25 July 2025 will be remembered as an important date in the history of British digital regulation. The Online Safety Act coming into force in the UK triggered an unprecedented surge in VPN use, with increases of up to 1,400% according to Proton VPN data. This massive reaction from British users reveals how complex it is to balance protecting minors with preserving privacy in the digital age.
The Online Safety Act: a regulatory revolution in the UK
The UK’s Online Safety Act, passed after seven years of development, is one of the strictest pieces of age verification legislation in the world. The law requires online platforms to implement highly effective checks to make sure their users are adults before they can access potentially harmful content.
Instead of simple “I am over 18” tick boxes, Ofcom (the UK communications regulator) now requires sophisticated verification methods. These include ID checks with facial recognition, using bank information via open banking, age estimation from selfies analysed by artificial intelligence, and validation by mobile operators.
VPN use in the UK: the numbers speak for themselves
VPN usage statistics in the UK since the Online Safety Act came into force are revealing. Top10VPN, which monitors global VPN traffic, recorded a spectacular 1,327% increase on 25 July, followed by rises of 1,712% on 26 July and almost 2,000% on 27 July. These figures far exceed the peaks seen during similar events, such as the TikTok ban in the United States.
Proton VPN reported a sustained increase of more than 1,400% in UK sign-ups, describing it as significantly higher than during the Pornhub block in France in June 2025. Nord Security also confirmed a tenfold increase in VPN subscription purchases from the UK. The situation pushed five free VPN apps into the top 10 of the UK App Store.
France faces the same issues: the SREN law
The British situation is not an isolated case. France went through a similar experience with the SREN law (on securing and regulating the digital space), which came into effect on 11 January 2025. This French regulation also requires strict age verification for adult sites, with a “double anonymity” system guaranteeing that neither the site nor the user can be identified during the verification process.
Faced with these obligations, the Aylo group (owner of Pornhub, YouPorn and RedTube) chose to block access to its sites from France rather than comply. The decision immediately caused a rush to VPNs, with Proton VPN recording a 1,000% rise in subscriptions within just 30 minutes of the block. The French authorities, represented by the regulator ARCOM, are holding firm, pointing out that more than a third of 12- to 17-year-olds visited these sites every month.
The global trend: the United States and other countries
This issue goes beyond Europe’s borders. In the United States, more than a dozen states have adopted similar legislation, inspired by Louisiana’s pioneering 2022 law. Texas, Utah, Florida and other US states all saw similar surges in VPN use when their respective regulations came into force.
In Florida, the introduction of age checks coincided with a more than 1,000% increase in VPN searches. In Texas, where offenders face fines of up to $10,000 per day, VPN demand jumped 275% on the day the law came into force. These examples show a global trend in which every new age verification regulation is accompanied by mass adoption of circumvention technologies.
The technical and security implications of VPNs
The surge in VPN use in the UK raises important cybersecurity questions. While VPNs offer valuable privacy protection by encrypting internet traffic and hiding the IP address, they are not a complete security solution.
The risks of heavy VPN use include several technical vulnerabilities. Weak or outdated encryption can be broken by determined attackers. DNS (Domain Name System) leaks can reveal browsing activity even with an active VPN. Some providers keep activity logs that can be compromised or seized by the authorities. Man-in-the-middle attacks remain possible on poorly configured VPNs.
In addition, VPNs do not protect against viruses, malware or phishing attacks. Performance can also suffer, especially when the VPN server is far from the user. For cybersecurity professionals, it is crucial to understand that free VPNs, often chosen by novice users, carry extra risks: no robust encryption, collection and sale of user data, or even malware distribution.
Security challenges for professionals
For cybersecurity professionals, this surge in VPN use in the UK presents specific challenges. Companies now have to deal with employees potentially using unapproved VPNs to get around restrictions, creating security gaps in the corporate network infrastructure.
Recommended solutions include clear security policies on personal VPN use, raising employee awareness of the risks of free VPNs and adopting SASE (Secure Access Service Edge) solutions for more granular control of network access. Regular security audits also become essential to identify unauthorised VPN use and assess the associated risks.
The technical limits of age verification
The very effectiveness of age verification systems has been called into question by events in the UK. Cybersecurity researchers have shown that some facial verification systems can be bypassed using images generated by video games or deepfakes. Cybersecurity expert Kevin Beaumont publicly demonstrated how some games’ selfie features could fool age verification algorithms.
These technical flaws highlight the fundamental difficulty of building age verification systems that are both effective and privacy-friendly. The current technical architecture forces a choice between security and anonymity, a dilemma neither lawmakers nor technologists have yet resolved satisfactorily.
Outlook and recommendations
The UK’s experience with the Online Safety Act offers valuable lessons for the future of digital regulation. The British government, through Secretary of State Peter Kyle, maintains that the law solves most of the problem, while admitting it is watching VPN use very closely.
This position reveals the complexity of the regulatory challenge. Banning VPNs would put the UK alongside countries such as China, Russia or Iran, fundamentally undermining digital freedom and cybersecurity. Yet allowing their unrestricted use drastically limits the effectiveness of measures to protect minors.
Cybersecurity experts recommend a multi-layered approach combining digital education, parental controls at the home router level and the development of less intrusive age verification technologies. The future may lie in decentralised solutions where age verification happens on the device rather than at the service level, preserving anonymity while keeping the checks effective.
VPNs in the UK: frequently asked questions
Yes, VPNs remain perfectly legal in the UK. The British government has made it clear that it has no intention of banning VPNs, but it is monitoring their use in the context of the Online Safety Act.
Technically yes: a VPN hides your geographical location and lets you access content from a country where the restrictions do not apply. However, this practice can undermine the protection of minors, which is the main goal of the law.
Free VPNs often carry risks: weak encryption, collection and sale of personal data, limited speed and sometimes malware distribution. It is best to choose reputable providers with no-logs policies.
No, the law mainly applies to sites hosted in the UK or outside the European Union and to platforms classified as Category 1 by Ofcom. Many large sites are based in other EU countries, creating legal grey areas.
Companies should implement clear policies on VPN use, raise employee awareness of the risks and consider adopting SASE solutions for more granular control of network access.
Leave a Reply