The VPNs allowing youngsters to bypass Online Safety Act rules

Telegraph

31-07-2025

Downloads of VPNs have exploded across Britain since age checks were introduced for pornography and other age-restricted websites last week.
VPN apps have soared to the top of Apple's download charts while one provider, Proton, said it had seen a 1,800pc increase in daily sign-ups.
Here's what you need to know about the technology.
What is a VPN?
How do they work?
What are they for?
Are they legal?
What are the risks?
What have politicians said about them?
How do you verify your age under the Online Safety Act?
How VPNs get around age verification
What is a VPN?
VPNs, or virtual private networks, are services that internet users can deploy to disguise where they are accessing the web from.
Some use them to be more anonymous online, but most install VPNs to circumvent internet restrictions in their own country by routing traffic to appear as if they are online elsewhere.
The UK has seen a surge in VPN use in recent days because of new online safety age checks, which are required on adult websites.
How do they work?
When you use the internet through a mobile network, home wi-fi connection or a public hotspot, your internet activity carries an internet protocol (IP) address, which is assigned to your router or smartphone.
Websites can use this address to tell what country and region you are visiting from.
A VPN prevents this. Instead of connecting directly to a website, internet traffic goes through the VPN company's computer servers, which are based in various places around the world.
That server then routes the traffic back to your smartphone or computer, allowing users to 'disguise' where they are from. It is a bit like using a phone box instead of your own phone to make a call, so that the receiver cannot tell who is ringing.
What are they for?
VPNs are often presented as a way of protecting privacy. Millions of websites and apps tracking activity from your personal IP address could be used to target adverts or profile individuals.
The programmes are popular in countries such as China, where internet access is restricted and closely monitored.
However, they are also often used to get around other internet controls. Netflix has regularly sought to stop the use of VPNs to access TV catalogues in other countries, in what the company has called a game of 'whack a mole', while French sport broadcasters have demanded that VPNs block illegal streaming websites.
Because websites base location-dependent controls, such as the UK's new age checks for adult websites, on a user's IP address, VPNs are now being used to circumvent these restrictions too.
Are they legal?
VPNs are legal in Britain, and the Online Safety Act does not change that. The requirements in the new laws are on websites to enforce age checks, not on users to follow through with them.
Using a VPN to bypass TV streaming services' restrictions is not a criminal offence, but is considered a terms of service violation and could result in a ban.
Any illegal online activity, such as watching pirated football games, remains illegal when using one.
What are the risks?
Routing all of your internet traffic through a single company involves placing a lot of trust in that provider. In theory, they could store all your browsing data or sell it to the highest bidder.
One early popular VPN, Hola, was accused of commandeering users' internet addresses to trigger cyber attacks, while another, Onavo, was used by Facebook to track what rival apps were becoming popular. In response, the company gave users the ability to opt out of the feature.
In 2020, several VPNs were found to be publicly exposing logs of people's internet usage.
A recent investigation from the Tech Transparency Project found that some popular VPN apps were routing traffic through China.
'VPNs are privacy tools but not silver bullets as by using one, you're shifting the trust to a private company,' says Jake Moore, global cybersecurity adviser for security company ESET. 'So it's crucial to choose one you trust.
'While VPNs encrypt your traffic and mask your IP address from your internet service provider, they can see everything you do on the internet once the traffic reaches their servers.
'It is advisable to avoid free VPNs as some have been caught logging and selling some user data to advertisers in the past.'
Mr Moore recommended using a paid VPN with a 'no logs' policy that does not store users' browsing history. Some companies go further by having these policies audited by third parties.
What have politicians said about them?
Peter Kyle, the Technology Secretary, has said that sites that advertise VPNs as a way to bypass age checks would be punished.
'If platforms or sites signpost towards workarounds like VPNs, then that itself is a crime and will be tackled by these codes,' he told The Telegraph last week.
Companies are required to take reasonable steps to prevent children from seeing adult content, although detecting VPN use is seen as a consistent challenge, with providers repeatedly improving the technology they use to mask traffic.
Melanie Dawes, the head of Ofcom, told MPs in May that people would use VPNs to get around the restrictions.
'A very concerted 17-year-old who really wants to use a VPN to access a site they shouldn't may well be able to,' she said. 'Individual users can use VPNs. Nothing in the Act blocks it.'
When the Online Safety Act was going through Parliament under the previous Conservative government, Labour supported a further crackdown on VPNs.
'The use of VPNs exposes a serious weakness in the Online Safety Act's armoury,' said Matt Holman, an AI and data lawyer at Cripps.
As their use continues, pressure may build for a further crackdown.
How do you verify your age under the Online Safety Act?
For those simply wishing to get past websites' new age checks, most sites give users a variety of ways to verify that they are over 18.
Companies such as X, Reddit and Discord are allowing people to use software known as facial age estimation, in which they take a short video selfie that uses artificial intelligence to guess whether they are over 18 or not.
Other options offered by websites include entering a credit card number or connecting to a bank account, which proves users are over 18, or uploading a government-issued ID.
How VPNs get around age verification
Since the Online Safety Act only applies in the UK, masking one's location means users can appear to be from any number of countries that have not enforced age checks.