Decentralized, encrypted, and completely private messages. That's what Session promises.

You may never have heard of the app, but for its 1.7 million monthly users, Session is an important piece of privacy tech worth fighting to sustain.

Due to a severe funding shortfall, Session was expected to cease operations this week. However, after securing $200,000 to keep the project afloat, the team is now ready to look ahead.

Session co-founder Chris McCabe described the app as a "critical tool for fighting against an Orwellian future." But what is Session, and what does it offer that mainstream giants like Signal can't?

How Session survived its financial crisis

Launched in 2018, the project originally sustained its decentralized infrastructure through its own crypto tokens. According to McCabe, the Session Technology Foundation (STF) sold roughly $2.4 million worth of tokens toward the end of 2024 to keep the project going.

However, the model wasn't sustainable and, when a crisis in the crypto market drained Session's finances last year, the founders were forced to terminate the contracts of all 16 of their team members.

Unwilling to let the platform die, the founders scrambled for alternative lifelines. Following a high-profile emergency donation from Ethereum co-founder Vitalik Buterin — who gifted 128 ETH to support the app's mission — the foundation decided it was time to turn to its user base for long-term survival.

That grassroots fundraising campaign ultimately paid off.

To date, Session has received hundreds of community donations totaling $205,000. While that is still a long way off the project's ultimate $1 million sustainability goal, it is enough to keep the platform operational, albeit with far fewer resources than it once had.

"This funding allows us to retain three developers and one community operations person to maintain the app," McCabe explains.

How Session protects your messages

"Send messages, not metadata" is Session's mantra. To back this up, the app uses a variety of advanced techniques to ensure users' messages remain private and secure.

From basics like end-to-end encryption to the use of a decentralized infrastructure and onion routing, Session goes significantly further than mainstream messaging apps.

"Session is completely trustless," McCabe told TechRadar. "You don't even have to trust us because the open-source code guarantees your security."

In the future, the app's design should also make it less vulnerable to increased surveillance and monitoring, such as the initiatives currently being proposed in Canada, the EU, and the UK.

Because the platform is open source, McCabe claimed the app can continue to operate even in countries where it has been banned from mainstream app stores, noting that users can easily bypass those restrictions by sideloading the app on Android devices.

And what happens if a repressive government demands data about an individual user? McCabe noted that the foundation simply couldn't comply, saying: "It's technically impossible for our company to copy or store that data."

Crucially, users do not need a phone number or email address to sign up for the service. That anonymity is especially beneficial for citizens in conflict zones or highly restrictive digital environments, where hostile governments can block SMS two-factor authentication messages to cut off access to mainstream messaging networks.

So, how exactly does Session stack up against mainstream giants like Signal?

Is Session really better than Signal?

Signal is widely recognized as the gold standard for privacy-preserving messaging apps. Like Session, it is fully open-source, collects minimal metadata, and uses advanced end-to-end encryption via the Signal Protocol.

While McCabe agrees that "Signal is great," he believes that being completely decentralized and eliminating the need for a phone number tips the scales in Session's favor.

However, not everyone in the cybersecurity community shares this view.

A prominent cryptanalyst who uses the pseudonym Soatok has publicly argued against switching from Signal to Session. A major point of criticism is Session’s decision to remove Perfect Forward Secrecy (PFS) — an important security feature that ensures that past chats remain private even if a user’s long-term identity keys are compromised in the future. Soatok also suggested that Session contained several other cryptographic flaws and implementation mistakes.

Bill Budington, Senior Staff Technologist at the Electronic Frontier Foundation (EFF), backed Soatok’s analysis, telling TechRadar that Session appears to be another aspiring Signal competitor that "comes up lacking on its security claims."

Mohammed Al-Maskati, the Digital Security Helpline Director at Access Now, shared this concern. He argued that sticking with a widely implemented standard like the Signal Protocol is generally a safer option because it significantly reduces the risk of making critical errors during development.

Responding to these critics, McCabe explained that while Session initially relied on the Signal Protocol, the team was forced to build its own encryption method because Signal's architecture wasn't designed to handle a decentralized node network.

However, he confirmed that PFS is officially slated to be reintegrated into the platform with the upcoming Session Protocol V2 upgrade.

Security experts have also pointed out that Signal remains a stronger choice for most users due to the sheer size of its network, which makes it far easier to use with friends and contacts.

However, McCabe rejects the idea that popularity equates to security, arguing that by that logic, WhatsApp would be considered a better privacy option than Signal. "Which it is not," he said.

What’s next for Session?

As Session prepares to enter its next phase, the foundation is focused on achieving long-term financial sustainability.

To generate steady revenue, the platform plans to launch a premium subscription tier called Session Pro. Similar to Telegram Premium, Session Pro will offer power users advanced features — such as higher message character limits, expanded group sizes, more pinned chats, and animated profile pictures — backed by cryptographic proofs that preserve user anonymity during payment.

Most pressing, however, is finalizing Session's Protocol V2. Beyond reintroducing Perfect Forward Secrecy (PFS), it will also introduce post-quantum cryptography to secure users' chats against 'harvest now, decrypt later' threats.

While the wider InfoSec community continues to be divided on whether Session's custom architecture outperforms legacy rivals, the core team remains fiercely dedicated to the project.

"Many former team members are incredibly passionate and are taking pay cuts or donating their time to help get it back together," said McCabe.

And with mandatory age verification, lawful access to data, and encryption backdoors challenging the very notion of online privacy globally, it seems that messaging app like Session are going to become increasingly important.

As McCabe puts it: "People often don't realize they need this level of privacy until things go really badly and freedom of speech is restricted."

If you want to support the platform, Session continues to accept donations directly through its official website and mobile application.

• Broadcasters in France, Spain have submitted a formal complaint to FIFA
• Rightsholders labeled the partnership with ExpressVPN as "disastrous"
• ExpressVPN previously refused to implement sweeping anti-piracy blocking

FIFA’s decision to partner with ExpressVPN for the 2026 World Cup has sparked outrage among top European football broadcasters.

La Liga and French media giants, including LFP Media and Canal+, have formally submitted a complaint to football's governing body, slamming the new sponsorship as a "disastrous" message to the football ecosystem, according to reports from French sports newspaper L'Equipe.

"La Liga believes that this agreement is manifestly incompatible with the principles of protecting football's audiovisual rights that should govern the actions of world football's governing body," said La Liga president Javier Tebas.

Rightsholders are furious that FIFA would accept sponsorship money from a company they previously targeted with lawsuits for "facilitating access to pirated content," Tebas added.

In a statement to TechRadar, a spokesperson for ExpressVPN strongly denies such allegations.

"Any suggestion that ExpressVPN has been 'found guilty' of facilitating piracy is entirely inaccurate; we have not been convicted of any such conduct in any jurisdiction," the company told us.

While reiterating that a virtual private network (VPN) is a privacy and security tool — "not a loophole for illegal activities" — ExpressVPN also argues it has already presented a framework to national and EU authorithies to tackle the illegal distribution of copyrighted content, without breaking its no-logs VPN commitment.

For everyday football fans and privacy advocates, this corporate clash highlights the growing tension between rightsholders wanting total control over internet traffic and privacy companies defending open, unrestricted access.

If you are looking to secure your digital footprint, utilizing the best VPN is essential to bypassing unfair network restrictions and ensuring your online activity isn't monitored by your internet service provider (ISP) or third-party organizations.

A clash of privacy and anti-piracy

In France, organizations like the Association for the Protection of Sports Programs (APPS) have aggressively pursued court orders forcing ISPs and tech companies to block access to pirated streams.

ExpressVPN has historically resisted these demands, refusing to implement network-wide blocks. This staunch defense of an open internet led to the VPN provider being formally condemned in the country, making FIFA's sponsorship announcement a bitter pill for French broadcasters to swallow.

The situation has escalated similarly in Spain, where La Liga's president has spearheaded a controversial crusade against illegal streaming. La Liga’s heavy-handed tactics have been heavily criticized by digital rights groups, especially after a recent anti-piracy campaign backfired spectacularly, wrongly blocking over 500,000 legitimate websites in Spain.

The Spanish league has also previously attempted to fine individual users and pressure tech platforms into handing over user data. With La Liga’s war on piracy breaking the internet in Spain, privacy experts have warned that your VPN could be the next target.

Despite the immense legal pressure and the latest formal complaint to FIFA, top VPN providers have consistently argued that enforcing rightsholder site-blocks fundamentally compromises the security and architecture of a privacy service.

In fact, NordVPN recently won a crucial legal battle in Spain over La Liga piracy fines, establishing a major victory for user privacy against copyright holders.

Meanwhile, the climate in France remains incredibly hostile for privacy tools.

Earlier this year, a French court backed the LFP and ordered top VPNs to block illegal football streams. This sweeping injunction set a dangerous precedent, forcing the VPN industry to react to France’s aggressive order to block illegal streaming sites and defend the technical realities of zero-logs infrastructure.

• Russia’s Digital Development Ministry confirmed it has completely dropped its plan to charge users for international internet traffic.
• The proposal initially aimed to charge users roughly 150 rubles per extra gigabyte after a 15GB monthly allowance.
• Demand for censorship circumvention tools remains at an all-time high as the Kremlin continues its broader crackdown on digital privacy.

Internet users in Russia can breathe a sigh of relief as the government has abandoned its controversial plan to tax international mobile traffic.

The proposal, which heavily targeted those using the best VPN services to bypass state censorship, would have forced residents to pay steep premiums to access a free and open internet.

The policy reversal was confirmed during a recent State Duma session by Deputy Minister of Digital Development, Ivan Lebedev.

Responding to parliamentary questions about the initiative from Communist Party lawmaker Oleg Smolin, Lebedev categorically stated: “Fees for foreign traffic are not being considered”, according to reports from Meduza.io.

First introduced during a late March meeting between Digital Development Minister Maksut Shadayev and domestic telecom operators, the plan aimed to hit privacy-conscious users' wallets.

Because Russian carriers inherently classify VPN data routing as international traffic, the government intended to implement a strict 15-gigabyte monthly cap. According to initial reports from the BBC’s Russian service, authorities intended to charge users roughly 150 rubles for every additional gigabyte consumed beyond that limit.

The sudden U-turn comes after months of ongoing logistical hurdles and industry pushback. The tax was initially scheduled to take effect on May 1, but was subsequently postponed to June 1 after the Russian business daily Vedomosti reported that carriers were not ready to configure their billing systems.

The deadline was later pushed again to "closer to fall" or after the September elections, before finally being scrapped altogether.

As previously reported by TechRadar, an inside source confirmed that Russia's internet regulator, Roskomnadzor, lacks the technical abilities to effectively prevent residents from using VPNs at scale.

A temporary victory in a wider digital crackdown

While the scrapped tax is a definitive win for privacy advocates, it remains just one battle in an increasingly hostile digital war.

Russian demand for circumvention tools has surged dramatically following the state-ordered blocking of major global platforms, including YouTube, Facebook, Instagram, WhatsApp, and Telegram.

Without a VPN, everyday citizens are largely cut off from independent news sources and international social networks.

Rather than relying purely on financial deterrents, the Kremlin has steadily escalated its technical and legislative attacks to plug the gaps.

By mid-April, authorities successfully pressured major domestic internet platforms to comply with new regulations, actively restricting users from accessing their sites and apps while a VPN was enabled.

Cybersecurity experts have also repeatedly warned of more drastic state-led interventions aimed at entirely isolating the country's internet infrastructure from the rest of the world.

For now, millions of citizens continue to rely on robust privacy tools to navigate the web safely and maintain digital contact with the outside world. If you find yourself dealing with this restrictive landscape, learning exactly how to survive Russia's VPN crackdown is more crucial than ever.

• New Zealand's Education Minister denies any plans to restrict or ban VPNs
• Reports previously alleged it was part of the teen social media ban package
• Prime Minister Christopher Luxon also confirmed "no plan to ban VPNs"

The New Zealand government has officially denied any plans to restrict or ban VPN apps as part of its upcoming under-16 social media ban, putting an end to intense speculation and a rapid backlash from digital privacy advocates.

The saga began following a report from The Post that Education Minister Erica Stanford said the government was considering any restrictions on VPNs as part of the country's under-16 social media ban.

Because a Virtual Private Network (VPN) can easily spoof a user's location and bypass local network blocks, the technology was viewed by some officials as a potential roadblock to enforcing age verification mandates.

New Zealand VPN ban's privacy backlash

The notion of banning vital encryption software sparked immediate political and public pushback. Coalition partners quickly distanced themselves from the idea, with the ACT party reportedly marking any anti-encryption measures as a strict red line — The Post reported.

The Free Speech Union also lambasted the concept. Critics warned that a VPN ban would undermine digital free speech and put New Zealand in the same category as oppressive regimes that strictly control internet access.

“The Government wants the power to prohibit technologies New Zealanders use every day, because those technologies make it harder for the state to control what we see and say online. That is not child protection, it is censorship infrastructure," the organisation said in a statement.

Following the uproar, the government changed its tune.

In a recent media stand-up, Prime Minister Christopher Luxon put the rumors firmly to rest. "I can reject that outright. There's no plan to ban VPNs at all," Luxon said. "I don't know where that reporting or where that story came from, but I can reassure you that's not the case".

Shortly after the Prime Minister's remarks, Stanford’s office officially clarified its position, stating that the Government is "not looking at restricting or banning VPNs". For anyone relying on the best VPN to secure their personal data, the rapid reversal is a significant victory.

Circumvention tool or essential security?

The brief controversy in New Zealand highlights a growing global debate surrounding age verification laws and privacy tools. As governments worldwide attempt to regulate how minors interact with the internet, VPNs have increasingly found themselves in the crosshairs of lawmakers seeking foolproof ways to enforce their legislation.

Because a VPN encrypts your internet connection and masks your IP address, it is commonly used to bypass geo-blocks and content filters. This makes it an obvious workaround for teenagers looking to dodge age gates.

However, treating VPNs purely as circumvention software fundamentally misrepresents what they do. They are essential security tools used by millions of businesses, journalists, and everyday citizens to protect sensitive data from hackers, intrusive ISPs, and mass surveillance.

New Zealand’s flirtation with anti-VPN measures mirrors the shifting role of VPNs in the UK. This friction is also visible in Europe. The EU recently signaled that VPNs could be targeted next to prevent users from bypassing local rules.

The reality is that age verification has changed the internet, and authorities are desperately searching for ways to enforce digital borders. Yet, as Australia's social media ban shows, heavy-handed child safety measures are incredibly difficult to implement — with or without a VPN.

Ultimately, lawmakers must strike a delicate balance. Enforcing a social media ban should never come at the cost of weakening the cybersecurity infrastructure that protects the wider population.

The question remains: could the UK’s social media ban, or New Zealand's, lead to real VPN restrictions? For now, at least in New Zealand, the answer is a resounding no.

• Proton VPN added 89 new Brazilian servers to combat network congestion
• This follows intense World Cup streaming traffic that flooded its servers
• Football fans globally are using VPNs to watch matches on CazeTV

Proton VPN has been forced to drastically expand its South American infrastructure, deploying 89 new servers in Brazil over a single week to combat massive network congestion caused by 2026 World Cup streaming.

The Swiss-based privacy provider confirmed the rapid rollout after its existing Brazilian servers struggled under the immense weight of international fans bypassing geo-restrictions to stream the tournament. The massive influx of traffic specifically spiked during the Brazilian national team's matches, grinding connections to a halt for some users.

According to Proton VPN, the culprit is the immense popularity of CazeTV, a Brazilian YouTube channel showing the entire tournament for free. Savvy football fans are utilizing the best VPN services to route their internet traffic through Brazil, unlocking the geo-blocked broadcast.

The sudden demand forced the company’s engineering team to take drastic action ahead of the heavily anticipated Brazil vs. Norway fixture, working overnight to ensure their network could handle the load.

"Please don't break these too"

The sheer scale of the server upgrade highlights just how much bandwidth live 4K streaming demands.

General Manager at Proton VPN, David Peterson, confirmed the emergency rollout in a post on X (translated from Portuguese): "Fans, you can rest easy: the ProtonVPN infrastructure team pulled an all-nighter reinforcing servers in Brazil. That's +59, on top of the 30 already added this week."

Peterson assured users that the network was now ready, adding: "To watch Brazil vs. Norway today via Proton VPN, just connect and cheer."

The official Proton VPN account also took to X to address the unprecedented traffic surges directly.

"Every time Brazil plays, our 🇧🇷 servers get flooded," the company stated. "We assume Brazilians abroad are connecting to our Brazil servers to watch the World Cup for free on the CazéTV YouTube channel. We've added a bunch more servers to help with that. Please don't break these too."

How CazeTV is driving the VPN boom

If you are already using a VPN to tune in to the World Cup, Proton VPN’s swift infrastructure upgrade is excellent news.

Adding extra servers directly increases the overall bandwidth available in the region. This reduces the load on individual servers, meaning your connection is much less likely to stutter just as your team lines up to take a crucial penalty.

For those who want to try the workaround themselves, the setup process remains incredibly simple. You can read our full guide on how to watch CazeTV from outside Brazil with a VPN for step-by-step instructions.

Just remember that streaming 4K video requires strong, consistent speeds. Furthermore, most free VPN plans restrict access to South American servers, so you will likely need a premium subscription to reliably grab a virtual seat in the stadium.

• Amnezia VPN has restored its Premium service in Russia
• Amnezia Free is expected return in the coming weeks
• Roskomnadzor blocked over 90% of its local servers between June 1 and 15

Russian privacy provider Amnezia VPN has successfully restored its Premium service for users in the country, after suffering an unprecedented state-backed infrastructure strike.

Between June 1 and June 15, millions of Amnezia users in Russia lost their connection after the state censor, Roskomnadzor (RKN), launched a multi-pronged offensive that blocked over 90% of the provider's local servers.

The strike represents a dramatic escalation in Moscow's digital crackdown, deploying automated network fingerprinting and targeted cyberattacks to actively hunt down VPN infrastructure.

While the Premium tier is now back online with a newly updated, stealthier protocol, Amnezia has confirmed that its Free tier's Russian service will return in the coming weeks.

For internet users trapped behind Russia's "sovereign internet" firewall, the stakes have never been higher. Identifying the best VPN has become a critical lifeline to the free web as the state dumps massive resources into its censorship machine.

A sophisticated, $898 million censorship machine

According to Amnezia’s incident analysis, Roskomnadzor has abandoned basic IP-blocking in favor of a highly automated, aggressive ruleset.

By analyzing network traffic, Russian authorities appear to have learned to identify the unique "network fingerprint" of specific VPN protocols — Amnezia's proprietary AmneziaWG protocol included.

Once RKN's internet censorship and filtering system (known as TSPU) detects this fingerprint, it automatically blacklists the server's IP address. During the June assault, Amnezia attempted to swap out its servers, only to see the fresh IP addresses blocked within hours.

This technological leap is heavily state-funded. Forbes Russia and Kommersant estimate nearly 60 billion roubles (770million) is being spent to strengthen the filtering system, while The Moscow Times projects a wider RKN budget allocation of 70billion roubles (898 million) between 2026 and 2028.

To compound the technical assault, RKN paired its deep packet inspection with traditional hacking tactics, launching active DDoS attacks on VPN services. This wave of attacks even targeted the Amnezia website, while deploying phishing schemes against the provider's staff.

Mazay Banzaev, founder of Amnezia VPN, believes this escalation is proof that Roskomnadzor had been preparing a new set of rules for the TSPU for a long time, and fully applied them on June 1. He now expects these measures to be extended to other services operating in Russia.

"Such practices have been used in other countries too, Iran and China, for example, but in Russia they have been taken to a new level of automation: on average, a server is blocked within a few hours of users beginning to connect to it," said Banzaev.

Bouncing back with better security

Despite the severity of the attack, Amnezia confirmed that no infrastructure was breached and user data remained secure, crediting regular security audits by independent cybersecurity firm 7ASecurity.

To bypass the new TSPU ruleset, Amnezia has dropped a new version of its AmneziaWG protocol. This update strips out the fingerprint that allowed censors to identify the VPN traffic in the first place. Users must update their AmneziaVPN client to restore their connection, as the provider has intentionally disabled older, vulnerable versions of the app to prevent repeat attacks.

To make up for the downtime, Amnezia is also compensating affected users. Premium subscribers on a 6-month plan will receive one extra month of service, while those on 12-month plans will receive two additional months.

The provider now has its sights set on future expansion, noting that interest in circumventing state censorship continues to surge globally. Amnezia plans to expand its network to 100 locations while developing new, open-source methods to outsmart the censors.

Are you a Google user living in the European Economic Area (EEA), the UK, or Switzerland? If so, you have probably received a message from the tech giant informing you that it will soon start using your IP address for advertising measurement purposes.

Google has so far only used IP addresses to route traffic and display adverts in these regions. However, as reported by Bleeping Computer, from 4 August, it will allow third parties to show you more personalised adverts by tracking your activity via your IP address.

The move raises questions about compliance with the GDPR in the EU and UK, which classifies IP addresses as personal data. Under current regulations, companies must obtain users’ consent before tracking IP addresses for the purpose of personalising adverts.

Indeed, the tracking of IP addresses in the EU is regarded as 'fingerprinting' — an invasive profiling practice that tracks an individual and their devices to link their digital activities. IP addresses can help identify your device, making it much easier for third parties to build a profile and bombard you with targeted ads while potentially exposing your data to hackers.

Google has stated that it is now shifting the burden of complying with the regulations in these regions onto advertisers, reminding them to adhere to its EU User Consent Policy and to obtain valid consent from users in the regions concerned, thereby placing much of the responsibility for managing and tracking IP addresses directly on these companies.

The days when the tech giant promoted a privacy-friendly digital environment now seem a distant memory. However, the best VPNs can help you retain control over your IP address.

What Google’s IP-tracking means for your privacy

Google's new initiative could mark a significant turning point in terms of consent. Above all, it involves the creation of persistent profiles based on users' activities.

