They're About to Break Every VPN in the UK

Added: 2026-06-02

[00:00:00]Okay, this video is entitled They're About to Break Every VPN in the UK. So, you've probably been watching the UK's age verification roll out. Um, adult sites, social media still expanding.

[00:00:13]We've also seen them move on to different targets like gaming platforms.

[00:00:18]Um, Sony is sending out a reminder at the moment about uh age verification and it's possibly going to expand onto messaging apps quite soon. There's also something else that's being discussed right now. Something that's critical and Ofcom have even confirmed they're monitoring it. Uh this is of course VPNs. Now we've been hearing rumors and clues for a while about this. Uh this for example is a Freedom of Information request, one of many in fact, asking for details of how Offcom is monitoring VPN traffic. Uh I'll put the letter below.

[00:00:54]uh they dodged most of the questions but they did admit they were monitoring the traffic uh and they mentioned some of the tools they were using. Now VPNs are the very thing that people have started using to escape these verification checks and that's pretty crucial as I'll explain soon. Now there is more evidence which I'll explain in this video if you've got a few minutes to spare. So, let's go on and have a look at what's being proposed. Uh, why it probably won't work and what it would actually mean for your privacy if it indeed does.

[00:01:27]So, a quick recap because despite what it seems, this all didn't come from nowhere. Uh, the online safety act came into force in 2023.

[00:01:37]The idea was to protect children from harmful content online and age verification was the main mechanism supposed to make this happen. Now platforms had initially to verify user ages before letting them access certain content. Now the first targets were very much the obvious ones. So adult websites. Offcom set some rules and they issued some deadlines and fines. Um some sites just blocked UK users entirely rather than comply. Quite a few actually. Um and then age verification companies started appearing out of nowhere really offering facial scans. ID uploads, credit card checks, there's loads of them now and they're all multi-million pound companies.

[00:02:21]So then the scope started expanding.

[00:02:24]There was social media platforms are being mentioned now. Video sharing basically anything a child might conceivably access and each time the arguments are pretty much the same. It's for child safety. Think of the children.

[00:02:38]The platforms need to comply and of course the technology is already there.

[00:02:44]Now, at the moment, UK law lawmakers are openly debating whether VPN services should be brought under the act scope.

[00:02:52]Uh, this isn't speculation anymore. This is live policy and it's happening right now.

[00:02:58]So, why VPNs? Well, the government and offcom indeed have a problem. The age verification is simply not working as they intended. There was a study published this month um that found that over a third of the children in the UK have already successfully bypassed the new age checks. That's a lot of children. Now, how? Well, mostly VPNs, but not exclusively. They're basically connecting through a server in another country where the checks don't apply, but also apparently using things like their parents' account. Um there quite a few other methods surprisingly, but they're probably easier to solve. Uh my personal favorite detail from this study was the fake mustaches and that one was tended to be the headline. Uh I'll leave that one without comments for uh the multi-million pound super high techch biometric companies to explain. Anyway, so from the government's perspective, basically there is a loophole. Children are rooting around the checks by simply appearing to be somewhere else. and the policy response being discussed is essentially close the loophole by bringing VPNs into scope. So an EA EU report made the same point and it described VPNs as a loophole that should be closed. So the logic if you want to follow it goes like this. Age verification is required on all platforms. VPNs let people bypass platforms. Therefore VPNs need age verification too. It's very simple logic and it indeed has quite a few problems.

[00:04:35]So, uh, let's go through them. So, what age verification on VPNs would actually look like. So, what would it mean in practice? Well, a VPN, as you possibly know, works by encrypting your internet traffic and routting it through a server in a different location. Now, the entire privacy model depends on the VPN provider not logging, not identifying, and not retaining information about who you are and what you're accessing.

[00:05:02]That's kind of the whole point. That's what you're paying for, anonymity. Now, if you require a VPN provider to verify the age of their users, they have to know who their users are, which means collecting identity documents or using a third-party age verification service or checking against some kind of database.

[00:05:24]And all of these are fundamentally incompatible with what a privacy respecting VPN actually does. Now, Misilla, the company behind Firefox, uh not exactly a fringe organization, submitted a formal warning to UK regulators on exactly this point. Their message was that restricting VPNs will not magically fix Britain's age verification problems. And they also described VPNs as essential privacy and security tools. And they warned that restrictions would have serious unintended consequences for people like security researchers, journalists, businesses, and everybody, ordinary users. Even uh the CEO of Proton, another well-known privacy focused VPN provider, went further and said that forcing age verification onto VPN services would effectively mean, in his words, the death of anonymity online.

