On July 25, the UK rolled out the first phase of its Online Safety Act. The new regulation requires any website hosting pornographic content to verify that users are over 18 — not just with a checkbox, but with a reliable method: a government-issued ID, a selfie-based age estimation, or a credit card.
Sites that don’t comply could face fines of up to £18 million or 10% of global revenue. Ofcom, the UK’s media regulator, says the new rules are meant to reduce the risk of minors accessing harmful content online.
But just hours after the law went live, VPN downloads in the UK exploded — jumping over 1,400% on iOS. Proton VPN became the most downloaded app in the country. Searches for “VPN” on Google increased tenfold. A clear sign that many users are looking for ways around these new checks.
What Is a VPN and Why Are People Using It Now?
A virtual private network (VPN) is a tool that masks a user’s real IP address. People use them to access content not available in their country, browse privately, or avoid tracking. Under these new rules, they’re also being used to bypass local age verification.
If a user connects to a VPN server in another country — one where the same website doesn’t require ID or a face scan — they may be able to access content without going through the UK’s verification process.
It’s legal to use a VPN. But using one to get around a legal requirement is where the problem starts.
How Platforms Are Responding
Ofcom has said that platforms cannot encourage or promote VPN use as a way to avoid age checks. And some sites, like Pornhub, have already implemented stricter measures — including age gates that won’t let users in without real verification. Others are testing different solutions: facial age estimation, digital wallets, or scanning government-issued IDs.
Some, like X (formerly Twitter), are reportedly developing their own AI tools to estimate age. Discord is giving users the choice between uploading an ID or a selfie. Telegram says it will use facial scanning to check age. Bluesky has said it will offer multiple verification options.
Across the board, platforms are trying to comply. But they’re also dealing with a challenge: how to create an experience that meets legal standards without driving users away.
Why This Is a Challenge for Everyone
Evasion is a real issue. As more countries introduce strict age verification laws, users who don’t feel comfortable with face scans or ID uploads may turn to tools like VPNs to avoid the process entirely.
That creates a problem for both enforcement and safety. If users move to sites hosted elsewhere — ones that don’t comply with the law at all — it may actually reduce the effectiveness of the regulation. It can also push users toward platforms with weaker moderation or no protections at all.
For regulators, the challenge is balancing enforcement with user trust. For platforms, the challenge is creating age verification experiences that feel safe, private, and fast enough that users don’t immediately look for a workaround.
What Could Make This Work Better
Experts and age verification providers agree on a few things. First, users want choice — not just one method, but several. Some may be comfortable with a selfie-based age estimation. Others may prefer to upload ID. Some might even want to use a privacy-preserving tool like a digital token or verified wallet.
Second, platforms need to make it clear how their systems work, what data is collected, and what’s never stored. The more transparent the process is, the more likely users are to stay — instead of looking for the nearest VPN.
Third, this can’t be solved by law alone. There needs to be collaboration — between platforms, regulators, privacy experts, and users — to build solutions that actually work, not just on paper, but in real-world behavior.
For more on the current rollout of the Online Safety Act, read BBC’s full report. For deeper context on why age verification laws are being tested around the world — and where they’re falling short — see this analysis by Enrique Dan