By placing the responsibility for obtaining consent on advertisers, while at the same time making it impossible for users to delete their own 'digital footprint' themselves, the Big Tech giant heavily impacts users’ online privacy.

Additionally, advertisers may implement consent banners in ways that are unclear or designed to encourage users to click 'accept', leading regulators to question whether the new system truly respects users' choices.

Although users might soon be able to manage IP-based personalisation, current opt-out options are limited to existing cookies and ad personalisation settings — meaning that, at present, users have little control over this new form of profiling.

It is particularly clarifying that Google itself was previously against the move, having completely U-turned from 2019, when it recognised fingerprinting as 'wrong', claiming it undermines users’ freedom of choice.

However, in 2024, the platform backtracked on its pro-privacy stance and lifted the ban on advertisers' use of fingerprinting, almost immediately raising concerns at the UK's Information Commissioner's Office (ICO), which described the reversal as 'irresponsible'.

Awkwardly for Google, new developments come just one month after the ICO published its 2026 guidance, where it reiterated that tracking a person's digital activity across different websites to build a behavioural profile will continue to require users' explicit consent.

How can a VPN help?

A virtual private network (VPN) gives you control back over these issues, as it spoofs users' IP addresses to minimise tracking — routing your traffic through remote servers and fooling websites you visit into thinking you’re somewhere else.

Leading providers, including NordVPN, Surfshark and Proton VPN, offer services such as ThreatProtection, CleanWeb and NetShield, which provide both shared and dedicated, static IP addresses, as well as blocking trackers, reducing cookie pop-ups and using alternative IDs, making IP-based identification harder.

A handful of secure free VPNs, including ProtonVPN Free, Windscribe Free, and Privado VPN Free, are also worth the game. However, these solutions usually have limitations, often a limited number of servers, which can slow down connection speeds and cause traffic congestion.

In recent years, some top VPNs have also integrated anti-fingerprinting technologies. Windscribe, for example, has added such a feature on its Chrome and Edge browser extensions, while Mullvad VPN developed the Mullvad browser with fingerprinting resistance.

Finally, using a privacy-first browser like Mozilla Firefox, which incorporates an ad-blocker, free proxy, and fingerprinting protections, will help minimise IP-tracking for ad personalisation, making unpleasant ads a distant memory.

• US football fans turned to VPNs to avoid hydration break ads
• Planet VPN saw a 57 per cent surge on the first day of the World Cup
• A VPN lets you access international coverage of games

VPN downloads in the US have surged as football fans seek ways to enjoy the World Cup without being interrupted by 'hydration break' ads, according to the latest data from Planet VPN.

Introduced this year by FIFA, hydration breaks have significantly altered the football tournament's viewing experience, with fans around the world complaining online that the interruptions are heavily disrupting the momentum during matches.

But whilst in the UK broadcasters use these minutes to provide tactical analysis of the games or to show players taking a breather, in the US viewers are forced to sit through minutes of non-stop adverts.

Desperate to have a smoother experience, Americans have massively turned to the best VPN apps to watch international live broadcasts instead.

Nobody likes ads

Planet VPN recorded a staggering 57% spike in downloads just on the opening day of the tournament. Its new users on iOS almost doubled, while premium subscriptions in the US more than tripled since the tournament began.

Perhaps unsurprisingly, downloads peaked at +343% on 19 June —precisely the same day as the match between the US and Australia.

For Konstantin Levinzon, co-founder of Planet VPN, it is obvious that football fans are turning away from Fox’s lengthy ad breaks to tune in to international broadcasters, where interruptions are filled by experts such as Roy Keane and Wayne Rooney.

It is a huge business for US television: according to a recent BBC report, these adverts could generate over £189 million. However, fans seem to hate them, especially when broadcasters interrupt the live coverage for ads — and only return after the match has started, as Fox did during the opening match between Mexico and South Africa.

Needless to say, a virtual private network (VPN) is a huge asset in such situations. It allows you to route your internet traffic through servers located all over the world to bypass geographical restrictions that would otherwise prevent you from accessing local streaming platforms.

This way, no matter where you are, you can access your preferred coverage and watch ad-free content on BBC iPlayer and ITVX in the UK, SBS on Demand in Australia, or RTE Player in Ireland — streaming football exactly as if you were in a London or Dublin pub.

And let’s not forget that VPNs encrypt your browsing data and protect it from cybercriminals. Levinzon reminds users to choose a VPN by taking certain specific features into account: "We always recommend choosing a VPN provider that doesn't track users without consent or keep logs of their activity, sticking to trusted, legal streaming services to keep your data secure."

The perfect World Cup ally

VPNs are the perfect companion for the World Cup. In the US, for example, where most games sit behind a paywall, VPNs enable viewers to virtually ‘travel’ to other countries where the same matches are free to watch.

Additionally, streaming demand places high strain on servers during major matches, when millions of fans log in at the same time, causing ISP peering issues, network congestion, and mid-match buffering. If you use a VPN, you are basically leaving the ‘data traffic jam’ everyone else is stuck in for a smoother experience.

Furthermore, VPN speeds are further optimised via modern protocols such as WireGuard, while additionally offering a wide range of traffic routing and speed optimisation features.

The icing on the cake? You can access commentaries from all over the world — from Brazil to Turkey to India. Their locations will affect their perspective and focus, hopefully making your experience even richer.

• Malaysia beefs up action against VPN used to facilitate crimes
• Misuse includes bypassing the new under-16 social media ban
• Officials have stressed that owning or using a VPN is not an offence

Malaysia is set to take action if VPN are used to facilitate criminal activities or help residents bypass the new social media age limit.

According to local reports, Deputy Home Minister Datuk Seri Dr Shamsul Anuar Nasarah said the government is working closely with the Malaysian Communications and Multimedia Commission (MCMC) to counter VPNs and borrowed identities that are being used to slip past newly enforced social media age limits.

For the many people who reach for the best VPN services to protect their browsing, encrypt their traffic, or simply keep their data out of advertisers' hands, the reassuring takeaway is that the tool itself is not the target. What the authorities want to reach is the small share of activity where a VPN is used as a shield for something illegal.

What Malaysia actually announced

The comments came during a question-and-answer session on cybercrime and age verification. Shamsul Anuar explained that police would draw on public complaints and their own investigations to identify cases where VPNs or identity-masking tools are being abused, and that such misuse could be treated as an added element of an offence.

He was clear that the crackdown is aimed at conduct, not software. The minister framed the effort as part of Malaysia's wider push to protect children online, pointing to a sharp rise in offences.

This sits on top of Malaysia's under-16 social media ban, which took effect on 1 June 2026 under the Online Safety Act 2025. Large platforms including Facebook, Instagram, TikTok, and YouTube must now verify users' ages and block under-16s from registering, with non-compliance carrying penalties reported at up to RM10 million.

VPNs enter the picture because they are an obvious way to make it look as though a user is somewhere the rules do not apply. Age verification laws elsewhere, such as Australia and the UK, have repeatedly triggered spikes in VPN sign-ups, with many often being adults looking to protect the sensitive documents these systems ask them to hand over.

What it means for everyday VPN users

For most people, this is not a reason to stop using a VPN, and it is not a ban in disguise.

Digital rights groups, however, have been sharply critical of the age-verification model underpinning the ban.

ARTICLE 19, alongside local partners, has argued the measure was rushed, is disproportionate, and risks normalising surveillance while exposing people's identity documents and biometric data to misuse.

• Proton, Windscribe, and PureVPN launched a satirical campaign to make fun of the gaming sector's digital shift
• PlayStation said it will stop releasing games on discs in 2028
• The satirical stunt highlights growing consumer concerns about digital ownership, server shutdowns, and game preservation

The ongoing debate over digital ownership in the gaming industry, which follows Sony's announcement to stop releasing PlayStation games on discs by 2028, has found an unlikely group of critics in VPN firms.

In a coordinated display of industry satire, several of the market's best VPN providers have begun openly trolling the gaming sector's controversial shift away from physical media.

Leading the charge is Swiss privacy company Proton, which first released a parody announcement on Thursday declaring that "in response to the gaming industry removing physical offerings moving forward, we've decided to fill in the gap by making our services entirely physical, starting 1st April 2027."

The stunt took direct aim at the frustrations gamers face as digital storefronts increasingly replace physical discs.

Rival providers quickly jumped on the bandwagon. Both Windscribe and PureVPN also took to X to join the trend, adding their own satirical jabs at the gaming industry's expense.

Earlier this week, Windscribe sparked a different conversation online when it parodied Mullvad's recent political donation crisis.

Encrypted letters and human password managers

Proton's fake announcement outlined a hilarious reverse-digitalization strategy, presenting the idea of making completely physical versions of inherently digital services.

According to the satirical campaign, Proton Mail will soon post "encrypted letters hand-delivered by team," while its passcode service will be replaced by "someone who follows you around and remembers your passwords for you."

The jokes extended to the company's flagship networking and storage products. Proton VPN humorously claimed it would send its clients to one of their 90 plus server locations so they could browse online "like a local." Meanwhile, Proton Drive users were promised a folder would be shipped to them with "an additional folder available on request".

Artificial intelligence wasn't spared from the joke, either. The company announced its AI assistant, Lumo, would become an actual "smart" employee sent to a user's location to "answer questions, help with work, and draw things."

Even David Peterson, Proton VPN General Manager, joined in the fun and said that "using the Secure Core option to fly you via Iceland is the most private option, but may cause some latency."

While Proton has no intention of substituting its digital services for physical ones, the broader message resonated strongly with the gaming community.

A joke with a serious message for gamers

Behind the coordinated trolling from Proton, Windscribe, and PureVPN lies a genuine consumer rights issue. The gaming industry has aggressively pivoted toward digital storefronts and subscription models, leaving players increasingly concerned that purchasing digital titles merely grants a license for using games, not owning them.

The problem of game preservation has become a hot-button topic. As noted by the campaign's underlying message, there is a very real danger that digital games could become permanently unavailable in the case of "server shutdowns, changes in licensing agreements, or the publisher removing their products from online stores."

Physical media, while fading from retail shelves, offer tangible, long-term ownership, a stark contrast to the volatile nature of digital libraries. Many players argue that physical copies provide much stronger consumer protections.

By playing on the irony of current digitalization trends, Proton and its peers successfully weaponized satire to champion consumer rights.

The campaign aligned perfectly with the VPN companies' overarching aim of protecting users' privacy and giving them more freedom regarding their personal data. Ultimately, it proves that these privacy giants aren't afraid to have a little fun while sparking a crucial conversation around digital ownership.

• India is reportedly working on new VPN regulations
• Companies could be forced to establish an office in the country
• VPNs found workaround to previous restrictions

India is working on an expansive new legal framework to clamp down on virtual private networks (VPNs), with proposals reportedly including mandatory local offices, designated compliance officers, and even prison terms for non-compliance.

According to The Indian Express, the upcoming rules aim to make VPN providers legally liable when citizens use their tools to circumvent government-mandated content blocks.

"In the last few months, we have been observing that users are able to bypass content, accounts, and online services that have been blocked by the government on various grounds by using VPN services," an anonymous senior government official told reporters.

This new set of rules is also seen as necessary, officials admitted, as the controversial data retention law enforced in 2022 by the Indian Computer Emergency Response Team (CERT-In) has proved to be unsuccessful.

The directive legally requires VPN firms, data centers, and cloud providers to log sensitive user information — including real names, verified IP addresses, and usage patterns — for up to five years, and surrender it to authorities upon request.

Yet, major VPN companies, including the likes of ExpressVPN, NordVPN, Hide.me, Surfshark, and Proton VPN, found a simple way to avoid compliance — removing their physical servers from the country.

"They have simply refused to comply. So, the need for a full-fledged law is being felt," the senior official told The Indian Express.

What's at stake for India's VPN users?

Beyond encrypting user data to boost privacy and security, virtual private networks (VPNs) spoof IP addresses, allowing users to bypass local, state-enforced geo-restrictions.

This capability has become critical for local internet users. Last month, India experienced a massive spike in VPN downloads after the government temporarily blocked the messaging app Telegram due to concerns over exam fraud.

Just weeks earlier, the Ministry of Electronics and Information Technology (MeitY) ordered VPN firms to actively block access to the decentralized prediction platform Polymarket, threatening legal repercussions if they refused.

The proposed framework aims to hand New Delhi the necessary legal teeth to force VPN providers into enforcing these content bans on the government's behalf. Digital rights groups frequently criticize India's aggressive approach to censorship; according to data trackers, the country consistently leads the world in government-imposed internet shutdowns.

While specific details of the draft framework remain scarce, leaked proposals suggest that offshore VPN companies will be required to establish a physical corporate presence in India and appoint local compliance officers to act as direct government liaisons.

Criminal penalties for non-compliance are also on the table, including potential prison sentences for local employees if an order is ignored.

However, serious questions remain over how authorities plan to enforce these rules. For many global VPN providers, simply keeping their physical servers outside of Indian borders has previously been enough to circumvent local jurisdiction.

It is also unlikely that premium, strict no-logs services will fundamentally alter their server infrastructure to comply with New Delhi's demands — especially after resisting a similar ultimatum four years ago.

Dr. Pete Membrey, Chief Research Officer at ExpressVPN, pointed back to the company's 2022 decision to become the first major provider to pull its physical servers from India, confirming that its stance remains.

"We’ll evaluate when a proposal is published," Membrey told TechRadar, adding that "ExpressVPN will continue to work hard to keep users connected to the open and free internet, no matter where they are located."

A Surfshark spokesperson also said that the company remains committed to upholding the privacy of its users.

TechRadar reached out to India's Ministry of Electronics and Information Technology (MeitY) and CERT-In for further clarification on the draft framework and an expected enforcement timeline. Neither agency responded prior to publication.

• Brazilian YouTube channel CazéTV hit a record 12.4 million concurrent viewers by streaming the World Cup for free in 4K
• Fans use VPNs to bypass local paywalls and access the legal broadcast
• While the Portuguese commentary limits global appeal, fans can still use a VPN to find other free international streams

The 2026 World Cup is in full swing, and millions of football fans have found a new, entirely legal way to dodge expensive broadcaster paywalls: YouTube.

Viewers across the globe are turning on the best VPN to access CazéTV, a Brazilian YouTube channel that is currently streaming all 104 matches of the tournament for free in gorgeous 4K.

Run by 32-year-old Casimiro Miguel, a streamer who originally started on Twitch, CazéTV has become the breakout broadcast story of the tournament. During Brazil's opening game, the channel peaked at an astonishing 12.4 million concurrent viewers. This shattered records, becoming the largest live audience in YouTube's history and marking the first time a solo streamer channel has crossed the 10 million mark.

The global appetite for this high-quality, cost-free feed is staggering. With the stream geographically licensed only to Brazil, international fans are masking their IP addresses to get in on the action.

The YouTube revolution vs traditional paywalls

For years, major rights-holders have argued that steep paywalls are the only viable way to fund live sports. CazéTV, which fun fact, counts football legend Cristiano Ronaldo as a stakeholder, is a direct challenge to that outdated model. While Brazil's longtime broadcast giant, Globo, carries just 55 matches, CazéTV is legally broadcasting the entire tournament without asking fans for a dime.

Yegor Sak, founder of VPN provider Windscribe, notes that this unprecedented surge reflects years of consumer frustration.

"One channel on YouTube is out-broadcasting the official rights-holders, in 4K, for free, and pulling the biggest live audience the platform has ever seen," Sak said. "The paid broadcasters should find that alarming. Fans know exactly what they want, and it isn't another paywall."

Because broadcast rights are sold country by country, fans are often forced to pay premium subscriptions to watch their national teams. However, tuning into a foreign YouTube channel via a VPN is not piracy; it is simply consumers seeking out the best legal value.

"The barrier was always artificial," Sak added. "CazéTV just proved the appetite was there the whole time."

Language barriers and global alternatives

"People aren't trying to do anything wrong, they're looking for value," Sak explained. "When a free, legal, high-quality stream exists and your local broadcaster wants money on top of a subscription you already pay for, the choice makes itself."

However, there is a catch for international audiences. Because CazéTV is a Brazilian broadcast, all commentary is in Portuguese. While the stunning 4K visuals are universally understood, the language barrier does somewhat limit the stream's ultimate 'global' appeal for those who want tactical analysis in their native tongue.

Interestingly, other FIFA partners do have agreements in place that give them the option to show full matches on YouTube and strengthen coverage, but major networks have largely neglected this route, likely because it doesn't align with their subscription-heavy financial models.

If Portuguese commentary isn't for you, there are still plenty of ways to bypass the paywall. If you're wondering should I use a VPN to watch the World Cup, the answer is a resounding yes. By routing your connection through servers in countries like the UK or Australia, you can easily access free, English-language broadcasts on platforms like BBC iPlayer or SBS.

Just remember that if you are streaming on the go, it is worth tweaking these 5 VPN settings to keep your connection fast so you don't suffer buffering during a crucial penalty shootout. With a reliable provider, you can watch the World Cup 2026 for free from anywhere, entirely on your own terms.

• Spain's LaLiga anti-piracy blocks disrupted at least 554,507 legitimate domains between January and June 2026, OONI reveals
• Blocking just 4 to 20 IP addresses during a one-hour match window knocked out over 400,000 unrelated websites
• Researchers also uncovered alarming TLS Man-in-the-Middle (MitM) interception tactics on one Spanish ISP

Football fans in Spain aren't the only ones feeling the impact of LaLiga's aggressive war on illegal streaming. A staggering new report shows that the league's court-authorized anti-piracy campaign has accidentally disrupted access to more than 500,000 legitimate websites, taking down everything from human rights platforms to vital cloud infrastructure.

According to a June 2026 report published by the Open Observatory of Network Interference (OONI), Spain's IP-based blocking campaign caused widespread collateral damage between January and June 2026.

The nonprofit organization, which specializes in measuring global internet censorship, found that at least 5.8% of the 9.2 million most popular internet domains were blocked at least once during football match broadcasts.

The sheer scale of this collateral damage highlights a fundamental flaw in current anti-piracy tactics. Because much of the modern web relies on shared hosting and content delivery networks (CDNs), attempting to block a single illegal stream by banning its IP address often drags hundreds of thousands of innocent websites down with it.

If you want to bypass these broad regional blocks, using the best VPNs is increasingly becoming a necessity for Spanish internet users trying to maintain access to the open web.

The collateral damage of La Liga's anti-piracy blocking

The collateral damage stems directly from how the internet is built. Providers like Cloudflare, Amazon, Microsoft, and Meta use shared reverse-proxy architectures, meaning thousands of entirely unrelated domains sit behind a single IP address.

OONI’s data shows that blocking as few as four to 20 IP addresses in a typical one-hour LaLiga broadcast window was enough to make over 400,000 unique domains completely inaccessible.

Throughout the observation period, OONI discovered the enforcement impacted 7,441 unique IP addresses across 36 infrastructure providers. Cloudflare bore the brunt of the outages, with the report identifying over 501,000 impacted domains hosted behind just 2,218 blocked IPs.

Among the collateral damage were benign and critically important websites, including those belonging to Amnesty International and Greenpeace.

Beyond the widespread outages, the anti-piracy tactics have introduced alarming security vulnerabilities.

OONI researchers noted in a post on X that they "detected TLS Man-in-the-Middle (MitM) attacks on Digi Mobil (AS57269), raising privacy and security concerns."

This privacy invasion affected 7,334 unique IPs hosting over 10,759 domain names, exposing Spanish users to potential data interception just to stop them from streaming football matches.

As we covered on Tuesday, there is growing pushback against these reckless enforcement measures. European ISP groups have strongly argued that rightsholders must be liable for collateral damage in piracy blocking, as erroneous court orders from rightsholders like LaLiga are repeatedly breaking the internet.

While OONI admits its methodology has limitations and likely understates the true scale of the impact, the findings paint a bleak picture of IP-based blocking. When taking down a handful of pirate streams knocks out half a million legitimate websites, the cure may very well be worse than the disease.

• Windscribe has released a satirical statement mocking Mullvad's PR crisis
• Mullvad's co-founder donated roughly $500,000 to Sweden's populist Örebro Party, sparking user backlash
• Mullvad confirmed the donation "is not part of Mullvad's values or mission"

Rival providers in the best VPN market rarely miss an opportunity to capitalize on a competitor's misstep, and the ongoing controversy surrounding Mullvad is no exception.

In a satirical response to the recent news that a Mullvad co-founder made a massive political donation, Windscribe has issued a mock apology regarding its own CEO’s financial contributions.

Earlier this week, it was revealed that Mullvad VPN co-founder Daniel Berntsson donated 5 million Swedish kronor (around $514,000) to the controversial populist Örebro Party in Sweden. Berntsson, who stated the donation was made personally to support the party's anti-corruption stance, contributed a sum that accounted for 72% of the party's total income last year.

The disclosure forced Mullvad into damage-control mode. The firm quickly clarified that the private donation "is not part of Mullvad's values or mission," and offered refunds to any users who wished to cancel their subscriptions over philosophical disagreements.

Seizing the moment, Windscribe posted its own tongue-in-cheek statement on social media, assuring users that it wanted to "get ahead of any potential public outcry". The company explained that it would be hypocritical to criticize Berntsson's financial support without disclosing that Windscribe CEO Yegor Sak has also made monetary donations to organizations supporting causes he believes in.

"Let us make one thing clear: we are not here to lie," the statement read. "Yes, our CEO has made donations to a specific side, but today we want to come clean and make things right."

The dogs versus cats debate

Rather than backing a divisive political movement, Windscribe revealed that Sak, the proud owner of a corgi named Snoop, had donated personal funds to Save Our Scruff, a dog rescue in Toronto.

Anticipating that a strict pro-dog stance could "cause division within our userbase", the company quickly added that it had corrected the imbalance.

"So today, we are making one thing clear — we support cats as well, and Yegor has personally donated to the local Annex Cat Rescue organization to support their work," the post noted.

While Windscribe’s parody is light-hearted, it underscores a serious point about brand identity in the cybersecurity industry. VPN users are notoriously privacy-conscious, and they often evaluate a provider's ethical compass just as rigorously as its encryption protocols.

