Age verification failed. Regulating VPNs won't fix it

Governments are contemplating the role of VPNs in circumventing age restrictions rather than focusing solely on age verification methods. In Australia, the eSafety Commissioner suggests tech companies actively detect and block VPNs used for bypassing age checks. The UK's Technology Secretary has also proposed revisiting VPN restrictions.

Despite these proposals appearing minor individually, they collectively demonstrate how VPNs are being viewed as part of the enforcement issue, not the security infrastructure relied upon by businesses, journalists, remote workers, and millions of ordinary users. VPN usage among US remote workers, for instance, is prevalent. Age verification laws initially aimed to deter minors from accessing harmful content, yet inadvertently led to increased VPN usage as users sought to avoid uploading personal information to untrusted websites.

Imposing VPN restrictions could lead users to less regulated alternatives and grant governments more control over online content. Despite years of developing privacy-focused browsers, internet users adapt faster than regulations. Restricting VPNs faces a common technical challenge – it's impossible to distinguish a journalist safeguarding sources, a remote employee on a hotel network, or someone evading age checks based solely on VPN use.

Any enforcement mechanism targeting age-check bypass must reside atop the same traffic, unable to differentiate between a teenager avoiding harmful content and an accountant filing a report. Stigmatizing VPNs won't alter the demand for privacy either. People will find alternative methods to ensure privacy, often through less transparent platforms.

This concern is heightened due to the origin of such laws. High-profile regulations often become templates for other nations, regardless of their effectiveness. Granting privacy tools the ability to identify users could eventually extend to encrypted messaging and cloud storage services, technologies crucial for businesses. Privacy tools are not the issue; an estimated 1.7 billion people worldwide use VPNs, a significant number that should prompt policymakers to reconsider treating them primarily as a means to bypass age restrictions.

Verifying age on social networks, where users already have an identity, is acceptable, but not on adult sites where the goal is to conceal identity. Privacy-preserving age verification exists, separating the party confirming someone's age from the party they're visiting. A trusted intermediary issues a cryptographic token proving eligibility without revealing the user's identity, ensuring privacy and verification can coexist.