On the last Friday of July 2025, something strange happened to the shape of British internet traffic. It did not announce itself with a press release or a ministerial statement. It showed up instead in the dry telemetry of app stores and sign-up dashboards, in the kind of numbers that usually only matter to growth marketers and venture capitalists. Proton, the Swiss privacy company, watched its hourly UK sign-up rate climb by fourteen hundred per cent above a normal Friday baseline. Across the weekend that followed, the increase settled at around eighteen hundred per cent. Five of the ten most downloaded free apps on Apple's UK store were suddenly virtual private networks. By some estimates, roughly two million VPN downloads landed on British phones in a matter of days.
The trigger was not a scandal, a hack, or a viral panic. It was a law. Specifically, it was the moment the United Kingdom's Online Safety Act stopped being a thing that lawyers discussed at conferences and became a thing that ordinary people bumped into when they tried to open a website. From 25 July 2025, any service that might serve pornography or other content judged harmful to children had to deploy what the regulator calls highly effective age assurance. In practice that meant a face scanned by an algorithm, or a passport photographed and uploaded, or a credit card checked, before a user could proceed. The state had decided to put a bouncer on the door of large parts of the internet. And within hours, millions of adults went looking for a way to climb through the window.
This is a story about that window, and about the people climbing through it, and about what they found on the other side. Because here is the uncomfortable thing that a peer-reviewed study published in June 2026 has now documented in careful detail: a law written to protect children from the worst of the web appears to have nudged a large number of adults, and an unknown number of teenagers, towards a category of software whose own privacy practices range from genuinely excellent to actively predatory. The British government set out to make the internet safer. The measurable, near-term consequence was a surge in demand for tools that route your entire digital life through a third party you have never met, governed by a privacy policy you will never read, based in a jurisdiction you cannot name. Whether that is a tragedy, a farce, or simply the predictable physics of regulation depends a great deal on where you are standing.
A bouncer for the whole internet
To understand how Britain arrived here, you have to take the Online Safety Act seriously on its own terms, because its authors certainly did. The Act received Royal Assent in October 2023 after years of parliamentary wrangling, and it was sold, repeatedly and earnestly, as the legislation that would make the United Kingdom the safest place in the world to be online. It is a genuinely sweeping piece of law. It imposes duties on user-to-user services and search engines to assess and mitigate the risk of illegal content, and a further set of duties to protect children from material that is legal for adults but harmful to minors, a category that includes pornography, content promoting suicide or self-harm, and material glorifying eating disorders.
The Act did not arrive all at once. It came in waves, and the waves matter, because they are the rhythm to which everything else in this story moves. The first major milestone fell on 17 March 2025, when the illegal content duties took effect and platforms were obliged to have completed their risk assessments and begun removing material relating to terrorism, child sexual abuse, fraud, and a long list of other offences. The second came on 25 July 2025, when the Protection of Children Codes came into force and, with them, the requirement that pornography services and other risky platforms verify that their users were adults. The regulator, Ofcom, had published those codes in April, giving platforms a deadline of 24 July to complete their children's risk assessments. The third wave is ongoing, a slow accretion of enforcement actions, investigations, and the looming possibility of the most onerous Category 1 duties being applied to the largest services.
What turned an abstract legal duty into a daily friction for ordinary people was the phrase highly effective age assurance, which Ofcom shortened to the slightly clinical acronym HEAA. The regulator was careful not to prescribe a single method. Instead it set out criteria. An age check has to be technically accurate, reliable, robust, and fair, and it has to be hard to circumvent. Self-declaration, the old tick-box that asked whether you were over eighteen and trusted your answer, was explicitly ruled out as inadequate, as were payment methods that did not actually confirm an adult was present. What remained were methods with real teeth: photographic identity matching, where you upload a government document and a selfie; facial age estimation, where an algorithm studies your face and guesses your age; checks routed through mobile network operators; and verification handled by trusted third parties whose entire business is deciding whether you are old enough to proceed.
