Online Safety Act drives VPN interest and raises privacy concerns

People's online behaviour has changed in response to legislation to prevent children from viewing harmful content - raising possible privacy and security risks, research suggests.

A new study examined how individuals have responded to age verification checks enforced by the Online Safety Act (2023) and evaluated the potential risks from bypassing the rules.

The Online Safety Act is a set of UK laws and duties that require social media companies and search engines to protect users, especially children, from illegal content and harmful material.

Researchers from the University of Edinburgh, in partnership with the Universities of Newcastle and Durham, studied data from Google Trends and Reddit, a forum-based social media platform.

The researchers found that UK users' online discussions about Virtual Private Networks (VPNs) - tools used to circumvent the new restrictions - increased by 145 per cent, whilst UK Google searches for VPNs rose by 147 per cent, using statistical analysis to compare with a typical day.

Discussions relating to the Act in UK political communities on Reddit also increased by 1,481 per cent.

The increases were concentrated around 25 July 2025, when age checks for adult websites and some social media platforms came into force, researchers say.

Whilst online discussions do not translate directly into VPN usage, the team used this as a proxy for interest, as they were not able to access data on the number of VPN downloads. The paper is published in the journal Proceedings on Privacy Enhancing Technologies.

Age verification may require users to disclose sensitive information about themselves, such as facial scans, identity documents or payment details.

A VPN creates a secure, encrypted connection between users' devices and the internet. It hides individual IP addresses and jumbles data so internet providers cannot track a location or online activity.

However, people who seek to gain access to restricted sites without submitting personal data by using VPN services may be putting themselves at risk, experts say. This is because some high-risk VPN services track, retain and share user data with third parties.

The increase in VPN interest matters because people using these services may not understand the difference between low and high-risk providers, experts say.

Researchers say there is a need for greater understanding of the privacy risks of VPNs to help keep everyone safe online.

Co-author Lei Shi, Senior Lecturer in Computing at Newcastle University said: "Our study carries key implications for ordinary internet users. Well-intentioned online-safety push many first-time users toward VPNs, yet most lack the know-how to spot risky providers.

"Civil-society groups should offer plain-language digital-literacy guidance on independent audits, provider jurisdiction and data-retention policies."

Co-author Dr Maxim Kolomeets, a Research Associate in Computing at Newcastle University said: "Some VPNs used to get around age checks may collect and sell your personal data - in trying to protect children online, regulators have created new privacy risks for others. Safety rules should protect everyone, not shift risks from one group to another."

Dr Tuğrulcan Elmas, Lecturer in the School of Informatics, University of Edinburgh, said: "The sharp rise in interest in VPNs highlights an important unintended consequence: users seeking to avoid sharing sensitive information for age verification could unknowingly use services that collect and sell their data."

Reference: Online Safety Regulation Increases Attention to VPNs: Privacy Implications of the UK Online Safety Act. Proceedings on Privacy Enhancing Technologies. arXiv:2606.05273