The Online Safety Act UK: Age Verification and the rise of VPNs

The UK’s Online Safety Act has introduced new requirements for online platforms to protect children from harmful content. Central to this is age verification, forcing sites and services to check users are old enough before granting access. Since the rollout in mid-2025, millions of daily checks are now the norm, alongside a surge in VPN usage as people seek to bypass restrictions. This blog looks at what the Act means for businesses, how VPNs complicate compliance, and what steps organisations should take to stay secure.

What Is The Online Safety Act?

The Online Safety Act 2023 is the UK’s most significant internet regulation to date. It places a legal duty of care on platforms, search engines, and online services to remove illegal material, minimise harmful content, and protect under-18s. Ofcom, the UK’s regulator, now has the power to issue fines of up to £18m (or 10% of global turnover), block non-compliant services, and hold senior executives personally accountable.

While the Act covers a wide range of online harms, from fraud and hate speech to unsafe algorithms, its age assurance rules have become the most visible change. These require services with potentially harmful content to implement robust checks that go beyond simple “Are you 18?” disclaimers, marking a new era of online accountability.

How Age Verification Rules Work (and Who They Apply To)

Platforms hosting adult, mature, or high-risk content must now use “highly effective” age checks. This includes methods such as ID scanning, credit card verification, or mobile operator checks. Crucially, the rules apply to any service accessible in the UK, regardless of where it is based. Companies that fail to comply face fines or even site blocking, making this a global compliance issue for all digital service providers.

Is Privacy at Risk? The Backlash Against Verification

These safeguards come with trade-offs. Requiring users to share ID, banking details, or biometric data raises serious privacy concerns. Critics warn of risks if verification data were ever exposed, and digital rights groups argue that constant ID checks erode anonymity online. The government stresses that verification providers should minimise data collection, but scepticism remains – especially among adults uneasy about linking personal information to their browsing habits.

VPNs on the Rise

In response, many users have turned to virtual private networks (VPNs). VPNs mask a user’s location, allowing them to appear outside the UK and sidestep age gates.

Reports show VPN downloads in the UK surged by over 1,000% in the days following the Act’s rollout. This surge highlights the challenge; while the rules block access at the front door, VPNs provide an easy back entrance – one that both privacy-minded adults and younger users are exploiting.

Can VPNs Be Regulated Too?

Talk of restricting VPNs has surfaced, but experts caution against it. VPNs are essential for secure remote work, corporate networks, and personal data protection. Banning or heavily limiting them would harm businesses and infringe on digital rights. Technically, blocking VPNs would also require heavy surveillance of internet traffic – something considered disproportionate in a democratic system. For now, ministers say VPNs will remain legal, though monitoring and detection will increase.

What Businesses Need to Know – Compliance, VPN Detection & Trust

For organisations, the Act means assessing whether your platform or service falls under age verification obligations, and ensuring robust systems are in place. Equally important is preparing for the VPN effect. If users access your services through VPNs, you may inadvertently serve under-age users and breach compliance. VPN detection tools can help, but blanket bans risk alienating legitimate customers. Businesses must strike a balance: secure compliance, proactive monitoring, and maintaining user trust through transparency.

Balancing Safe Internet with Privacy & Access

The Act is a live test of how to balance safety, privacy, and freedom online. Its effectiveness depends not just on enforcement but also on user behaviour, education, and responsible business practices. Overly rigid barriers can backfire, but so can doing nothing. The path forward lies in innovative age assurance, clear communication, and ongoing refinement of the rules – ensuring that the internet is safer for young people without sacrificing adults’ rights to privacy or access.

How Optimising IT Can Help

At Optimising IT, we help businesses navigate the Online Safety Act with confidence. From implementing secure age-assurance tools to deploying VPN detection and compliance strategies, we work with you to protect users, meet regulatory standards, and maintain trust.

As a B Corp-certified IT partner, we combine cyber security expertise with values of trust, simplicity and respect – ensuring your systems are not only compliant, but future-proof. Discover more or contact us today to discuss your organisation’s needs.