From essential security tools to restricted circumvention software: The EU signals that VPNs are the next target following the release of its age verification app

EU Executive Vice-President Henna Virkkunen didn’t need to explicitly use the phrase "VPN ban" to spark concern among cybersecurity experts and privacy advocates.

What was once considered a drastic measure reserved for authoritarian regimes is increasingly being framed as a logical next step for democratic regulators as age verification becomes a global norm.

"Of course, it's an important part of the next steps also to look at that it shouldn't be circumvented," Virkkunen said during a press conference on April 29. She was responding to questions regarding how regulators might prevent children from bypassing the EU's new age verification app using a VPN.

Over the last week, a wave of criticism has flooded social media platforms. High-profile figures, including Belgian cryptographer Bart Preneel, have hit back at the comments, saying it represents "the slippery slope" experts have repeatedly warned of.

The EU’s stance is far from an isolated case. Last Wednesday, Utah became the first US state to enforce VPN usage restrictions as part of its latest age verification regulations. However, the measures remain highly contentious — a similar proposal in Wisconsin was defeated in February following significant public backlash.

A few days before that, the UK passed its Children's Wellbeing and Schools Bill, which includes an obligation for adult service providers to take "reasonable anti-circumvention measures".

And the UK's consultation on online harms is still ongoing. The government has already confirmed that VPNs may face age restrictions if officials determine that these tools undermine online safety protections.

Elsewhere in Europe, French politicians have also publicly confirmed that "VPNs are next on the list" after the Parliament approved the first European teen social media ban.

Once praised as essential security tools, VPNs are increasingly being rebranded by regulators as dangerous circumvention software that must be controlled.

But how did we get here? And, most importantly, what are the risks of this crusade against VPNs?

The age verification effect on the threat to VPN

Mandatory age verification comes as a response to an online world that many governments believe has become too dangerous for children.

The UK was the first country to implement mandatory verification to access so-called "legal but harmful" content in July last year. More countries around the world were quick to replicate similar legislation.

Australia set a further precedent in December when the government enforced a world-first social media ban for those under 16. A stream of governments, including France, the UK, the EU, Greece, and Spain, are now pushing for similar rules.

As mandatory age checks become widespread, a similar pattern has emerged — enforcement always coincides with a spike in VPN usage among citizens.

VPNs, in fact, not only encrypt all of your internet connections, but they also spoof your real IP address, making you appear as if you're browsing from another country. This ability allows you to evade any geo-local restrictions, including age checks.

It is difficult to determine whether these users are primarily adults unwilling to share biometric data or children seeking restricted content. However, studies from groups like Childnet and Internet Matters suggest the balance swings toward the former.

The dangers of banning VPNs

Whether we like it or not, mandatory age checks are here, so it seems understandable that lawmakers want to close all loopholes that allow citizens to bypass the law. But the realities will be more complicated than that.

A virtual private network (VPN) is security software that millions of adults as well as businesses use every day to boost their online privacy, security, and overall internet experience. A VPN encrypts all the data leaving your device and that makes it difficult to track your activities.

That's why cybersecurity experts fear that restricting VPN usage will have a significant impact on people's online safety — which is, ironically, exactly what these laws are trying to prevent.

A VPN industry group, the VPN Trust Initiative (VTI), explained this risk perfectly in a recent statement addressed to the UK government.

"Policies that weaken or restrict VPNs risk reducing online safety for the very users these proposals are intended to protect, without delivering commensurate benefits," the VTI said, while arguing that "treating VPNs primarily as a 'loophole' is a complete misunderstanding of their role".

That's a position shared by another coalition in a separate warning to the UK issued on Tuesday.

"Restricting the use of privacy-preserving technologies undermines efforts to empower users to navigate the web safely and to develop digital literacy," said Mozilla, one of the signatories.

Last year, US Public Policy Manager at Proton, Christine Bannan, expressed the same concerns in an interview with TechRadar around a similar bill in Michigan. On that occasion, Bannan specifically warned politicians against crafting legislation that turns VPNs from a vital security tool into a "liability".

Do VPN restrictions even work?

Regulations targeting VPNs may face another big, technical hurdle — they seem to be impossible to enforce.

As Utah becomes the first democratic territory to pass such a law, digital rights experts at Fight for the Future branded it "a waste of money", while arguing that restrictions are "impossible by design" to enforce.

This echoes the warning from popular VPN provider NordVPN, which previously dubbed the law "a liability trap" that could end up punishing all users worldwide instead.

It is technically impossible to block all known VPN and proxy IPs in Utah, NordVPN told TechRadar back in March. The only remaining option appears to be age-verifying every visitor globally, regardless of their actual location.

Russia’s ongoing crusade to block VPN usage serves as a stark warning. Despite the millions of rubles spent by the Kremlin on building a sophisticated censorship system, VPN services keep showing resilience by constantly adapting to new tactics.

There are over 400 scientists calling for a halt to mandatory age verification until "scientific consensus" is reached regarding the technical feasibility and benefits of these measures. And even for purely economic and practical reasons, perhaps they are right?

If politicians remain convinced that age verification is the best path forward, they must accept that VPNs are far more than mere circumvention tools.

If some people bypass the rules, then perhaps that's just the price to pay for security, privacy and, ultimately, safeguarding the integrity of the tools that provide it.

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!