UK age checks and the VPN surge: what the Online Safety Act rollout revealed
When the UK's Online Safety Act age-assurance duties came into force on 25 July 2025, the first measurable effect appeared not on adult platforms but in the app stores. Within days, VPN applications crowded the UK download charts, and providers reported sign-up spikes of the kind usually associated with internet shutdowns. Sixteen months on, the episode stands as a case study in how age verification changes how ordinary privacy tools are used, sold and policed.
The July 2025 spike
The rules require sites and apps hosting pornographic content — along with large platforms such as Reddit, X and Bluesky — to apply highly effective age checks to UK users, through facial age estimation, photo ID matching, card checks or equivalents. TechCrunch reported that around 6,000 pornographic sites had signalled compliance before the deadline, and noted users were already trading tips on bypassing the checks with fake IDs, video-game selfies or VPNs. The consumer response was immediate. According to BBC reporting three days after launch, half of the ten most-downloaded free apps in Apple's UK App Store were VPNs on the Monday morning, and Proton VPN said UK daily sign-ups had risen around 1,800% over the weekend. A generic free app, named Free VPN, sat sixth in the charts, its engineering vice-president reporting a significant surge of new UK users. “Many of these free VPNs are riddled with issues,” BCS cyber-security expert Daniel Card told the BBC, warning that such apps can act as data brokers. Proton's own end-of-year review put the UK episode in unusual company. The company logged a 1,200% increase in VPN sign-ups after the Act took effect, listed alongside Afghanistan's 35,000% spike during the Taliban's September blackout and Iran's 5,500% surge during the June conflict, and described the UK as part of a notable new pattern in Western democracies, taking in the US, Spain and France.What Ofcom actually says about VPNs
Ofcom's position is narrower than much of the commentary suggests. The regulator does not license VPN providers and has no power to ban them; its duties fall on in-scope services, which must deploy highly effective age assurance and must not host content encouraging children to bypass it. Ofcom's first statutory report on age assurance, published in July 2026, counted over 69 million age checks completed across a sample of 32 services between July and December 2025 — a twenty-three-fold increase on the previous six months. All ten of the most-visited porn sites complied; by June 2026, 64 of the top 100 carried age checks and another ten geo-blocked UK users outright. The regulator has opened 23 investigations covering 88 adult services, and seven providers of 24 sites have been fined, including penalties of £1.35m and £1m. On circumvention, Ofcom's research tracker records that around one in five UK adults online (22%) have used a VPN, that 1% admitted using one specifically to get around age checks, and that among 13- to 15-year-olds the figure was 6% — small shares of huge user bases. Around seven in ten UK adults online have already encountered an age check, the same research suggests, and Ofcom has published work on VPN detection and circumvention strategies. The policy horizon keeps moving: the UK is preparing a social media ban for under-16s, with potential age restrictions from 2027, an Ofcom assessment in Parliament by late October 2026 and an app-store report by January 2027.Censorship by compliance
Rights groups argue that the deeper costs arrive before any fine. The Electronic Frontier Foundation's position, restated after the US Supreme Court upheld Texas's age-verification law in June 2025, is that no method of age verification is both privacy-protective and entirely accurate — and that mandatory checks build databases of IDs and biometrics waiting to leak. Campaigners describe the resulting dynamic as censorship by compliance: platforms over-block or withdraw rather than risk penalties.“It's surveillance dressed up as safety.” — EFF, on proposals to make sites block VPN usersThe breach risk those warnings point to surfaced in the same week the UK checks launched: the Tea app leak exposed roughly 72,000 images, including about 13,000 verification selfies and ID photos — an incident Proton cited as context for the UK sign-up surge.
Elsewhere, the same script
The UK rollout sits inside a larger pattern of age-verification experiments, each producing its own circumvention wave.- In the US, 23 states had enacted age-verification laws for adult content by August 2025, with two more taking effect in late September; after the Supreme Court let Texas's law stand in FSC v. Paxton, Pornhub has continued to geoblock affected states rather than verify ages.
- In France, when Pornhub was blocked in 2025, Proton reported a 1,000% jump in registrations within half an hour.
- US legislators in Wisconsin and Michigan have gone further, proposing that sites or internet providers detect and block VPN traffic — an approach EFF calls unworkable, since websites have no way to tell if a VPN connection is coming from Milwaukee, Michigan, or Mumbai.