It is that last category, the trusted third party, that quietly became the fulcrum of the whole arrangement. Most websites do not want to build a biometric age-estimation pipeline from scratch, and most would rather not store a database of their users' passports, which is the digital equivalent of keeping a vault full of dynamite in the basement. So they outsourced it. A handful of specialist firms now sit between British internet users and the content they are trying to reach, scanning faces and reading documents on behalf of platforms that would rather not touch the data themselves. The state mandated the check. The market supplied the intermediary. And the British public, asked to trust an unfamiliar company with their face or their passport in order to read a Reddit thread or watch a video, did the thing that publics have always done when confronted with a demand they find unreasonable. They looked for a way around it.
The data point that frames everything
The most rigorous account of what happened next comes from a study uploaded to the arXiv preprint server in June 2026, the work of researchers spread across the universities of Edinburgh, Newcastle, and Durham. Its title declines to hedge: Online Safety Regulation Increases Privacy Risk: Evidence from the UK Online Safety Act. The team, which included Dhyey Mehta, Marc Juarez, and Tuğrulcan Elmas at Edinburgh, Eldar Jalilzade, Maksim Kalameyets, and Lei Shi at Newcastle, and Rebecca Owens and Stergios Aidinlis at Durham, set out to measure something that intuition suggested but data had not yet pinned down: did each phase of the Online Safety Act actually change how British people behaved towards privacy tools, and if so, how much, and why?
Their method was a combination of the social and the technical. They mined discussion from VPN-focused and politics-focused communities on Reddit, tracking how often and in what terms British users talked about virtual private networks in a regulatory or privacy context. They cross-referenced this against Google Trends data, and they conducted a structured risk assessment of sixty-nine separate VPN services, grading their logging, tracking, and data-sharing practices. The result was a portrait not just of how much VPN interest grew, but of what kind of VPNs people were reaching for, and what story they were telling themselves as they did it.
The headline numbers are stark, and they line up almost perfectly with the legislative calendar. At the first milestone, the illegal content duties of March 2025, VPN discussion in a regulatory or privacy framing rose by one hundred per cent. At the second, the age verification deadline of July 2025, it rose by two hundred and seventeen per cent. By the third phase, the figure had climbed to four hundred and fifteen per cent. In the more politically engaged corners of Reddit, the increases were steeper still, with rises of two hundred and thirteen per cent, five hundred and forty-five per cent, and four hundred and sixty-four per cent at the successive milestones. Google Trends recorded an eighty-nine per cent spike in VPN searches around the age-verification deadline alone. This was not noise. It was a stepwise, escalating response, each turn of the regulatory ratchet answered by a larger turn of the public towards circumvention. What gives the figures their weight is the sheer regularity of them. A one-off spike could be dismissed as a news cycle, a flurry of curiosity that fades within a week. A response that climbs at every successive milestone, in two separate communities, corroborated by an independent search-trends dataset, is something else. It is a population learning a behaviour and repeating it, with the lesson reinforced each time the law tightened. The researchers were not capturing a moment of panic. They were capturing the formation of a habit.
The most revealing finding, though, was not the magnitude but the motive. The researchers paid close attention to how users framed their own behaviour, and the framing was overwhelmingly defensive rather than acquisitive. People were not, for the most part, talking about VPNs as a way to reach pornography. They were talking about them in the language of privacy, surveillance, and distrust. The recurring villain in these discussions was not the content restriction itself but the age-verification intermediary, the unfamiliar company being handed a face or a passport. Users framed the VPN as a shield against being catalogued, not as a key to a locked door. That distinction is the entire argument of this piece compressed into a single observation. A law aimed at the supply of harmful content provoked a response aimed at the demand for personal privacy. The two were never quite talking about the same thing.
The window everyone climbed through
There is a tidy assumption buried in a lot of online safety policy, which is that the people inconvenienced by a content restriction must be the people who wanted the content. It is a comforting assumption because it lets you dismiss the inconvenienced as a rogue's gallery of would-be transgressors. The Reddit data punctures it. The privacy framing means that a substantial share of the VPN surge came from people who had no particular interest in the restricted material and every interest in not surrendering their identity documents to a company they had never heard of.
