When the UK started making people prove their age before visiting adult websites, a lot of users didn’t reach for their passports. They reached for a VPN. Now a new study says that quick workaround may be trading one privacy problem for a bigger one.

According to Tech Xplore, researchers from the University of Edinburgh, working with colleagues at Newcastle and Durham universities, looked at how people reacted to the age checks required under the Online Safety Act, and what risks come with dodging them.

The numbers behind the spike

The team leaned on two data sources: Google Trends and Reddit. Compared with a typical day, UK Google searches for VPNs jumped 147 percent, and UK conversations about VPNs on Reddit climbed 145 percent. Talk about the law itself in UK political communities on Reddit shot up a massive 1,481 percent.

The surge clustered around July 25, 2025, the day age checks for adult websites and some social media platforms kicked in. According to FutureScot‘s Kevin O’Sullivan, the researchers didn’t have VPN download figures, so they treated online discussion as a “rough proxy” for interest. In other words, chatter isn’t the same as installs, and the study is upfront about that.

Why people are reaching for VPNs

Age verification can mean handing over some very personal information, like a face scan, an ID document or payment details. A VPN encrypts the connection between your device and the internet and masks your IP address, which is why it looks like an easy way around the checks.

But the researchers found that most people weren’t talking about VPNs as a cheat code. “What stood out from our findings was that users did not frame VPNs as a way to bypass restrictions, but as a way to preserve privacy amid identity checks, facial scans and surveillance,” Edinburgh undergraduate Dhyey Mehta said, as quoted by Tech Xplore. Mehta added that future policies “should account for how people actually respond.”

The catch: not every VPN is on your side

Here’s the twist. Some higher-risk VPN services track, store and pass user data to third parties, and many users can’t tell the safe providers from the shady ones.

“The sharp rise in interest in VPNs highlights an important unintended consequence: users seeking to avoid sharing sensitive information for age verification could unknowingly use services that collect and sell their data,” said Dr. Tuğrulcan Elmas, a lecturer in Edinburgh’s School of Informatics.

His colleague Dr. Marc Juarez, a lecturer in cybersecurity and privacy, said the team was surprised that “people trust VPN providers over the companies who have been certified to run the checks,” especially since interest in high-risk VPNs went up too. “We urgently need to raise awareness of the privacy risks of VPNs and highlight that not all VPN providers are created equal,” he said.

The research has been published in the journal Proceedings on Privacy Enhancing Technologies, and the findings were picked up again on October 19 by Digital Information World.

A trust problem for age checks

The Online Safety Act was built to protect people, especially children, from harmful material online. What it highlights is how real users behave when a law asks them to trade personal data for access: according to the researchers, plenty of people seem more comfortable handing their traffic to a VPN company than handing a face scan or ID to a certified age checker. That gap in trust is something lawmakers and platforms will have to deal with if they want age checks to work without pushing people toward riskier tools.

The takeaway

If you’re a fan in the UK, a VPN isn’t automatically the private option. Some providers make money from the same kind of data you’re trying to protect, so look into who runs a service and what it does with your information before you trust it. And if you’re a creator, this is a reminder that your audience is thinking hard about privacy, and the platforms and tools that respect it are the ones people will stick with.

Image: Laptop locked with a chain and padlock, photo by Santeri Viinamäki (CC BY-SA 4.0), via Wikimedia Commons.