Virtual Private Networks (VPNs)
(not all of them are what they seem or claim to be)
On 25th July 2025 UK law changed.
Under the (very popular) Online Safety Act 2023 (OSA), online porn providers now have to establish age gates, guarded by an age verification system (AV). Under-18s should no longer be able to access or be exposed to porn on the internet from within the UK, whether accidentally or intentionally
In my previous blog I noted there has apparently been a massive drop in the number of UK visitors to porn sites.
Pornhub say they had 77% fewer customers from our green and pleasant land. That’s a huge precentage but it comes from Pornhub so I am wary. They usually have an angle even if, as here, it isn’t instantly obvious.
On the face of it the most likely explanation is rather than go through an AV process a great many people simply turned away. In addition, whether they wanted to or not, children couldn’t complete an AV process to pass themselves off as 18 or above so that too would contribute to the stated decline.
That’s one possible explanation, but not everyone is convinced.
The BBC journalist who covered the story was not alone in wondering whether or to what extent the decrease in porn site visitor numbers from the UK could be explained at least in part by people starting to use Virtual Private Networks (VPNs). But how large or significant was that part, particularly in respect of children?
What is a VPN?
A VPN is an App, software which can be configured to allow a user to camoflague their location. Depending on the particular App being used (they are not all the same), VPNs generally will have a number of privacy enhancing features but in this context it’s the VPN’s ability to allow you to misrepresent your physical location which is of interest. In the UK, in principle and without more, it is not a crime to claim to be in another country when you are using the internet.
Someone using a VPN while in the UK could, for example, pretend to be in Norway. Seeing the visitor is in Norway the porn site would not ask them to go through an AV process. In this way the UK numbers would fall but, obviously, under false pretences.
Thus, we are left with a nagging suspicion not that much has changed really, or it hasn’t changed to the degree suggested by the headlines.
Play the ball not the player
Some of those suggesting the use of VPNs is the sole or a major reason why UK visitors to porn sites have fallen off are simply, and gleefully, trying to knock the gilt off the OSA’s gingerbread. But that doesn’t mean we can ignore their arguments. There is something here that needs to be addressed.
Adults were never a target
The overriding purpose of the relevant parts of the OSA was and remains to protect children from porn. It is not to deny adults access to it. If, for whatever reason, certain adult porn consumers feel nervous about going through an AV process and they resort to using a VPN I am not going to lose any sleep over it.
Toddler techies? I don’t think so
How many children, particularly younger children, know about VPNs and can go about acquiring, installing then configuring one so they can login from a jurisdiction which does not have AV laws then carry on finding or being exposed to porn?
And they started doing this on, after or about 25th July 2025?
Not credible.
But what about tweens and older teenagers? The law seeks to protect all under-18s even if, understandably, the focus has tended to be on younger folk. A determined older child almost certainly could find their way to a VPN, which is why we cannot ignore the question.
Ofcom has looked at this. And it has spoken.
A letter from Ofcom to Parliament
On 8th October the CEO of Ofcom, Dame Melanie Dawes wrote to the Chairs of two important Parliamentary Committees.
Here is a key passage:
“Since the age check rules came into force, there has been considerable public debate about whether and how the rules may be circumvented, including by using VPNs. VPNs are in common use in the UK and other Western democracies and offer privacy and anonymity benefits. But because they allow users to access sites and apps without revealing their real location, they offer an opportunity to circumvent the protections of the OSA. Following the 25th July deadline we saw a spike in their use – with UK daily active users of VPN apps temporarily doubling to around 1.5 million. However, usage has since plateaued, and has now fallen back to around 1 million by the end of September. This was expected, and has happened in other countries or US states that have attempted to introduce age checks. The key question we will be monitoring (though it is hard to measure) is whether VPN use is rising amongst children. Data from Internet Matters, collected before July, suggests that around one in ten under-18s used VPNs, with use skewing towards older teenagers.”
Ofcom the Regulator says
There are two bits to this.
“host or permit content that directs or encourages children to attempt to circumvent age and access controls.”
and, for the avoidance of doubt we are reminded it is a
“legal requirement for pornographic services to put in place systems that are ‘highly effective’ at determining a user’s age”
Long before the OSA hove into view a great many online businesses were deploying VPN detection technology.
In the main these were and are companies concerned to enforce rights agreements. Rights to broadcast, for example sports events, or publish certain music tracks or articles are often restricted to nominated jurisdictions.
The VPN detection technology being used is therefore engaging in what is known as “geo-blocking”. That is usually (not always) a slightly misleading description.
Often what is actually going on is not linked to geography at all. In truth the businesses are simply saying
“you may not use a VPN to access our site or service from anywhere”.
VPN detection and blocking technology can be “highly effective”. The cost and complexity of implementing it will vary from the trivial to the substantial according to the nature of the platforms. Can some of it be beaten? Yes, some of it can but here too the cost and complexity of doing so can vary enormously.
