People’s online behaviour has changed in response to legislation to prevent children from viewing harmful content – raising possible privacy and security risks, research suggests.
A new study examined how individuals have responded to age verification checks enforced by the Online Safety Act (2023) and evaluated the potential risks from bypassing the rules.
The Online Safety Act is a set of UK laws and duties that require social media companies and search engines to protect users, especially children, from illegal content and harmful material.
Researchers from the University of Edinburgh, in partnership with the Universities of Newcastle and Durham, studied data from Google Trends and Reddit, a forum-based social media platform.
They found that UK users’ online discussions about Virtual Private Networks (VPNs) – tools used to circumvent the new restrictions – increased by 145 per cent, whilst UK Google searches for VPNs rose by 147 per cent, using statistical analysis to compare with a typical day.
Discussions relating to the Act in UK political communities on Reddit also increased by 1,481 per cent.
The increases were concentrated around 25 July 2025, when age checks for adult websites and some social media platforms came into force, researchers say.
Whilst online discussions do not translate directly into VPN usage, the team used this as a proxy for interest, as they were not able to access data on the number of VPN downloads.
Age verification may require users to disclose sensitive information about themselves, such as facial scans, identity documents or payment details.
A VPN creates a secure, encrypted connection between users’ devices and the internet. It hides individual IP addresses and jumbles data so internet providers cannot track a location or online activity.
However, people who seek to gain access to restricted sites without submitting personal data by using VPN services may be putting themselves at risk, experts say. This is because some high-risk VPN services track, retain and share user data with third parties.
The increase in VPN interest matters because people using these services may not understand the difference between low and high-risk providers, experts say.
Researchers say there is a need for greater understanding of the privacy risks of VPNs to help keep everyone safe online.
The paper was published in the journal Proceedings on Privacy Enhancing Technologies .
Dr Tuğrulcan Elmas, Lecturer in the School of Informatics, University of Edinburgh, said: “The sharp rise in interest in VPNs highlights an important unintended consequence: users seeking to avoid sharing sensitive information for age verification could unknowingly use services that collect and sell their data.”
Dr Marc Juarez, Lecturer in Cyber Security and Privacy, University of Edinburgh, said: “It surprised us that people trust VPN providers over the companies who have been certified to run the checks, especially as user interest also increased for high-risk VPNs. We urgently need to raise awareness of the privacy risks of VPNs and highlight that not all VPN providers are created equal.”
Dhyey Mehta, an undergraduate student from the University of Edinburgh, said: “What stood out from our findings was that users did not frame VPNs as a way to bypass restrictions, but as a way to preserve privacy amid identity checks, facial scans and surveillance. Future policies should account for how people actually respond and address the concerns that drive them towards circumvention.”
Proceedings on Privacy Enhancing Technologies