When the executives behind a VPN support controversial causes, it can severely test user trust, regardless of the company's official stance or strict no-logs policies.

Windscribe concluded its post by mimicking the standard corporate PR playbook, asking users to forgive its "lack of transparency" in the pet debate. The company emphasized that Sak's donations are a reflection of his personal beliefs and will not impact the safety or operation of the software.

"Our service and applications are not affected by these donations," the statement concluded. "They remain secure and dedicated to providing our users with the best VPN on the market."

• Researchers found "VPN Go" extensions for Chrome and Firefox secretly harvesting copied text
• The clipboard theft was not there at launch and arrived through a later update
• Anything copied while the extension was active should now be treated as exposed

Security researchers at Socket found two browser extensions distributed under the "VPN Go: Free VPN" branding, one listed on the Chrome Web Store and one on Firefox Add-ons, to secretly harvest copied text.

Both present themselves as free VPN tools with working proxy features. Underneath, Socket says, both also run a clipboard stealer that continuously watches copied text and sends it to infrastructure controlled by the attacker.

According to Socket, the clipboard theft was not present when the extensions first appeared. It was added later, through an ordinary-looking update, after the extensions had already built up a base of trusting users. That staged approach is exactly what makes this kind of threat so hard to spot, and why even a fairly cautious user can end up exposed.

For anyone weighing up a no-cost privacy tool, it is worth knowing that not every free option behaves like this, and the best VPN services are tested precisely so you do not have to take this kind of gamble. But this case shows how thin the line can be between a useful free extension and a data-harvesting one.

What Socket's research uncovered

Socket says the earliest analyzed builds behaved like ordinary proxy extensions, with no confirmed clipboard theft.

On Chrome, that changed with version 1.1, when the extension added a script that reads the clipboard and ships those chunks off to a hardcoded address. The Firefox version followed the same path slightly later, moving the same theft loop into its background script.

Once active, the monitoring is relentless. The Chrome content script checks the clipboard roughly every half a second, according to Socket's analysis, while the Firefox build polls every 1.5 seconds.

Each newly copied value is tagged with a session identifier so it can be reassembled on the other end, then sent out over plain HTTP. All of this was happening while the two apps' privacy policies stated that the tools did not collect, store, or share user data and did not keep activity logs.

TechRadar has reached out to VPN Go for comment, but both email addresses bounced, and both extensions have since been pulled from their stores.

Why clipboard stealers are dangerous for users

The reason clipboard theft is so effective is that it abuses something completely routine. People copy and paste sensitive information all day, and it's not careless to do so. Password managers rely on exactly that: copying long, unique passwords into your accounts.

An extension that can silently read the clipboard has access to all of this information; it just has to wait for you to copy the right thing. If you have used either of the two extensions in question, you should treat any information you've copied during that time as exposed.

Researchers have repeatedly found free VPN extensions doing things their users never agreed to. Recent reporting has covered a free Chrome VPN extension caught taking screenshots of every page its users visited, and a malicious free VPN extension that resurfaced after being removed, returning in a more evasive form.

The pattern is consistent enough that it is worth treating any unknown free VPN extension with caution by default. That caution matters: TechRadar's own polling found that nearly 1 in 4 readers use free VPNs despite knowing the risks.

How to stay safe

If you want the protection a VPN offers without rolling the dice, stick to providers with a track record and independent testing behind them.

A reputable paid service, or one of the carefully vetted best free VPN options, is a far safer bet than an unknown extension promising unlimited access for nothing. As the saying goes, when the product is free, there is a decent chance that you are the product.

• European ISPs urge the EU to hold rightsholders financially liable for taking down innocent websites
• Aggressive anti-piracy blocking in Italy, Spain, France has caused widespread collateral damage
• EuroISPA warns that extending blocking orders to DNS and VPN providers is technically flawed and legally disproportionate

Aggressive site blocking by copyright holders is breaking the internet, and Europe's internet service providers (ISPs) want those rightsholders to foot the bill.

In a recent submission to the European Commission, EuroISPA, an umbrella group representing over 3,300 European ISPs, has strongly criticized the collateral damage caused by imprecise anti-piracy campaigns.

Grounded in research including an April 2026 study by the Centre for European Policy Studies (CEPS), the organization is officially demanding that copyright holders who cause excessive network outages be held accountable and pay for the resulting damages.

For the average user, this growing internet censorship means legitimate web services, educational sites, and cloud platforms are randomly going dark just to stop illegal sports streams. It's a blunt approach that is now threatening the global infrastructure of the web, including the best VPN services.

TechRadar has contacted EuroISPA for a comment on the specific collateral damage of targeting VPNs, and we will update this article if we receive a response.

The current situation in Europe

Over the last few years, major copyright holders like sports leagues have obtained sweeping court orders to block piracy sites using IP-level blocking. But because thousands of legitimate websites often share a single IP address, this method is causing chaos.

The collateral damage is already staggering. In Italy, the "Piracy Shield" system misfired so badly that an erroneous order took Google Drive offline for over 12 hours in October 2024.

We already reported how La Liga’s war on piracy is breaking the internet in Spain. Now, a June 2026 report by the Open Observatory of Network Interference (OONI) revealed that by blocking just a handful of shared IP addresses during match broadcasts, the league inadvertently took down human rights platforms, government domains, and environmental sites, impacting a total of over 500,000 domains.

Despite these massive disruptions, copyright holders face zero direct liability.

To fix this, the ISP group argued that rightsholders should be "held accountable for collateral damage caused by overbroad blocking actions."

According to EuroISPA, compensation mechanisms should be clearly defined and enforceable to ensure that "the burden of enforcement errors does not fall on innocent intermediaries and their users."

VPNs and DNS providers in the crosshairs

As traditional ISPs push back, rightsholders are shifting their aim to other internet infrastructure intermediaries, creating new legal headaches and a dangerous precedent for internet freedom.

In its submission to the European Commission, EuroISPA said to be "deeply concerned" by the approach taken in certain Member States. "Most notably Italy, Spain, France and Austria, where network blocking measures have escalated beyond local access providers to target global infrastructure providers with no direct relationship to the infringing content," the group wrote.

In France, a court backed the Professional Football League (LFP) in January and ordered top VPNs to block illegal football streams for the third time. At the same time, the MPA has pressed for VPNs to have a role in the anti-piracy row in Europe as well. And Italy also plans to require VPN and DNS providers to block pirated content.

However, VPNs and DNS resolvers lack the technical architecture to implement these hyper-local blocks safely. As EuroISPA noted in its submission, they "lack the technical means to apply geographically restricted blocks and are frequently neither based in nor subject to the jurisdiction of the issuing Member State."

Experts have repeatedly warned that DNS resolvers aren't a censorship tool, and that network blocking is never going to be the solution.

Ultimately, EuroISPA argues that "because the Internet is designed to be global and redundant, domain or IP blocking is inherently incomplete and prone to over-blocking."

Forcing rightsholders to pay for their mistakes might be the only way to protect the open internet.

• Mullvad VPN's co-founder Daniel Berntsson donated 5M SEK to the Örebro Party
• Mullvad confirms the donation "is not part of Mullvad's values or mission"
• Örebro party's leader, Markus Allard, is known for controversial views

Daniel Berntsson, co-founder and co-owner of Mullvad VPN, has donated 5 million Swedish kronor (around $514,000) of his personal funds to the controversial populist Örebro Party.

First reported by local news outlet Flamman, the 2025 donation accounted for 72% of the party's total income last year.

"This is a donation from me personally," Berntsson told reporters, saying that he supports the party's anti-corruption stance. In a post on social media, Mullvad confirmed that it was a "private donation," which "is not part of Mullvad's values or mission."

The disclosure has sparked backlash online, with some users threatening to switch VPN providers. The Örebro Party and its leader, Markus Allard, are known for controversial populist stances, particularly regarding "remigration" policies.

Mullvad's response

Speaking to TechRadar, Mullvad co-CEO Fredrik Strömberg confirmed that neither Mullvad VPN AB, its parent company Amagicom AB, nor its sister company Tillitis AB played any role in supporting the political party.

"Speaking for myself, I don’t like that he made this donation, and I know this view is shared by many of my colleagues. Speaking as the co-CEO of Mullvad, we will continue to protect the universal right to privacy," Strömberg said.

The firm also addressed the controversy publicly. In a statement posted to X, the team reiterated that Mullvad operates as a "political company" dedicated to fighting for freedom of speech, freedom of information, and the universal right to privacy.

"We also live these values by being tolerant in our daily work," the post continues. "No matter what their other opinions are and no matter whether the founders or anyone else in Mullvad dislike them. The founders themselves fundamentally disagree on several important issues."

Mullvad said it would "gladly refund" any customers who choose to cancel their subscriptions or switch to another provider due to philosophical disagreements.

The news has attracted criticism, in fact.

One Reddit user said they "deeply regret recommending Mullvad to people over Proton," adding that they will personally switch to Windscribe.

Asked about users thinking of dropping their Mullvad subscription, Strömberg told TechRadar that people should feel safe using Mullvad regardless of their political affiliation.

Why is the donation so controversial?

Defining itself outside the traditional left-right spectrum, the Örebro Party began as a local party in Örebro before launching its parliamentary election campaign this year.

Berntsson's donation appears to have been vital in elevating the party's campaign capabilities ahead of the upcoming election.

According to data collected by DonationWatch, 2025 was the most lucrative year in the party’s history, netting a total of 5.58 million SEK. For comparison, the party received just 202,000 SEK in total donations throughout 2024.

While tech founders are entirely free to hold personal political affiliations, this incident raises broader questions regarding the growing influence of tech wealth in political campaigns. It also forces a conversation about whether privacy-focused firms should be entangled with political groups—regardless of where they sit on the ideological spectrum.

Ultimately, the number of users who choose to cancel their Mullvad subscriptions in protest will serve as a strong indicator of how deeply the privacy-conscious community values neutrality.

• NordVPN discovered adware campaign operating across 50,000 websites
• The malware collects highly specific device data to profile and track you
• The adware can detect and bypass ad blockers with domains that change daily

Who doesn't love a free movie? Unfortunately, a recently uncovered cyber threat is proving the old adage true: if the product is free, you are the product. NordVPN’s Threat Intelligence team has exposed a highly sophisticated adware campaign that has successfully infected at least 50,000 active websites, turning the hunt for free content into a cybersecurity minefield.

The campaign is specifically targeting high-risk corners of the internet, including illegal streaming platforms, torrent portals, underground forums, and adult websites.

Once a user lands on an infected page, the adware — a type of malware that hides behind online ads — deploys invasive tracking scripts to build a persistent profile of the user's device, harvesting data that ranges from their hardware specs to whether they use a crypto wallet.

"If you’re not paying for a product, you are often the product," says Marijus Briedis, CTO at NordVPN, explaining that what looks like a free stream or download can quickly become a gateway to tracking, scams, and malware.

According to NordVPN, the scale of the threat is immense. Every single month, hundreds of thousands of the company's users encounter infection attempts tied directly to this specific adware kit.

How the adware campaign works

The operation works by loading a hidden JavaScript tag the moment a real person visits an infected website. To ensure maximum profit, the adware utilizes a fingerprinting module to build a persistent visitor ID stored directly on your device, allowing operators to track you even without using traditional cookies.

The sheer volume of data collected by this script is staggering. It scopes out your CPU cores, RAM, operating system, and installed plugins.

But it goes further than standard tracking. The adware actively hunts for browser-injected crypto wallet tools like MetaMask, checks for motion signals like accelerometer and gyroscope availability, and even uses favicon checks to figure out if you are logged into YouTube.

This highly specific profile is then likely sold to third parties or used to target you with customized scams.

"This campaign shows how cybercriminals turn user attention, personal data, and risky browsing habits into revenue at industrial scale," said Briedis.

Perhaps the most alarming aspect of this adware is how aggressively it hijacks your browsing experience.

You don't even need to click on a visible advertisement to fall victim. Simply clicking on an ordinary, non-advertising part of the infected webpage can trigger a redirect, immediately sending you to phishing campaigns, malware download sites, or push-subscription traps.

If you think your current ad blocker is enough to keep you safe, think again. The adware actively detects when filtering protections are running in your browser. If it spots an ad blocker, it switches to a proxy bypass mechanism, dubbed "adblock-proxy-super-secret" by its creators, which generates at least three brand new domains every 24 hours.

This constant shifting allows the malware to effortlessly dodge standard security blocklists. It even hides its malicious behavior if it detects a search engine bot, ensuring the infected pirate sites look completely harmless to Google.

How to stay safe

To protect your digital life, NordVPN's CTO Marijus Briedis recommends taking the following precautions:

• Avoid "free" premium content: Stay away from piracy and illegal streaming sites, as these environments are hotbeds for adware and phishing.
• Use tracker protections: Employing reputable ad and tracker blockers limits malicious scripts from executing in your browser.
• Reject push notifications: If a sketchy website asks for permission to send you notifications, deny the request immediately.
• Update your software: Keep your browser and security tools up to date to ensure they can catch the latest malicious scripts and deceptive redirects.

The World Cup draws millions of viewers who want nothing more than to stream the action live. For many fans, this doesn’t just mean watching any broadcast; it means accessing their home country’s service to hear commentary in their native language.

Yet when you travel abroad, live sports streaming often hits a brick wall. Streaming platforms are increasingly aggressive in detecting and blocking VPN connections, making it surprisingly tricky to access familiar home broadcasts from your hotel room or airport lounge.

Understanding how these apps spot your connection and knowing how to bypass their defenses with the best VPN services is key to keeping your viewing experience uninterrupted.

Why streaming services block VPNs (and how they do it)

Streaming services block VPNs because they have strict licensing deals based on location.

Broadcasters pay for exclusive rights to show matches in specific countries. If a user logs in via a VPN to watch games they aren’t licensed for, it breaks those agreements.

To honor these agreements, platforms have no choice but to block these workarounds. For football fans, this creates a frustrating loop: you try to connect, the app spots something is amiss, and you’re hit with an error message before kickoff.

The most common method streaming services use to spot VPN traffic is maintaining a huge, updated blacklist of IP addresses known to belong to data centers. If your connection comes from one of these flagged numbers, you’re blocked immediately.

Beyond IPs, platforms analyze behavior. A genuine user travels slowly over days, whereas a VPN user might appear in London one minute and New York the next, triggering alerts.

Even if your main traffic is hidden, small background requests such as DNS queries can slip outside the VPN tunnel, revealing your real location.

Some services use deep packet inspection to recognize the unique “fingerprints” of popular VPN protocols. If the data looks like it’s running through a tunnel rather than regular browsing, it gets flagged.

How to avoid VPN detection

Navigating these streaming app blocks starts with picking the right settings. While protocols like WireGuard are the best option for raw speed, they don’t inherently hide your traffic better from detection systems than other VPN protocols.

The real key is often the server you choose. Just because one server is blocked doesn’t mean the whole country is out of reach. Sometimes a heavily used server gets flagged while a smaller, less popular one flies under the radar. If you run into trouble, start by switching locations before tweaking anything else.

Before you even test a connection, make sure your browser isn’t working against you. Clearing your browser’s cache and cookies is crucial because old location data stored there can contradict your new IP address and trigger an immediate block, making a good server appear broken.

If problems persist, experiment with your protocol. Although WireGuard is the default choice of many VPN providers – and the fastest – OpenVPN over TCP can sometimes work better on restrictive networks, particularly when those networks block or interfere with UDP traffic.

The best streaming VPNs counter blacklists and leaks by rotating fresh IPs, maintaining private networks to avoid data center flags, and using obfuscation to mask traffic.

Don’t let distance stop you from streaming the World Cup

Knowing how streaming services block access can help you watch the World Cup online from anywhere.

Choose a quality VPN, configure it properly, and stay ahead of detection tricks to keep your connection steady.

For answers on which VPN works best for specific services or where to watch your national team this summer, check our streaming guides and full World Cup coverage.

When the soon-to-be ex-British Prime Minister, Keir Starmer, told the nation last week that a full social media ban for all under-16s from social media was “the right choice" for the country, a group of people was watching closely, and thinking about what to do next.

For them, policies like these are problematic. They require all users (adults included) to undergo mandatory age verification checks. That means face scanning or ID document sharing to prove that any user is old enough to access content and social media services – and that’s something that privacy advocates and technologists have long warned is "a cybersecurity disaster waiting to happen".

But for this group, this is just the tip of the iceberg. Today, it’s your face they’ll want to scan. Tomorrow, it’ll be your messages.

So, after a social media ban in Australia, the development of Canada’s Bill C-22, the expansion of mandatory age verification in Europe, the EU's Chat Control debate, and discussions on children’s online safety proposals in the US Congress, the UK’s announcement was the final straw

On June 16, 2026, just 24 hours after Starmer's speech, that the Stop Killing the Internet campaign was officially unveiled with its mission to defend the open internet against state policies that could trigger mass surveillance and excessive control.

"Any restriction that restricts people's human rights and right to access the open internet is what we're opposed to,” Programme Manager at the Open Rights Group (ORG), James Baker, told TechRadar.

The ORG is just one of many high-profile UK digital rights groups that have come together to form Stop Killing the Internet, along with Big Brother Watch, and Index of Censorship. They are calling to arms other worldwide organizations committed to finding rights-based solutions to online social problems to join in.

“We hope to expand globally because it affects people in all countries, including places like India or China, where the internet is a lot more restricted."

Ahead of the launch, Baker and the rest of the group have already held urgent meetings with over 20 organizations, listened to the perspective of young people about the UK's proposed teen social media ban, and decided it was time to take action.

Stop Killing the Internet was formed as a sister campaign of Stop Killing Games, a movement created by the gaming community to advocate for legal protections to prevent publishers from shutting down video games.

But why have gamers joined forces with digital rights advocates to challenge ongoing children's online safety policies? And, most importantly, which solutions is the group proposing instead?

Why restricting the internet for teens is a bad idea

We can divide children's online safety policies into two main strands — each has its critics warning of dangerous unintended consequences.

The first are access barriers which cut children off from online spaces and content thought to be unsuitable for their age.

Policymakers first started by barring children from adult-only sites with age verification checks. Then came total platform blocks such as Australia's world-first under-16s social media ban, which the likes of the UK, France, Malaysia, and other countries are also looking to follow.

Baker believes that, ultimately, these bans won't work — an idea backed up by recent data from Australia — but it’s the nature of the approach that bothers the ORG’s Programme Manager.

"If there was rowdy behavior or a fight in a town hall or a public square, you'd try to police it and solve it — you wouldn't completely shut down the space for everyone,” he said.

“Yet the response to internet problems is to try to shut down the space and exclude people based on their age."

The second group of child protection policies focuses on content scanning.

An example here is Keir Starmer's ultimatum to Big Tech to find a way to prevent children from accessing explicit images on their devices. It's a plan that so unpalatable from a privacy perspective that it prompted private messaging platform Signal to say that it "would rather exit the market than undermine the technical guarantees that people trust for their privacy".

Content scanning is an old idea that continues to arise on lawmaker agendas and, often, fails to translate into actual legislation.

One incarnation of this client-side scanning was initially part of the UK's original Online Safety Act, but it was halted until "it's technically feasible to do so" in a privacy-respecting manner. And there's been no mention of it since, with regard to OSA, most likely because it's easily said by politicians but next to impossible in practice.

In the EU, another message scanning movement, commonly referred to as Chat Control — the nickname for the Child Sexual Abuse Regulation (CSAR) proposal — has been in negotiations for over three years and still there's no final text that's convincing enough for privacy experts to accept.

In reality, though, according to Stop Killing Games' Strategy Lead Moritz Katzner, all of these copycat policies, wherever they are in the world, have very little to do with child safety at all.

"You have to seriously ask if this is actually about protecting children. As someone who was recently part of that demographic, I do not believe them, because they did not care about me, nor my gaming communities, for a very long time," he told TechRadar.

Katzner explains that a crucial part of the Stop Killing the Internet campaign is indeed making people understand that there is no difference between chat control, age verification, and ID verification.

"They are all reasoned from the same agenda," he said. "It is an escalation ladder where they start by scanning your face, then require ID, and eventually start scanning your chats."

How Stop Killing the Internet plans to reset the debate

For the people involved in Stop Killing the Internet, it's a non-negotiable — what's needed to protect both children and the open web is to shift the focus of the online safety debate.

"Our primary goal is to force a hard reset of the debate,” said Katzner. “To do so, we should listen to what experts have been saying for three decades and look at the algorithms, because these platforms are addictive to adults, too."

And how do they plan to do that?

Stop Killing the Internet aims to make the knowledge of academics, computer scientists, civil societies, and other experts, mainstream directly via social media content creators. This strategy would allow them to bypass mainstream media, which, they believe, has mostly failed to critically report on this issue.

An important goal of the movement is to expose the global network of funding that they say backs up these laws. According to Katzner, it's vital to make a clear distinction between genuine advocacy and corporate lobbyism.

"Meta spent millions in the US and UK lobbying for platform-level age verification because it serves their interests, and politicians are being misused in this process," he said.

While Big Tech plays hot potato with the responsibility of children's safety, how the laws land make a huge bearing on the likes of the gaming community, according to Katzner. Gaming platforms are also included in age verification and social ban policies. Yet, as Katzner explains, there's also a tactical reason for Stop Killing Games to be involved in this fight.

Stop Killing Games has material successes in its fight to date. It brought its cause to the political agenda and helped the Protect Our Games Act to pass California’s Assembly vote — as reported by The Guardian.

“We are now bringing the strong muscle of online communities into this campaign," Katzner added, with reference to the broader internet freedom fight.

What's next for Stop Killing the Internet?

While Stop Killing The Internet is expected to fully launch on June 27, 2026, — and reveal all the people involved — Baker from Open Rights Group said that it has already attracted interest from organizations and individuals from Australia, Canada, the United States, Africa, and Europe.

In the coming days, we will also know what the movement's first step will look like.