The fact is this whole area is a never-ending arms race, but that is the case with almost every area of online activity where you find people willing to cheat to gain some sort of advantage or benefit. Very like life on terra firma. ‘Twas ever thus. Humans! Huh?
The Aussies and VPNs
Under the Social Media Minimum Age Act 2024, from 10th of next month social media sites and services operating in Australia will be required to ensure under-16s are not able to create or retain accounts with them.
Australia’s e-Safety Commissioner has issued a set of FAQs to help guide relevant businesses in respect of their obligations.
In the section headed
“How will under-16s be stopped from finding a way around the age restrictions?”
the following appears
“… platforms will have to take steps to stop under-16s getting around the law. This includes having ways to prevent under-16s from faking their age by using false identity documents, AI tools or deepfakes. It also means trying to stop under-16s from using VPNs to pretend to be outside Australia.”
Similar unambiguous language about VPNs and other forms of evasion does not appear in the relevant Australian e-Safety Commissioner approved industry code but the intent of the code is crystal clear and is directed towards exactly the same end, keeping porn away from kids’ eyes. If it is found VPNs are poviding a channel for kids to get at porn, there can be little doubt about what will happen next, pdq.
Downloads and “active users”. The same thing? No!
Going back to Ofcom’s letter, I haven’t had a chance to speak to anyone there yet but, in my book, downloading an App is not the same as becoming an “active user”. Over the years I must have downloaded dozens if not hundreds of Apps then abandoned them before I actually used them, for example when I saw and objected to the true cost, the disclosure requirements or, after a little while, I found they were rubbish and didn’t do what they claimed. I might not have uninstalled the App immediately. Would I still count as an “active user”?
How many keyboard warriors who are hostile to the OSA and want to discredit or undermine it set in motion maybe thousands of bots, hundreds of thousands, to download VPNs, particularly “free” ones.
Are the fruits of their sneaky labours being counted as “active users”, propaganda to weaken public confidence in the law’s effectiveness?
A national survey
In June 2024 You Gov did a representative national survey of VPN usage among people aged 16 or above. The age range is slightly off but only a little. UK internet users were already into VPNs for a variety of reasons, only one of which was about accessing geo-restricted materials, a desire for anonymity being another big one. My guess is anxieties about WiFi were probably an initial major, awareness-raising spark.
But note the bit at the end of the You Gov survey
“…. nearly two-thirds (64%) of online VPN users have never paid for the service, indicating a preference for free options.”
You know that old saying about the internet
“if you are not paying for the product you are the product”
Then look at this survey from September 2022 and note this paragraph
“We found that 12 out of 16 of the VPNs we looked at either inaccurately represented their products and technology, or made hyperbolic or overly broad claims about the kinds of protection they provide their users.”
This is important because if you choose to use a VPN, in effect you are putting a lot of trust in whoever supplied it. Some VPNs are very far from secure. Some even collect user data and, yes, sell it on, maybe to the very companies or outfits you might have thought you were shielding yourself from.
Maybe the Information Commissioner and others should get busy on this?
Ofcom needs reliable data on actual VPN usage
While it is interesting to know how many VPN downloads there have been it is much more important to know how many VPNs are actually being used and to know how many under 18s are among those using a VPN to access porn.
Ofcom’s letter acknowledges it might be difficult to get such data but there are various ways in which it could be collected, both technical or based on surveys such as the one You Gov carried out, or by a combination of the two.
Ofcom also needs reliable data on AV usage
As we saw from the You Gov survey there could be several reasons why people might want to use a VPN but unquestionably one of the principal reasons why anyone would want to download and use an AV app is to…..yep, prove their age (even though some can also be used as a broader identity app where required). It isn’t only online porn sites that might require proof of age.
In the Ofcom letter cited above Dame Melanie Dawes says the following
“The majority of the top 100 most popular adult sites in the UK have now deployed an age check and our latest data suggests that more than 8 million UK users are accessing adult sites with age checks every day.”
That looks promising, subject to the larger point about VPNs possibly disguising the real situation and it fits, for example, with reports from (what I think is) the world’s largest supplier of AV solutions, Yoti. They say globally 20 million people have downloaded the Yoti Digital ID App, about 800,00 of these coming from the UK and France in the last 6 weeks alone. In addition there are 7 million UK individuals who have acquired a digital ID provided by Yoti in conjunction with either the Post Office or Lloyds Bank.
To get a complete picture of what’s going on in this area therefore, Ofcom should publish reliable data on VPN downloads and usage alongside reliable data on the downloads and usage of AV apps.
Kill off the clickbait
Too many hostile campaigners have picked up on this VPN thing. It plays into a familiar trope about politicians/governments once again getting it wrong or going for a cosmetic change, superficially attractive but one which, in this case, comes with creepy edges. They are wrong but since when has that mattered if a tasty bit of clickbait beckons?
We need to knock these stories definitively on the head.
—-ooo—-
There is a potscript to this blog. It looks at what is happening with VPNs in other countries. It should make us think differently about the UK figures.
I will put it up tomorrow. And I promise it will be short. Well, sort of.