Age checks were sold as a way to keep children off adult sites. In 2026 they have become something larger: a fight over whether a VPN is a privacy tool, a loophole, or a business that should be treated like the websites it is used to reach.
In May 2026, journalist Joel R. McConvey laid out that fight for Biometric Update. Lawmakers in the EU and the UK were no longer arguing only about face scans and ID uploads. They were arguing about the encrypted tunnels people turn on when they refuse those scans. The question underneath the policy paper-speak is simple. If you can change your apparent country with one tap, does an age law still mean anything — and if it doesn’t, do you go after the law, or the tap?
The surge that put VPNs on the agenda
A briefing from the European Parliamentary Research Service said VPN use had jumped in countries that had already switched on legal age verification. That is not a mystery. When a site demands a passport photo or a biometric age estimate before you can read, watch, or log in, a lot of adults leave. A VPN does not forge an age token. It often changes the signal that decides whether the gate appears at all: your IP address, and the country the platform thinks you are in.
From one side of the debate, that is a hole in the fence. The EPRS language treats VPNs as a “loophole that needs closing.” The suggested fix is blunt: restrict VPN access to people above a digital age of majority. In other words, age-gate the tool that people use when they do not want to be age-gated. The UK had floated a version of the same idea. In the United States, Utah’s Senate Bill 73 took a different route. It says the state’s rules still apply to you if you are in Utah, even if a VPN makes a website think you are somewhere else.
Utah’s approach is worth sitting with. It does not pretend a tunnel moves your body. It asserts jurisdiction over the person, not the IP. That is legally tidier than banning software. It is also a warning that “I connected to another country” may not be an answer a court or a platform is required to accept.
The other reading: the law taught people to leave
The competing view is that the surge is evidence the laws are misfiring, not that VPNs are a crime scene. Age assurance, as rolled out in Britain and in several U.S. states, often means handing a government ID or a face to a vendor you did not choose, for a site you may only visit once. Plenty of the people downloading VPNs are not children. They are adults who do not want a porn site, a social network, or a forum to hold a copy of their identity document.
If the response to that refusal is to put age checks on VPNs themselves, the circle closes. Everyone, everywhere, does an age check to use the internet in the way they already used it. Privacy stops being a setting and becomes a privilege you unlock with a scan. That is the “free, anonymous internet” argument McConvey puts on the other side of the tug-of-war, and it is not a small one. A VPN is how whistleblowers, queer users in hostile households, journalists, and ordinary people on café Wi-Fi keep a private path. Age-gating that path for the sake of adult-content rules would hit all of those uses at once.
The industry’s preferred fix is not a ban. It is detection.
The Age Verification Providers Association does not call for banning VPNs. It agrees there is circumvention, then says platforms can live with it. Detect the tunnel. Weigh behavioural clues. Offer the flagged user a chance to prove age or location. Compliance, in that telling, does not stop when someone hits connect. The checkpoint just moves from “show your face” to “we think you are on a VPN, so show your face anyway.”
That is a more politically saleable path than an outright VPN ban, which would collide with businesses, remote workers, and every minister who has ever used one on a train. It is also how a restriction can arrive without ever being named as a ban. If every bank, shop, and social app is pushed to notice encrypted tunnels and then demand extra proof, the software stays legal and the useful part of it gets taxed in friction.
Trust is being transferred, not created
McConvey’s piece does not let VPN companies off the hook, and it should not. A 2023 University of Michigan study surveyed 1,252 VPN users in the United States and interviewed nine providers. Users trusted review sites. Providers talked about money. The researchers found that people often misunderstand what a VPN protects and what data the service itself can collect. Commercial VPNs are a multi-billion-dollar industry. Ownership is sometimes opaque. Standing up a service is not technically hard. One provider’s line, quoted in the paper, was that two people in a basement with decent power can run one.
The study’s most useful sentence is also the least glamorous. Using a VPN is transferring trust from your internet provider to your VPN provider. ISPs have been around longer and sit under more rules. The VPN market has not caught up. Age-assurance vendors, for all the hostility they attract, are at least being shoved toward audits, standards, and procurement fights. A lot of VPN marketing still runs on the assumption that the new middlebox will be kinder than the old one. That is only true if you picked a provider that keeps no logs, can show it, and would have nothing to hand over if someone asked.
That critique cuts both ways. It is a reason not to treat every VPN as a human-rights organisation. It is also a reason not to let governments collapse the entire category into “the thing kids use to dodge a face scan.” The existence of bad or lazy VPN companies does not make biometric age gates a good bargain. It makes the choice of provider the actual product.
What this fight is really about
Child safety is a real problem. So is a design that trains adults to leak identity documents to whichever site is newly in scope. The EU and UK debate McConvey described is what happens when those two facts collide and the available workaround is an encrypted tunnel.
A VPN will not mint a fake age credential. It will not put you outside the law of the place you physically are. It will hide your destination from your ISP, change the country a website thinks it is serving, and make a location-triggered gate less likely to load. Those are different jobs. Mixing them up is how you get policy that either bans a privacy tool to save an age law, or pretends an age law is working because the people who refused it left the room.
If you are an adult who can still choose a VPN without showing a passport first, that choice is the point. Pick a provider you would actually trust with the traffic your ISP used to see. Prefer modern protocols and a no-logs practice that has been tested, not just advertised. Keep the app updated. Do not confuse a relocated IP with a relocated body, and do not confuse “the gate went away” with “the law went away.”
Regulators can go after tunnels, or they can build age checks that do not demand a face and a photocopy for a login. The May 2026 debate was about which of those they were willing to try. The people in the middle of it still need a private path either way.
