The European Parliamentary Research Service (EPRS) published a briefing paper this week describing VPN use as "a loophole in the legislation that needs closing," as governments across Europe and the U.S. expand laws requiring platforms to verify users' ages before granting access to adult content.

The paper noted that VPN downloads spiked after enforcement began in the UK and several U.S. states, with one app developer reporting an 1,800% increase in downloads in the first month following the UK's Online Safety Act taking effect last year. Some policymakers, including England's Children's Commissioner, have called for VPN services to be restricted to adults only.

The EPRS paper acknowledges that current age-assurance methods are "relatively easy for minors to bypass," but offers no technical workaround to prevent VPN circumvention. In March, Utah became the first U.S. state to target VPN use in its age-verification law when Governor Spencer Cox signed Senate Bill 73. However, such efforts are technically flawed because the only reliable method for identifying VPN protocol signatures is deep packet inspection at the network level, which the EPRS paper doesn’t mention.

The EPRS paper also highlights France's "double-blind" verification model, in which the adult platform learns only whether a user meets the age threshold, while the verification provider doesn’t see which sites the user visits. California has taken a separate approach, requiring operating systems to collect age data at device setup. GrapheneOS has refused to comply with such laws.

Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.