID or facial data, how many users will stay away? Anonymity, long considered a cornerstone of internet freedom, is under pressure. For some, that trade-off might be acceptable. For others, it changes the character of the internet itself.
Digital resistance and cultural drift
On Reddit and Discord, UK users swap VPN tips and joke about Kojima's accidental contribution to online resistance. Norman Reedus, once known as the star of The Walking Dead, has now become a strange avatar of digital subversion. His face, or at least his digital double, is a stand-in for millions who'd rather not show their own.
People in the UK appear to be using Garry's Mod to get past newly imposed age restrictions
undefined Dexerto (@Dexerto) July 30, 2025
Earlier this week, users also had success using Norman Reedus's face from Death Strandingpic.twitter.com/vU7C8osMMI
Recently, the Tea app, which allows women to share their dating experiences and complete background checks on potential dates, was hacked. The breach exposed users’ personal data, uploaded selfies, and IDs. This incident was a timely warning of how easy it was for attackers to access 72,000 images and photo IDs from a verification process on the dating advice app.
Many believe that it’s not a case of if we will see an attack like this on a nationwide scale, but when. While many users voiced concerns about their digital identity data being hacked or misused, one user casually bragged in a Reddit thread that he just used his mum's passport to get through the checks.
Beyond the humour lies unease. The tone of online commentary is an increasing awareness that we need to protect children, but users are increasingly uneasy with how it's being done and the risks involved.
A future with online checkpoints
In forums and comment threads, a new digital culture is emerging, one where privacy workarounds, spoofing tools, and tech-savvy resistance are shared like recipes. Some shrug and comply. Others comply begrudgingly. Still others resist outright. But everyone is asking variations of the same question: Is this the internet we want?
We may look back on 2025 as the year digital gatekeeping became the norm. The UK's Online Safety Act, despite all its flaws and fumbles, could set a precedent far beyond its borders. It challenges long-standing internet assumptions: that pseudonymity is sacred, that adults shouldn't have to "show papers" to read a forum, that children's protection doesn't justify mass data collection.
There's no simple answer here. Child safety online matters, but so does the right to access information without unnecessary friction. Whether it's the Sam Bridges character on your screen or a VPN in your app drawer, the workarounds are part of that conversation. They're not just hacks, they're expressions of discomfort with a shifting digital norm.
The gates are rising, and only time will tell if the UK is one data breach away from a massive Identity theft scandal. But for today, who gets to hold the keys and under what terms will define the next era of online life.
Your email address will not be published. Required fields are markedmarked