UK VPN use surges after OSA age verification rules come into effect

UK uptake of Virtual Private Networks (VPNs), which allow users to disguise their online location, has surged since the new age verification rules under the Online Safety Act 2023 (OSA) came into force on 25 July. The move potentially risks undermining government efforts to protect children online. As sites, including adult content providers and social media platforms like X, Reddit, and TikTok, implemented new age assurance systems last Friday, UK users increasingly turned to VPNs to bypass these checks.

VPN apps dominated the top free apps on the UK's iOS App Store over the weekend, with Proton VPN becoming the most popular. Proton reported an over 1,800% increase in daily UK sign-ups, while Nord VPN saw a 1,000% rise in UK subscriptions. Proton commented that such spikes are usually associated with civil unrest, highlighting concerns among adults over the impacts on privacy as a result of measures introduced by the OSA. Google Trends also showed a significant increase in UK VPN searches. 

A Sky News report on Saturday showed how easy it is to bypass age verification systems on pornographic websites. In a matter of seconds, ethical hackers working with the cyber training group, The Hacking Games, demonstrated how to get around the measures designed to protect young people on the internet using widely available technology and without verifying their ages.

Then on Monday, a political row broke out after Reform UK announced during a press conference that it would repeal the OSA, calling it the "greatest assault on freedom of speech in our lifetimes". 

Responding to the news in an interview with Sky News, the Secretary of State for Science, Innovation and Technology, Peter Kyle, said: "I see that Nigel Farage is already saying that he's going to overturn these laws. So you know, we have people out there who are extreme pornographers, peddling hate, peddling violence. Nigel Farage is on their side." Kyle went on to say: "Make no mistake about it, if people like Jimmy Savile were alive today, he'd be perpetrating his crimes online. And Nigel Farage is saying that he's on their side." 

Following the remarks, BBC News reported that Farage called Kyle's comments "absolutely disgusting" and demanded that he "do the right thing and apologise." 

However, politics aside, The Guardian reported on Wednesday that five million additional online age checks are being carried out a day in the UK since age verification became a mandatory requirement, according to data released by the Age Verification Providers Association (AVPA).

While the government could point to these statistics as evidence that the OSA is working, serious concerns are being raised about the companies carrying out age checks on behalf of online platforms. 

An Article by the Open Rights Group highlights how internet users are not able to choose which company verifies their age, and that platforms are not required to partner with trusted or certified providers that meet set data protection and security standards. 

In addition, Byline Times reports that some of the companies offering age verification services to online platforms have themselves been criticised "for presiding over privacy breaches." These companies, many of which are based outside of the UK, collect biometric data, passport and personal identification documents, and banking and credit card information to verify identities. The article includes an overview of three such companies: AU10TIX (used by X), Kids Web Services (used by Bluesky), and Persona Identities Inc. (used by Reddit).

Meanwhile, a petition to repeal the OSA has received 466,248 signatures at the time of posting. 

Moving forward, the Financial Times (£) reports that Ofcom has opened investigations into four companies: 8579 LLC, AVS Group Ltd, Kick Online Entertainment SA and Trendio Ltd. Combined, these companies operate 34 adult websites and receive over 9 million unique monthly UK visitors. The move illustrates that Ofcom is prepared to act quickly to initiate regulatory enforcement activity to enforce the OSA's age verification requirements. 

£ - The Financial Times article requires a subscription.

Versions of the main FT article are available without subscription in BBC News and The Register.