This is not paranoia, and it is worth dwelling on why. By the time the age-verification deadline arrived, British users had been handed a steady drip of reasons to distrust the machinery of identity verification. In July 2025, the same month the law took effect, a dating-advice app called Tea suffered a breach that exposed roughly seventy-two thousand user images, including selfies and government identification documents that users had uploaded to prove who they were, after the files were left sitting in a misconfigured cloud storage bucket. In October 2025, Discord disclosed that a breach at one of its third-party support vendors had exposed something in the order of seventy thousand images of government-issued IDs that had been submitted for age verification. The Electronic Frontier Foundation, which had spent years warning that age-verification mandates would turn identity databases into honeypots, marked the Discord episode with a pointedly named award for breaches that vindicated earlier warnings. An earlier breach at the identity-verification vendor AU10TIX had already established the pattern.
So the average British adult, watching the news and then watching a website demand their passport, was not being irrational when they reached for a VPN. They had been handed a working theory of the world, and the theory was that handing your identity documents to an intermediary is a gamble whose downside is permanent and whose upside is the privilege of carrying on as before. A VPN, which makes your traffic appear to originate somewhere outside the United Kingdom and therefore outside the reach of the age check, looked like a rational hedge. The trouble is that the hedge carries its own, less visible, downside.
A shield that may also be a sieve
Here is where the story curdles. A virtual private network does one straightforward thing: it routes all of your internet traffic through a server operated by the VPN provider before sending it on to its destination. To the websites you visit, you appear to be coming from wherever that server sits. To your internet service provider, and to the age-verification systems keyed to UK addresses, your traffic becomes opaque. This is precisely why a VPN defeats a geographically scoped age check. But the same mechanism that hides your traffic from everyone else also exposes it, completely and intimately, to the VPN provider. You have not eliminated the trusted intermediary. You have swapped a regulated one, operating under the gaze of Ofcom and the Information Commissioner's Office, for one of your own choosing, operating under nobody's gaze in particular.
For a paid service with an independently audited no-logs policy, run by a company whose entire reputation depends on not betraying its users, that swap can be a genuine improvement in privacy. For a free VPN downloaded in a hurry from an app store, the swap can be catastrophic. The research literature on free VPNs is bleak and consistent. One widely cited investigation tested the hundred most popular free Android VPN apps, a set accounting for more than two and a half billion installs worldwide, and found that seventy-one per cent shared personal user data with third parties while eighty-eight per cent leaked data outright. The academic work is no kinder. In February 2026, researchers from the University of New Mexico, the University of Michigan, and IIT Delhi presented a study at the Network and Distributed System Security Symposium built on an automated auditing tool they called MVPNalyzer, which they turned on two hundred and eighty-one free Android VPN apps drawn from the Google Play Store. Sixty-one transmitted data without encryption at all. Five sent sensitive VPN configuration files in cleartext, leaving the tunnel itself open to hijacking. Twenty-nine leaked browser or DNS traffic outside the encrypted tunnel, which is to say they leaked precisely the record the user had installed them to conceal. And seventy-six sent device identifiers, Android's Advertising ID among them, to third parties, handing over exactly the handle needed to track and fingerprint a person across the web. The business model is the problem. Running a global network of servers is expensive, and a service that charges you nothing has to make its money somewhere. Very often, the product being sold is you: your browsing history, your connection timestamps, your location, packaged and passed to advertisers or data brokers, sometimes in flat contradiction of the marketing copy that lured you in.
This is the cruel symmetry at the heart of the whole episode. The Online Safety Act tried to remove one set of intermediaries from a position of trust, the platforms that had been allowing children to stumble into harmful content, and it inadvertently created demand for a different set of intermediaries who are subject to far less scrutiny. The age-verification firms, whatever their flaws, operate inside a regulatory perimeter. They can be audited, fined, and hauled in front of a select committee. A free VPN headquartered in an opaque jurisdiction with a privacy policy carved full of exceptions answers to no one a British user can name.
