BrusselsVPN apps topped Britain’s download charts after its age-verification law took effect.
EU Parliament researchers call VPNs an age-gate loophole and propose extending verification to VPN access itself.
Utah’s SB 73 is the first US law requiring age checks before VPN access.
Sources: Hacker News
WHAT A VPN ACTUALLY DOES
A VPN encrypts traffic between your device and a server elsewhere, then forwards it to the destination. The destination sees the VPN server's IP, not yours. The technology was built in the 1990s for corporate remote access — letting employees reach internal networks from home — not for evading geo-restrictions.
THE LOOPHOLE MECHANIC
Age-verification laws bind sites to check users in a given jurisdiction. A VPN moves the apparent jurisdiction. The UK's Online Safety Act triggered a roughly 1,400% surge in VPN signups the week age checks went live — the law's enforcement perimeter is the IP address, and the IP address is exactly what a VPN changes.
THE SECOND-ORDER PROBLEM
Once regulators concede the loophole, the next move is to regulate the tool itself. Utah's SB 73 (2025) is the first US law to require age verification before installing or using a VPN. France's Arcom has explored similar measures. The pattern matches encryption debates of the 1990s — Clipper Chip, export controls — where the workaround eventually became the target.
THE COMPLIANCE STACK
Hard age verification means submitting a government ID, a face scan, or a credit card to a third-party provider. That creates a permanent record linking a real identity to whatever the user was trying to access. The privacy cost is not in the moment of the check — it is in the database the check populates.
THE GREAT FIREWALL PRECEDENT
China has banned unauthorized VPNs since 2017, requiring providers to register with the state. Russia followed in 2017 and tightened enforcement in 2024. Iran blocks most commercial VPN protocols at the ISP level. In each case, the stated rationale started narrow — pornography, gambling, foreign extremism — and expanded to political speech once the infrastructure existed.
THE FUNCTION-CREEP PATTERN
Surveillance infrastructure is consistently deployed for a narrow, sympathetic purpose then expanded once it exists. License plate readers (stolen cars), DNA databases (violent crime), airport body scanners (explosives), and cell-site simulators (kidnapping) all followed this arc. The original justification sets the political precedent; the eventual use is limited only by what the technology permits.