It Got Worse: UK Pushing to Extend Age Verification to VPNs

As government pushes to ban youth from social media, the UK government is also going after VPNs as well.

It looks like I can add another entry to the list of “Drew Wilson was right” moments. After accurately predicting that government would abandon the idea of exclusively tying age verification to “pornographic” websites, accurately predicting that the age verification technology deployed would be neither secure nor accurate, accurately predicting that the technology employed would be easily circumvented, accurately predicting that the government would simply start targeting whole platforms as a form of censorship creep, and accurately predicting that these laws would be used to curtail political speech, I can now say my prediction that government would start targeting anonymous tools for censorship as this whole thing continues to spiral out of control came true as well.

The reaction to age verification laws in the UK are not one bit surprising. The population is rising up and doing what they can to fight back against this surveillance and censorship. People are turning to VPNs in droves, using video game characters, and creating fake IDs to fool the system – all in their efforts to fight against these oppressive laws. All of these moves prove that there is an ongoing arms race between government and the people.

Recently, lobbyists pushing their snake oil age verification technology signalled that VPNs would become the next target for their surveillance and censorship tech. They tried to use slippery language to effectively conclude that VPN usage should be banned from platforms without directly calling for the banning of VPNs, but that is what the call amounted to. Either way, it showed that the oppression of age verification can only get worse from here.

Today, we learned that the UK government has also turned their sites on VPNs as well. They want to extend age verification to VPN technology as well. From the BBC:

The government needs to stop children using virtual private networks (VPNs) to bypass age checks on porn sites, the children’s commissioner for England has said.

Dame Rachel de Souza told BBC Newsnight it was “absolutely a loophole that needs closing” and called for age verification on VPNs.

The children’s commissioner’s recommendation is included in a new report, which found the proportion of children saying they have seen pornography online has risen in the past two years.

Last month VPNs were the most downloaded apps on Apple’s App Store in the UK after sites such as PornHub, Reddit and X began requiring age verification.

Virtual private networks connect users to websites using a remote server and conceal their actual IP address and location, meaning they can circumvent blocks on particular sites or content.

Dame Rachel told BBC Newsnight: “Of course, we need age verification on VPNs – it’s absolutely a loophole that needs closing and that’s one of my major recommendations.”

She wants ministers to explore requiring VPNs “to implement highly effective age assurances to stop underage users from accessing pornography.”

The report (PDF) (Freezenet mirror) calls on government to explore ways to prevent children from using VPNs:

That the government explore options to ensure children aren’t able to use VPNs to avoid the age
assurance process

There’s only one logical way I can think of where this is going to go. Given the fact that VPNs operate in numerous different countries, and many VPN services are decidedly not under UK laws, the UK government’s only real option here is to block access to VPN services abroad and order local VPN companies to use age verification technology. I struggle to see how this is ultimately going to go any other way. It is entirely possible that the government would implement half of this strategy and simply require all VPNs to implement these age verification systems, but there is a snowballs chance in hell that all of them will comply with this. This leaves website blocking as the only other option which is a huge threat from a security perspective.

Now, obviously, just because this is probably going to end up being the law doesn’t necessarily mean it’s going to be enforceable. After all, a major reason why VPNs are successful is because a number of them are good at, well, circumventing censorship. It’s kind of their thing, after all. One possibility is that government would apply to the courts to block a number of IP addresses. That process would invariably take time. In that time, the VPN service would implement an extension to their services by including new IP addresses. The government would respond by applying to the court again to block those IP addresses too… and the cycle endlessly repeats in a never ending game of whack-a-mole. Not all VPNs will go through this trouble, but the ones that do stand to make serious bank out of all of this.

As I’ve noted in the previous article, the whole freaking point of VPNs is to change your IP location and add a layer of privacy. For a lot of customers, the idea of having to submit your government ID or facial recognition scans so you can mask your identification is kind of a self-defeating proposition. If you are already thinking about using a VPN or already using a VPN, chances are, being asked to fork over your identity to a government mandated identification system is a hard “no”. Who is forking over their identity in exchange of adding a layer of privacy to their web browsing?

At any rate, the escalation in this privacy arms race is already happening. We’ll have to see how far the government is willing to take their war on the internet, but so far, it seems that escalation is on the menu.

Drew Wilson on Mastodon, Twitter and Facebook.