EU calls VPNs a 'loophole that needs closing' in age verification push

The European Parliament's research service has warned that virtual private networks are increasingly being used to bypass online age verification systems, describing the trend as "a loophole in the legislation that needs closing."

The warning comes as child online safety rules expand across Europe, requiring platforms to verify users' ages before granting access to adult or age-restricted content.

According to the parliamentary research document, VPN usage has surged following the introduction of mandatory age verification laws in countries like the United Kingdom and several U.S. states. In the UK, where online services are now required to prevent minors from accessing harmful content, VPN apps topped download charts shortly after the law took effect.

VPN demand surges 1400% in the UK following new age verification law

VPN usage in the UK has surged 1400% as users try to bypass new age verification rules under the Online Safety Act.

Durov's CodeIgor Savkin

"Current age assurance measures – including verification, estimation and self-declaration – are relatively easy for minors to bypass," the report states.

"Bypassing geographical restrictions on online content is among the main uses of VPNs. In the context of child protection, VPNs are relevant insofar as they allow users to bypass national requirements on online age verification methods on platforms and websites that provide pornographic content and other forms of content deemed harmful to children," the document notes.

The report frames VPNs directly as a regulatory gap, noting that some policymakers and child safety advocates believe access to a VPN should itself require age verification. The Children's Commissioner for England has also called for VPN services to be restricted to adults only.

Speaking at a May 1 press conference for the EU's new digital age verification app, European Commission Executive Vice-President Henna Virkkunen acknowledged that users can circumvent the system via VPNs and suggested that addressing this could be part of the "next steps" EU lawmakers may need to consider.

"VPN must not allow the system to be circumvented," she said.

Forcing users to verify their identity before accessing VPN services would, however, significantly weaken anonymity protections and create new risks tied to surveillance and data collection. VPN providers and other privacy advocates have already pushed back against the approach in a letter sent to UK policymakers.

Report finds UK children easily circumvent online age checks

Children in the UK have found simple ways to bypass online age verification systems, in some cases using nothing more than drawn-on moustaches.

Durov's CodeDaria Ivanova