If it feels like VPNs are suddenly everywhere — topping app store charts, discussed by friends who never cared about privacy tools before, mentioned in the news most weeks — you're not imagining it. Over the past year, VPN adoption has surged in country after country, and the trigger is almost always the same: a new law requiring people to prove their age before accessing certain websites.
This is a genuine shift in how the mainstream internet works, and it's worth understanding properly — not just why people are reaching for VPNs, but what a VPN actually does, the privacy trade-offs involved, and how to tell whether the one you're using is doing its job at all.
What Changed: The Age-Verification Wave
For most of the internet's history, "verifying" your age meant clicking a button that said "Yes, I'm over 18." That era is ending. Starting in 2025, a series of governments began requiring websites — particularly adult content platforms, and in some cases social media — to perform real age checks, often using ID documents, face-scanning estimation, or third-party verification services.
The rollout has been rapid and global:
- United Kingdom — The Online Safety Act's age-verification requirements took effect in July 2025, requiring "robust" age checks on sites hosting adult content.
- United States — A patchwork of state laws now covers roughly half the country's population, with individual states setting their own age-verification rules.
- Australia — Introduced a social media ban for under-16s in 2025.
- Brazil — Rolled out its own age-verification requirements, reportedly triggering a dramatic overnight jump in VPN demand.
- Planned for 2026 — Countries including Denmark and Malaysia have signalled similar measures.
The intent behind these laws is broadly popular: keeping children away from content designed for adults. The disagreement is about the method — because verifying age online means, in practice, collecting far more identifying information about everyone, including adults.
Why People Are Turning to VPNs
A VPN (Virtual Private Network) routes your internet traffic through a server somewhere else and replaces your visible IP address with the server's. To a website, you appear to be connecting from wherever that server sits, not from your actual location. (If you're new to the concept, our guide on what a VPN is and how it protects you covers the basics.)
That single property — changing your apparent location — is why age-verification laws have driven so many first-time installs. When a set of rules applies based on where you appear to be connecting from, a VPN changes that appearance. The scale has been striking: after the UK's Online Safety Act took effect, one VPN app developer reported downloads surging by around 1,800% in the first month, and similar spikes followed each major law elsewhere.
It's worth being clear-eyed here: much of this new demand is people trying to avoid handing over identity documents to websites, rather than a sudden mass conversion to privacy advocacy. But the underlying privacy concern is real, and it's shared by many security experts.
The Privacy Trade-Off Nobody Mentions
The core worry with age verification isn't the age check itself — it's the data trail it creates. To prove you're an adult, you typically have to share a government ID, a face scan, or a credit card with a website or a third-party verification vendor. That information is now sitting in another database, tied to a record of the specific sites you visited.
As Molly Buckley of the Electronic Frontier Foundation put it, the concern is that these laws push us to "pass even more of our most sensitive, most valuable data over to big tech companies." Robin Wilton of the Internet Society has warned that "mandatory age verification is a step towards mandatory authentication for online access" — in other words, a slow erosion of the ability to browse anonymously at all.
Even VPN industry figures who support child-safety goals raise the same flag. Laura Tyrylyte of Nord Security has said such initiatives are welcome "provided they don't have negative effects on privacy and security" — the crucial caveat being that poorly designed verification systems often do exactly that.
This is the honest version of the story: age-verification laws and VPNs are two sides of the same privacy tension. One asks you to prove who you are; the other lets you reveal less. Reasonable people disagree about where the balance should sit, and that debate is far from settled.
The Backlash: Laws Are Now Targeting VPNs Themselves
Because VPNs change the location a website sees, some lawmakers have started treating them as a loophole to close rather than a tool to tolerate. This is the newest — and most contentious — phase of the story.
In the United States, Utah became the first state to write VPNs directly into an age-verification law. Senate Bill 73, signed in March 2026, requires platforms to treat a user as being in Utah if they are physically located there regardless of VPN use, and bars adult sites from providing instructions on circumventing age checks. The VPN provisions were due to take effect on 6 May 2026, but enforcement was delayed to 3 September 2026 following a legal challenge. Other states, including Wisconsin and Michigan, have floated their own VPN-related measures, and in Europe a research body controversially labelled VPNs a "loophole."
Digital rights groups have pushed back hard. The EFF argues that laws targeting VPN users demand "impossible technical feats" — VPN IP addresses change constantly, so reliably detecting them means either blocking huge ranges of legitimate addresses or forcing universal identity verification on everyone. Critics also warn about the precedent: VPNs are essential tools for journalists, abuse survivors, remote workers, and travellers, and rules written to catch one use case tend to catch all of them.
If You're Going to Use a VPN, Make Sure It Actually Works
Here's the part that often gets lost in the rush to install one: a VPN only protects you if it's configured correctly and the provider is trustworthy. A surprising number of VPNs leak the very information they're supposed to hide. If you're relying on one for privacy, it's worth verifying rather than assuming.
Check for leaks
Even with a VPN running, your real details can slip out through a DNS leak or an IPv6 leak, quietly revealing your true location or browsing activity. It takes seconds to test — run our VPN leak test with the VPN connected and confirm your real IP and DNS servers aren't showing.
Confirm what sites actually see
Your IP address is only one signal. Techniques like browser fingerprinting can identify you even behind a VPN. Our "what websites see" tool shows you exactly what data your browser is exposing right now, VPN or not.
Choose a provider on more than price
The things that actually matter for a privacy VPN are a genuine, ideally audited, no-logs policy; the legal jurisdiction the company operates under; and built-in leak protection and a kill switch. Free VPNs frequently monetise by logging and selling the exact data you were trying to protect. Our VPN comparison breaks down what to look for.
Is Using a VPN Legal?
In most countries — including the UK, the US, and across the EU — using a VPN is entirely legal, and businesses rely on them every day. A handful of countries heavily restrict or ban them. Legality is a separate question from whether using one to bypass a specific age check or terms of service is permitted; laws in this area are changing quickly, so it's worth checking the current rules where you live. This article explains what's happening and why, not how to break any law.
Frequently Asked Questions
Does a VPN hide my identity completely?
No. A VPN hides your IP address and encrypts your traffic between you and the VPN server, but it doesn't make you anonymous. Logins, cookies, browser fingerprinting, and any personal details you enter can still identify you. Think of it as changing your apparent location and securing your connection, not as an invisibility cloak.
Will age-verification laws make VPNs illegal?
There's no sign of a broad ban in most Western countries. The recent laws, like Utah's, are narrower — they try to make VPNs less effective for bypassing specific checks, or place obligations on the websites rather than outlawing the tools. VPNs remain legal and widely used for security and business.
Why did my VPN stop working on a particular site?
Some sites actively block known VPN server IP addresses. If a site won't load or repeatedly demands verification while your VPN is on, it may be blocking that server. Switching to a different server usually helps, though it's a constant back-and-forth between sites and providers.
Is a free VPN good enough?
For casual, low-stakes use, maybe — but many free VPNs fund themselves by logging your activity, injecting ads, or selling data, which defeats the purpose if privacy is your goal. If you're using a VPN specifically to keep your data private, a reputable paid provider with an audited no-logs policy is a much safer bet.