Last Friday, the Online Safety Act’s (OSA) age verification provisions kicked in for companies hosting adult content accessible to British audiences. These provisions required companies to verify age in “technically accurate, robust, reliable and fair” ways, including use of driving licences, credit cards, and even selfies.
But it wasn’t difficult to see how British users planned to get around our enlightened government’s plans. Virtual Private Networks (VPNs) are easily accessible and reroute internet traffic through another country to hide its origin.
In a 2022 Institute of Economic Affairs paper, Matthew Lesh and Victoria Hewson warned that the OSA’s age-verification measures risk companies blocking access to British users or the same users “using virtual private networks (VPNs) to access them, thereby undermining the ability of the Bill to achieve its stated purpose”.
Or, as one BBC News reader commented, “Sure, I will give out my sensitive information to some random, unproven company or… I will use a VPN (…) Difficult choice.”
To nobody’s surprise then, VPN use skyrocketed over the weekend after the measures came into effect. The Switzerland-based Proton VPN became the UK’s top free app on the App Store, with half of the top-10 now VPN apps.
This represents a second high-profile rebuke for the government’s internet control programme this year. In February, Apple withdrew its most secure cloud storage service from the UK market rather than comply with a request under the Investigatory Powers Act to allow authorities mythical ‘backdoor’ access to the company’s customers’ end-to-end encrypted data.
So what should we expect from the government? Some humility perhaps? It seems unlikely. Peter Kyle, the Secretary of State for Science, Innovation and Technology, made the staggering accusation that Nigel Farage was ‘on the side’ of predators like Jimmy Savile for criticising the law. These comments sent a clear signal that things will get worse before they get better.
Guido Fawkes points out that during the then-Online Safety Bill’s passage, the Labour Party’s leadership supported a proposed amendment to monitor the impact of VPNs on compliance. “If VPNs cause significant issues, the Government must identify those issues and find solutions, rather than avoiding difficult problems”, said the amendment’s sponsor Sarah Champion MP.
Thankfully, the government ruled out a crackdown on VPNs this week but it’s difficult to see where the OSA goes from here. If VPNs provide an easy avenue for people to avoid the legislation’s mandates, will the government really accept that the OSA has become Law In Name Only? I doubt this week marks the end of the VPN wars and any future attempt to restrict them would still be an alarming escalation.
A full VPN ban would put us into an exclusive category with fellow liberal democracies Belarus, North Korea, Iraq, and Turkmenistan. The wider group of countries which significantly restrict VPN usage includes Russia, Iran, Oman, Turkey, the United Arab Emirates, and the People’s Republic of China. Surely just another group of countries doing right by their citizens by protecting them from scary online harms.
I don’t expect that this kind of company would give the state pause for thought. Governments, especially those like the UK that don’t have robust constitutional safeguards to individual liberties, have no incentive to limit themselves to things they should do. If they did, the government would have acknowledged the threats posed by the OSA to free speech, privacy, and innovation, and scrapped the legislation altogether.
But VPN restrictions would go even further, a case of the state failing to acknowledge the limits of what they can do.
Take the case of communist China, an authoritarian superpower which keeps its 1.4 billion residents trapped within the confines of its ‘Great Firewall’ which restricts access to sites hosted by tech behemoths like Meta, Google, and Amazon. This pushes people to use Chinese Communist Party-approved services like WeChat and Weibo which government censors can more easily control, regulate, and censor.
In the early years of mass surveillance and censorship, Chinese dissidents and everyday people curious to see beyond the online walls imposed by the state, started using VPNs. This set off an arms race which has continued ever since, with the communist censors finding new ways to detect and thwart VPN and proxy connections, and citizens innovating new ways to get around the latest restrictions.
To get around the blocking of mainstream VPN providers, Chinese dissenters often host their own VPNs and proxy servers. They also draw on a vast international community of experts who help them to circumvent the Chinese government’s latest passive and active detection of encrypted traffic. Leading international providers like Nord VPN have innovated ‘obfuscation servers’ designed to mask encrypted traffic to make it appear normal to the Chinese censors. As recently as February 2024, it was reported that VPN use in the People’s Republic had doubled, while reports from February 2025 suggest the CCP is preparing for another crackdown. This cycle will likely continue.
There are one or two countries, however, that seem to be doing a better job clamping down on VPNs: North Korea and Turkmenistan. In communist Korea, most citizens don’t have the material resources to access banned content. Only some have access to the state-sanitised mini-internet ‘Kwangmyong’, with an even smaller cadre of connected elites the only ones able to surf the world wide web (albeit under strict surveillance). Even then, some tentative reports suggest an uptake in VPN usage in the hermit kingdom.
It’s a similar story in Turkmenistan where internet connection is slow, expensive, and entirely run through the country’s one, state-controlled Internet Service Provider (ISP). Nonetheless, reports suggest an ongoing game of cat-and-mouse between censors and VPN users there as well.
So, the government has two coherent options. One is to respond to the age verification failure by going down the same road as authoritarian superstates like China. This means building an effective nationwide censorship infrastructure and network of state-sponsored tech companies in order to enter a constant arms race with tech savvy citizens and foreigners to keep VPNs, proxies, and the like under some sort of control. Or it can admit defeat and accept that there are some powers that not even Parliamentary Sovereignty can give you.
In all likelihood, the government will just muddle on. Regulations and restrictions will slowly ratchet up over time, imposing more costs and inconvenience on the great majority of internet users while leaving savvy citizens (including genuine wrongdoers among them) unscathed.