The arXiv study is careful here, and its care is to its credit. The researchers did not find evidence that the Act was disproportionately funnelling people towards the very worst providers. When they mapped the surge in demand across their sixty-nine graded services, the increase spread across low-risk, medium-risk, and high-risk VPNs in a relatively stable distribution. In other words, the regulation did not act as a malicious filter steering the public towards the most dangerous tools. But that nuance cuts both ways. It means a substantial number of people did end up at higher-risk providers, simply because higher-risk providers got their share of a vastly enlarged pie. When you grow the total demand for a category of software by hundreds of per cent, and a known fraction of that category is dangerous, you have manufactured a great deal of new exposure even if the proportions never shifted. The researchers framed their conclusion precisely: online safety regulation can create secondary privacy costs even without disproportionately pushing users towards higher-risk providers. The cost is real. It is just distributed quietly, across millions of individual decisions, rather than announced in a headline.
The teenagers nobody planned for
The group whose position is most exposed, and least examined, is the one the law was built to protect. Consider the logic from a fifteen-year-old's point of view. The entire point of the age check is to stop them reaching certain content. A VPN, by relocating their apparent position outside the United Kingdom, makes the check vanish. Teenagers are, as a class, more comfortable with this kind of technical workaround than the adults legislating over their heads, and they have every incentive to deploy it. The age gate, in other words, does not merely fail to stop a determined minor. It actively teaches the minor that the solution to an online obstacle is to install a piece of intermediary software and route everything through it.
That lesson has consequences that outlast any single blocked website. A teenager who installs a free VPN to slip past an age check is now funnelling their entire mobile internet life, their messages, their searches, their logins, their location, through a third party whose data practices they cannot assess and whose jurisdiction they cannot identify. The state set out to reduce the harms a child encounters online and may, at the margin, have introduced a new and durable one: a generation conditioned to treat unvetted privacy intermediaries as the normal cost of getting online, and to make that trade reflexively, at speed, under irritation, with no capacity to tell the audited Swiss service from the data-harvesting clone with a near-identical icon.
This is the part of the story that the original policy debate never really priced in. The Act's defenders tend to argue, reasonably, that no measure is perfect and that raising friction still reduces casual exposure, that a gate a determined teenager can climb over still keeps out the child who wanders past. There is truth in that. Friction is a real lever and not every minor will reach for a VPN. But the arXiv data suggests the friction is doing something more complicated than simply deterring. It is reshaping behaviour, and the reshaped behaviour has its own harms, and those harms land on the same population the law named as its beneficiary. A safety measure that creates a new safety problem for the people it is meant to safeguard is not obviously a net gain. The honest answer is that nobody modelled it, and the country is now running the experiment on its own children in real time. There is a further wrinkle that the design of the law all but guarantees. A child who routes their traffic through a VPN to defeat the age gate does not only defeat the age gate. They also defeat every other protection that the same geographic signalling underpins, from regional content controls to the platform's own attempts to tailor a safer experience to a UK minor. The VPN does not surgically remove the one restriction the teenager objected to. It dissolves the platform's ability to know where the user is at all, and a great deal of online child safety, for better or worse, is built on exactly that knowledge. In trying to wall off a single category of content, the law may have handed minors a tool that switches off the lights in the entire building.
The politics of a law that will not sit still
None of this has played out in a vacuum. By the time the VPN numbers were spiking, the Online Safety Act had already become one of the most contested pieces of legislation in recent British political life. A parliamentary petition demanding its repeal, launched in July 2025 as the age checks bit, gathered more than five hundred and fifty thousand signatures, comfortably clearing the threshold that forces a Commons debate. That debate took place in Westminster Hall in December 2025. Members of Parliament declined to repeal the Act, but the very fact of the debate was a measure of how much public temperature the law had generated in under half a year.
