The European Parliamentary Research Service has published a briefing paper that describes VPN use as a loophole in age verification legislation that needs closing. The paper notes that VPN downloads surged 1,800% in the first month after the UK's Online Safety Act took effect. Some policymakers have called for restricting VPN services to adults only.
Utah enacts first US VPN-targeting age verification law
Utah became the first US state to target VPN use in age verification law when Governor Spencer Cox signed Senate Bill 73 in March 2025. The law took effect on May 6, 2025. The UK House of Lords voted 207-159 in January 2025 to ban VPN services for under-18s. The EU Parliament adopted a resolution in November 2024 supporting a digital age of majority of 16 for social media.
Mozilla, Mullvad, and Proton sent a joint letter on May 5, 2025 opposing the UK's proposals to mandate age verification for VPN access. They urged officials not to undermine the open internet. The EPRS paper acknowledges that current age-assurance methods are relatively easy for minors to bypass but offers no technical workaround to prevent VPN circumvention.
France has implemented a double-blind verification model that separates age checks from site identity. California requires operating systems to collect age data at device setup, but GrapheneOS has refused to comply. The EU's own age verification app failed a security test in April, with a security consultant demonstrating a full biometric bypass in under two minutes.
Discussion
0 comments
Log in to join the thread with a thoughtful take, question, or correction.