[00:06:21]And and that isn't a fringe view. that's from people who actually build and run these services. Um, but I think here's the part that some people are missing in this story. Um, because the problem isn't just that it won't work technically. It's what actually happens to your data if it does.

[00:06:41]So, let's say the law passes anyway.

[00:06:43]What exactly happens? Well, what's happened with every other site that's had to comply with age verification so far is pretty instructive. The platform usually doesn't verify your age itself.

[00:06:55]It hands you off to a third-party age verification provider. You do something like upload your ID, they check it, and they pass a signal back saying yes or no. Now, here's the question worth asking. Who are these third party providers? Where are they based? What did where did they come from? What data standards do they operate under? and probably more importantly, what happens to your documents or your data or your image once the check is done? Now, these aren't really rhetorical questions. Um, several of the companies that have sprung up to handle UK age verification have quite sort of opaque ownership structures. Um, a few have links to data brokers and intelligence companies. Some are based outside the UK. Meaning UK data protection law doesn't apply to them in the same way it would to a UK company. So really the practical outcome of extending age verification to VPNs isn't really a safer internet. It's really a large database of people's identity documents and images and personal data held by companies that probably haven't been properly scrutinized.

[00:08:09]um for a check that a third of children are getting around already anyway. So the problem isn't just that it won't work. It also creates new and very serious privacy risks in the process of failing to work. And I think that's really the pattern here. The online safety act was drafted with a specific set of targets in mind. And every time these targets find a workaround or a problem, they expand the scope and the tools people use to protect their legitimate privacy, i.e. VPNs being the latest example, start getting framed as obstacles rather than legitimate services, which they are with legitimate users.

[00:08:51]Okay, so where does this leave us all practically? Well, first of all, remember the law hasn't actually passed yet. There is still consultation and live debate really. Uh now I put some ideas on this slide too that may be helpful as well. Now Mozilla has and several others has submitted evidence against these proposals. The VPN industry has submitted evidence against it. So the outcome is is not entirely settled. So it's probably not worth panicking just yet, but it's certainly worth keeping an eye on. Now secondly, if you are using a VPN, and it's probably advisable now, it's worth knowing where your provider is headquartered. Now, UKbased VPN providers are going to fall under any new UK law directly. Um, providers based in other jurisdictions like places like Switzerland, Panama, Iceland, Sweden would not be necessarily subject to UK regulation in the same way, at least not immediately. Now, Proton is Swin Swiss.

[00:09:53]Uh, Mulvad is from Sweden. Um, the Nord NordVPN, which is VPN I've been using for many years. Great discount below if you want to support the channel. By the way, they're based in Panama, so this geographical detail matters if if the legislation does progress. And thirdly, I have covered this when I looked at um a Colorado age verification bill um a week or so back. These consultations do get read really by the lawmakers.

[00:10:22]Colorado bill was actually amended quite substantially because developers and open-source advocates push back and explain what would actually happen. Now, Offcom, to be fair, does run public consultations. Responses do go in and they do sometimes change things. So, you've also got your MPs as well, remember? So, if you want to make your view heard, there's a few legitimate channels to do it through or just try and keep up with the debates and see what's happened. Now, I'll put a link to any um relevant offcom pages in the description below. So, a final point, Misilla made this point directly as well. VPNs aren't a loophole. their infrastructure and treating them as an obstacle to be regulated out of existence in order to patch some sort of child safety system which is in vogue and isn't working anyway. I think it's the wrong approach and I think a lot of people across the technical and civil liberties communities would agree. So the debate as I've said before about age verification generally it's not really about safety versus no safety. It's about where you put the controls, who holds the data, and who bears the risk when the system fails. Those are questions worth asking. Okay, just to finish a quick summary of where things are. Offcom is monitoring VPN usage and discussing blocking it. UK lawmakers are debating bringing VPNs under the online safety act. The VPN industry are pushing back. Nothing settled yet, but the direction of travel is clear and it's worth paying attention to. I'll keep covering this as it develops. And if you want clear, nonstense coverage of what's happening to tech and privacy in the UK, subscribe. There's much more of this coming. And thanks very much for everybody for watching. Stay safe, stay private, and I will see you in the next one hopefully. So have a great day everybody. Bye for now.