Friday, July 25, 2025, sees new age verification laws come into effect in the UK.
The Online Safety Act aims to protect under-18s from viewing harmful content online through more robust age checks – with an emphasis on sites hosting "explicit material."
Until now, many sites that require the visitor to be over 18 simply require you to click a button confirming your age, with no actual checks in place.
Credit card checks, facial age estimation, and submitting photographic ID are some of the ways age verification could be done – and these all pose concerning cybersecurity and privacy risks.
How comfortable will users be in handing over this sensitive personal information to an unknown third-party?
While the law is well intentioned, using one of the best VPNs appears to be a simple solution to getting around it.
A user could connect to a server in a country where age verification laws don't apply and access sites without the need to submit any proof of age. But is it necessary?
How VPNs bypass age verification checks
A virtual private network (VPN) is a legal tool which acts as an intermediary between your device and the internet. Your data is sent through an encrypted tunnel before connecting to the internet, protecting it from hackers, third-parties, and your internet service provider.
When you access a site with age restriction measures, it uses your IP address to determine your location. If your IP address is in the UK, the site will then require you to submit proof of age.
With a VPN, you can connect to a server in a different country and obtain an IP address from that location – the site will then think you're based in that country. As long as your chosen location doesn't have age verification laws you won't be subject to checks.
Which VPN should you go for?
NordVPN is the VPN we recommend for most people. It's our #1 VPN overall and combines speed, security, and functionality – our NordVPN review allows you to explore it in detail.
With over 7,000 servers in 126 countries worldwide, you'll have plenty of locations to choose from. Connecting is easy, simply select your country of choice from the home screen list, and get started.
NordVPN protects your data with the highest standards of encryption – now post-quantum encryption – across all of its apps. There's support for all major platforms, including Windows, Android, iOS, Mac, and Linux.
It's also one of the fastest VPNs, with speeds topping 950 Mbps. For reference, 4K Netflix streaming requires speeds of 25 Mbps. This means NordVPN will be able to handle everyday browsing and sees it named as one of the best streaming VPNs.
Sites that require age verification may be more susceptible to malware, ads, and trackers. NordVPN's Threat Protection Pro feature can help protect your device from threats. Its a certified anti-phishing tool and was rated as the best VPN malware protection.
It's not a silver bullet, but it's effective at blocking ads and trackers and will warn you if you click on potentially malicious links.
Until the end of July, Tom's Guide has an exclusive NordVPN deal. All two-year plans come with four extra months of VPN protection for free and selected plans include free Amazon gift cards.
NordVPN Plus represents the best value for money as you get a best-in-class VPN, with fast speeds and protection for up to 10 devices, but also one of the best password managers, NordPass, Threat Protection Pro, and a $20 or £20 Amazon gift card.
In the UK, the 28 month plan works out as £2.99 per month (£83.76 up front, pre-tax).
For US users, It's $3.76 per month ($105.36 up front, pre-tax) for 28 months of protection.
Both plans include a £20 and $20 Amazon gift card respectively, as well as a 30-day money-back guarantee.
The deal is also available to those in Canada and Australia.
Cheap plans starting at $2.31 / $2.91 per month are also available, although these do not include any gift cards.
Should you be worried about the new law?
As mentioned above, the legislation has good intentions and it's important to protect under-18s from harmful content. However, how age verification laws are expected to be enforced raises significant cybersecurity and privacy concerns.
There are numerous ways age verification checks can be achieved, with each site deciding which third-party provider it uses and what methods it employs. Some examples include:
- Credit card checks
- Email-based age estimation
- Facial age estimation
- Uploading Photo ID
- Bank verification
All these methods present concerning privacy and cybersecurity risks. All require giving the third-party age-check service access to highly sensitive personal information such as your credit card, passport, or driving licence.
Many age-check services say they securely store and access this data, but as users we can't guarantee this. Many businesses have been victims of notable cyberattacks in recent months – including retailers in the UK – and should an age-check service suffer a breach, the consequences for users could be catastrophic.
Hackers could get hold of highly sensitive information and commit cybercrime with ease.
Understandably, many people will feel uncomfortable in handing over such sensitive information and bypassing these checks will appear very appealing.
Reddit has recently introduced age verification checks. It uses the firm Persona and requires users to upload a selfie or photo of their government ID.
According to the BBC, the site said it doesn't have access to any photos uploaded and Persona would "promise not to retain the picture for longer than seven days."
Social media site X is another company to introduce age verification checks. You can upload a government-issued ID but the site also utilises AI-powered facial age estimation.
Firstly, "guessing" someone's age based on a live selfie isn't a reliable method of verification. Secondly, many won't be comfortable in having an AI tool accessing images of them and how AI will store and use these images isn't clear.
In its "Age Assurance on X" policy, X states it "prioritizes your privacy." It says "third party providers will also be bound by strict data protection standards" and it will update its use and storage information as it rolls out estimation methods.
If you're in any way concerned about handing over your personal information, it's worth understanding alternative ways of accessing age-restricted sites.
Clearly, although well-intentioned, the UK's age verification law poses significant privacy and security risks.
People wanting to access sites operating checks will have an important decision to make regarding their personal information. Many won't be comfortable with the risks associated with age-check services
One comment under a BBC article read: "Sure, I will give out my sensitive information to some random, unproven company or.. I will use VPN. Difficult choice."
In an age where our online privacy is constantly being threatened, people are increasingly taking steps to protect their data – and age verification laws are a contributing factor.
We test and review VPN services in the context of legal recreational uses. For example: 1. Accessing a service from another country (subject to the terms and conditions of that service). 2. Protecting your online security and strengthening your online privacy when abroad. We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.
You must confirm your public display name before commenting
Please logout and then login again, you will then be prompted to enter your display name.