What's certain, however, is that the problems with children's online safety policies are only its starting point — the goal is to save a free and open internet from all forms of online restrictions.

• X-VPN has added dedicated Soccer servers aimed at World Cup viewers
• The servers cover six countries, chosen based on language preferences
• The launch arrives as streaming demand and server congestion peak

With the 2026 World Cup already underway across the United States, Canada, and Mexico, X-VPN has rolled out a server line built for one job — streaming football matches.

The company has launched what it calls a dedicated Soccer 2026 server line across six countries: the United Kingdom, Ireland, Brazil, Austria, Poland, and the Netherlands.

Plenty of people already reach for the best VPN to follow their team when they are travelling or stuck behind a regional blackout, and the broad strokes here are familiar.

What is different is the framing: a seasonal, event-specific line that is meant to be quicker to navigate than a general world map of servers. If you have ever wondered whether you even need a VPN to watch the World Cup, this is X-VPN's pitch for one.

What X-VPN's Soccer 2026 servers actually do

Instead of a generic country list, the Soccer 2026 line points you toward locations tied to the tournament's free and regional broadcasters.

Several of the six countries map neatly onto the platforms fans already use to watch the World Cup for free, with the UK in particular covering BBC iPlayer and ITVX. The selection is built around language and viewing preferences rather than raw server count.

On availability, X-VPN says initial support has been announced for iOS, Windows, macOS, and Android, with Apple TV and Android TV support planned. That last part is worth flagging, since the living-room devices most people actually watch football on are still on the roadmap rather than live today.

Why streaming-optimized servers matter during the World Cup

Live sport is one of the hardest things to stream well. The feed is real-time, it eats bandwidth, and a small amount of lag can mean a goal alert buzzes your phone before you see the ball hit the net.

The flip side is congestion: when too many users pile onto the same server, speeds drop, which is exactly the risk during a simultaneous global kickoff. Grouping servers around a specific event is, in part, an attempt to manage that load.

A server tuned for streaming is really about three things: speed, stability, and not landing on an overcrowded connection when millions of other people are watching the same knockout tie.

None of this removes the basics. If you are watching on stadium, fan-park, or hotel Wi-Fi, your local network is often the real bottleneck, and a few settings tweaks to keep your connection fast in crowded environments will do as much for your stream as the server you pick.

The tournament runs from June 11 to July 19, 2026, and is the first 48-team World Cup, with 104 matches in total. That is a lot of football, a lot of late nights for some viewers, and a lot of demand hitting broadcasters at once.

A server line built for exactly this window makes it easier for more people to watch the matches they're interested in, and with the regional complexities and expenses involved with sports streaming, this is always a good thing.

• Past breach data show over 1.1 million soccer-related passwords
• ExpressVPN found that nearly 1 in 4 football fans use this info in their logins
• Experts urge to delete any sports references from account logins' details

As the FIFA World Cup kicks into high gear, millions of fans are displaying their loyalty online. While you might already be using the best VPN to secure your browsing, ExpressVPN — now an official supporter of the 2026 tournament — is warning that this very public fandom can translate into a major cybersecurity vulnerability.

In a new research report, cybersecurity researcher Jeremiah Fowler partnered with ExpressVPN to examine how soccer obsession influences our password choices. The results suggest that fans are openly handing hackers the keys to their digital lives by using highly predictable phrases.

Fowler's analysis of historical data breaches revealed more than 1.1 million soccer-related passwords. Words like "soccer," alongside massive club names such as "Liverpool," "Chelsea," "Arsenal," and "Barcelona," appeared repeatedly throughout the dataset.

Because fan loyalty is incredibly public, plastered across social media profiles, usernames, and group chats, these passwords are far easier to crack than a random string of characters.

"As a cybersecurity researcher, I've seen criminals target people through the interests they share most openly," Fowler explained. "A club name, player nickname, shirt number, stadium, city, or tournament year may look harmless on its own, but together those details can help someone guess how a fan might build a password or craft a message they're more likely to trust."

An open goal for cybercriminals

To determine if this behavior remains common today, ExpressVPN surveyed 6,000 football fans across six countries. The findings confirm that bad password hygiene is still widespread.

Nearly one in four surveyed fans admitted to having used soccer-related information to secure an account.

Among these fans, the most common choices included their favorite team names, player names or nicknames, and jersey numbers. These easily searchable statistics are exactly what malicious actors look for when compiling custom dictionaries to breach an account.

The fans themselves are surprisingly aware of the risk. In the US, a massive 73.1% of those using soccer-themed passwords acknowledged that someone familiar with their sporting interests could likely guess their login.

This vulnerability is compounded by the fact that many fans are already putting their digital privacy at risk through other careless online behaviors during the tournament.

How to protect your accounts

Using a weak password becomes catastrophic when you consider password reuse. According to Aaron Engel, Chief Information Security Officer at ExpressVPN, the habit of using the same login across multiple services is what turns a minor breach into a full-scale privacy crisis.

"Password reuse is what allows one exposed credential to become a wider account-security problem," warned Engel.

He also noted that fans who share streaming logins put their personal data in further jeopardy: "Sharing passwords increases the number of people and devices that may hold that password; in doing so, users are putting their security into the hands of others. Multi-factor authentication doesn't undo reuse, but it can prevent a stolen password from being enough on its own."

If you want to stay safe while streaming the tournament, you should immediately strip any sports references out of your logins. Instead, use a dedicated password manager to generate complex, unique credentials for every account.

It is also a great time to ensure your overall connection is encrypted, particularly if you are wondering whether to use a VPN to watch the World Cup.

Just keep in mind that new ExpressVPN users still have a chance to win a premium ticket for the World Cup, but you won't get its usual 30-day money-back guarantee.

Traveling to the 2026 World Cup means joining hundreds of thousands of fans in crowded cities across North America.

Airports, stadiums, fan zones, and hotels are all packed with people competing for the same public Wi-Fi networks. These connections are often slow and insecure, making personal data vulnerable to interception.

To stay protected without sacrificing speed, you need more than just a VPN – you need the best VPN with the right settings. Tuning your VPN configuration helps keep your connection secure and fast, no matter where you go during this summer’s tournament.

The 5 best settings to change for top VPN performance

Just turning on your VPN isn’t always enough to cut through the noise of a packed stadium or busy airport terminal. To get good speeds and real security when thousands of people are online at once, here are five specific settings to tweak:

1. Protocol

WireGuard is the superior protocol choice for modern devices, offering faster connection speeds and lower latency compared to OpenVPN or IKEv2.

This efficiency matters when network congestion is high. WireGuard establishes secure tunnels more quickly, reducing wait times. If your provider offers OpenVPN, it's a great alternative for compatibility, but for raw performance in crowded zones, WireGuard is best.

2. Transport protocol

If you've never heard of transport protocols before, think of them as the delivery method your VPN uses to move data. Most commonly, you'll see TCP and UDP as your choices for this.

On congested networks, TCP’s reliability mechanisms can add delay when packets are lost. UDP avoids this overhead by sending data without waiting for confirmation.

In a crowded stadium where every millisecond counts, switching to UDP can reduce latency and improve responsiveness for smooth VPN streaming even when the network is struggling to keep up.

3. Split tunnelling

With split tunneling, you can choose which apps can be routed outside the VPN’s encrypted tunnel. At a stadium, your banking app needs maximum security, but a local map app might benefit from direct access to avoid unnecessary latency.

Excluding non-sensitive apps from encryption can reduce bandwidth strain and prevent compatibility issues with local networks that sometimes block VPN traffic entirely.

4. Location

Connecting to the server closest to your physical location often results in lower ping and faster speeds. However, nearby servers may be overwhelmed by thousands of users connecting simultaneously.

If your current location lags, try switching to a server slightly further away that’s under less user load. Avoid jumping between regions unnecessarily, as crossing international borders increases the distance data travels and introduces lag that ruins live streaming.

5. Obfuscation

In monitored environments like airports, deep packet inspection can detect and block standard VPN traffic.

Obfuscation disguises VPN traffic as regular HTTPS web traffic, allowing you to bypass firewalls and censorship attempts. Although this adds processing that might marginally impact speed, the ability to stay connected when other connections fail more than makes up for this.

As you prepare to cheer on your national team at the 2026 FIFA World Cup, make sure your setup can handle the packed stadiums and busy airports.

By selecting the right VPN protocol, using UDP, and enabling features like split tunneling, you can protect your data and keep your device safe so you can enjoy the World Cup worry-free..

• Windscribe CEO warns social media quizzes can harvest data to bypass knowledge-based authentication
• The 'fun' prompts often perfectly mirror bank security questions
• Experts advise users to treat them as a second password by lying

We've all seen them pop up on our feeds: "What's your 90s sitcom character?" or "Discover your stripper name!" But while these social media quizzes might seem like a bit of harmless fun, they are actually acting as a massive phishing net.

That's the warning from Yegor Sak, the founder of one of the best VPN providers, Windscribe. According to Sak, these viral personality tests are carefully crafted to harvest the exact answers that financial institutions use to verify your identity.

By wrapping standard bank security questions, like your mother's maiden name, your first pet, or the street you grew up on, into a gamified social media post, attackers are tricking users into willingly handing over the keys to their accounts.

The dangers of Facebook quizzes

The success of these quizzes comes down to psychology rather than advanced hacking techniques. The questions are cleverly disguised to disarm your natural skepticism.

"If a stranger walked up to you on the street and asked for your mother's maiden name, your first pet, and the street you grew up on, you'd walk away," Sak explained. "Wrap those same questions inside a 'Which 90s sitcom character are you?' quiz, and people happily type the answers into a database owned by someone they'll never meet."

Sak describes every completed quiz as "a credential reset form for a stranger."

Asking for a mother's maiden name directly puts people on the defensive, but asking for a silly combination of a first pet and childhood street gets a laugh.

"Same data. One feels like an interrogation. The other feels like a game. That gap is the entire attack surface," said Sak.

This isn't just a theoretical threat. Back in 2020, a major investigation by the UK's Information Commissioner's Office (ICO) confirmed that personality-style apps on social platforms were harvesting data from tens of millions of users, many of whom had no idea their information was being collected.

"Most people have been quietly handing over the keys to their bank accounts for the better part of a decade," Sak noted, "and they think they're just having fun on Facebook."

How to protect yourself (and why you should lie)

So, how do you spot a trap? Sak says the danger lies in the type of information requested.

"Any quiz asking for a name plus a memory is a red flag," he warned. "First pet, first car, first school, the street you grew up on, mother's maiden name, favourite teacher. If a quiz is collecting four or five of those in one round, it's not a personality test. It's a security questionnaire with stickers on it."

Because a leaked password can be changed in seconds but the name of the street you grew up on cannot, Sak recommends a simple but drastic fix for knowledge-based authentication: lie.

If you've ever filled out one of these quizzes, you should immediately update the security questions on your bank, email, and brokerage accounts. Treat the answers like a secondary password by using random, fictional responses.

"The data is gone," Sak concluded. "The only thing left to do is change your security answers everywhere, and stop using questions whose answers exist on the internet."

Banning all children from social media apps has been this week’s headline-grabbing, simple fix to an online world growing more hostile by the day. Too bad that it may not work, after all.

Not only is a blanket social media ban incredibly difficult to enforce from a technical standpoint, in fact, but the fallout will hit everyone where it hurts the most: our digital privacy, ultimately perhaps even taking down VPNs in the process.

Children and teens living in Australia were the first in the world to take an enforced break from their Snapchat, Instagram, and TikTok lives — a break that law now states must last until they turn 16. That's the theory, at least, but reality tells a very different story.

In March, Australia’s body tasked with overseeing the young person social media ban's implementation, the eSafety Commissioner, found that around seven in 10 under-16s still have an active account on major platforms. Worse still, three months later, and there have been no notable changes in the cyberbullying or image-based abuse reported by children that this law was designed to stop.

The numbers are not encouraging and show that the sweeping restrictions are failing to bring the hoped-for results. Nonetheless, the UK government is convinced that banning all under-16s from social media "is the right step for Britain", and has set a deadline for implementing an Australian-like model by spring next year.

Predictably, the privacy tech industry has raised the alarm over expanding mandatory age verification checks, branding the proposal as a "cybersecurity disaster waiting to happen". Less expected, though, is the resistance cries of foul coming from children's safety groups.

Talking to TechRadar, Rowan Ferguson, Policy Manager at the Molly Rose Foundation — a non-profit set up by the father of the 14-year-old who died after seeing harmful content online — pointed to the evidence coming from Australia, arguing that a social media ban risks being a "step back" in children's online protection instead. He said:

"A lot of the evidence points to the fact that a ban is likely to quickly unravel, meaning a majority of children will be able to continue having accounts on platforms that we know are currently very unsafe."

So, what does the data from Australia really tell us? And, if a social media ban doesn't work, is there a better way to make children safer online without putting the privacy of all British social media users at risk?

What Australia’s social media ban data tells us

Since December last year, the world-first teen social media ban requires all so-called "user-to-user platforms" to prevent under-16s from accessing their services. As we said, however, Australia's eSafety Commissioner found that most of them are still active on social media.

A large-scale poll carried out by the Molly Rose Foundation across Australians aged 12–15 drew similar results. Three-fifths of respondents continue to have access to one or more social media accounts.

Strikingly, over half of the participants questioned said that the ban coming into force has made no difference to their online safety, with one-in-seven feeling even less safe now.

As Ferguson from Molly Rose Foundation points out, this trend doesn't mean that kids have been great at bypassing the rules.

"It's more a case of 'malign compliance' by the Big Tech firms. Simply, they are not taking proactive action to remove under-16s' accounts," he told TechRadar.

How under-16s in Australia retained access on social media

Versus Comparison Data

Attribute	YouTube	Snapchat	Instagram	TikTok
No action taken	64	61	60	60
Got around age checks to keep using an existing account	23	24	22	25
Used a workaround to set up a new over-16s account	10	11	14	14
Asked a friend or family member	10	7	7	8
Used a VPN	4	4	4	5
Other	4	2	1	1

YouTubeSnapchatInstagramTikTok

VS

YouTubeSnapchatInstagramTikTok

No action taken (%)

+5%64

61

Got around age checks to keep using an existing account (%)

23

24+4%

Used a workaround to set up a new over-16s account (%)

10

11+10%

Asked a friend or family member (%)

+43%10

7

Used a VPN (%)

4

4

Other (%)

+100%4

2

Data from Molly Rose Foundation, survey March 2026 https://mollyrosefoundation.org/wp-content/uploads/2026/04/MRF_Australia-Social-Media-Ban-Research_Briefing-April-26.pdf

The findings of both studies show, in fact, that the main reason why under-16s are still active on social media is that these platforms have not yet asked children to verify their age.

Molly Rose Foundation's survey even found that, while 70% of children still using restricted sites say that it was "easy" to circumvent the ban, only between 4-5% of respondents use a virtual private network (VPN) or similar tool to do so.

These results, alongside similar studies conducted by Internet Matters and ChildNet, shatter the narrative that under-16s are turning to VPN services to bypass online safety rules.

Nonetheless, this is a belief that still proliferates among UK policymakers, who are expected to decide whether to also introduce age restrictions on VPN usage sometime next month.

How the UK’s teen social media ban could be enforced

The details on how the enforcement of the UK’s child social media ban policy will look are scarce so far, but it appears that the burden to find a workable process will mostly be the responsibility of social media providers themselves.

According to the UK's Department for Science, Innovation & Technology, the country's media regulator Ofcom has been tasked to share a list of age assurance methods for proving whether someone is over 16 that are "accurate, robust, reliable, and fair". It’s not an easy job, as Ofcom itself admitted.

In a letter addressed to the Department, Ofcom's Director of Online Safety, Oliver Griffiths, said verifying that users are over 16 "should be technically feasible" but would prove harder than existing over-18 restrictions under the Online Safety Act.

In Australia, social media platforms have a handful of methods, including government ID scans, face or voice recognition, or so-called "age inference" checks.

The last of these uses an algorithm to analyze online behaviour and interactions to estimate a person's age. That may, however, not be an option in the UK. Talking to the Financial Times, Ofcom said that there is no evidence showing these models can deliver an effective, privacy-preserving solution.

What are the risks of a teen social media ban?

Both cybersecurity and child safety experts are worried that a UK teen social media ban would actually create more problems than it might solve.

According to the Molly Rose Foundation, for example, a ban could make it harder for children to speak up and disclose online harm.

"Our chair, Ian Russell, is particularly concerned that if a child is experiencing grooming or seeing harmful content on a platform they officially shouldn't be on, they might fear seeking help because they could be penalized for being there," Ferguson told TechRadar.

Skeptical that the move will work, the group also believes that the UK’s proposed policy will ultimately give parents a "false sense of security" that the problem has been fixed instead.

Many commentators, including digital rights groups like Open Rights Group and Article 19, also argue that a ban could lead social media platform providers to stop addressing their safety problems altogether.

"A ban will reduce the pressure on platforms to clean up their act and provide age-appropriate, rights-respecting digital environments for children, and for everyone else," said Chantal Joris, Interim Head of Law and Policy at ARTICLE 19.

Joris argues that the problem is not children's accessing social media, “it is the toxic incentives and practices embedded in the platforms".

And all of this is before the consideration of the privacy and security toll on all social media users for both adults and children alike.

Commenting on this point, Romain Digneaux, Public Policy Manager at Proton, told TechRadar:

"We're already seeing serious security issues surfacing, such as in the Discord case, where thousands of users' personal details were stolen by hackers. And we all must remember that age verification for children alone doesn't exist. Age verification for children is age verification for everyone."

Are there any better alternatives to banning kids from social media?

Besides the criticisms, experts from all sides agree that finding a solution to children's online harms is a priority. So, if not a ban, what then?

For children's safety groups, making platforms safer by design is what's needed.

"By safety by design, we mean an end to the harmful and addictive design choices that evidence shows are the main drivers of online harm for children. In particular, we are calling for a conditional ban on harmful recommender algorithms unless platforms meet strict safety conditions," Ferguson from Molly Rose Foundation told TechRadar.

A recent research conducted by the Molly Rose Foundation shows that 47% of girls had seen harmful suicide, self-harm, depression, or eating disorder content in the last week, with this mainly driven by algorithmic recommendations.

Experts also believe that parents should be equipped with better parental controls and, at the same time, children should learn how to effectively navigate potential risks.

As Privacy Advocate at NordVPN, Laura Tyrylyte, told TechRadar: "The most effective approach is likely to be a layered one that combines strong parental controls, improved digital literacy, responsible action by platforms, and privacy-preserving age assurance mechanisms at the device-level."

The UK government ensures that a social media ban for under-16s is what 9 in 10 parents asked for in its online safety consultation. But, would those parents be of the same opinion if they knew that, like in Australia, there’s a very good chance that it might not work?

It’s understandable why a faltering UK administration might have taken the headline-grabbing chance to make a bold move towards a cause that most people could get behind, but in its haste to do so, it seems to have overlooked the data that points in the opposite direction.

As Ferguson told TechRadar, if we really want to fix the internet, "we shouldn't be taking the easy options; we need to be following the evidence."

As British Prime Minister Keir Starmer announced a sweeping social media ban for under-16s by next spring, speculations have mounted that VPN services may be the next ones on the chopping block.

Concerns like these do not happen in a vacuum.

In his Monday announcement, Starmer said that more information on further restrictions will be shared next month.

Then, speaking to BBC Breakfast the day after, Technology Secretary Liz Kendall left no room for doubt when she said: "We will make further statements in July about VPNs."

As we wait to see what the Government decides to do next, let's look at how the debate has been unfolding and what's at stake for VPN users in the UK.

The VPN debate in the UK

Calls to close the 'VPN loophole' have been thrown across Palace of Westminster benches since mandatory age verification landed in the UK last July and led to a surge in VPN usage across the country.

Virtual private network (VPN) apps and similar tools can indeed make users look like they are browsing from outside the country, potentially helping them bypass age checks.

It's been difficult to determine whether this spike in usage is driven by adults unwilling to share biometric data or by children seeking out restricted content, but recent studies from groups like Childnet and Internet Matters suggest the balance may swing towards the former.

Nonetheless, the debate got so heated among politicians last year that the Government decided to include questions about potential age restrictions for VPNs in its online safety consultation, which ended in May.

In the meantime, though, the controversial Children’s Wellbeing and Schools Act has becaome law, introducing an obligation for all service providers to take "reasonable anti-circumvention measures".

This, alongside the newly proposed teen social media ban, could put increased pressure on UK lawmakers to further regulate the use of VPNs.

The risks of age restricting VPNs

In the consultation's accompanying report, the Government emphasizes the need to balance enforceable content restrictions without limiting the "legitimate and lawful use" of VPNs by adults.

However, when we took the online safety survey ourselves, we found that VPNs were mostly described in the questionnaire as circumvention tools rather than privacy products which is, of course, their prime purpose. It's a grossly simplistic take that's been concerning cybersecurity experts.

According to Proton VPN's Public Policy Manager, Romain Digneaux, lawmakers must take into consideration that VPNs are an essential tool for user privacy and security that millions of Brits rely upon daily.

"Imposing age restrictions on VPNs would only make it harder for law-abiding citizens to access tools that protect their privacy and security," Digneaux told TechRadar.

VPN providers are aslo worried about the impact that potential age restrictions will ultimately have on their product. Most of them, in fact, operate under a strict no-log policy to collect as little information as possible about their users.

This is exactly why, according to Surfshark's Senior Product Manager, Justas Pukys, the prospect of age‑gating VPNs is so concerning.

"It would undermine the very privacy architecture these services are built on, mostly affecting ordinary users and reputable providers," he told TechRadar.

NordVPN's Privacy Advocates, Laura Tyrylyte, echoes these concerns. She told us:

"Restricting access to these tools, or requiring identity-linked access to them, would have consequences far beyond the negligible number of users who may seek to circumvent online restrictions."

Concerns aren't coming only from the companies building the VPNs, either.