The criticism arrived from directions that rarely agree on anything. Civil liberties organisations including the Open Rights Group, Big Brother Watch, and Index on Censorship, alongside the Electronic Frontier Foundation, called publicly for the Act to be reformed or repealed, warning about its implications for privacy and free expression. From the populist right, Reform UK denounced it as censorship. Critics catalogued a sprawl of seemingly absurd over-blocking, with users reporting that the better-safe-than-sorry instinct of platforms terrified of eighteen-million-pound fines had led to the age-gating of material that no reasonable person would call harmful, from particular Spotify playlists to, in one widely circulated example, the recording of a Member of Parliament's own speech about child sexual abuse. When the machinery built to protect children blocks a speech about protecting children, the gap between intention and execution has become hard to ignore.
The Wikimedia Foundation, which operates Wikipedia, took its objection to the High Court, arguing that if the encyclopaedia were swept into the most stringent Category 1 duties it might have to verify the identities of its contributors, something it said would force it to cut off large numbers of British users rather than compromise the privacy of the volunteers who build it. The court rejected the challenge in 2025, though the judge left the door open for a fresh case should Ofcom actually try to classify Wikipedia as a Category 1 service. In July 2026 that question was answered, provisionally. Ofcom determined on the tenth of the month that Wikipedia did not currently meet the criteria for Category 1 status, sparing it the strictest duties, contributor identity verification among them. But the reprieve arrived with a caveat more revealing than the decision itself. Ofcom placed the encyclopaedia on a watch list and retains the discretion to revisit the classification whenever it chooses, which is why the Wikimedia Foundation continues to treat future Category 1 designation as a live threat rather than a closed chapter. It is a telling vignette. One of the most benign and valuable resources on the internet found itself contemplating whether it could continue to serve the British public at all, not because of anything it hosts, but because of the identity-verification architecture the law could oblige it to adopt.
Ofcom, for its part, has not been idle, and it would be unfair to paint the regulator as either toothless or reckless. By early 2026 it had opened investigations into more than ninety online services and issued a series of fines. In December 2025 it penalised AVS Group Ltd, which operates eighteen adult websites, a million pounds for failing to put robust age checks in place, and added a further fifty thousand for failing to respond to its information requests. In February 2026 it fined Kick Online Entertainment SA, an adult website operator whose properties include motherless.com, eight hundred thousand pounds on the same grounds, with thirty thousand more for ignoring information requests. The regulator is plainly enforcing the law it was handed. The question this story raises is not whether Ofcom is doing its job. It is whether the job, as defined, produces the safety it promises or merely relocates the risk somewhere harder to see.
Part of that answer arrived in July 2026, and it deserves stating plainly because it cuts against the grain of this article. On the fifteenth of that month Ofcom published its statutory report on the use of age assurance, and the findings were not the damp squib the law's critics had forecast. Across a sample of thirty-two online services, more than sixty-nine million age checks were completed in the second half of 2025, a twenty-threefold increase on the previous six months. The proportion of children who met a highly effective age check when asked to verify their age rose from twenty-five per cent to forty-three per cent between July 2025 and January 2026. Ofcom's conclusion was that when they are implemented properly, highly effective age checks work, though it warned that tougher action was still needed and singled out social media platforms as the laggards, the services that had proved most adept at avoiding implementation altogether. That evidence has to be taken seriously, and taking it seriously does not dissolve the argument of this piece. It sharpens it. The gates are being built, and where they are built they do what gates do. The claim here was never that the Act achieves nothing. It is that its ledger has a second column nobody totals, and the column has been filling at roughly the same rate as the first. Both things are happening. Only one of them appears in the regulator's report.
Who pays when the model is wrong
Step back from the detail and a pattern emerges that should be familiar to anyone who has watched regulators try to govern the internet. The Online Safety Act treats online harm as a problem of supply. There is bad content; children reach it; therefore the law should make platforms build gates so children cannot reach it. This is intuitive, it polls well, and it is not entirely wrong. But it models human beings as static targets of content rather than as adaptive agents who respond to incentives, and that omission is where the trouble breeds. Put a gate in front of a determined population and the population does not evaporate. It routes around the gate, and the route it chooses has consequences the gate-builder did not intend and frequently cannot see.
The arXiv researchers gave this dynamic a precise name when they described the secondary privacy costs of online safety regulation. The phrase is dry, but the thing it describes is not. The cost is borne, first, by the privacy-conscious adult who only ever wanted to read a forum without photographing their passport and who now routes their traffic through an intermediary they cannot vet. It is borne, second, by the teenager the law was built to protect, who absorbs, young, the habit of trading data for access without understanding the terms. It is borne, third, by everyone whose identity documents now sit in the databases of age-verification vendors that have already demonstrated their capacity to leak. And it is borne, finally and most diffusely, by the public conversation itself, handed a law so sprawling and so prone to over-blocking that it manufactures distrust faster than it manufactures safety.
The impulse behind the Act was never cynical, and a government that did nothing would also bear responsibility for the harms that nothing allowed. The case for action is strong. The difficulty is narrower and more technical, and for that reason easier to miss in a debate conducted in the language of moral urgency. It is that the specific mechanism chosen, geographically scoped age gates enforced through identity-revealing intermediaries, has a predictable failure mode, and the failure mode transfers risk from a regulated sphere to an unregulated one while presenting itself as a reduction in risk overall.
The cleanest summary of the gap between intention and consequence is this. The Online Safety Act intended to reduce the harm British internet users encounter. Its measurable near-term effect was a stepwise surge in the adoption of privacy tools whose risk profile the public is poorly equipped to judge, undertaken largely by people who were never the target, framed not as a hunger for forbidden content but as a flight from surveillance. It is the law working and producing a second-order harm at the same time, the way a dam that stops a flood can also drown the valley behind it.
The state has now noticed the window. Ofcom has confirmed that it is monitoring UK VPN usage through a third-party monitoring tool, prompted by concern that VPNs are being used to circumvent the Act, and it has said it will keep gathering information to guide its thinking on whether there is a need for further action in this area. It is widening the evidence base too, putting the question to youth panels and surveying families on how familiar they are with the software. The limits are real. VPNs cannot themselves be blocked under the Act, and a ban on apps promoting their use is not being considered. But the shape of the thing is unmistakable. A law written to close one door has produced a regulator studying the window, and the next move in a supply-side model of harm is always to look for a way to close that too. Which would, in turn, produce a new window. This is how ratchets work.
What would a better version look like? The study's authors do not prescribe one, and neither, honestly, can a single article. But the shape of the problem points at the shape of the answer. Age assurance that does not require revealing identity, the privacy-preserving cryptographic approaches that prove you are over eighteen without disclosing who you are or storing what you showed, would remove much of the rational basis for the flight to VPNs in the first place. So would a regulatory regime that treated the privacy of the verifying adult as a first-order design constraint rather than an afterthought, and that recognised the data risks of the circumvention it provokes as part of its own ledger rather than someone else's problem. The technology to verify age without harvesting identity exists. The current implementation, for the most part, does not use it, and the gap between what is possible and what was built is the gap into which two million VPN downloads disappeared in a single July weekend.
The lesson is not that Britain should not try to protect children online. It is that protection designed without a model of how people actually behave will keep generating these unhappy surprises, where the intended beneficiaries learn new bad habits and the unintended bystanders pay the bill. The internet is not a passive surface onto which a regulator can paint a rule and watch it set. It is a system full of agents who respond, adapt, and route around obstruction, and the only regulation that survives contact with that reality is the kind written by people who expected it. The window through which Britain climbed in July 2025 is still open. The question that should haunt the next iteration of online safety law is not how to board it up, but why so many ordinary, law-abiding people felt they had no choice but to use it, and what it cost them on the other side.
