APPS that disguise a user’s location have surged in popularity after the UK introduced age-verification rules as part of its Online Safety Act.
The new restrictions, which went into effect in late July and aim to prevent children from accessing harmful material on the internet, require “age assurance” systems to be implemented across thousands of websites that contain adults-only content. These include pornography sites, dating apps and social media platforms such as Reddit and TikTok.
But it seems that many Britons are reticent to hand over a credit card number or other identification credentials to prove they’re over the age of 18, and are instead opting to use a “virtual private network” (VPN) to make it look like they’re in a different country. As of Aug. 4, VPNs comprised four of the top 10 most downloaded free apps on Apple, Inc.’s App Store in the UK.
VPNs aren’t just a challenge for the UK’s ambitious new effort to govern the internet and keep children safe. As regulators around the world pass rules aimed at reining in access to content on the web — whether to protect kids from harmful posts, suppress speech or restrict access to social media — users are rushing to find tools to subvert such controls.
WHAT IS A VPN?
Whenever you use the internet, your connection is assigned a unique set of numbers called an Internet Protocol (IP) address.
A VPN is basically a digital mask that disguises that IP address. It’s a piece of software that hides what you’re looking at online and where you’re looking from. It does so by routing your internet traffic through an encrypted “tunnel” to the VPN provider’s servers elsewhere in the world.
If you’re browsing the web in London, for example, a VPN can make it appear to an internet service provider and government authorities that you’re surfing online from Barcelona. If someone were to intercept your internet traffic, it would appear as unreadable encrypted code.
WHY DO PEOPLE USE VPNS?
The idea of VPNs emerged three decades ago as a way for employees to log into their office networks remotely over a secure connection. VPNs have gained traction as a tool for privacy protection as people can avoid being tracked by websites and apps for targeted advertising.
People looking for ways to skirt the rules of the internet have found other uses for VPNs. These services can enable access to “geoblocked” content that isn’t available in a user’s home country, such as a show on streaming platform Netflix or a live sports event where the broadcasting rights belong to an overseas network.
In places with harsher censorship and surveillance regimes, such as China and Russia, VPNs have taken off as a means of bypassing government firewalls. Hackers also employ VPNs to conceal their identities.
Several companies, such as Lithuania’s NordSec BV, have turned VPNs into lucrative businesses, charging a subscription fee to companies that want to improve their cybersecurity or consumers trying to avoid ad-trackers or prying eyes.
HOW POPULAR ARE VPNS?
Interest in VPNs tends to rise after governments move to restrict access to content on the web.
The UK’s rules on age verification commenced on July 25 and triggered a dramatic spike in sign-ups for VPN services in the country. On July 27, sign-ups were almost 2,000% higher than the daily average over the 28 days prior to the new rules being in force, according to Top10VPN, a global VPN monitoring platform.
Swiss VPN provider Proton VPN said that it experienced an 1,800% increase in daily sign-ups from UK-based users, on average, in the six days following the implementation of the age checks.
The VPN momentum in the UK has outpaced recent upticks in activity elsewhere spurred by other governments’ rule changes.
In Iran, Top10VPN data indicates VPN demand surged by as much as 707% above average after the government restricted internet access in an attempt to blunt the impact of cyberattacks during the June conflict with Israel.
And when age-verification laws for adult websites kicked into effect in France in June, VPN demand peaked at 570% above normal levels, according to Top10VPN.
ARE VPNS LEGAL?
VPNs are legal in most parts of the world when used for legitimate purposes — for example, by workers connecting remotely to a corporate network, or as an additional layer of security to protect payment information when shopping online.
In jurisdictions where VPNs are allowed, law enforcement agencies have moved to shut services down if they enable criminal activity. In 2022, a joint operation by 10 countries, including Germany, the US and UK, seized the servers of VPNLab.net after an investigation found the network was being used to support the deployment of ransomware and other cybercrime.
Some countries have banned VPNs outright, including Turkmenistan, North Korea and Iraq. Others have restricted their use, requiring VPNs to block certain content, such as in Russia, or only allow access to officially authorized VPN apps that may be monitored by authorities. In China, for instance, VPNs must be approved by the government.
VPNs are sometimes subject to temporary constraints on their usage during what a government deems a crisis.
CAN VPN USERS BE IDENTIFIED?
Although VPNs enhance privacy significantly, users can still be tracked.
“Subpar” VPNs may make a user’s real IP address visible to websites, according to Surfshark, a VPN and antivirus software provider owned by Nord Security. Companies that require users to log in will also have records of their customers’ activity while they’re logged into their accounts.
Government and law enforcement agencies may request access to logs of VPN users’ online activity, although many VPN providers say they don’t keep such data.
Even if a VPN user isn’t identified, a number of websites can detect that a VPN is being used and block the traffic. Websites that want to stop users from breaking local laws or enforce geographic restrictions can identify traffic coming from known VPN IP addresses. They might also look for signs of unusual activity, such as a single IP address generating a high amount of traffic, or traffic coming at odd hours for the location.
And while traffic is encrypted in the VPN tunnel, the information outside of it, such as data stored on a user’s device, is not.
COULD VPNS UNDERMINE THE UK’S ONLINE SAFETY ACT?
The Online Safety Act, which was passed in 2023 and is being rolled out in phases, puts the onus on websites to enforce age checks, not on users to comply. Platforms that fail to implement age-verification measures risk penalties of up to £18 million ($24 million) or 10% of their global revenue, whichever is greater.
But even if age assurance systems are in place, children and teenagers could just use VPNs to circumvent the restrictions, particularly as many VPN apps are free or offer cheap subscriptions. Adults may also use this workaround out of fear that hackers could steal the personal data they submit to verify their date of birth.
VPN apps are legal to download and use in the UK and there aren’t currently any proposals to curtail them. Some UK lawmakers have previously suggested that Ofcom, the media regulator, should investigate the effect of VPNs.
The Department for Science, Innovation and Technology has said that “platforms have a clear responsibility to prevent children from bypassing safety protections. This includes blocking content that promotes VPNs or other workarounds specifically aimed at young users.”
Early data suggests that VPNs haven’t completely neutralized the Online Safety Act’s new age requirements. In the initial days after the rules came into force, the government said there were an additional 5 million age checks on a daily basis, citing data from trade body the Age Verification Providers Association. — Bloomberg