VPNs Under EU Scrutiny: They Are a Loophole for Age-Verification Systems

Protection of minors has become an absolute priority for European lawmakers, to the point of introducing increasingly stringent rules on age verification. However, a hurdle has emerged on the horizon: the use of VPN.

Online Safety for Minors and VPNs: The European Union Aims to Close the Regulatory Gap

VPNs were born as essential tools for privacy protection, offering traffic encryption and masking the IP address through remote servers. While their use is widely legitimate, this technology allows minors to bypass geographic and age checks.

In the United Kingdom, for example, VPN apps have dominated download charts right after the entry into force of restrictive laws on access to content for minors. This situation has pushed some advocates of child safety to propose drastic measures, such as requiring age verification even just to access VPN services or limiting their use to adults only.

However, proposals of this kind raise enormous concerns regarding privacy and the collection of personal data. Forcing a user to identify themselves before activating a VPN weakens the very function of the tool, creating new risks related to mass surveillance and the storage of sensitive information.

At the moment, age-verification technology remains fragmented and difficult to apply, with systems that can be easily circumvented. Not to mention the EU’s new age-verification app, hacked in just two minutes. Clear signals that much work still remains to obtain a clear and efficient answer.

Meanwhile, the legislative landscape is already moving to directly address the VPN challenge, with some international precedents that could set an opening. In Utah, for example, a new law states that a person’s legal location depends on where they are physically located and not on their IP address. In this way, the “trick” of VPNs that hides one’s real location is made moot.

Even in Europe the situation is evolving: the EPRS does not exclude new cybersecurity rules, and those offering VPN services could be subjected to much stricter scrutiny.

Future amendments to the European Union Cybersecurity Act could indeed introduce specific requirements to prevent the misuse of VPNs to circumvent blocks destined for minors. Clearly this would be a real turning point in the neutrality of these services.

Closing the VPN loophole without compromising users’ privacy requires an extremely cautious approach. It remains to be seen what measures the EU will adopt, since at the moment the debate is still open.