Blocking VPNs won't solve online age verification failures

Full text

Governments are beginning to look beyond age verification itself and toward the tools people use to bypass it. In Australia, recently released Freedom of Information documents revealed the eSafety Commissioner wants technology companies to actively detect and block VPNs used to circumvent age checks. In the UK, Technology Secretary Liz Kendall has also suggested the government could revisit restrictions on VPNs .

Viewed individually, these proposals may seem limited. Taken together, they illustrate how VPNs are increasingly being treated as part of the enforcement problem, when in reality, they are part of the security infrastructure that businesses, journalists, remote employees and millions of ordinary users rely on every day. In the United States alone, half of the country’s remote workers use a VPN.

Age verification laws were introduced with the objective of making it harder for minors to access harmful content, but it produced an unintended consequence. Across multiple markets, growing numbers of users are turning to VPNs because they don't want to upload government IDs or facial scans to websites they neither trust nor expect to visit regularly.

Folding VPNs into the regulatory framework confuses the symptom with the problem. Banning or restricting VPNs rarely stops the underlying behavior. Instead, it pushes users toward less regulated workarounds while handing governments a new lever to tighten control over what citizens can access online. Having spent years building a privacy -first browser, I’ve learned that internet users adapt far faster than regulation.

You can't regulate intent

Every proposal to restrict VPN use runs into the same technical problem. A VPN connection doesn't explain why someone is using it. A journalist protecting sources, a remote employee on a hotel network, and someone dodging an age check look identical from the network's side, and enforcement can't tell them apart.

Any enforcement mechanism built to catch age-check bypass has to sit on top of that same traffic, and it has no way to separate a teenager evading harmful content from an accountant filing a report over a hotel connection.

Stigmatizing VPNs further won't change the underlying demand either. People don't stop wanting privacy because a tool becomes less socially acceptable. They find another way to get both, often through channels with far less transparency than the ones being restricted.

The precedent is important

The concern here is sharper because of where these laws tend to originate. Rules written in a few high-profile markets often become templates, and other governments treat them as proven models regardless of how well they work. If privacy tools must identify users to function, that expectation can eventually reach encrypted messaging, cloud storage , and other technologies businesses depend on daily.

A company that accepts identity checks on its VPN traffic today has little basis to object when the same logic gets applied to its encrypted messaging platform or its cloud storage provider tomorrow. The infrastructure being debated under the banner of child safety is the same infrastructure that keeps corporate communications and data secure.

Privacy tools are not the problem

An estimated 1.7 billion people worldwide use VPNs, a scale that should give policymakers pause before treating them primarily as a way to bypass age verification. For most users, VPNs are part of everyday internet security, protecting communications and safeguarding public Wi-Fi connections.

The spikes in VPN usage tell a consistent story. The largest surges follow political unrest, as seen during Myanmar's turmoil, or when a popular platform is suddenly blocked, as happened when Turkey restricted Wikipedia for several years.

Laws tied to age verification drive new sign-ups too, albeit on a smaller scale, mostly from people who don't want to upload an ID or a face scan to reach a site they'd rather not be seen visiting, adult sites being the clearest case.

Not all verification is equal

It's worth separating two different situations.

Verifying age on a social network, where someone already has an identity and a reason to be recognized, differs from verifying age on an adult site, where the point is precisely not to be identified.

The first one is reasonable. On the other hand, I don't think anyone should hand over an ID or a facial scan for the second, given the risk of that data leaking and being used for blackmail.

The technology already exists, with limits

Privacy-preserving age verification is real, and working versions already exist, though it's worth being precise about what they can and can't guarantee. Proving something with zero trace anywhere in the system is extremely hard to achieve, and trust must always sit somewhere.

A workable model separates the party confirming someone's age from the party they're visiting. A trusted intermediary checks eligibility once and issues a token in return. That token isn't a currency and isn't tied to a wallet or an account, it's simply cryptographic proof that can't be traced back to the person it was issued to. No one can identify who is presenting the token later.

It works like an ID card with the photo, name and number stripped out, leaving only a yes or no answer to one question. That token lives on the person's own device. The service confirming eligibility never holds it, the user does.

Privacy and verification can coexist

Protecting minors is a legitimate policy objective, and rejecting today's approach isn't the same as rejecting age verification altogether. The question is how to achieve it without asking millions of adults to surrender more personal information than necessary. Parents are best placed to decide what their children can access using tools that already exist. Public policy should support that role.

Governments should encourage age verification systems that collect the minimum information needed to confirm eligibility, while letting privacy tools do the job they were built for. The real work is building age verification people can trust without asking them to surrender their privacy. Regulating VPNs won't get us there.

We've featured the best secure VPN provider.

This article was produced as part of TechRadar Pro Perspectives , our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit