U.S. and U.K. lawmakers are cracking down on VPNs and your privacy will suffer
Privacy tools should not be treated as contraband simply because they frustrate regulatory schemes.
Virtual private networks (VPNs) are much more than just useful workarounds to avoid age verification requirements, but governments are increasingly targeting them due to that capability. But these efforts would not simply preserve age-verification regimes—they would undermine the very privacy and security protections that VPNs exist to provide. For reference, VPNs mask a user’s location, encrypt their internet traffic, and route their connection through a private service, all of which enhance the user’s privacy online. Some U.K. lawmakers are now looking to require age verification before people can access VPNs, and others are looking to ban children from using them entirely. Meanwhile, lawmakers in the U.S. are wrestling with some of these questions and in one state they were even trying to make VPN use completely illegal.
Lawmakers are frustrated that VPNs help users get around age verification
In the U.K., people are using VPNs to evade age verification requirements that were implemented by social media platforms due to the Online Safety Act. VPNs enable users to mask their locations and make their internet traffic appear as though it comes from another location—including outside the law’s jurisdiction. This is especially important in places like China and Iran, where residents can use VPNs to evade the countries’ mass online censorship. U.K. users embraced VPNs in order to avoid having to upload sensitive information in order to access speech online. Although lawmakers were surprised to see this happen, this outcome was completely foreseeable due to the nature of how VPNs work.
Because VPNs can be used by adults and children alike to avoid age checks, U.K. lawmakers are now proposing age verification in order to access them and even banning children from using them. But this undermines the purpose of VPNs—to protect user privacy. VPNs encrypt users’ online traffic, mask IP addresses, can help protect users from hackers, and help reduce the ability of users to be tracked online. Without an effective VPN, internet service providers can track and share the websites a person visits. In the same way adults benefit from such protections of VPNs, so do children. Preventing minors from accessing privacy enhancing technology does them a disservice and forcing adults to prove their ages with sensitive materials undoes some benefit of VPNs by making them to prove their identity in order to access privacy-protecting tools.
Age verification for VPNs undermines why people use VPNs
Mullvad VPN warned that these proposals “would require everyone to identify themselves in order to use a VPN,” adding that it “would pose a risk to whistleblowers, violate human rights, and represent yet another step toward an authoritarian society.” In the same post, they also noted that the measure “is not age verification but identity verification.” Modern age verification mechanisms that require users to upload their government identification or face scans constitute identity verification. Users upload these materials and hope they aren’t hacked or breached, which has already happened with Discord’s vendor in 2025 (Discord implemented age verification in order to comply with the Online Safety Act), the Tea app in 2025, and the vendor for many top tech companies in 2024, to name a few.
U.S. lawmakers look to regulate VPNs
In the United States, lawmakers are similarly looking at VPN regulation due to the technology’s ability to evade state and federal age verification requirements. Lawmakers will likely continue to turn their attention more towards VPNs as they increasingly look to age-gate social media and AI chatbots. An Arkansas law regulating social media explicitly applies to in-state users who route their traffic through a VPN. The provision rests on a technical assumption that is often unworkable, as websites frequently cannot determine with certainty whether a user is routing traffic through a VPN. Meanwhile, a bill introduced in Michigan last year would have required internet service providers to block VPN traffic and would have even criminalized the “promotion or sale” of VPNs.
Reduced safety online
Directly banning VPN traffic and the sale of VPNs would obviously hinder the ability of regular people to protect their privacy online—but even age-gating them would suffocate user privacy. Many users would be unwilling to upload face scans or government identification in order to access them in the first place—remember, people are increasingly using VPNs in order to avoid having to upload this information on social media sites. Instead, those people would not use VPNs to protect their online activity—or use unsafe VPNs. Not all VPNs are the same, and some can even contain malware. More reputable VPNs may well opt to comply with age verification laws while less reputable ones may end up more attractive to users by not complying with such laws. Further, if VPN providers rely on age verification vendors, those vendors could face breaches and hacks like those mentioned above. Even if they create their own age verification systems, there is no guarantee that they will not face similar vulnerabilities.
Privacy tools should not be treated as contraband simply because they frustrate regulatory schemes. If lawmakers respond to age-verification workarounds by targeting the tools themselves, they risk eroding digital security for everyone. The better response is to design laws that do not require people to sacrifice their privacy in the first place.