As the European Union (EU) pushes forward with its mandatory age verification regulations, fears are growing that it will move to regulate or ban the popular security tool used by individuals and companies to protect their privacy and data.
European officials and bodies have recently highlighted what they describe as a "loophole" that enables people to evade their age restrictions by using Virtual Private Networks (VPN).
The European Parliamentary Research Service (EPRS) claimed last week that VPNs are increasingly being used to bypass online age-verification systems, describing the trend as “a loophole in the legislation that needs closing”.
The comments came after EU Executive Vice-President Henna Virkkunen said in April that "an important part of the next steps [is] also to look at that it shouldn't be circumvented".
Virkkunen was responding to questions about how regulators might prevent children from bypassing the union’s recently-launched age verification app using a VPN.
Immediately, digital security and privacy experts expressed concern, with Belgian cryptographer Bart Preneel warning such a move is the “slippery slope” experts have been warning about.
“[T]his starts with mandatory age verification (for everyone!) and ends with banning VPNs and massive blocking”, Preneel wrote on X.
Experts have previously warned of the dangers of banning security tool.
Reducing Online Safety
After the UK put forward proposals to introduce age verification for VPNs earlier this year, a technology industry group the VPN Trust Initiative (VTI) argued that such policies “risk reducing online safety for the very users these proposals are intended to protect, without delivering commensurate benefits".
They added that "treating VPNs primarily as a 'loophole' is a complete misunderstanding of their role".
Similarly, another industry coalition told the British government in an open letter that "restricting the use of privacy-preserving technologies undermines efforts to empower users to navigate the web safely and to develop digital literacy".
VPNs are regularly used as an important piece of internet security for individuals and companies to prevent third-parties such as hackers or governments from monitoring their online activity.
They offer users significant privacy and security by encrypting user data and routing traffic through a remote server to replace a user’s IP address - the device’s unique digital signature - making it appear as if a person is in a different country.
Proposals to ban or regulate VPNs have, until recently, largely been the preserve of totalitarian governments such as in China or Russia. In these countries, the technology enable users to communicate anonymously and evade censorship.
But the mood has changed, with the UK announcing earlier this year plans to regulate the use of VPNs, as part of its drive to improve internet safety for children.
Internet Safety for Children
French politicians have also stated that "VPNs are next on the list" after their parliament approved the first European social media ban for teenagers.
Similar plans have been mooted in some American states, with Utah the only one so far to implement legislation barring the use of VPNs.
What has changed the tone of the debate is the global internet safety drive, led by Australia’s ban of under 16s using social media.
The EU’s regulatory moves are part of a broader global trend toward tighter government control of online access. Now that Brussels has launched its own age verification app, VPN regulation may be next.
VPNs can be used to bypass location-based restrictions. Some studies, including research by the European Parliamentary Research Service, suggest that new online curbs often lead to greater use of such tools.
The European body’s research frames the security software as a regulatory gap, highlighting calls from politicians and safety advocates for VPNs to be themselves subject to age verification.
Waste of Money
However, studies from groups like Childnet and Internet Matters suggest that VPNs are not primarily used by children to evade restrictions, but by adults who want to maintain their anonymity and keep data safe.
Regardless of the broader questions of policy and freedom of speech, experts such as Fight for the Future have said regulations on the privacy technology are "a waste of money" and argued that restrictions are "impossible by design" to enforce.
Russia’s efforts to block VPN usage exemplify this problem, as despite investing millions of rubles on a censorship system, VPN providers keep evading their attempted crackdown.
However, some experts have warned that VPNs are not entirely without risk themselves, with some providers concealing links to authoritarian regimes such as China.