Last month, Mozilla, the non-profit behind Firefox, warned the UK's Department for Science, Innovation and Technology that age-restricting VPNs "would undermine the privacy and security of all users," while failing to protect children.

The outcry follows a similar call from the wider tech privacy industry that came as the Children's Wellbeing and Schools Bill became law.

Is restricting VPNs even needed, and could it work?

While VPNs have proved themselves as useful tools to evade the mandatory UK age checks required to access so-called legal but harmful content under the Online Safety Act, it's still unclear if they will help at all to bypass the new social media ban.

As Windscribe's CEO, Yegor Sak, explains, this depends on how these restrictions are ultimately enforced. If a platform simply blocks users that are based on the UK network location, he explains, then a VPN is the right tool for the job.

"But if the check happens at the account level, app-store level, device level, payment level, or through identity verification, a VPN does not make a 15-year-old look 18. It doesn’t create an old account, a credit card, or a verified identity," Sak told TechRadar.

Right now, we know very little detail on how enforcement would look, but experts overwhelmingly expect the more robust, latter scenario.

Social media providers could also use a mix of account history, payment signals, facial estimation, identity vendors, device or app-store signals, and document checks.

Regardless of whether age-gating VPNs is actually needed to successfully implement the UK's teen social media ban — Australian lawmakers didn't think it was necessary, for what it's worth — it also remains to be seen whether such VPN restrictions would actually work in practice.

As we saw in Utah, which became the first US state to pass such requirements, it may be technically impossible to block all known VPN and proxy IPs. That's, at least, what NordVPN told TechRadar back in March, arguing that the only remaining option would be age-verifying every visitor globally, regardless of their actual location.

What's more, even the most draconian of restrictions aren't that effective. Take Russia, for example. The Kremlin has invested millions in building a sophisticated censorship system, but VPN services keep showing resilience by constantly adapting to new tactics.

It looks like UK lawmakers have many factors to consider for drawing the next steps in making the internet a safer place for children, then, and it appears it might be wise to take a look around before drawing up its plans.

For Sak from Windscribe, however, it should be enough to look at one single element.

"If a policy creates pressure to age-gate VPNs, that is a sign the policy is broken. You don't protect children by weakening privacy and security for everyone," he said.

VPN and privacy-conscious users in the UK will hope that this point remains right at the forefront of the discussion.

The UK Government has finally announced its long-rumoured social media ban for under-16s. While the current proposal focuses on social media platforms, lawmakers are also considering restrictions on gaming platforms, streaming services, and, potentially, VPNs.

Previously, the Online Safety Act’s age verification requirements led swathes of people to use VPNs to avoid the measures. Now, the worry is that, without restrictions to VPN access, circumvention of the social media ban would leave children exposed to the materials the move aims to block.

The problem is that circumvention risks have blinded policymakers to a key factor — VPNs are crucial to securing children online.

Be it securing their data against leaks or the growing integration of features such as parental controls, there’d be greater harm from banning these tools than from leaving them be. What’s more, with the UK adopting an ‘Australia plus’ model, there’s little chance VPNs would help anyway.

How VPNs actually improve children’s online safety

Research by Childnet in late 2025 showed that while VPN providers saw searches increase over 300% when age verification arrived, there was no huge rise in VPN uptake by children when age verification landed that July. Uptake in the 3 months after was only 2% higher than a year earlier.

In the same study, 38% of children said that their primary reason for using a VPN was to stay safe online. By contrast, only 10% of children said they used a VPN to access content that they shouldn't.

Talking to TechRadar, Childnet International CEO Will Gardner elaborated, saying:

“Children that use VPNs do so for a variety of reasons, and, in fact, the primary reason they gave was to protect their privacy/online safety… any steps to restrict children from using this technology will be overriding these [reasons].”

Unsurprisingly, the VPN industry itself isn’t oblivious to the risks that children face online either.

Speaking to TechRadar, Chief Research Officer at ExpressVPN, Pete Membrey, underlined how VPNs can shield children from tracking and online profiling, and “provide private access to health information and safeguarding services”.

In other words, children can access the materials they need to remain healthy, even if they are in unsafe living situations.

ExpressVPN took this one step further earlier this year. Partnering with the International Watch Foundation (IWF), a foundation aiming to eliminate all child sexual abuse material online, ExpressVPN now blocks all sites listed by the IWF as hosting child sexual abuse material (CSAM).

This means any child using the internet while connected to ExpressVPN cannot see these materials. What’s more, parents can take this one step further thanks to adult content blocking settings in-app. If VPNs were restricted, neither of these capabilities would be accessible.

ExpressVPN has also made the technology for blocking CSAM material, OpenBoundary, open source, in a move to encourage other services to take similar measures.

Speaking on the importance of the partnership, Membrey explained:

“Our partnership with the Internet Watch Foundation takes [protecting children online] further…it shows that VPN providers can actively contribute to child protection while preserving the privacy that makes VPNs valuable in the first place."

“We empower parents to protect their children by applying these VPN benefits to their kids’ online activity.”

ExpressVPN is not the only VPN to have taken action to protect children. Countless of the best VPNs now offer measures such as parental controls and content blocking to protect children online — including NordVPN, Surfshark, Windscribe, and more.

The UK Government is also looking at gaming and streaming as part of the measures. In these instances, VPNs can not only secure the data you send online but also help prevent doxxing, meaning revealing someone's personally identifying details online, and other malicious practices that children can be exposed to.

Parental controls integrated into VPNs can also limit access to these services without the need to compromise VPNs entirely, unlike a total ban which risks leaving children totally exposed.

The VPN industry is also taking to other areas of parenting problems, disrupting those other markets by solving them in a more secure way.

HeyPolo is one example, a private location-tracking solution built by the team behind Surfshark.

Its tracking is entirely consent-based, so no one is tracked more than they want to. More importantly, no user data is sold to advertisers, protecting children from unwanted online profiling before they understand what it is.

Compare that to the current market-leading family tracking service, Life 360, which openly sells user data and bombards with advertising, rather than focusing on the online safety of the children using the platform.

The risks of imposing VPN restrictions

VPN restrictions are no guarantee of online child safety. App stores are constantly flooded with VPNs claiming to be safe that are entirely the opposite.

A TechRadar study recently found that over 75% of Android VPNs fail basic transparency tests, and it’s unlikely that restrictions would stop the emergence of such services appearing and being available to download before being restricted.

So any government-imposed restrictions on known VPNs would very likely push children to these untrustworthy and often malicious services. This could lead to children’s data being collected and monetized or put into databases at risk of breach from bad actors.

The same can be said for social media platforms. As YouTube spokesperson Jay Stoll,, explained while speaking to Wired: “Blanket bans push kids out of such curated, supervised, beneficial experiences and towards anonymous, less safe services.”

When age verification measures arrived on adult content in the UK, the number of people accessing this content via unregulated websites skyrocketed.

Data from the Lucy Faithfull Foundation, a foundation named after its founder, suggested that up to 39% of adults had accessed content through unregulated sites.

Were the proposed restrictions to come in, there’s little to stop this from occurring again.

If, however, VPNs weren’t restricted, malicious content blocking tools included in these services would be a simple solution.

Keeping children protected and private

There’s little opposition to the need to protect children online. Where problems arise, though, is the UK government’s proposal to diminish online privacy to achieve this. Suggesting that one must be compromised so the other remains is a false dichotomy and undermines the broader benefits of a VPN to children and the wider population.

VPN restrictions are still under consideration for the coming months, and that means there’s still time for a solution that protects children online without compromising their access to protective, privacy-focused tools, but the signs aren’t good.

This is the second time in the past 12 months that VPNs have come under extreme scrutiny in the UK.

Many of the suggested actions are technically impossible. Adding age verification to the VPNs themselves, for example, would fundamentally contradict the no-logs policies these tools are built on, and the infrastructure VPNs use wouldn’t be capable of verifying a user's age without breaching this.

Regardless, it’s becoming difficult to see a future where access to these services isn’t restricted in some form to allow for greater protection of children and vulnerable adults online.

Australia’s model, which the UK Government’s proposal is built from, puts the onus on social media platforms to prevent VPN misuse, we’ll have to wait and see whether the UK will follow suit.

• Amnezia VPN restored access to 20 server locations for Premium users
• The provider is also actively issuing compensation to Premium subscribers
• This follows a major update amid suspected state-sponsored DDoS attacks

UPDATE: After publication, Amnezia VPN shared more details on these moves. We add some of these comments throughout the copy.

It has been a gruelling few weeks for the anti-censorship tool Amnezia VPN, but the dust is finally beginning to settle. The provider says it has restored access to all 20 of its international VPN locations for Premium users, signalling a return to normal service after a series of severe disruptions.

The good news does not end there. Alongside restoring its servers, Amnezia VPN has begun rolling out compensation to Premium subscribers affected by the outages.

Finding the best VPN to bypass aggressive government censorship remains a constant cat-and-mouse game. The latest disruption appears to be linked to a broader wave of DDoS attacks on VPN services, with Russia’s internet watchdog, Roskomnadzor, widely accused of being involved.

Amnezia VPN confirmed to TechRadar that these moves are part of the service's recovery plan.

"We’ve had to make some adjustments to our infrastructure architecture, which is why the number of available locations has been temporarily reduced," Mazay Banzaev, founder of Amnezia VPN, told TechRadar, adding that the team plans to expand the number of available locations to 100 or more.

Bouncing back from the blackout

The restoration was quietly announced via the provider's official X account. According to the post, Premium users can once again route their traffic through 20 different global locations, allowing them to unblock restricted content and browse the web privately.

"We’ve restored access to 20 locations, operating normally via AmneziaWG. Russia is temporarily down for optimization, we’ll let you know when it’s back," said Amnezia VPN.

The victory isn't absolute just yet, as the provider's Russia-based servers are still temporarily down. This isn't entirely surprising, given the intense scrutiny and technical roadblocks currently aimed at virtual private networks operating within the country's borders.

Banzaev confirms to TechRadar that a location with Russian servers is expected to be available within the week. "And the number of available locations will continue to increase," he added.

In a separate X post published shortly before the restoration update, the company confirmed it was taking steps to make things right with its paying customers by sending out compensation.

"We understand that many Premium users experienced disruptions during this period. The compensation program was introduced as part of our commitment to affected users while we worked to restore access and strengthen the platform," Banzaev told TechRadar.

In an industry where service outages are often met with silence, proactively compensating users is a strong move to rebuild consumer trust.

A relentless fight against censorship

If you have been following our Amnezia VPN review coverage, you will know that the service is built from the ground up to bypass severe internet restrictions. But even the most resilient tools can take a hit.

A couple of weeks ago, a massive, coordinated attack targeted multiple anti-censorship tools. Experts accused Roskomnadzor of launching active Distributed Denial of Service (DDoS) campaigns, a tactic where servers are intentionally overwhelmed with fake traffic until they crash. Amnezia was caught in the crossfire, leading to the frustrating blackouts Premium users recently experienced.

Fortunately, the provider hasn't just been sitting back and waiting for the storm to pass. Last week, AmneziaVPN strengthened its apps with a major update designed to counter these aggressive new blocking methods.

This defensive strategy includes the rollout of the new AmneziaWG 2.0 protocol. By subtly altering the headers of data packets, the protocol obfuscates VPN traffic. This makes it incredibly difficult for Deep Packet Inspection (DPI) systems, the technology governments use to spot and block VPNs, to detect the connection.

While the loss of the Russian server location remains a thorn in the side for some users, the return of 20 global locations and a proactive approach to compensation proves that AmneziaVPN is refusing to back down from the fight.

• India blocked Telegram until June 22 to prevent exam cheating
• The block triggered a spike in VPN usage as citizens look for workarounds
• Telegram is now challenging the order in court

Millions of internet users in India are flocking to VPN after the government ordered a temporary block on popular messaging platform Telegram.

David Peterson, General Manager at Proton VPN, has already confirmed a +150% spike above normal levels, noting the rapid influx of new users trying to circumvent the sudden censorship.

For everyday internet users, this highlights how vital a reliable VPN service has become for maintaining uninterrupted access to basic communication tools. A virtual Private Network masks your real IP address and routes your connection through a secure server in another country, allowing you to easily unblock restricted apps like Telegram.

The temporary restriction, which runs until June 22, 2026, was implemented by India's Ministry of Electronics and Information Technology (MeitY) to prevent cheating ahead of the controversial NEET-UG medical entrance re-exam.

The National Testing Agency (NTA) requested the blackout, claiming bad actors were using the app's message-editing feature to spread fabricated exam papers and fake leak evidence. In response, Telegram is challenging the Indian government's order in the Delhi High Court to restore service.

The BGP Hijacking controversy

The technical execution of the ban has also sparked major controversy, stretching the impact far beyond India's borders. To enforce the block, Indian internet service providers allegedly resorted to tampering with global internet traffic routes.

Doug Madory, Director of Internet Analysis at Kentik, reported that telecom Reliance "AS18101 of India hijacked BGP routes belonging to Telegram." BGP, or Border Gateway Protocol, is the underlying system that directs traffic across the Internet. When a provider hijacks these routes, it essentially creates a fake detour, sending traffic into a black hole.

This method caused severe collateral damage, accidentally blocking Telegram for users in countries like the United Arab Emirates. Telegram CEO Pavel Durov publicly condemned the move, claiming that the Indian telecom company was sabotaging global access and advising network operators worldwide to reject the unauthorized internet routing announcements.

India's track record of internet restrictions

While the Telegram block has grabbed international headlines, sudden internet blackouts are a common occurrence in India. According to research by Surfshark, India ranks first in Asia and in the world by restriction count.

Since 2015, the country has enforced at least 170 internet restrictions, far outpacing other nations. In June 2026 alone, the government implemented localized internet shutdowns in Uttarakhand, Jaipur, and Haryana to maintain public order. It is worth noting that localized restrictions in Jammu and Kashmir are counted separately.

Telegram is no stranger to censorship, either. Besides India, the messaging app has been blocked in other countries worldwide. Historically, around 30 different countries have disrupted the platform at least once, often during periods of political unrest or highly contentious national events.

For consumers, the takeaway is clear: as governments increasingly resort to app bans and network tampering, having a secure VPN installed on your devices is no longer just an extra layer of privacy; it is a mandatory tool for keeping your digital life online.

• UK digital rights advocates join the newly formed Stop Killing the Internet movement
• The group was launched a day after the UK announced an upcoming social media ban for under-16s
• A petition urging the UK government to scrap its plan is also now live

Just 24 hours after the British Prime Minister announced a sweeping social media ban for under-16s, UK digital rights advocates have joined forces to launch a global movement opposing online restrictions.

The "Stop Killing the Internet" campaign has a clear mission — defending the open internet against state policies that could trigger mass surveillance and excessive control under the guise of online safety.

An official statement seen by TechRadar explains that the campaign formed after global advocates met to discuss how proposals like social media bans, on-device scanning, and heightened state surveillance are accelerating worldwide.

Organizers officially unveiled the campaign on Tuesday at a press conference inside the European Parliament, alongside a new petition urging the UK government to scrap its plans.

High-profile groups including the Open Rights Group, Big Brother Watch, and Index on Censorship are among the UK-based digital rights organizations that have already backed the movement.

Moritz Katzner, director of Stop Killing Games — the movement's sister campaign — is urging the public to resist the recently announced measures.

"The internet is a place of education, games, friendship, culture, work, and public debate. Like any town hall, it can become ugly. But we would never respond by shutting down the town hall. We would never demand identity papers at the door," he said.

Why join the campaign?

The Stop Killing the Internet coalition launched in response to a wave of international legislative proposals that attempt to address child safety using what privacy experts call invasive, privacy-eroding measures.

The campaign's launch follows a succession of ultimatums from the government, including Monday's proposed social media ban and a looming deadline for Apple and Google to enforce on-device scanning.

"We all want children to be safe online, but these policies create new safety and privacy risks for young people and entire adult populations alike," said Silkie Carlo, director of Big Brother Watch.

The campaign seeks to unite internet users, families, content creators, and technical experts who want lawmakers to find less invasive solutions to these societal harms.

"Open Rights Group encourages people around the world who want a human-rights-based approach to tackling harm to join this movement," said James Baker, programme manager at the Open Rights Group.

More information on the Stop Killing the Internet movement and its active petition can be found on the campaign's official website.

• The UK government has announced a social media ban for under-16s
• Privacy advocates are concerned about the impact of increased age checks
• Some groups also argue that a ban will fail to protect kids online

The UK's "world-leading" plan to protect teenagers with strict social media regulations has drawn immediate fire from privacy advocates.

On Monday, British Prime Minister Keir Starmer announced that social media platforms will be required to prevent under-16s from using their services. Restrictions on certain harmful features and curfews are also being considered.

Privacy advocates and VPN companies are particularly concerned about the prospect of more frequent mandatory age verification checks. Justas Pukys, Senior Product Manager at Surfshark, told TechRadar: "While we fully support the goal of protecting minors, mandating that platforms collect government IDs for age verification is a cybersecurity disaster waiting to happen."

More details on how the upcoming restrictions would work in practice — including whether VPN services will become age-restricted — are set to be disclosed next month, with implementation expected for Spring 2027.

Just a week earlier, Starmer handed Big Tech platforms another controversial ultimatum, giving them three months to implement on-device scanning technology to block children from viewing explicit images.

The issues with age verification

Mandatory age verification remains the primary concern for privacy advocates.

Romain Digneaux, public policy manager at Proton, points to last year's leak of 70,000 Discord users’ government-issued ID photos as a stark reminder of the risks when age checks become a routine requirement for online platforms.

"We all must remember that age verification for children alone doesn't exist. Age verification for children is age verification for everyone," Digneaux told TechRadar, arguing that the global push toward age verification is no "silver bullet" for child safety.

Meanwhile, Harry Halpin, NymVPN's CEO, argues that these initiatives may be a pretext for a more invasive agenda. He told TechRadar:

"Currently, children can bypass these restrictions by drawing a mustache on their faces. The point of these technologies is not to protect children but to create a centralized digital ID database to find and track down online political dissent."

Halpin expects age checks to be implemented directly at the operating system level, arguing that this would mean "you will have to scan your ID card and face to use your phone or computer."

However, according to Windscribe's CEO, Yegor Sak, social media providers could use a mix of account history, payment signals, facial estimation, identity vendors, device or app-store signals, and document checks.

"None of that is privacy-neutral," Sak told TechRadar. "If the check is weak, teenagers bypass it. If the check is strong, everyone else gets dragged into identity checks."

When age checks cannot be avoided, Laura Tyrylyte, privacy advocate at NordVPN, suggests that lawmakers prioritize solutions that "minimize the collection and sharing of sensitive personal data" to avoid creating new cybersecurity risks for users.

The wrong solution to a pressing problem?

Beyond age-verification concerns, many commentators fear that banning children and teenagers from social media will ultimately fail to protect them.

James Baker, Programme Manager at the Open Rights Group, argues the ban will fail because it ignores the root causes of online harm. The real issue, he explains, is the "business models that reward harmful content."

This stance is shared by other digital rights groups, including Article 19, alongside several child safety campaigns.

Ultimately, tech experts are united in the belief that a social media ban is not only a threat to public privacy, but a drastic measure that could do more harm than good—leaving parents with a false sense of security.

• Telegram CEO criticized the UK's proposed social media ban for teenagers
• As users did in Russia, Durov claims that teens will simply move to VPNs
• The UK announced a plan to ban all under-16s from social media platforms

The UK government's controversial plan to ban teenagers from social media is facing fresh criticism from the technology industry. Telegram CEO Pavel Durov has publicly slammed the proposal, comparing the UK's legislative approach to the heavy-handed internet censorship frequently deployed in Russia.

Taking to X, Durov reflected on the historical futility of government-mandated digital blockades. Drawing on his extensive experience operating a global messaging platform against the backdrop of restrictive regimes, he argued that state-level bans rarely achieve their intended effect.

Pointing directly to Russia's historical attempts to block platforms and control the flow of online information, Durov noted that citizens quickly found ways to adapt to the restrictions. "They just moved to VPNs," he stated, highlighting the inevitable cat-and-mouse game between internet regulators and everyday users.

"No law can replace good parenting. Parents already have the tools to limit kids' digital consumption: parental controls, screen-time limits — or no smartphone at all. Instead, many parents give toddlers iPads just to keep them quiet," he also added.

As the June 2026 UK social media ban looms closer, the debate over how teenagers will respond is heating up.

For tech-savvy youth looking to bypass geographical or network-level blocks, firing up the best VPN on their smartphone is an increasingly trivial task.

A flawed comparison?

While Durov’s comments underscore the technical difficulty of enforcing an online blockade, his comparison to Russia’s sweeping censorship requires a reality check.

Blocking an entire platform for all citizens across an entire country — as Russia has routinely attempted — is fundamentally different from restricting social media access specifically for minors.

A targeted teen ban relies heavily on age verification tools at the point of sign-up or app download, rather than relying solely on ISP-level network blocking.

While a Virtual Private Network can effectively spoof a user's IP address and encrypt their web traffic, it cannot easily bypass strict age-gating mechanisms if social media platforms are legally compelled to require a government ID for account creation.

Ultimately, Durov might be overestimating the power of a simple location spoof when it comes to rigorous legislative age checks.

The VPN debate grows

Despite the nuances of age verification, Durov is far from the only public figure questioning the logistics of the UK's new legislation.

Politicians like Nigel Farage have also voiced doubts over whether the ban will work, similarly pointing to VPNs as an obvious and accessible workaround for determined teenagers.

The rush to legislate also comes despite brain experts telling the UK government that there is very little concrete scientific evidence proving that smartphones are actively harming kids.

Regardless, the ban is moving forward, prompting Telegram's CEO to condemn the restrictions much in the same way he previously urged Russians to stock up on VPNs to bypass domestic blocks.

Whether Durov’s prediction rings true in the UK remains to be seen. But if history is any indicator, whenever governments attempt to build digital walls, users will inevitably reach for the tools to climb over them.

