The UK’s Online Safety Act Demonstrates the Dangers of Age Verification Mandates
The United Kingdom (UK)’s Online Safety Act (OSA) recently went into force. The law requires, among other things, widespread age verification. In the name of protecting children, platforms have been forced to verify the ages of users before displaying content — including content that most people would consider banal. The striking breadth of the OSA’s provisions regarding children incentivize platforms to over-block user speech, and those incentives have become UK users’ reality.
The App Security Project has long warned of the privacy and data-security risks that age verification creates. The striking thing about the early period of the OSA’s enforcement is that users seem to understand — or at least intuit — the same issues. Users have flooded app stores to download virtual private networks (VPNs), which allow the skirting of geographically based restrictions. For example, “Proton VPN, an app offered by Swiss privacy tech firm Proton, told the BBC it had seen a 1800% spike in UK daily sign-ups over the weekend after age check rules took effect,” BBC reported. Other VPN providers have also experienced surges in downloads.
When policymakers evaluate proposed digital regulations, they all too often tend to ignore or downplay the unintended consequences of their policies. Advocates will justify policies based on some purportedly crucial goal without reference to the advice of experts with respect to whether their proposals are likely to achieve the stated goal or whether they are likely to endanger the privacy and security of users.
American lawmakers can learn from the mistakes of the UK and other countries. The evidence of the damage of mandated age verification is no longer theoretical but manifest on the other side of the Atlantic. These lessons should not be ignored.
Published on August 8, 2025