VPNs appear to get around the UK's age verification law – but are they necessary?

July 25, 2025, saw new age verification laws come into effect in the UK.

The Online Safety Act aims to protect under-18s from viewing harmful content online through more robust age checks – with an emphasis on sites hosting "explicit material."

Credit card checks, facial age estimation, and submitting photographic ID are some of the ways age verification can be achieved – but there are risks.

People may not feel comfortable handing over their sensitive personal information to an unknown third-party.

While the law is well intentioned, people appear to be turning to one of the best VPNs in an attempt to get around it.

A user could connect to a server in a country where age verification laws don't apply and access sites without the need to submit any proof of age.

But is using a VPN necessary?

How VPNs bypass age verification checks

A virtual private network (VPN) is a legal tool which acts as an intermediary between your device and the internet. Your data is sent through an encrypted tunnel before connecting to the internet, protecting it from hackers, third-parties, and your internet service provider.

When you access a site with age restriction measures, it uses your IP address to determine your location. If your IP address is in the UK, you will see content and information appropriate to the country.

With a VPN, you can connect to a server in a different country and obtain an IP address from that location – the site will then think you're based in that country.

The UK has already seen a huge spike in VPN usage, with leading provider Proton VPN recording an increase in sign ups 1,400% over its baseline.

Worryingly, suspect free VPNs also rose in popularity. These might have helped users bypass age verification checks, but endanger your personal data in other ways.

Some have been wondering if the UK would ban VPNs. Although their use has been discouraged, this move is very unlikely.

Which VPN should you go for?

NordVPN is the VPN we recommend for most people. It's our #1 VPN overall and combines speed, security, and functionality – our NordVPN review allows you to explore it in detail.

With over 8,000 servers in 126 countries worldwide, you'll have plenty of locations to choose from. Connecting is easy, simply select your country of choice from the home screen list, and get started.

NordVPN protects your data with the highest standards of encryption – now post-quantum encryption – across all of its apps. There's support for all major platforms, including Windows, Android, iOS, Mac, and Linux.

It's also one of the fastest VPNs, with speeds topping 900 Mbps. For reference, 4K Netflix streaming requires speeds of 25 Mbps. This means NordVPN will be able to handle everyday browsing and sees it named as one of the best streaming VPNs.

Sites that require age verification may be more susceptible to malware, ads, and trackers. NordVPN's Threat Protection Pro feature can help protect your device from threats. Its a certified anti-phishing tool and was rated as the best VPN malware protection.

It's not a silver bullet, but it's effective at blocking ads and trackers and will warn you if you click on potentially malicious links.

All two-year plans come with three extra months of VPN protection for free and 30-day money-back guarantees.

NordVPN Plus represents the best value for money as you get a best-in-class VPN, with fast speeds and protection for up to 10 devices, but also one of the best password managers, NordPass, and Threat Protection Pro.

In the UK, the 27 month plan works out as £3.09 per month (£83.43 up front, pre-tax).

For US users, It's $3.99 per month ($107.73 up front, pre-tax) for 27 months of protection.

Entry-level NordVPN plans start at £2.39 / $3.09 per month are also available, although these do not include any gift cards. Our NordVPN prices and plans page details every plan NordVPN offers.

Should you be worried about the new law?

As mentioned above, the legislation has good intentions and it's important to protect under-18s from harmful content. However, how age verification laws are expected to be enforced raises significant cybersecurity and privacy concerns.

Over 5 million extra age checks have been performed since July 25. and there are numerous ways age verification checks can be achieved. Each site can decide which third-party provider it uses and what methods it employs. Some examples include:

• Credit card checks
• Email-based age estimation
• Facial age estimation
• Uploading Photo ID
• Bank verification

All these methods present concerning privacy and cybersecurity risks. All require giving the third-party age-check service access to highly sensitive personal information such as your credit card, passport, or driving licence.

Many age-check services say they securely store and access this data, but as users we can't guarantee this. Many businesses have been victims of notable cyberattacks in recent months – including retailers in the UK – and should an age-check service suffer a breach, the consequences for users could be catastrophic.

Hackers could get hold of highly sensitive information and commit cybercrime with ease.

Cybersecurity experts have raised concerns about the law. The founder of Windscribe VPN, Yegor Sak, described the law as a "disaster waiting to happen."

"Requiring people to submit IDs or biometric data just to prove they're 'old enough' to browse the internet is absurd – and dangerous," he said.

"It creates centralized databases full of sensitive info, which inevitably get breached or abused." Sak cited the recent Tea app breach, which saw thousands of IDs leaked, as an example.

Understandably, many people will feel uncomfortable in handing over such sensitive information and bypassing these checks will appear very appealing.

There has been strong arguments from the law's supporters and critics. Many have understandably hesitant to hand over their data. But the UK's Secretary of State for Science, Innovation and Technology, Peter Kyle, said those wanting to overturn the Online Safety Act "are on the side of predators."

Over 510,000 people want to overturn the act, as seen through an online petition. A petition is unlikely to impact the UK government's stance – it has said it won't repeal the act – but it highlights the layer of opposition that exists.

The internet has also been asking a range of questions about the Online Safety Act. People are asking if the government will look at their IDs, whether their data will be used to train AI, and how their data is being stored.

A number of sites have introduced age verification checks, and Reddit is one of them. It uses the firm Persona and requires users to upload a selfie or photo of their government ID.

Reddit has said it doesn't have access to any photos uploaded and Persona deletes your information after 7 days.

Social media site X is another company to introduce age verification checks. You can upload a government-issued ID but the site also utilises AI-powered facial age estimation.

Firstly, "guessing" someone's age based on a live selfie isn't a reliable method of verification. Secondly, many won't be comfortable in having an AI tool accessing images of them and how AI will store and use these images isn't clear.

In its "Age Assurance on X" policy, X states it "prioritizes your privacy." It says "third party providers will also be bound by strict data protection standards" and it will update its use and storage information as it rolls out estimation methods.

Spotify is another site to introduce age verification checks. Users encountering this request who don't comply will have their accounts deactivated and then deleted.

If you're in any way concerned about handing over your personal information, it's worth understanding alternative ways of accessing age-restricted sites.

Clearly, although well-intentioned, the UK's age verification law poses significant privacy and security risks.

People wanting to access sites operating checks will have an important decision to make regarding their personal information. Many won't be comfortable with the risks associated with age-check services

One comment under a BBC article read: "Sure, I will give out my sensitive information to some random, unproven company or.. I will use VPN. Difficult choice."

In an age where our online privacy is constantly being threatened, people are increasingly taking steps to protect their data – and age verification laws are a contributing factor.