DIGITAL LIFE

Online Safety Act drives VPN interest and raises privacy concerns

People's online behavior has changed in response to legislation to prevent children from viewing harmful content—raising possible privacy and security risks, research suggests.

A new study examined how individuals have responded to age-verification checks enforced by the Online Safety Act (2023) and evaluated the potential risks from bypassing the rules.

The Online Safety Act is a set of U.K. laws and duties that require social media companies and search engines to protect users, especially children, from illegal content and harmful material.

VPN interest surged around age checks...Researchers from the University of Edinburgh, in partnership with the Universities of Newcastle and Durham, studied data from Google Trends and Reddit, a forum-based social media platform.

They found that U.K. users' online discussions about virtual private networks (VPNs)—tools used to circumvent the new restrictions—increased by 145%, while U.K. Google searches for VPNs rose by 147%, using statistical analysis to compare with a typical day.

Discussions relating to the act in U.K. political communities on Reddit also increased by 1,481%.

The increases were concentrated around July 25, 2025, when age checks for adult websites and some social media platforms came into force, researchers say.

While online discussions do not translate directly into VPN usage, the team used this as a proxy for interest, as they were not able to access data on the number of VPN downloads.

Avoiding checks can introduce privacy risks...Age verification may require users to disclose sensitive information about themselves, such as facial scans, identity documents or payment details.

A VPN creates a secure, encrypted connection between users' devices and the internet. It hides individual IP addresses and jumbles data so internet providers cannot track a location or online activity.

However, people who seek to gain access to restricted sites without submitting personal data by using VPN services may be putting themselves at risk, experts say. This is because some high-risk VPN services track, retain and share user data with third parties.

The increase in VPN interest matters because people using these services may not understand the difference between low- and high-risk providers, experts say.

Researchers say there is a need for greater understanding of the privacy risks of VPNs to help keep everyone safe online.

The paper appears in the journal Proceedings on Privacy Enhancing Technologies and was also released on the arXiv preprint server.

Privacy concerns shape users' choices...Dr. Tuğrulcan Elmas, lecturer in the School of Informatics, University of Edinburgh, said, "The sharp rise in interest in VPNs highlights an important unintended consequence: users seeking to avoid sharing sensitive information for age verification could unknowingly use services that collect and sell their data."

Dr. Marc Juarez, lecturer in cybersecurity and privacy, University of Edinburgh, said, "It surprised us that people trust VPN providers over the companies who have been certified to run the checks, especially as user interest also increased for high-risk VPNs. We urgently need to raise awareness of the privacy risks of VPNs and highlight that not all VPN providers are created equal."

Dhyey Mehta, an undergraduate student from the University of Edinburgh, said, "What stood out from our findings was that users did not frame VPNs as a way to bypass restrictions, but as a way to preserve privacy amid identity checks, facial scans and surveillance. Future policies should account for how people actually respond and address the concerns that drive them toward circumvention."

Interest in virtual private networks (VPNs) has risen following the introduction of the Online Safety Act, but Edinburgh academics have warned of the ‘privacy risks’ in using such platforms.

A new study led by the University of Edinburgh examined how individuals have responded to age verification checks enforced by the Online Safety Act and evaluated the potential risks from bypassing the rules.

The 2023 legislation is a set of UK laws and duties that require social media companies and search engines to protect users, especially children, from illegal content and harmful material.

Researchers found UK users’ online discussions about VPNs – tools used to avoid restrictions – increased by 145 per cent, whilst Google searches for VPNs rose by 147 per cent, using statistical analysis to compare with a typical day.

The academics, worked with colleagues from the universities of Newcastle and Durham, studied data from Google Trends and Reddit, the online forum and message board.

On Reddit, discussions relating to the act in UK political communities increased by 1,481 per cent, the study showed.

The increases were concentrated around 25 July 2025, when age checks for adult websites and some social media platforms came into force, researchers say.

Without data on VPN downloads, the team used online discussions as a ‘rough proxy’ for interest, even though discussion doesn’t directly reflect usage.

Age verification may require users to disclose sensitive information about themselves, such as facial scans, identity documents or payment details.

A VPN encrypts the connection between your device and the internet, hiding your IP address and scrambling your data so internet providers can’t see where you are or what you’re doing online.

But experts warn that people using VPNs to reach restricted sites without handing over personal details could be putting themselves at risk.

Some riskier VPN services track, store and share user data with third parties, and many users may not know how to tell safe providers from risky ones, and the researchers said people need to better understand VPN privacy risks to stay safe online.

Dr Tuğrulcan Elmas, lecturer in the School of Informatics, University of Edinburgh, said: “The sharp rise in interest in VPNs highlights an important unintended consequence: users seeking to avoid sharing sensitive information for age verification could unknowingly use services that collect and sell their data.”

Dr Marc Juarez, lecturer in cybersecurity and privacy, University of Edinburgh, added: “It surprised us that people trust VPN providers over the companies who have been certified to run the checks, especially as user interest also increased for high-risk VPNs. We urgently need to raise awareness of the privacy risks of VPNs and highlight that not all VPN providers are created equal.”

The implementation of age-verification guidelines mandated by the UK’s Online Safety Act has triggered a significant side effect: a massive surge in interest in Virtual Private Networks (VPNs) and the emergence of new privacy and digital security risks.

A study published in October 2026 by researchers from the universities of Edinburgh, Durham, and Newcastle revealed how user behavior shifted following the introduction of mandatory age checks.

The VPN interest boom...To map the public's reaction, the researchers analyzed data from Google Trends and discussions on the platform Reddit. Key findings indicate that:

• Google searches: Searches for VPNs in the UK spiked by 147% compared to a typical day.

• Forum discussions: Discussions about VPNs on Reddit rose by 145%, while threads concerning the legislation within British political communities surged by 1,481%.

• Critical moment: This spike in interest was heavily concentrated around July 25, 2025—the date when strict age-verification requirements for adult websites and certain social media platforms came into effect.

Why did users turn to VPNs? The Online Safety Act requires digital platforms to employ "highly effective" systems to prevent minors from accessing harmful content. In practice, this necessitates that users provide highly sensitive information, such as facial scans (biometrics), identification documents, or credit card details.

Many adults and young people have opted to use VPNs to mask their IP addresses, making it appear as though they are browsing from outside the UK. By doing so, they are able to access websites directly, bypassing the data-verification process. 

New privacy risks...Although users adopt VPNs with the goal of protecting their identities and avoiding the exposure of documents on web portals, experts warn that this strategy has created a new privacy hazard:

1. Use of malicious providers: Many users—especially those using such tools for the first time—cannot distinguish between secure services and high-risk or "free" providers.

2. Data collection and sale: Numerous low-quality VPNs profit precisely by tracking, retaining, and selling users' browsing history and personal data to third parties.

3. Shifting the risk: As highlighted by the study's authors, in attempting to protect minors by restricting access, regulators have inadvertently pushed the general population toward services that compromise their digital security.

Government response...Faced with this situation, some lawmakers even suggested restricting or blocking tools used to bypass access controls. However, following intense pressure from digital rights organizations such as the Open Rights Group, the British government backed away from plans to ban VPNs or impose age restrictions on them, acknowledging them as legitimate and essential cybersecurity tools for remote work, journalists, and the general public.

Provided by University of Edinburgh