• Reform UK's leader, Nigel Farage, says the UK's teen social media ban is "unlikely to work" due to VPN use
• Social media providers are expected to prevent under-16s in the UK from using their platforms
• While digital rights experts say circumvention is easy, the UK Prime Minister insists the ban is enforceable

Nigel Farage said the government's plan to ban under-16s from social media platforms is "unlikely to work" due to the "mass adoption of VPNs."

Following the British Prime Minister's announcement, the leader of Reform UK took to X to express his skepticism, adding that while "well-intentioned," the ban will lead to "the introduction of Digital ID via the back door."

VPN services are security tools that millions of Brits use on a daily basis to secure their internet connection and improve their digital privacy. However, as they can allow people to change their IP address and spoof their location, they can also be used to evade mandatory age checks.

When asked whether children may use VPNs to bypass restrictions, Keir Starmer told reporters that authorities "can enforce" the ban.

"I'm not prepared to say that because some children may try to get around it — and some may get around it — that is not a good reason to take the act of banning. I just don't accept that," he said.

UK's social media ban: all we know

Snapchat, TikTok, YouTube, X, Instagram, Facebook, and gaming platforms operating in the UK will soon need to prevent access to all under-16 users. It is expected to come into effect in spring 2027.

The ban specifically targets "user-to-user platforms" that enable public social interaction, with messaging services like WhatsApp and Signal excluded from the bill.

Building on the Australian model, the UK government promises to "go further than a blanket ban." As per the official announcement, the rules will include blocks on some harmful functions, such as livestreaming and stranger communication with children under-16s.

Lawmakers are also looking into potential curfews and breaks in infinite scrolling for under-18s, with more details expected in July.

It's not clear how platforms are expected to enforce these requirements, but the announcement suggests that mandatory age verification checks could be strengthened.

Whether a virtual private network (VPN) or similar tool could help children bypass the new rules will depend on how social media providers decide to implement age checks. This means that VPNs may work with some services and not with others.

VPNs could be used to mask people's location and make tech platforms think a user is based outside the UK. However, this is unlikely to work if checks are carried out at the App Store or device level.

Social media platforms are likely to know where their users are based due to someone's past activity. Additionally, platforms could work out a user's true location using a variety of different techniques, including network and SIM card data, and in-app GPS tracking.

However, there may still be other ways to circumvent the restrictions.

According to James Baker, Platform Power and Freedom of Expression Programme Manager at Open Rights Group, there are a "host of ways" a young person could circumvent a ban that don’t require a VPN connection.

He told TechRadar: "Evidence from Australia showed that many young people circumvented age checks by tricking the facial age estimation, or borrowing identity documents."

As more details become available, we will have a better understanding of how the ban will work in practice and any potential workarounds.

The UK has become the latest country to ban social media for under-16s, with Prime Minister Keir Starmer announcing today that "children will be given back their childhoods thanks to government action".

Following Australia's decision to lock teens out of popular social media apps in December 2025, the UK has promised "world-leading additional restrictions" on features like live streaming and strangers communicating with children.

The landmark legislation, which the UK government says is "backed by 9 in 10 parents", is expected to be brought before Parliament before Christmas, and could then come into force in Spring 2027.

So how exactly will the social media ban work, and what does it mean for children in the UK? You can follow all of the latest updates here live...

UK social media ban — a quick primer

Hello, and welcome to our liveblog on the UK's landmark social media ban for under-16s.

We'll be rounding up all of the latest news, reactions and more here today, but first a quick primer on what's happened.

The UK announced the social media ban for under-16s this morning. The statement says that social media is "designed to be addictive" and that the restrictions will give mean "less time for scrolling and more time for play".

The government says it will "use the same model for a social media ban as Australia" and that means the platforms will include Snapchat, TikTok, YouTube, Instagram, Facebook and X. It won't include private messaging apps likes of WhatsApp and Signal.

If it's passed by Parliament later this year, the ban is expected to come into force from Spring 2027.

Which platforms are affected?

The UK government's statement lists some of the major platforms that will be affected by its proposed ban. These are

• Snapchat
• TikTok
• YouTube
• Instagram
• Facebook
• X

The UK government says that "we do not intend for messaging services like WhatsApp and Signal to be included in the social media ban".

However, there are also planned restrictions for "so-called AI ‘romantic companion’ chatbots – designed to simulate sexual relationships or roleplay with users", which will "have to enforce a minimum age of 18".

The statement adds that "similar intimate functionalities will be restricted for under-18s on AI chatbots more widely".

This is an 'Australia plus' ban

As expected, the UK's proposed social media ban for under-16s is following a so-called 'Australia plus' model. That means it's following the thrust of Australia's legislation by restricting access to social media apps for children, but also adding extra restrictions for platforms that aren't banned.

The UK says this will include "world-leading blocks on harmful functions such as livestreaming and stranger communication with children for under-16s" and will affected "a wider range of online services, including on gaming sites".

And that's not it — the government says it will "also be looking in more detail at overnight curfews and breaks in infinite scrolling for under-18-year-olds". Exactly how this might be implemented isn't clear, which is why Prime Minister Keir Starmer has said the UK will "set out more detail in July".

UK says it will "learn the lessons" of Australia ban

Reports have claimed that Australia's social media isn't proving very effective, with research from the Molly Rose Foundation claiming that over half of under-16 users were still on TikTok, YouTube, and Instagram.

The UK government says it will "learn the lessons from Australia’s experience" by introducing "more highly effective age assurance (HEAA) measures to support compliance, making it far harder for children to bypass safeguards". Exactly what that entails, and how it will be balanced with privacy concerns, isn't yet clear.

Ban is "backed by 9 in 10 parents"

The UK government is pretty confident its social media ban for under-16s has public support and will be passed by Parliament "before Christmas".

It says the announcement follows "one of the biggest national conversations held by this government" with over "116,000 responses submitted by parents, children and experts across the country".

In those responses, "9 in 10 parents said they would support a social media ban for children under 16s", it said. Surprisingly, the government added that most "young people" also backed action" with "two-thirds agreeing that children younger than 16 should not be allowed to use at least some social media platforms".

That said, it didn't clarify exactly what it meant by "young people" and some inevitable controversy will arise more from its implementation than the broader idea.

How will the ban work?

The specifics of how the UK's social media ban will work is down to the country's communications regulator, Ofcom. The government says "Ofcom will conduct a rapid study on what is effective age assurance for verifying whether someone is over 16".

Ofcom has said it's been behind "some of the strongest changes" for online safety regulation, which includes porn sites being required to carry out age checks.

This means the UK social media ban will likely rely on technologies like digital ID and face scans — techniques that'll no doubt kickstart another privacy debate. VPNs will also likely in the spotlight, given their role in allowing people to get around similar blocks.

Not everyone backs the ban

The UK's proposed social media ban for under-16s isn't backed by all experts, despite the government's confidence that it has public support.

Professor David Ellis, Chair of Behavioral Science at the University of Bath and a member of the Institute for Digital Security and Behavior, said: "This ban is based on worry, not evidence. The evidence base as it stands suggests social media has a minuscule effect, if any, on teenagers — particularly once you account for the other factors we know shape childhood development".

"It's also unlikely to be straightforward to enforce, given what we've seen elsewhere, and it risks pushing teenagers towards less regulated parts of the internet," he added. "Worse, it lets social media companies off the hook: they can divert resources away from making platforms safer, despite the fact that many young people will simply remain on them".

Is there more to come?

While the ban is currently aimed at under-16s, Children’s Commissioner Dame Rachel De Souza wants measures extended to 18-year-olds across several key areas.

“Any online service – not just social media, but gaming and other platforms – that uses harmful features should be banned from accessing under-18s unless and until it can prove it is safe.”

‘Harmful features’ is the term being used throughout this process, likely to allow further features to be added in the future should they be deemed applicable. That said, the Commissioner explicitly mentions addictive scrolling, explicit content, and unwanted strangers in her statement.

Measures surrounding under-18s are to be looked into in more detail in July. However, there’s currently nothing to suggest this will extend to a full ban like that enforced today.

Do you need to do anything?

Thankfully, for now, all you need to do is sit tight and wait for new information. The Government has said it will provide details to families and children ahead of the ban's enforcement.

If you're an adult, the ban will likely take a similar shape to the enforcement of the Online Safety Act age verification measures last year. This means that most likely, your account will automatically be deemed to comply if:

• It's been open for 16 years or longer
• it's linked to an email account that can prove you are over 16
• A bank card is associated to the account that can prove your age

Should you be required to verify your age, it will likely use methods including ID checks, facial scanning, or bank card verification.

If you've already verified your age for services as a result of the Online Safety Act, you shouldn't need to do them again either!

Will it work? Parents are split in polling

More responses to the UK government's plan are coming in.

YouGov has just released a poll that shows while 77% of UK parents with children under 18 support the ban (a point over all Britons in general at 76%), only 45% think it will be very or quite effective at curbing social media use.

59% of the population as a whole think the ban will be not very effective at stopping under-16s from using social media.

Greens say offline support is needed

How are the UK's other parties responding to the ban?

The UK's Green Party has said it "welcomes action to address the harms social media can cause to young people. The impact on mental health and online safety is well documented as is the huge concern among parents, teachers and many young people themselves. Stronger safeguards are clearly needed."

However it added, "organisations including the NSPCC and the Molly Rose Foundation have warned that a blanket ban could leave some young people, particularly disabled and LGBTQIA people, more isolated and cut off from support. We also need to see real investment in youth services and creative activities for young people to fill the void that will be created by this ban."

This echoes the words of Lisa Nandy, the UK's Secretary of State for Culture, Media and Sport, who said "Keeping children safe online must go hand in hand with giving them more opportunities offline."

More UK party leaders weigh in

Sentiment among other parties and their leaders is spilt.

Kemi Badenoch, the Conservative party leader, has called the ban "fantastic news," saying it's "an important step in helping parents protect childhood for children."

Meanwhile Liberal Democrat leader Ed Davey noted that while "families have been crying out for action to protect children from harmful social media" he and his party are "really worried that the government hasn't listened, and has instead come up with a half-baked policy that won't keep children safe."

Reform UK leader Nigel Farage doesn't think the ban will work "given the mass adoption of VPNs" adding that this move is "the introduction of Digital ID via the back door." He instead says that "handsets for children with limited features" are the best option — suggesting he's either yet another dumb phone fan, or isn't entirely aware of modern phone's parental controls like the ones Apple just added to iOS 27.

Meta and YouTube respond

Platforms are also sharing their thoughts on the UK's plans.

Speaking to the media a YouTube spokesperson has said "YouTube is a vital resource for young people, educators and parents, external. Blanket bans push kids out of such curated, supervised, beneficial experiences and towards anonymous, less safe services."

Meta (Facebook, Instagram, WhatsApp) has echoed YouTube's response, adding that any targeted age based restrictions should be done on device "so people aren't asked to hand over ID to dozens of individual services to prove their age.”

How will 16 and 17-year-olds prove their age?

When you're trying to prove you're over 18 there are a few methods like a driver's licence or a credit card check that can be used to verify your age. For people aged 16 or 17 there are fewer options, and we'll need to wait and see what Ofcom proposes they use as details of the UK government's plans are hashed out.

Options they could use include provisional driver's licences, bank account information, or passports if they have them.

Whatever verification method is proposed could go hand-in-hand with the UK's legislation to lower the voting age from 18 to 16 by the next general election.

We have our first viral reaction

The mood in UK classrooms today appears to be somber, as this BBC report captures brilliantly.

First, the reporter asks under-16 students to raise their hands if they support the ban — a request that's inevitably met by stunned silence.

Then, when asked what she will do instead of the nine hours per weekend she typically spends on social media, the student Isabella replies "stare at a wall". It's fair to say this isn't going down well with many — and if you've grown up with social media and use it as a communications tool, that's understandable.

Is the evidence really there?

Is there any scientific evidence that social media use harms the brains of children? Not really, as academics told a Science, Innovation and Technology Committee this week.

Professor Denis Mareschal, who is the director of the Centre for Brain and Cognitive Development at Birkbeck College, said "There is very little, if any, causal research in the early years".

And those views were echoed by University of Cambridge Professor Sarah-Jayne Blakemore, who said that the impact of "digital devices or social media" on adolescent brains amounted to "almost nothing".

That's not to say there's no impact, of course, just that the data doesn't yet support the theory that social media's impact on young brains is causational, not just correlational.

• Read more: Brain experts tell the UK government there's 'very little' scientific evidence that phones are harming kids — but a social media ban is going ahead anyway

Bluesky is also included in the ban

The dust is starting to settle on yesterday's bombshell announcement of a UK social media ban for under-16s — and more details are emerging.

For example, Liz Kendall (Secretary of State for Science, Innovation and Technology) has just confirmed (below) that Bluesky will be included in the age restrictions, as it's on Australia's list of affected apps.

If you want to see the full list of affected apps, check out our guide on 5 things you need to know about the UK social media ban.

• Read more: How will the UK's social media ban actually work? Here's the full list of affected apps — and 5 things you need to know

The 2026 FIFA World Cup spans three countries, drawing millions of fans across the US, Canada, and Mexico borders. As travelers hop between cities like New York, Vancouver, and Mexico City, many rely on the best VPN services for security and content access.

Yet, a key concern looms at the checkpoint: Is using a Virtual Private Network (VPN) safe during border crossings and while navigating these countries? While VPNs remain completely legal in all three host nations, federal law doesn’t guarantee a smooth experience.

From border inspections to state regulations, there's constant room for unexpected hurdles. So, understanding how privacy tools intersect with physical borders can help you enjoy a trouble-free tournament.

Can border patrol search your phone for a VPN?

Border officials in the US, Canada, and Mexico can search electronic devices and inspect your phone’s contents, including installed apps. However, possessing a commercial VPN isn’t illegal, nor can you be denied entry solely for having it downloaded.

Yet a visible VPN icon may prompt further questioning. In the US, refusing to unlock a device can result in its seizure for weeks, even months. While US citizens can’t be denied entry for this refusal, non-citizens face greater risk of being turned away.

Secure your device with a strong passcode, but know that protection has limits at borders. If the VPN app causes anxiety, delete it before crossing and redownload it once cleared. Alternatively, providers like Proton VPN offer hidden icons to conceal the app from your home screen.

The impact of age verification on VPN use

VPNs are recognized as key privacy tools across the US, Canada, and Mexico. That legitimacy means federal governments won’t prosecute personal users simply for having one installed. However, new state-level restrictions are coming into play.

Take Utah’s Online Age Verification Amendments. This law doesn’t ban VPNs outright, but requires adult websites to enforce age checks on anyone physically located in Utah, holding sites legally responsible if a user bypasses the check via a VPN.

Because they face fines for non-compliance, websites are now forced to aggressively detect and block known VPN traffic to protect themselves. While you won’t be arrested for using a VPN, you may find your connection blocked by these filters.

It’s important to distinguish between breaking the law and violating Terms of Service. Downloading or sharing copyrighted content is illegal regardless of a VPN. Conversely, connecting to Fox Sports or TSN from overseas via a VPN isn’t a crime – but it may be a breach of contract.

How to keep your VPN running smoothly

If you hit ISP blocks or streaming bans when traveling, obfuscation is the solution. Standard VPN connections leave tell-tale signs that firewalls and platforms can spot. To bypass this, use features like NordVPN’s Obfuscated Servers or Norton VPN’s Mimic protocol.

These tools scramble data to look like regular HTTPS traffic, preventing ISPs from throttling your connection and making it harder for services like CTV, Sling TV, or YouTube TV to block your IP. By enabling these settings, you can expect a smoother experience throughout the tournament.

The bottom line for World Cup travelers

You’re not breaking the law by having a VPN, but how you handle it depends on your comfort level. There’s no obligation to keep your VPN visible during border inspections – some travelers prefer leaving it off or deleted at checkpoints to avoid scrutiny, then reinstalling afterward. Others keep it installed for convenience and rely on hidden icon features if available.

Once inside the host countries, use obfuscation to bypass blocks. By choosing the approach that balances your security needs with peace of mind, you’ll be ready for the 2026 World Cup!

This year, London Tech Week is set to be remembered for an 'innovation' in how we use our devices — but not one that tech fans would expect or, perhaps, want.

On its opening day on Monday, British Prime Minister Keir Starmer took the stage at the Olympia event and gave Big Tech an ultimatum: Apple and Google have three months to implement on-device scanning technology to prevent children from accessing explicit images.

"If we are serious about unlocking the opportunities that tech can bring, then we must also be serious about protecting our children from those who look to abuse it," said Starmer in his speech.

For the government, the move is non-negotiable to stop the rise in online child sexual abuse material (CSAM) and grooming incidents. It's also a feasible task, according to Starmer.

"This is not an impossible challenge," he said, threatening to "change the law" if tech companies don't comply.

A wave of privacy backlash was quick to follow online, especially among privacy tech providers and advocates.

Talking to Bloomberg, President of the encrypted messaging app Signal, Meredith Whittaker, went as far as to say that her company "would rather exit a market than undermine the technical guarantees that people trust for their privacy".

So, is on-device scanning the solution to children's safety that we were waiting for, or a disproportionate response set to erode privacy and security and expose confidential communications? Let's lay out all we know.

How on-device scanning could work

Right now, we know very little about how these scanning technologies will work in practice. But we do know that Apple, Google, and other companies have been making progress with on-device detection functionalities and children's safety.

After introducing broader child safety features and age checks for UK iPhone users, this week Apple unveiled some new tools to help parents protect kids and teens online. These include a simpler way for guardians to manage child accounts and age ratings in the App Store, alongside a SensitiveContentAnalysis framework for developers to build apps that can check for and blur nudity.

Communication Safety is another tool that Apple says will enhance child safety while also safeguarding privacy. Turned on by default for accounts under 18, the feature automatically blurs explicit images received via iMessage, AirDrop, FaceTime video messages, and shared photo albums.

Google has also been making progress. Parents using Android can already manage screen time, track the location of their children's devices, and block camera access. The Big Tech giant also includes a Sensitive Content Warning feature on Messages to detect and blur explicit images.

These are certainly a good start, but none address the more regularly used methods of messaging communications among teens, like Snapchat and Instagram.

Equally, blurring explicit harmful content is one thing, but blocking it altogether is a step further that requires a very high bar for precision to avoid unintended consequences and trigger false positives

That balance, however, is something another company promises to have found.

UK cybersecurity firm SafeToNet — and the linked children's online safety advocate group SafeToNet Foundation — have developed HarmBlock: a technology that works at the operating system level to detect and block explicit images in the camera app, messages, and even encrypted environments like WhatsApp.

Talking to TechRadar, SafeToNet's Co-Founder, Sharon Pursey, explains that HarmBlock works by scanning for image pixels on three different levels: at the screen, on storage, and at the point of broadcast.

Pursey is assured that the rate of accuracy is 98% plus and says that HarmBlock can easily distinguish between an explicit sexual image and an innocent picture of someone on a beach, for example.

So, are SafeToNet, Google, and Apple working together to build what the government's asking for? "I can't deny or confirm," Pursey told TechRadar.

A Home Office representative, however, confirmed to us that the "technology is already there," but did not specify which ones. The Home Office also told us that what the government is now asking is "to apply it differently".

Can scanning ever be private and secure?

Experts have long warned against the idea of so-called client-side scanning. Back in 2023, experts' criticisms led UK lawmakers to decide to halt any scanning requirements within the Online Safety Act until it was technically feasible to do so privately and securely.

Now, the government appears to be convinced that that day has arrived, but technologists and privacy advocates aren't buying it.

From a technological point of view, Mullvad VPN's Founder, Daniel Berntsson, believes that operating system-level scanning will inevitably harm the trust that users have in their devices. And this, he explains, will consequently impact people's privacy rights.

"No one will be able to trust their ultimately government-controlled device for anything requiring privacy, including, among lots of other things, many uses of VPN services," Berntsson told TechRadar.

Robin Wilton, Internet Society's Senior Director for Internet Trust, echoes these concerns. He argues that these functionalities will introduce security flaws into the OS that could later be exploited by criminals and hostile governments alike.

"Whether it’s done by weakening encryption, keeping copies of users’ keys, or reading their messages before they are encrypted, the bottom line is that users can no longer have confidence in the security or privacy of what they send and receive," Wilton told TechRadar.

In a post on X, the UK's Home Office Secretary, Shabana Mahmood, ensured that "there is no reporting, no data collection, no monitoring, and no images leaving the device".

But, Policy Manager at the Open Rights Group, James Baker, isn't convinced.

"I don't know how the Home Secretary can claim that no data will be lost when they're telling companies to develop this software," Baker told TechRadar. "And if she knows that the software exists, then why isn't she being open about saying what it is they're going to do?"

From her side, Pursey from SafeToNet, assures that HarmBlock has been built in a totally privacy-preserving way. Images, she explains, are never stored, but deleted as soon as they are blocked. Everything happens on the device.

Security experts, however, are also all worried about the risk of mission creep. Once these features are on the device, they argue, it would be easy for either the current or future governments to expand on these scanning abilities.

In a fierce open letter, Signal raised this exact problem (among others) by noting: "We know that mass surveillance and censorship capabilities, however sincere-sounding the promises of those who initiate them are, never remain narrowly scoped."

The age verification paradox

While we need to wait and see how the UK government’s proposed final detection and blocking tools will work in practice, there is another intrinsic requirement that's making privacy advocates worried — mandatory age verification.

To determine whether a device is owned by an adult or a child, all users will have to go through ID checks. This, according to Silkie Carlo, director of Big Brother Watch, "will only result in population-wide ID checks for all of us to use our phones, tablets, and laptops".

Beyond whether that's an ethically proportionate request, there may also be a serious privacy and security aspect. Current age verification methods have so far proven to be inadequate in protecting people's sensitive data. The exposure of 70,000 Discord users’ government-issued ID photos because of a third-party vendor should be a stark reminder.

This was among the reasons that led to a coalition of over 400 scientists calling for a halt on age checks until a "scientific consensus" is reached on the balance of benefits versus harm to the wider population.

