Online age checks came first — a VPN crackdown could be next

This is The Stepback, a weekly newsletter breaking down one essential story from the tech world. For more news about online age verification and your privacy, follow Emma Roth. The Stepback arrives in our subscribers’ inboxes at 8AM ET. Opt in for The Stepback here.

Virtual private networks, or VPNs, weren’t always used to access region-locked Netflix streams, bypass censorship online, or to prevent your internet service provider (ISP) from tracking your browsing history. It took years for VPNs to become the technology we know today, which provides an encrypted connection between your device and a private server, while concealing your IP address and browsing data.

The concept behind VPNs first emerged in the 1990s with a mundane purpose: to help businesses securely send information across offices. Instead of forking out money for the pricey leased lines that they would need to make these connections, many businesses decided to use their existing infrastructure to transfer data across encrypted “tunnels” on the web. While Microsoft, AT&T, and Cisco pioneered early versions of the tech, Francis Dinha and James Yonan went on to launch OpenVPN in 2001, offering a more secure, open-source alternative for both businesses and consumers.

But things changed in 2013, when whistleblower Edward Snowden leaked confidential documents that revealed the National Security Agency had been carrying out mass surveillance programs across the web. This revelation made more people aware of security-related risks, as a 2015 survey from Pew Research found that 34 percent of Americans have taken at least one step to protect their privacy online. Just one year later, another Pew Research survey found that 86 percent of Americans tried to “remove or mask their digital footprint” by doing things like clearing cookies, encrypting their email, or using VPNs. The rise of streaming and region-locked video libraries created tangible benefits for having a VPN, too, not to mention the prevalence of virtual networks in torrenting.

Though Snowden may have sparked a privacy movement stemming from government surveillance, a new wave of VPN adoption is being driven by a different force: the rise of the age-gated internet.

Lawmakers around the globe are implementing rules surrounding online age verification as part of purported efforts to keep kids safe online. But such efforts come at the expense of everyone else’s privacy and ability to openly access the internet. Intrusive requirements to upload your ID, bank card information, or take a video selfie to access content online threaten to deanonymize all users, while also putting troves of personal information at risk of data breaches.

As a result, many are turning to VPNs to circumvent these requirements, as they can use the tech to mask their location and present their web traffic as coming from a different state or country — one without age verification requirements.

Last year, searches for VPNs soared in Florida after the state required age verification for adult websites, and similar scenarios are playing out in other countries. In the UK, mobile VPN usage shot up after imposing rules that require users to verify their age to access adult websites and platforms like Reddit, Bluesky, and Discord. VPNs are on the rise in Australia, too, which banned kids under 16 from social media in late 2025 and introduced age checks for porn websites earlier this month.

The future of VPNs is under threat. In Michigan, six Republican representatives proposed a bill that would not only restrict access to VPNs but also ban the distribution of porn, force ISPs to “block and filter” a wide range of adult content, and target depictions of transgender people online. Wisconsin lawmakers packaged a VPN ban in the state’s age verification bill, but they have since removed the provision after facing widespread backlash.

Regulators in countries outside the US are eyeing VPN usage as well. Last year, the UK Children’s Commissioner Rachel de Souza called VPNs a “loophole that needs closing” during an interview with the BBC, while the country’s communications regulator, Ofcom, is monitoring VPN use, according to a report from TechRadar. Meanwhile, the French Minister Delegate for Artificial Intelligence and Digital Affairs, Anne Le Hénanff, said VPNs are “the next topic on my list” after the country enacted a ban on social media for kids under 15.

Putting restrictions on VPNs would undermine user privacy and security. In addition to the businesses and students who use VPNs to securely connect to online resources or communications platforms, many people use VPNs for safety reasons, including activists, journalists, and members of the LGBTQ+ community, as noted by the Electronic Frontier Foundation (EFF). A ban on VPNs might not even be effective, either, as users would inevitably find work-arounds, such as creating their own private networks.

The Cato Institute, a libertarian think tank, takes issue with the idea of banning VPNs as well. Laws restricting access to the tech would put the US, the UK, Australia, and others in the same category as North Korea, Russia, and China, which see the technology as a threat to their government’s authoritarian rule.

Even though the concept and execution of online age verification are still half-baked, lawmakers are pushing forward anyway, making the surge in threats to VPNs all the more concerning.