The EU becomes the latest authority to signal that VPNs are next, after launching its age verification app — here’s how VPNs went from a necessity security tool to circumvention software that needs to be restricted
The EU’s Executive Vice-President Henna Virkkunen didn’t have to explicitly mention the phrase “VPN ban” or “VPN restrictions” to make cybersecurity experts and privacy-conscious citizens worried. After all, what once was a drastic measure exclusive to authoritarian regimes has simply turned into the next natural step for democratic regulators since the obligation to verify your age has become just another part of being online.
“Of course, it’s an important part of the next steps also to look at that it shouldn’t be circumvented,” Virkkunen said during a press conference held on April 29, when asked about the measures to prevent kids from bypassing the newly launched age verification app by simply using a VPN service.
For the past seven days, a stream of criticism has been filling social media walls to contest Virkkunen’s response, with Belgian cryptographer Bart Preenel deeming it “the slippery slope experts have been warning for”.
But that’s far from an isolated case. On Wednesday, Utah became the first US State to enforce restrictions on VPN usage as part of its latest age verification regulation. Although, a strong backlash did manage to sink a similar idea in Wisconsin back in February.
And the UK’s consultation on online harms is still ongoing. The government already confirmed that VPNs may be age-restricted if it finds these tools guilty of undermining online safety protections.
Elsewhere in Europe, French politicians have also publicly confirmed that “VPNs are next on the list” after the Parliament approved the first European teen social media ban.
From a crucial cybersecurity tool once highly praised and recommended, VPNs and similar services have seemingly been branded dangerous circumvention software that governments want to control and restrict. But how did we get here? And, most importantly, what are the risks of this crusade against VPNs?
The age verification effect on the threat to VPN
Mandatory age verification comes as a response to an online world that many governments believe has become too dangerous for children.
The UK was the first country to implement mandatory verification to access so-called “legal but harmful” content in July last year. More countries around the world were quick to replicate similar legislation.
Then it was the time for Australia to set up another example to follow when the government enforced the world-first under-16s social media ban in December. A stream of governments, including France, the UK, the EU, Greece, and Spain, are now pushing for similar rules.
As mandatory age checks become widespread, a similar pattern has emerged — enforcement always coincides with a spike in VPN usage among citizens.
VPNs, in fact, not only encrypt all of your internet connections, but they also spoof your real IP address, making you appear as if you’re browsing from another country. This ability allows you to evade any geo-local restrictions, including age checks.
Whether these users are mostly adults not willing to scan their face or passport to use the internet, or children looking to access content not suitable for their age, isn’t easy to say for certain — actually, some studies conducted by groups like Childnet and the Internet Matters argue that the balance swings towards the former.
But that’s enough, it seems, to mobilize governments to view VPN usage usage as mostly tools of circumvention.
The dangers of banning VPNs
Whether we like it or not, mandatory age checks are here, so it seems understandable that lawmakers want to close all loopholes that allow citizens to bypass the law. But the realities will be more complicated than that.
A virtual private network (VPN) is security software that millions of adults as well as businesses use every day to boost their online privacy, security, and overall internet experience. A VPN encrypts all the data leaving your device and that makes it difficult to track your activities.
That’s why cybersecurity experts fear that restricting VPN usage will have a significant impact on people’s online safety — which is, ironically, exactly what these laws are trying to prevent.
A VPN industry group, the VPN Trust Initiative (VTI), explained this risk perfectly in a recent statement addressed to the UK government.
“Policies that weaken or restrict VPNs risk reducing online safety for the very users these proposals are intended to protect, without delivering commensurate benefits,” the VTI said, while arguing that “treating VPNs primarily as a ‘loophole’ is a complete misunderstanding of their role”.
That’s a position shared by another coalition in a separate warning to the UK issued on Tuesday.
“Restricting the use of privacy-preserving technologies undermines efforts to empower users to navigate the web safely and to develop digital literacy,” said Mozilla, one of the signatories.
Last year, US Public Policy Manager at Proton, Christine Bannan, expressed the same concerns in an interview with TechRadar around a similar bill in Michigan. On that occasion, Bannan specifically warned politicians against crafting legislation that turns VPNs from a vital security tool into a “liability”.
Do VPN restrictions even work?
Regulations targeting VPNs may face another big, technical hurdle — they seem to be impossible to enforce.
As Utah becomes the first democratic territory to pass such a law, digital rights experts at Fight for the Future branded it “a waste of money“, while arguing that restrictions are “impossible by design” to enforce.
This echoes the warning from popular VPN provider NordVPN, which previously dubbed the law “a liability trap” that could end up punishing all users worldwide instead.
It is technically impossible to block all known VPN and proxy IPs in Utah, NordVPN told TechRadar back in March. The only remaining option appears to be age-verifying every visitor globally, regardless of their actual location.
One look at Russia and it’s ongoing crusade to stop VPN use should be enough of a warning. Despite the millions of rubles spent by the Kremlin on building a sophisticated censorship system, VPN services keep showing resilience by constantly adapting to new tactics.
There are over 400 scientists calling for a halt to mandatory age verification until “scientific consensus” is reached regarding the technical feasibility and benefits of these measures. And even for purely economic and practical reasons, perhaps they are right?
But if politicians are sure that age verification is the best path to follow, they should probably make peace with the idea that VPN are more than circumvention tools.
If some people bypass the rules, then perhaps that’s just the price to pay for security, privacy and, ultimately, safeguarding the integrity of the tools that provide it.
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!