This is exactly why, according to Baker from Open Right Group, on-device scanning cannot be done in a privacy-friendly way.

"It is going to harm everyone's privacy because everyone is going to have to go through a digital ID checkpoint just to access their device and to access the internet," he told TechRadar.

What's next?

It's hard to say at this stage whether the UK plans to force locked devices on children is the right way to address online harms, nor if it's really possible to do so without breaking devices' privacy and security for all Brits.

What's certain, however, is that this is only the first step in the current commitment to making UK kids safer online.

Drawing on the results of its safety consultation, the government is expected to announce a social media ban for teens next week. According to indiscretions reported by Politico, restrictions will target specific features like livestreaming and disappearing messages.

For digital rights experts, however, a ban isn't a real fix. Commenting on this point, Wilton from the Internet Society told us: "I think secure and privacy-preserving age verification technology can be developed — but that doesn’t solve the human or societal parts of the problem".

It’s a position shared by child safety group, 5RightsFoundation, which has urged the government to start challenging the harmful tech companies' business model rather than policing kids.

Baker, from Open Rights Group, remains optimistic that it isn't too late to reverse this global direction, though. He told TechRadar: "I think it's going to spawn at some point a new global movement of people who are fighting for their free expression rights and open access to the internet. So, watch that space."

With more threats to come for digital freedom expected next week, we may not have to wait too long.

Three months, 88 days, 2,093 hours — that's how long people in Iran were plunged into near-total digital darkness, cut off from the global internet. Connectivity began to be restored on Tuesday May 26, but experts warn that "the internet is not connected" as severe restrictions persist.

According to the latest data from Doug Madory, director of internet analysis at Kentik, traffic has only reached 60% of pre-January 8 levels — the day authorities enforced the first wave of blackouts to crack down on massive anti-government protests.

While the government insists that full restoration "would be a gradual process," Amir Rashidi, Director of Internet Security and Digital Rights at the Miaan Group, describes this partial easing as a "new type of internet cutoff," explaining that "the connection is there, but the traffic isn't."

TechRadar spoke with Mahsa Alimardani, a London-based Iranian internet and human rights expert, to understand the devastating impact of the shutdown, what this partial restoration actually means for citizens, and what could happen next.

• 73% of surveyed fans trust public Wi-Fi just by its name
• Evil twin attacks exploit stadium networks
• Using a quality VPN secures your data on public networks

With the 2026 World Cup on the horizon, millions of football fans are set to unintentionally expose themselves to cyber threats by prioritizing connectivity over security on stadium Wi-Fi networks.

A recent survey commissioned by ExpressVPN, one of the best VPN services on the market, reveals a startling disconnect between fan enthusiasm and cybersecurity awareness ahead of major tournaments like the 2026 World Cup.

A survey of 6,000 football fans across six markets revealed that 73% said they would trust and connect to a public Wi-Fi network if it used the name of a venue they were attending. Yet fewer than four in 10 fans said they could reliably tell a real public Wi-Fi network from a fake one.

This willingness to accept danger stems from several factors: the desire to share live moments instantly on social media, check real-time scores and stats, stream matches, or simply stay connected while traveling to venues. For many supporters, all of this feels like an essential part of traveling, so they willingly connect to unsecured networks despite the risks.

"Cybercriminals don't need sophisticated tools"

Stadium Wi-Fi represents one of the most vulnerable points in a fan’s matchday experience. These large-scale public networks create ideal conditions for cybercriminals to deploy simple yet effective attack vectors.

Among the most prevalent threats is what's known as evil twin attacks, a technique that involves cybercriminals setting up rogue Wi-Fi networks that mimic legitimate venue access points to trick people into connecting.

As Aaron Engel, ExpressVPN’s Chief Information Security Officer, explained: "Cybercriminals don't need sophisticated tools to target football fans. They can name a network after a stadium, hotel, or fan event and wait for people to connect. Our research shows that familiar names carry more trust than they should."

Once connected to a rogue network, attackers can intercept login credentials, financial data, and personal messages. This exposure can lead to unauthorized account access, identity theft, and financial fraud.

The consequences of falling for such a trap extend far beyond momentary inconvenience, with younger fans facing the highest stakes. In the US, for example, 30.2% of fans aged 18 to 29 admitted to checking their banking or financial apps while connected on stadium Wi-Fi.

With personal information becoming increasingly valuable, the price of connecting to that unsecured network could end up being surprisingly high.

How football fans can protect themselves

Fortunately, protecting yourself doesn't require sacrificing connectivity or the ability to share your matchday experience. Taking several straightforward security measures can significantly reduce exposure to these common threats.

First and foremost, fans should avoid conducting sensitive activities on public Wi-Fi networks entirely. Banking applications, shopping purchases, and password changes should all wait until you’re on a secure, private connection.

Using a reputable virtual private network (VPN) encrypts all of your traffic regardless of the underlying network quality, creating a secure tunnel that prevents even advanced attackers from reading transmitted data.

Additionally, travelers should disable automatic Wi-Fi connections before arriving at destination stadiums. Supporters should also ensure their device operating systems and applications are updated before travel, and enable two-factor authentication (2FA) on all accounts.

By combining these practices, football fans can navigate the 2026 World Cup with confidence and focus on the game rather than security threats.

• Beeline’s 'whitelist VPN' automatically unblocks foreign platforms
• The feature is completely free for Bee subscribers
• The move restores access to services that voluntarily left the market

In a move that bypasses Western corporate boycotts without running afoul of the Kremlin's internet censors, major Russian mobile operator Beeline has officially launched a built-in "whitelist VPN" for its users.

Available automatically as of June 9, 2026, the feature restores direct access to a host of foreign digital services, including Spotify, Netflix, Ticketmaster, and the hit mobile game Brawl Stars, that suspended their operations in Russia following the invasion of Ukraine.

Crucially, users won't need to hunt down the best VPN or configure complex proxy settings on their devices. According to the telecom provider — as reported by Russian financial news outlet RBC — the new tool is integrated directly for customers on the company's Bee subscription plan, requiring no additional app downloads or extra payments.

Sergey Anokhin, Beeline's General Director, noted that the operator secured support from Russian regulators to implement the feature following discussions with several government departments. Because these specific Western platforms voluntarily left the Russian market rather than being explicitly banned by the state communications watchdog Roskomnadzor, granting access to them does not violate federal censorship laws.

Why 'whitelist VPNs' are needed in Russia

Since 2022, the Russian internet landscape has become heavily fragmented. While Roskomnadzor has systematically blocked independent news outlets, social media networks, and various circumvention tools, many Western tech companies voluntarily geoblocked their own services for Russian IP addresses.

This left Russian citizens in a digital gray zone: unable to access popular entertainment, even though those platforms were never officially outlawed by the state. Accessing these sites required third-party software, which has become increasingly difficult in the past few months as the government escalates its crackdown on traditional VPN services.

Since 2017, VPNs operating in Russia have been legally required to restrict access to resources on the registry of banned information — Human Rights Watch reported. In 2025 alone, Roskomnadzor reported blocking over 400 VPN services, according to Russian news outlet Kommersant. More recently, the agency has even been accused of launching active DDoS attacks against non-compliant providers.

The concept of a localized, ISP-level whitelist offers a government-approved middle ground. It is not a state-owned VPN for the entire country, but rather a curated whitelist of approved services that restores access to approved platforms without unlocking politically sensitive material.

Speaking to RBC, Anokhin outlined the rationale behind the launch. Translated from Russian, he stated: "There are popular and highly demanded services among Russians that are not banned in our country, but decided to no longer work here. To use them now, you need to turn on a VPN or resort to the services of intermediaries; this is inconvenient and not very fair."

Beeline also released an official statement confirming the origin of the tool, noting: "The idea of 'white VPNs', which was discussed at the St. Petersburg International Economic Forum, quickly transitioned into practice and convenience for users of Beeline's services."

With Beeline taking the first step, competing telecom operators, including T2, are reportedly discussing similar initiatives to improve their own client experiences while remaining compliant with Russian legislation. While the Kremlin has reiterated that there is no legal liability for citizens using standard VPNs, official telecom-level workarounds appear to be the new frontier for Russian web access.

• Fake X-VPN installer found to deploy credential-stealing malware
• X-VPN was not hacked; only those downloading the fake app were affected
• First targeting crypto traders, criminals widened to privacy-minded users

A new report has uncovered an uncomfortable truth for anyone who downloads software from somewhere other than the official source: a trusted-looking app can be weaponized against you.

Threat researchers at Cyderes have been tracking an active campaign that uses a fake X-VPN installer to deploy malware known as the STX RAT, which steals credentials and hands attackers remote control of an infected machine.

Crucially, this is not a breach of X-VPN, a provider that has just proved its privacy credentials with an independent no-log audit. The company's official download channels were unaffected, and the only people at risk were those who installed a malicious copy from attacker-controlled sources.

This is a stark reminder that, even if you pick one of the best VPN services around, you still need to be careful with downloads. As Google warned in its November 2025 fraud advisory, scammers are increasingly disguising malware as legitimate VPN apps to steal users' data.

How the fake X-VPN attack works

As the Cyderes' findings show, attackers took genuine X-VPN program files and slipped in one extra malicious file named CRYPTBASE.dll, a technique called DLL sideloading.

Because of a quirk in how Windows finds that file, the app appears to install normally while the hidden file injects the STX RAT malware straight into the computer's memory, leaving little trace for antivirus tools to catch.

Once active, STX RAT can harvest saved browser passwords and session tokens, collect system information, run commands remotely, and talk to its servers over ordinary encrypted web traffic, so it blends in. The fake VPN was one of 11 malicious packages tied to the operation, alongside trojanized installers for Binance, Bybit, MetaTrader 5, Exodus, and Steam.

The campaign began by targeting cryptocurrency traders, then pivoted to a trojanized X-VPN package to reach privacy-conscious users who often handle sensitive credentials. The same malware spread earlier through a brief compromise of the CPUID website, which Kaspersky linked to more than 150 victims across several countries and industries.

To its credit, X-VPN responded quickly, releasing Windows version 77.5.3 with hardened DLL loading controls. Users of the X-VPN app should update to that version or later.

How to avoid fake VPN apps

The good news is that the single most effective defense here is also the simplest and requires no technical skill. Most of these attacks fall apart the moment you refuse to download software from anywhere other than the official source.

Use the vendor's own website or an official app store, and avoid installers from third-party repositories or links sent to you. In this campaign, the files lived in an unknown Bitbucket repository.

There have been other cases of criminals using a fake free VPN to spread malware, so treat suspiciously cheap apps as a red flag.

Type the address yourself rather than clicking ads or search results, which avoids look-alike sites.

Keep software updated and run reputable security software for an extra layer of protection. Because STX RAT runs in memory and tries to evade detection, a modern antivirus or endpoint tool gives you an extra layer of protection alongside good download habits.

If you think you installed a fake VPN, assume your passwords and sessions may be exposed. Change important passwords from a clean device, sign out everywhere, and turn on two-factor authentication. A VPN is a valuable privacy tool, but only when you install the genuine article from a source you can trust.

• Russia's media regulator has proposed a "state VPN" for IT specialists
• Roskomnadzor seeks to restore access to developer platforms inadvertently blocked by its own VPN crackdown
• Industry experts worry the tool could enable state surveillance and create a "privileged tier" of internet users

In a deeply ironic twist, Russia's federal media regulator, Roskomnadzor, is planning to create a unified “state VPN” to help the country's IT specialists bypass its own aggressive internet restrictions. The proposal aims to solve a problem of the government's own making: its war on censorship-circumvention tools is now preventing developers from accessing essential foreign coding resources.

The plan was unveiled at a meeting on June 8 between Roskomnadzor's deputy head, Oleg Terlyakov, and several IT companies. As first reported by the independent Russian news outlet The Bell, the meeting was called after a wave of complaints from developers who found themselves cut off from vital international platforms. These include the code-sharing site GitHub, repositories for the Python programming language, and the design tool Figma.

Instead of loosening its grip, the regulator's proposed solution is a government-controlled VPN designed for "those who really need it."

This move highlights a growing conflict within Russia: the state’s desire for a tightly controlled internet is clashing with the practical needs of its strategically important tech industry.

While a VPN is the right tool for the job, relying on one of the best VPN services, which prioritize user privacy through audited no-logs policies, is the standard for secure access, something a state-run tool is unlikely to offer.

A cure worse than the disease?

Details on this unified state VPN are still scarce, but the reaction from Russia's IT community has been overwhelmingly negative.

Rather than welcoming the proposal, developers and industry experts have labeled the idea as "shady." Their main fear is that a centralized, state-controlled VPN is the perfect tool for monitoring and surveillance.

Routing all traffic through a single, government-managed gateway would give Roskomnadzor unprecedented visibility into the work of every developer using it. One source who attended the meeting told reporters, "Cutting off Russians from international development tools will be even easier if everyone starts using the same VPN."

There are also fears it could backfire internationally. "It could easily block access from abroad, and the idea itself seems shady," another source from a Russian IT association told The Bell.

The proposal, commentators fear, also risks creating a two-tiered internet, where a "privileged caste with full access will emerge."

Russia's war on VPNs

This latest development is just one chapter in the Kremlin's long-running battle against tools that offer Russians a window to the uncensored internet.

While Roskomnadzor has been blocking access to popular VPN services for years, blocking has now intensified as, since April, Russian providers have the obligation to detect and block active VPN connections.

More recently, the country's censorship body was even accused of launching DDoS attacks against VPN providers in an effort to disrupt their services. Despite these aggressive measures, Russian officials have also had to concede that completely banning VPNs is "simply impossible."

Faced with an unbreakable technology and an increasingly isolated digital economy, Roskomnadzor's plan to build its own VPN seems less like a solution and more like a Trojan horse, offering access with one hand while potentially tightening surveillance with the other. For Russia's developers, it's a "fix" that few are likely to trust.

• UK government announces three-month ultimatum for big tech companies to improve child safety
• Privacy advocates warn the mandate could undermine privacy
• Signal is among those warning that the proposal will create more harm than good

The UK's plan to become "the first country" in the world where children are prevented from accessing explicit pictures on their devices is facing a growing backlash among privacy advocates and tech companies.

On Monday (June 8), British Prime Minister Keir Starmer took the stage at London Tech Week to give major tech firms, including Apple and Google, a three-month ultimatum "to prevent children from sending and receiving sexually explicit images."

End-to-end encrypted messaging app provider Signal was quick to publicly respond to Starmer's announcement, warning that the proposal won't safeguard children but will endanger all citizens instead.

In a post on X, VPN provider NymVPN argued that the mandate could usher in automated mass surveillance on consumer hardware. Meanwhile, UK-based digital rights group Big Brother Watch warned that these new obligations will lead to "the death of anonymity and internet privacy."

However, Starmer appears determined to implement these new safeguards. "I expect tech firms to make that happen. This is not an impossible challenge," Starmer said during the official announcement.

Tech companies have until September to comply with the new rules. "But if they choose not to, then we will act and change the law," Starmer added.

The development comes as the government is expected to release the results of its consultation on children’s use of social media, which could introduce age restrictions on using VPN services.

The UK's child safety plans

The UK plan requires smartphone and tablet manufacturers like Apple and Google to activate built-in features or other technical solutions on smartphones and tablets "to detect and block nude images for children."

These changes are expected to apply to all UK devices, including both existing and newly sold smartphones and tablets, while new legislation could impact operating system providers and other companies involved in the devices' supply chain, such as retailers.

The government maintains that these features won't affect devices owned and used by adults who verify their age. However, this likely means everyone will be required to verify their identities to continue using their devices normally.

These requirements follow Apple's recent decision to introduce broader child safety features and age checks for UK iPhone users — but the government's new ultimatum goes a step further.

As the government notes, nudity detection tools do not currently impact children's use of the camera, third-party messaging services, or search functions. Consequently, children may still be exposed to inappropriate material.

"The government therefore wants Apple and Google to block nudity across the whole device by default, so they can only be deactivated via age assurance," the announcement reads.

Why are privacy advocates concerned?

In an open letter, Signal criticized the requirements as "dystopian," arguing that "surveillance is not safety."

According to the secure messaging service, forcing all UK residents to prove their age or have all their content scanned creates a dangerous precedent.

"We know that mass surveillance and censorship capabilities, however sincere-sounding the promises of those who initiate them are, never remain narrowly scoped," the letter reads.

Signal also argued that these requirements will not keep children safe, stating that children "deserve their human right to privacy."

Echoing Signal's concerns, Silkie Carlo, director of Big Brother Watch, also argued that the plan will fail to address the underlying causes of online harm.

"This will only result in population-wide ID checks for all of us to use our phones, tablets, and laptops," she said.

Beyond these "intrusive identity checks," Carlo warned of the unintended consequences of enforcing device-level restrictions on messaging, streaming, and browsing.

She stated that these mechanisms could "raise the potential of spyware in our pockets that will be exploited for other purposes before long."

Digital rights advocates have long warned about the privacy implications of mandatory age verification and scanning obligations. Recently, a coalition of over 400 scientists called for a halt on age checks until a "scientific consensus" is reached on the balance of benefits versus harm to the wider population.

Apple’s 2026 WWDC event promised some serious upgrades for Siri, macOS and parental controls.

Here at TechRadar our live WWDC 2026 coverage tracked everything the announcement included. If you need to catch up, we've summarized the 17 things we learned during the event.

And though we’ll continue covering all the on-device security upgrades, there’s still good reason to pick up a VPN subscription.

That’s where NordVPN comes in. NordVPN is the best VPN overall as well as our choice for the best VPN for iPhone, and with this deal you can now get it for an excellent price:

Do I still need a VPN if I have an iPhone?

Apple is keen to let its users know about its privacy and security credentials, such as offering users the opportunity to ask apps not to track their activity.

Apple has built a reputation as the ‘safer choice’ for those concerned with cybersecurity, with popular wisdom suggesting that iPhones, iPads, and MacBooks are less susceptible to data interception or malware than devices from rival brands.

However, there is one frontier that Apple can’t fully control, and that’s online privacy. Because accessing the internet depends on your ISP, public networks and companies outside of Apple’s purview, it can’t fully protect its users from online surveillance.

The best VPNs increase your digital privacy and shield your data from unwanted monitoring by ISPs. What’s more, NordVPN comes with a bevy of additional features to help keep you safe online.

While all three NordVPN plans offer a fast, reliable VPN with access to thousands of servers in the US and worldwide, the Complete plan adds advanced email monitoring, scam call filtering, an antivirus, and a dedicated secure search engine. Meanwhile, Prime adds insurance against identity theft (though its availability depends on your region).

Other VPN options

If NordVPN isn't ticking all the boxes, there are some great alternatives to choose from depending on your VPN needs.

Surfshark is even cheaper than NordVPN and offers a similar standard of features, including the option to upgrade to identity theft coverage.

And if you're an iPhone user but want to prioritize your Windows laptop, ExpressVPN is currently our pick for the best VPN for Windows users thanks to its blazing fast connection speeds on Windows devices.

• Windscribe now accepts cash payments for its 1-year Pro subscription
• Leaving a zero digital footprint, it gives users total financial anonymity
• Windscribe still strongly advises most users to stick to digital methods

When you think of buying the best VPN on the market, you generally expect a swift, fully digital transaction involving a credit card, PayPal, or perhaps cryptocurrency. What you probably don't expect is the option to stuff dollar bills into an envelope and mail them across the globe.

Yet, that is exactly what Windscribe has just introduced. The popular Canadian provider has rolled out a new feature allowing users to pay for their virtual private network entirely with physical cash.

According to the provider's announcement, the system is designed strictly for those who want absolute financial anonymity.

"Cash avoids the usual payment trail," the company explained. "No card number. No PayPal account. No app store subscription. No bank statement politely documenting that you bought privacy and immediately created a receipt for it."

However, in classic, sarcastic Windscribe fashion, the provider is aggressively trying to talk most people out of using it.

An "awkward analog side quest"

Mailing cash might sound like a throwback to a bygone era, but Windscribe asserts: "This is real, official, and somehow still a thing in the year of our lord."

By physically sending money, users remove the checkout middleman entirely. Your bank or local payment processor won't have any data logging your purchase of a privacy tool. In highly restrictive regions where purchasing a VPN might flag your bank account, this analog approach can be a crucial lifeline.

In launching this, Windscribe joins a very small, exclusive club of privacy-first providers. Competitors like Mullvad have long accepted cash payments, famously allowing users to send physical currency to their Swedish headquarters. Proton VPN also allows users to mail in bills to dodge the digital banking grid.

But while the privacy benefits are real, Windscribe is pulling no punches about the major drawbacks.

"Before you do, this is the slowest and riskiest way to pay," the company’s official billing page warns. The provider notes that envelopes can be "lost, delayed, damaged, stolen, or eaten by whatever lives inside the postal system." Because cash payments are inherently untrackable, the company cannot credit an account if the money vanishes in transit.

As a result, Windscribe is explicitly telling its general user base to stick to digital options.

"If that sounds dumb, congratulations, your pattern recognition is working," the company stated. "We've added the option available because privacy sometimes requires awkward analog side quests, not because we think everyone should start feeding paper money into the postal system."

Strict limitations on paper money

If you genuinely need a non-digital way to buy your VPN and are willing to brave the postal service, there are strict rules on what your paper money can buy.

Cash payments are limited to the one-year Windscribe Pro subscription, which currently costs $69 USD. You cannot use cash to buy custom plans, monthly rolling subscriptions, or lifetime memberships.

You are also entirely locked out of seasonal discounts.

Finally, any transaction made this way is completely non-refundable. If you send the cash, your only hope is that it arrives safely without interception.

For the average internet user looking to browse securely, setting up an account with a standard card or crypto wallet is a much safer, faster way to protect your online identity. But for that small subset of users whose threat model demands total detachment from the banking system, Windscribe is ready to receive your envelopes.

