VPN Age Checks

VPN age checks are a new initiative by British authorities aimed at protecting children from “harmful information.” It follows a series of other puritanical ideas, such as banning social media for people under 16, introducing age verification for viewing adult content, and similar measures. Xeovo explains why VPNs do not actually contribute to the criminalization of teenagers — and what the introduction of age checks could lead to.

Context

The technical logic of this proposal is the same as that of the infamous Chat Control Act. Chat Control is designed to oblige messaging platforms to scan conversations for CSAM before encrypting them and sending them to the recipient. To implement age checks, VPNs would have to scan the user before encryption — just as messengers would scan content.

In both cases, this is impossible without a fundamental restructuring of the architecture. End-to-end encryption, used by most popular messaging platforms, means that messages are encrypted on users’ devices before being sent. No one except the recipient can know their contents. A VPN, meanwhile, is a technology whose very purpose is to hide traffic and location from outside observers such as internet service providers and advertisers.

Of course, there are VPNs that collect and store personal information about their users and log their activity in order to later profit from selling data. But even those services typically do not require identity documents.

VPNs and social media

VPNs do not help bypass age restrictions on social media. To use these platforms, users need a verified account. Once someone logs into a personal account on any website, they automatically stop being anonymous — regardless of whether a VPN is enabled.

Social media platforms are quite capable of determining users’ age and residency through their friend networks, preferred content, photos, tags, as well as by pulling data from AppStore, Google Play or device account.

Changing geolocation through a VPN will only work if social media platforms do not know that the user is a citizen of a specific country that has banned social media for teenagers. If the platform determines that the user is likely such a person, it will block the account regardless of where the user is physically located.

The same applies to other services that may contain adult content, such as dating platforms. They verify the age of their users regardless of location, so using a VPN during registration will not change anything (except possibly the price of a subscription — though even there, the user’s bank card can reveal their location).

VPNs and gambling

Checking age before entering an online casino is a rational measure. But in that case, the endpoint should be controlled — not the road leading to it.

First, online casinos themselves are responsible for age verification. In virtually every country in the world, gambling is prohibited for minors. If an underage gambler somehow ends up in an online casino based somewhere in Curaçao, where such checks might be overlooked, banks step in. They can decline transactions made by customers under 18 (or 21) on websites belonging to companies with specific Merchant Category Codes.

In the United Kingdom, for example, the use of credit cards for gambling was officially banned in 2020, regardless of age. Debit cards can still be used, but only if the casino has a British license — and licensed casinos are required to verify the age of visitors.

Second, if someone wants to bypass restrictions and gamble at a crypto casino, they must first buy cryptocurrency — which requires passing KYC checks on an exchange. A minor will not pass that verification.

VPNs and pornography

Under the Online Safety Act (OSA), platforms hosting content that may be harmful to children must introduce age verification. Pornhub has already implemented checks through credit cards, mobile network operators, digital IDs, and other identifying documents for British citizens, which has pushed many users away.

In this case, VPNs can indeed help bypass restrictions. But the real question is how much teenagers actually need them when, within the first days after the OSA came into force, around 3,000 clone websites of well-known adult content platforms appeared online. Hosting providers complained that these clones simply pirate their content and impose no age restrictions, causing traffic and revenue to grow at the expense of law-abiding platforms.

VPNs and e-commerce

In the United Kingdom, the sale of disposable vapes is banned. Reusable vapes, nicotine salts, and similar products can only be purchased by adults. Tobacco shops, legal in the UK, request proof of age at checkout or perform verification using credit card information. Marketplaces such as eBay and Amazon also conduct age checks or hide search results for nicotine products.

In theory, teenagers may find grey-market online stores abroad that do not ask for documents and do not verify the identity of the bank card holder. As a rule, such stores are not hosted on ordinary domains that can easily be blocked by internet service providers but rather operate on the dark web. If the use of the Tor browser were illegal in the United Kingdom, VPNs could perhaps be blamed for helping minors access the darker corners of the internet. But Tor is not blocked.

VPNs and dangerous communities

Unfortunately, geoblocking access does not solve the problem of youth involvement in illegal activities or online bullying. Teenagers bully each other on any social network, and interest in radicalization can arise simply from reading the news.

Moreover, popular platforms such as Reddit and Discord have already introduced age checks for all users, regardless of their location. Platforms require verification via selfie or ID before users can view or participate in discussions on sensitive topics. 4chan is currently in court with Ofcom, unwilling to pay massive fines for failing to comply with the OSA.

Even 4chan, like any global platform, is still subject to the laws of the country where it is incorporated. It may allow hate speech, but if users discuss attempts to harm someone, the platform itself will ban them. Those with more radical intentions tend to communicate on decentralized platforms hosted on self-run servers or on forums on the dark web (such as 8kun, formerly 8chan).

In addition, radical communities benefit far more from adult followers than from teenagers — and adults are not prohibited from participating in such forums.

What happens if the law is adopted

The main problem is that VPNs cannot determine users’ age through behavioral patterns the way social media platforms do. This means they would have to require every user to provide an ID, bank card, facial scan, or similar verification. Even if VPN providers perform verification internally without involving third-party services, anonymity would effectively disappear. Providers would also need to store verification results to protect themselves in case of regulatory scrutiny.

If external verification providers are involved, the risks of sensitive data leaks increase significantly — not only because of the providers themselves, but because of any contractors involved. In October 2025, photos of official documents belonging to around 70,000 Discord users leaked online. The documents were stored in chats with support and safety teams, and the breach occurred through a third-party customer support provider.

VPNs that agree to introduce age checks would essentially cease to function as VPNs. Customers would start migrating to providers without age verification, and not all of them would be trustworthy. If such a law is adopted, the App Store and Google Play will likely be flooded with hastily built applications created by unknown developers in a matter of days — apps without proper encryption and collecting logs, but conveniently lacking age verification. In other words, something very similar to what happened with porn hosting sites.

VPN providers that refuse to comply will either be forced to leave the market or continue operating under the threat of fines and potential blocking. Blocking VPN services is hardly an original measure in today’s world — but it is somewhat hypocritical for a democratic country.

Children and teenagers will almost certainly start using drop services — adults who pass verification on their behalf. Adults who simply do not want to expose their official documents will likely do the same.

The Google search query “VPN” in the UK from March 2025 to March 2026 has two peaks: one at the end of July–early August, when the Online Safety Act required services to use age assurance to prevent children from accessing harmful content, and another in mid-to-late February, when the government was examining the possibility of introducing age checks for VPNs.

During the first days of July, VPN usage jumped by as much as 1400%.

It is therefore hardly surprising that lawmakers increasingly see VPNs as an enfant terrible — one that makes their attempts to control internet browsing look far less successful than intended.

Silence censorship. Protect your privacy and bypass restrictions with Xeovo VPN. Use code «HBR-10«.