Age Verification Laws Send VPN Use Soaring — Why Blocking VPNs Is Not as Effective as Increasing Age Verification Infrastructure

I am old enough to vote, sign contracts, pay taxes and be held responsible for everything I do online.

So why should I have to give an unknown company my face just to prove that I am an adult?

That question helps explain why VPN downloads surged after new age-verification rules took effect. As WIRED reported using Sensor Tower data, selected VPN apps roughly doubled their daily iOS downloads over several days in the United Kingdom.

Some users were undoubtedly trying to reach restricted content. Others were simply refusing a terrible bargain.

Upload your face, identity document or banking information—or leave.

For an adult accessing lawful material, using a VPN can feel less like evading responsibility and more like declining unnecessary surveillance.

Why is your face different from a password?

Passwords can be changed after a breach. Your face cannot.

That alone should make facial age estimation a last resort, not the default entrance ticket to the internet.

Verification companies may promise that images are encrypted, processed briefly and deleted. Users still have to trust that the system works exactly as advertised—after a software update, after an acquisition and after a future breach.

The risk is not limited to one photograph. A verification request can connect a person, a category of website and a moment in time. Once identity and browsing behavior meet inside the same system, poor design becomes much more dangerous.

Protecting children is a legitimate public goal. It does not follow that every adult should surrender biometric information to private contractors whose technology, retention practices and business relationships are difficult to inspect.

“Trust us with your face” is not privacy infrastructure. It is a privacy liability.

Does blocking a VPN prove anyone’s age?

Governments may see rising VPN use and conclude that VPNs are the problem. They are not.

A website may detect a known VPN address and block it. That still reveals nothing about whether the person behind it is 16, 26 or 66.

The connection could belong to someone avoiding an age check. It could also belong to a remote worker, a traveler on hotel Wi-Fi, a journalist protecting a source or an ordinary person who does not want a local network inspecting their traffic.

An IP address is not proof of age. It is not even reliable proof of physical location.

Trying to block every VPN makes an age-verification system more aggressive without making it more accurate. The technical problem becomes especially clear in the EFF’s analysis of Utah’s VPN-targeting law: websites may be pushed toward blocking broad groups of legitimate users because they cannot reliably recover the location a VPN was built to conceal.

There is also a displacement problem. A peer-reviewed study of U.S. age-verification laws found that searches for a major compliant platform fell while searches for a noncompliant platform and VPN services rose. The data cannot identify every searcher or prove where each person eventually went, but it leaves an important question: did the law reduce harm, or did it move activity somewhere less visible?

What should government-led minimal-disclosure verification look like?

The long-term answer is not stronger facial scanning. It is government-led, privacy-preserving age infrastructure.

A website usually does not need a person’s name, face, exact birthday or document number. It needs one narrow answer:

Is this person above the required age?

A properly designed credential could return a simple yes or no without exposing the identity behind it. The verifier should not learn which websites a person visits. Different websites should not be able to connect the same user’s activity. Sensitive documents should remain on the user’s device or with a tightly regulated issuer instead of being uploaded again and again.

This is no longer just a theoretical idea. The European Commission’s age-verification work is designed to let people prove an age threshold without compromising browsing privacy, while its digital-identity guidance describes selective disclosure rather than handing every website a full birth date or identity record.

Government involvement matters because age verification should be accountable public infrastructure, not an uncontrolled market in faces.

The rules should define what may be collected, how long it may be kept, who may access it and what happens when the system makes a mistake. Independent audits, meaningful penalties and accessible alternatives should be mandatory.

The goal should be to prove one fact while revealing nothing else.

What can adults do until better age infrastructure exists?

A VPN is not a complete privacy solution. It does not make a person anonymous, cancel local laws or guarantee that a website will grant access.

I also have to acknowledge the obvious: because a VPN can change the location a website thinks you are connecting from, it may sometimes get around a geographic block. But that is not the point for me. Until better verification infrastructure exists, I want to reduce how much information I leak. I do not want every website I visit to know who I am simply because I am trying to prove that I am an adult.

That same principle should apply to the VPN itself. A privacy tool should follow a minimum-information rule: collect only what is necessary, and avoid turning access into yet another identity checkpoint.

Oddly enough, one of the clearest examples I have found came from an unassuming travel VPN.

I first came across OnlyDogs VPN during a trip to Dubai. Government filtering made parts of the internet difficult to reach, and several of the large VPN brands I already knew simply did not work. OnlyDogs VPN did.

What really caught my attention, however, was not the connection itself. It was the way the product handled identity.

When I did not need to share access across devices, I could use it anonymously without signing in at all. When I wanted to use it on both my iPhone and my Mac, I entered my email address, received a verification code and completed the sharing process. I did not have to create a conventional account. I did not have to invent another password that might resemble one of my usual passwords, and I did not have to remember it later.

Is that not exactly what data minimization is supposed to look like?

The service also includes tracker blocking and ad filtering, which fit the same goal of reducing unnecessary exposure rather than asking for more personal information in exchange for privacy.

Now, when I run into a blocking wall, OnlyDogs VPN is the tool I tend to use. And the account design that first impressed me is almost the least conspicuous thing it does.

A few links I had open while writing this: WIRED on the UK VPN surge, the U.S. search-behavior study, EFF on Utah’s law, and the EU age-verification overview.