Nine months after the UK's age verification requirements under the Online Safety Act came into force, VPN downloads remain significantly above their pre-law baseline, according to Cybernews research. The data suggests the law has changed behaviour, though not in the direction its architects intended.
Cybernews tracked Reddit discussions on age verification bypass techniques and VPN download trends in the UK between May 2025 and April 2026. When the Online Safety Act's age verification measures took effect on 25 July 2025, Reddit commentary about bypass techniques surged by 460% in August compared to prior months. VPN downloads in the UK jumped to over two million that same month.
The spike has not fully unwound. By April 2026, UK VPN downloads were running at close to 800,000 per month — down from the August peak, but substantially above the pre-law level. Sustained demand at that scale points to more than a short-term workaround. A section of the population has incorporated VPN use into its normal browsing behaviour as a direct response to the legislation.
It looks like age verification laws are not stopping determined users from accessing restricted content. And it's not just kids – many privacy-conscious users simply do not want to share sensitive personal data online, as age verification often requires uploading an ID or doing a facial scan. As long as these methods remain so privacy-invasive while bypass techniques remain widely accessible, these laws are unlikely to achieve their intended effect
"It looks like age verification laws are not stopping determined users from accessing restricted content. And it's not just kids — many privacy-conscious users simply do not want to share sensitive personal data online, as age verification often requires uploading an ID or doing a facial scan. As long as these methods remain so privacy-invasive while bypass techniques remain widely accessible, these laws are unlikely to achieve their intended effect," said Aras Nazarovas, Senior Information Security Researcher at Cybernews.
The privacy concern Nazarovas identifies is separate from the intent-to-evade question. ID upload and facial scan requirements create data that, in the wrong hands, has serious downstream consequences. That concern is not limited to younger users trying to access restricted content. Whether regulators will treat elevated VPN adoption as evidence of a flawed implementation or as a signal that stronger enforcement mechanisms are needed will shape the next phase of the policy debate.
