Age verification requirements for online platforms are running headlong into a fundamental problem: the moment a government erects a digital gate, a well-established tool exists to walk around it. Virtual private networks - software that masks a user's real location by routing their connection through servers elsewhere - have surged in adoption wherever age-assurance laws have taken effect, and regulators are now confronting the uncomfortable reality that their frameworks were built without accounting for one of the internet's most widely used privacy tools.
The Loophole That Lawmakers Cannot Ignore
The European Parliamentary Research Service, an analytical body within the European Parliament, has formally identified VPNs as "a loophole in the legislation that needs closing." The statement followed the EU's introduction earlier this year of an identity and age verification application designed to restrict underage users from accessing social media platforms. The mechanism is straightforward enough in theory: verify who you are before you log on. The problem is equally straightforward - a user who connects through a VPN server located outside the EU can appear, to any platform running verification checks, to be browsing from a jurisdiction where no such requirement applies.
The data on adoption tells the story clearly. When the UK's age-assurance law came into force, Proton VPN reported a 1,400 percent increase in new sign-ups. A comparable surge followed France's decision to block Pornhub for users under 18. These are not marginal upticks - they represent a mass, near-immediate behavioral response. People who want to circumvent age gates know exactly what tool to reach for, and they reach for it quickly.
What Regulators Are Proposing - and Why Solutions Are Hard to Find
The EPRS does not currently offer a technical resolution to the VPN problem, which is telling in itself. One option under discussion - restricting VPN access to users who can verify they are over 18 - essentially proposes solving the age-verification problem by adding another layer of age verification. The Children's Commissioner for England has advocated for exactly this approach in the UK context. The logic has a certain internal consistency: if the concern is that minors can bypass verification by using a VPN, require verification to use the VPN in the first place. The practical and civil liberties complications, however, are considerable. VPNs are widely used for legitimate privacy, security, and professional purposes. Requiring identity verification to access a privacy tool inverts the purpose of that tool almost entirely.
In the United States, individual states are beginning to probe the same problem through legislation. Utah recently enacted a law declaring that any person physically located in the state is considered to be accessing a website from Utah, regardless of what IP address or VPN server their traffic passes through. The intent is clear: to make VPN-based location-spoofing legally irrelevant, at least within the state's own framework. Enforcement is another matter. Utah has no reliable mechanism for determining where a user is physically sitting. In Wisconsin, a bill that included an outright VPN ban was ultimately vetoed by the governor before it could be tested.
A Broader Tension Between Privacy and Protection
The regulatory impulse behind age verification is neither new nor, in its aims, unreasonable. The concern that children are routinely accessing content - whether pornography, violent material, or platforms with documented harms to adolescent mental health - has driven legislative action across multiple continents. What the VPN problem reveals is that these efforts, however well-intentioned, are encountering the structural reality of how the internet actually works. The network was not designed with jurisdiction in mind. Location is malleable. Identity is harder to pin down than a physical address.
The broader trajectory appears to be moving toward more aggressive restriction of the tools that enable anonymity and location-masking online. Whether that trajectory leads to genuinely enforceable policy or simply to an escalating cycle - tighter rules followed by more sophisticated workarounds - remains an open question. What is no longer in question is that governments on both sides of the Atlantic have identified VPNs as an obstacle they intend to address. The tools and the laws are now on a collision course, and the outcome will have implications well beyond the question of underage access to any single category of content.