• Apple removed the state-backed MAX app from its App Store to comply with international sanctions.
• While the app still functions for existing users, Apple has cut off push notifications for calls and messages.
• The Kremlin has aggressively pushed MAX as a mandatory 'national messenger' to centralize domestic digital communications

Apple has removed Russia's state-backed MAX Messenger from the App Store.

Russian users first reported the app's disappearance on the evening of Wednesday, June 3, as it vanished from App Store search results and direct download links.

The developer behind MAX later confirmed to the state-run news agency TASS that the application is no longer available for download. Independent local sources have also verified that the platform remains unavailable on iOS devices.

While the MAX app continues to function normally for users who already have it installed, the developer confirmed that these users will no longer receive push notifications for incoming messages and calls.

In a statement to TechRadar, Apple confirmed it removed the MAX app from the App Store in accordance with sanctions compliance rules. The tech giant noted that it operates in compliance with the laws of the jurisdictions where it does business, though it did not specify which exact sanctions triggered the enforcement.

What is MAX Messenger?

Developed by tech giant VK — the company behind Mail.ru and the VKontakte social network — MAX launched March 2025 as a state-approved alternative to WhatsApp and Telegram.

From the outset, the Kremlin made it clear that the super-app was destined to become an essential part of citizens' digital life.

In June 2025, President Vladimir Putin signed a law establishing MAX as a "national multifunctional messenger." By September, the software became a mandatory pre-install on all new smartphones and tablets sold in Russia.

As Russia's internet regulator Roskomnadzor intensifies its throttling and disruption of foreign platforms like WhatsApp and Telegram, citizens increasingly turned to MAX. Previously, Telegram was one of the few global platforms accessible without a VPN.

Digital rights and security experts, however, have warned of its "enormous surveillance potential" since the launch of MAX.

More recently, the US infrastructure giant Cloudflare flagged MAX as "spyware," though the label was later removed, according to independent Russian news outlet Meduza.

Other technical analyses has suggested that MAX can detect whether users have a VPN connection enabled, alongside other invasive tools to spy on users' activities.

MAX has strongly rejected allegations that the app can spy on its users.

• New independent research suggests China is increasing its crackdown on VPN use
• One censorship expert suggested that a new censorship effort began in April
• Outbound web traffic remains incredibly low in China

New independent research and reports from mainland China suggest that the Chinese government is increasing its suppression of VPN use.

Research from the Global Public Policy Institute (GPPI) focused on the Xinjiang Uyghur Autonomous Region (XUAR) in northwestern China estimates that, at most, 4% of all outbound internet traffic was via VPN to a banned website in an average week.

The report was compiled over a period of months from more than 100,000 documents sourced from the Chinese company Geedge Networks.

China is well known for its internet censorship policies, and many major Western websites are banned or very hard to access through officially sanctioned networks.

The GPPI research also notes that the XUAR may be something of an outlier compared to the rest of mainland China due to ongoing oppression of the native Uyghur population, leading to increased caution and self-censorship.

Still, this estimate puts VPN usage at much lower levels than we see in the West. According to NordVPN’s 2025 VPN Survey, VPN use hit 29 per cent of the total population in the US and UK in 2025.

The research report reads: “Whether through technical means or through intimidation, Beijing has successfully dampened citizens’ ability to access a lot of the foreign platforms many people outside China use without a second thought.”

A recent report by Australia’s ABC News (no relation to the American network) suggests that Beijing initiated a new effort against VPN use in April 2026.

Speaking to ABC, US-based censorship analyst Eric Liu said that network providers in China were asked to block all VPN services from accessing their networks.

He added that VPNs would be suppressed at certain points in the calendar to limit communication, such as around the anniversary of the Tiananmen Square incident on June 4.

China’s telecom industry is highly centralized, and the authoritarian nature of its government means that official access to user information is both common and publicly known.

The ABC report also includes interviews with two people affected by increasing government pressure on VPNs. Both used anonymous pseudonyms.

Lin used a VPN to stay across celebrity news and updates on Instagram while in high school, but found that the same VPN was much less reliable when she returned to China from college studies in Austria.

Hong Kong resident Billy told ABC that the VPNs he relies on during visits to mainland China were becoming harder to access: “It’s becoming more difficult finding stable VPNs – China recently is very active on banning VPN services.”

Indeed, GPPI’s report found an uptick in WhatsApp use between May and June 2023, when authorities would be on “high alert” for mention of the infamous incident, but traffic to WhatsApp still only accounted for 2 per cent of outbound internet traffic in said period.

Are VPN’s available in China?

When we talk about China cracking down on VPNs, we should be clear that we’re talking about those that Chinese authorities deem to be unauthorized.

VPNs are technically available in China, but typically allow government oversight of all traffic, and may require special permission to access.

GPPI’s report identifies that businesses are allowed to use VPNs to access otherwise banned productivity apps – allowing Chinese and, say, American businesspeople to collaborate on a Google Docs file.

However, the things we consider when we talk about the best VPNs – security, and the ability to turn away prying eyes from your online activity – are not a given with China’s state-sanctioned options.

How does China stop people from accessing the wider internet?

China’s infamous Great Firewall blocks a large number of the websites and apps the rest of the world rely on. The methods by which the government enforces this policy vary from dissuasion to intimidation.

On the lighter side of the coin, China partners with and otherwise encourages native developers to produce apps and online services for the Chinese population. Where the west has WhatsApp, Facebook, and YouTube, China has WeChat, Bebo, and Douyin.

Then there are the technical methods, which, as ABC touches on, much of the Chinese population do not understand, and can not surpass without using banned methods, like unauthorized VPNs.

Finally, there are more punitive measures. The GPPI report links to a New Yorker investigation, which found that one man in Xinjiang was detained in a crowded prison for having WhatsApp installed on his phone.

Why is China cracking down on VPNs?

The Great Firewall is far from a new phenomenon – for as long as China has had internet access, it’s been subject to oversight by the central government.

As TechRadar recently reported, VPN usage is getting more popular in the UK and is seeing steady growth worldwide. China’s latest crackdowns might be an effort to suppress a similar wave of popularity on home soil.

Billy, who spoke to ABC News, added that he previously used LetsVPN in mainland China – but in April, LetsVPN suspended services in the region due to “the impact of continuous internet blockage”.

VPNs are ultimately businesses, and by making them more difficult to use, China can strangle cash flow to smaller providers and engender these kinds of shutdowns.

And with fewer and fewer options available, more of China’s 1.4 billion residents will need to rely on heavily surveilled and readily censored government channels for their internet needs.

• Amnezia VPN claims Russian media regulator Roskomnadzor is actively DDoS-attacking its infrastructure
• The attacks began in late May, leaving both Amnezia Free and Premium users unable to switch servers or establish stable connections.
• Other circumvention services like BlancVPN have also reported disruptions,

Russia's federal media censor, Roskomnadzor, is allegedly taking a much more hostile approach to internet censorship.

Instead of simply blocking virtual private networks (VPNs), the agency is now accused of launching active Distributed Denial of Service (DDoS) attacks to take down VPN systems entirely.

The accusation comes from Amnezia VPN, a popular service that has been nearly non-functional for several days. The developers stated that the attacks have made it impossible for users to switch between servers, severely disrupting both its Free and Premium tiers.

According to a report by independent news outlet Meduza, Amnezia VPN users first started experiencing severe connection problems and app instability in late May. The service’s developers soon identified the cause, pointing the finger directly at Russian state censors.

"For the first time, we can state as fact that Roskomnadzor has begun not only blocking VPN servers but actively attacking our infrastructure," the developers announced. The agency has not commented on the allegations.

A coordinated cyberoffensive

The developers attributed the widespread outages to "an unprecedented DDoS attack amid the targeted blocking of a large array of Amnezia VPN IP addresses."

While Amnezia representatives first reported the targeted attack on June 1, they also noted that several other unnamed VPN services were "experiencing availability problems" around the same time.

Although the team initially estimated that restoring the service would take only a few hours, the sheer scale of the disruption has dragged the recovery process out.

On June 4, the developers stated they were working to "find the most effective way to restore stable operation of the services" and emphasized that "work is continuing around the clock." Amnezia VPN has promised to compensate its Premium users for the downtime.

The escalating battle over Russian internet freedom

This is not an isolated incident. Amnezia VPN had previously experienced outages in mid-May, which it blamed on "mass blockings in connection with the actions of censors."

Around the same time, Russian users also reported widespread issues with the MTProto cryptographic protocol, which is used by Telegram to bypass blocks.

Another popular service, BlancVPN, also suffered major disruptions in late May and early June, though it reported on June 4 that a large portion of its service had been restored.

A representative from BlancVPN told Meduza that the censorship landscape is rapidly deteriorating. They noted that there have been more blockings in 2026 than in 2025, and more in 2025 than in 2024.

As Roskomnadzor continues to refine its technical capabilities, VPN providers are forced to continuously develop new workarounds. This latest alleged shift from passive blocking to active DDoS attacks indicates that the battle for digital privacy in Russia is entering a new phase.

The tech giants are pushing back against Canada's Bill C-22. Companies are raising the alarm over the cybersecurity and privacy risks that these new obligations will pose.

Encrypted messaging app Signal and Windscribe VPN went as far as to vow to leave the country if it becomes law.

And the Canadian government appears to be listening to these concerns and has agreed to clarify contentious points around encryption and metadata. However, Canada's Minister of Public Safety, Gary Anandasangaree, remains firm that tech companies are "misinterpreting" the bill.

In a statement to TechRadar, the ministry "categorically rejects" claims that Bill C-22 would enable surveillance, arguing that the provisions are meant to "modernize" lawful access to data in line with similar requirements existing in other G7 countries.

"For international companies, to claim that Bill C-22 would somehow undermine their ability to offer robust privacy and security features is simply misleading," Simon Lafortune, Deputy Director of Communications and Press Secretary to the Minister of Public Safety, told TechRadar.

Tech giants, alongside some of the best VPN providers and encrypted messaging services, aren't convinced, though. Google has warned of "surveillance infrastructure" and, together with Apple, urged lawmakers to add explicit protections for encryption.

Meanwhile, a joint report from Citizen Lab and the Canadian Civil Liberties Association recently branded the proposed legislation "almost certainly constitutionally fatal".

So, what is the actual threat to Canadian privacy? Why are tech providers so worried? And, most importantly, will they manage to make the government actually rethink its surveillance law?

The encryption debate

Lafortune maintains that the government has made it clear that strong encryption is essential to cybersecurity, economic growth, and the protection of Canadian citizen personal information.

"We want to reassure Signal, Windscribe, NordVPN, and all service providers that we are not legislating to require them to install capabilities to enable surveillance, and any assertions otherwise are false," Lafortune told TechRadar.

One of the major areas of contention surrounds the draft's definition of encryption and vulnerabilities. In a May 13 submission, Google called for clearer definitions, while privacy advocates have warned about the law's potential future impact.

Laura Tyrylyte, privacy advocate at NordVPN, told TechRadar: "In its current form, Bill C-22 grants the government overbroad, unsupervised and opaque Ministerial Order powers that could effectively compel any electronic service provider to build technical capabilities that compromise end-to-end encryption, insert backdoors, or perform surveillance."

The VPN industry is largely united in its opposition to the bill, with representatives from ExpressVPN, Proton VPN, and Windscribe all echoing similar concerns.

ExpressVPN's Chief Research Officer, Pete Membrey, told TechRadar: "Even well-intentioned requirements can create pressure for providers to build technical capabilities that weaken security or undermine trust in encrypted services."

Meanwhile, Proton VPN's David Peterson said that politicians are at risk of misunderstanding how encryption works. "If you create a backdoor in encryption, it cannot be selective — it allows both good and bad actors in equally," he said.

For Yegor Sak, CEO of Windscribe, the issues with encryption are linked to another contentious point — greater data retention. He told TechRadar: "[The bill] forces companies to build technical capabilities and retain data in ways that make it nearly impossible to maintain strong encryption without major changes to how the service works."

Metadata privacy matters

Bill C-22 seeks to significantly expand providers' data retention obligations.

The government maintains that the bill introduces "limited retention requirements strictly for metadata," and the text does include restrictions on collecting data that could reveal the "content" of communications, users' "web browsing history," and their "social media activities."

For Sak, however, forcing companies to build data logging systems and "retain large amounts of metadata" directly undermines encryption.

"You can have strong encryption and effective law enforcement. You just can’t have both if you’re also forcing companies to weaken their architecture, which will put users at risk," he told TechRadar.

Even though metadata does not explicitly reveal the content of online activities, its privacy implications are vast. Powered by modern AI tools, tracking this information enables law enforcement — or any malicious actor with the necessary skills — to build a highly accurate picture of a user's digital life without ever breaking encryption.

Michael Geist, Canada Research Chair in Internet and E-Commerce Law at the University of Ottawa, warned that mandatory metadata retention will "create a national surveillance map" of Canadians' movements and communications.

Tyrylyte also views this level of data collection as "disproportionate and dangerous," especially in an era where citizens are increasingly targeted by data breaches, fraud, and identity theft.

Will the government find a compromise?

It remains unclear how the government intends to improve transparency and accountability. Minister Anandasangaree has said that he intends to pass the bill before Parliament breaks for the summer on June 19.

Conservatives also recently moved a motion to split the legislation in half to allow further study of the controversial encryption and metadata provisions.

However, Proton and Windscribe are not optimistic that any concrete changes will materialize.

"It is difficult to see how the privacy of Canadian citizens can truly be preserved while simultaneously granting law enforcement broad access to their most sensitive data," Peterson said.

Sak shares this skepticism, saying that potential amendments "will mostly be fluff."

Regardless, the government's stance remains firm. "The government remains committed to protecting both public safety and the fundamental rights of Canadians, and we look forward to Bill C‑22 proceeding through Parliament and receiving Royal Assent as soon as possible," Lafortune told TechRadar.

As a G7 nation and a member of the Five Eyes intelligence alliance, Canada's final lawful access framework could set a global precedent.

And with a growing list of countries attempting to "modernize" law enforcement's ability to access citizens' data, the implications stretch far beyond Canadian borders.

• Japan’s communications ministry has proposed tighter age limits on social media
• Unlike Australia’s under-16s ban, the draft measures do not propose a single age limit or total ban for those under a certain age
• The report is expected to be finalized in summer 2026, with the potential for amendments later on

Japan’s Ministry of Internal Affairs and Communication has proposed that the country adopt stricter age restrictions for social media users.

The proposal is part of a new draft set of measures designed to combat social media addiction in children and young people.

The measures were announced on June 2 by a panel of experts convened by the Ministry, and notably do not suggest a blanket ban on social media usage, or even a single age limit for all social media platforms.

Instead, the committee’s draft measures suggest that the Japanese government work with stakeholders such as social media platforms and mobile carriers to find age verification solutions. The Japan Times reports that the measures suggest collaborating on “methods of age verification based on feasible technologies and systems.”

This makes Japan something of an outlier in the growing group of countries considering social media restrictions. The trend follows Australia’s ban on social media for under 16s, which, as TechRadar reported at the time, came into effect in December 2025.

Japan’s communications ministry has said that adopting a blanket age restriction would be difficult due to the differences between each social media platform, and the widespread use of social media as a form of communication.

If the draft suggestions are adopted, we could see Japan implement one age limit for TikTok and another for Instagram, for example.

The proposed measures also ask social media service providers to take on more responsibility when it comes to age verification.

As The Asahi Shimbun reports, social media companies would, under the new proposals, be mandated by law to assess their own services and platforms for risks, and implement more stringent identity checks.

Currently, social media age verification in Japan generally relies on self-reported information, which is easier to get around for those willing to lie about their age.

The committee’s proposal suggests that age data already held by mobile networks could be used to provide stronger age verification for social media.

The proposal has some way to go before being adopted into law – it will first enter a public comment period before being finalized in summer 2026, after which point other ministries will be able to offer counterpoints, amendments, and additions.

As Kyodo News reports, Japan’s existing social media controls are mostly limited to mobile carriers filtering harmful websites, as well as parental monitoring.

Social media age limits - a growing trend

As mentioned, Japan is far from the first country to see government officials or elected lawmakers propose stricter controls on social media.

Australia, Malaysia and Indonesia have implemented social media bans for under-16s, while France, Greece, and Denmark have all announced blanket age limits with varying timeframes for compliance.

And at the end of May, digital ministers from G7 countries met to agree on a set of common principles for online child safety (via UNICEF).

There’s been comparatively little from the US when it comes to the prospect of limiting social media, though a Los Angeles court found in March 2026 that Google and Meta had intentionally built addictive platforms in what many viewed as a landmark case (via BBC News).

In the UK, however, the concept of a social media ban for under-16s has taken hold at the national level. Prime Minister Keir Starmer said in May 2026 that he would take “decisive” action against social media’s impact on children, though he did not comment on what this would look like.

However, getting bans or age restrictions in place is only the first step – the real challenge is likely to be enforcement.

VPNs can be used to change the perceived location of a device, and therefore could be used to attempt circumventing a local social media ban.

Australia tackled this issue head-on by requiring social media platforms to block underaged VPN users. Japan appears to be taking a milder approach, perhaps in response to concerns that banning young people from social platforms outright could have negative consequences.

Do people in Japan support a social media ban?

Calls for social media bans and age limits have been met with mixed reactions across the globe.

A report by Family First (via Global Teacher Prize) published before the announcement of the new draft measures found that 38% of parents and 28% of Gen Z in Japan support banning social media for under-16s.

That’s low compared to other countries – the same report found that 77% of parents in Malaysia and 73% of Gen Z in India supported an under-16s ban, while other ‘Western’ countries saw lower levels of support.

It’s not yet clear whether social media restrictions are effective in improving young peoples’ wellbeing. In 2024, Amnesty International called on Australian lawmakers to regulate, rather than restrict, social media for young people, suggesting that outright bans wouldn’t keep children as safe as good regulation. And April 2026 research from the Molly Rose foundation suggests that 60% of Australian children are still managing to access social media post-ban.

With support in Japan relatively low, the milder proposed measures could either be an effort to avoid backlash or a response to the successes and limitations of other countries’ initiatives.

Palantir’s £330 million contract with the NHS has yet again hit the news.

After previous reports showed that the NHS had granted Palantir "unlimited access" to identifiable patient health data, the US tech giant's involvement has now been subject to a review by the House of Commons Science, Innovation, and Technology Committee.

Before now, two petitions urging the UK government to scrap its contracts with Palantir amassed over 200,000 signatures, according to The Guardian. Now, new findings in this review have deemed Palantir's role 'unacceptable,' further increasing the likelihood that the UK government activates a break clause to end the deal with the NHS by early 2027.

Privacy campaigners and NHS staff alike have expressed deep concerns over how this data-sharing agreement could compromise patient confidentiality.

But is the Palantir-NHS partnership really as dangerous as critics claim? And, more importantly, what steps can UK citizens take to prevent their personal medical data from being sucked up by today’s most controversial company on the planet?

What is Palantir and how does the NHS use its software?

Headquartered in Miami, Palantir Technologies is a data analytics firm specialising in AI-powered tools designed to manage large datasets.

Co-founded in 2003 by PayPal's creator, Peter Thiel, among others, Palantir began its journey with deep ties to the US intelligence, and was initially funded by the CIA's venture capital body, In-Q-Tel.

Palantir’s flagship software platforms, Gotham and Foundry, are widely used by government organizations and businesses globally to uncover data patterns and support decision-making operations.

These tools are currently deployed across various public sectors, including healthcare, policing, border enforcement, intelligence agencies, and defense.

Palantir first established ties with the UK's public health sector in 2020, when Boris Johnson's government began using Foundry, alongside tools from Microsoft, Google, and Amazon, to manage the Covid-19 pandemic.

That relationship deepened in 2023 when then-Prime Minister Rishi Sunak signed the £330 million contract with the American firm. The deal tasked Palantir with leading a corporate consortium —including Accenture, PwC, NECS, and Carnall Farrar — to build the NHS's new Federated Data Platform (FDP).

A recent Financial Times disclosure has begun to cause concern, however, after it brought to light an internal NHS briefing note which explicitly earmarked "unlimited access" to identifiable patient data for certain contractor admin roles.

And, while the UK government claims to have already seen significant improvements in its data management flow, thanks to Palantir's Federated Data Platform (FDP), a report by Democracy for Sale says that staff have found Palantir's newly built platform to be 10 times slower than the existing system, citing an internal NHS document.

Palantir has strongly rejected these allegations, however. In a statement to Democracy for Sale, the US firm argued that "comparing the two systems is not like-for-like," adding that its platform "introduces guardrails to improve data correctness, enforce purpose-based access and allow more controlled data sharing".

What does it mean for your privacy?

Under the terms of the contract with the NHS, Palantir is named strictly as a "data processor". This means it cannot decide how the information that its software processes is used. In other words, Palantir could face direct liability should it fail to secure this data or violate NHS instructions.

Indeed, a Palantir spokesperson told the Financial Times that using this data for any other purpose would be "not only illegal but technically impossible due to granular access controls overseen by the NHS".

That said, the exact details of how Palantir can use UK citizens’ health data remain obscured. As The Conversation noted, the publicly available version of the contract was published with "nearly all the data protection text" heavily redacted.

However, in an open letter published earlier this month, a coalition of critical NHS personnel argued that current data privacy protections within the FDP system may be "inadequate", raising concerns about Palantir's access to FDP data and its use of artificial intelligence.

The signatories also highlight potential conflicts that could arise from the company's obligations under sweeping US surveillance legislation like the CLOUD Act and the Foreign Intelligence Surveillance Act (FISA), which could “allow the US government to request data held on the systems of an American corporation,” they note.

Critics have also raised concerns over how sensitive health data could be misused across different government bodies, such as immigration. The coalition wrote in the open letter:

"We are alarmed that Palantir UK CEO Louis Mosley confirmed to the Observer that Palantir would share NHS data for immigration enforcement purposes should a future government legislate for it."

The NHS is just one of the UK public sectors where Palantir currently operates. An investigation by The Nerve last January found details of 34 active contracts across at least 10 government departments, as well as local councils and police authorities.

Speaking to the BBC, Mosley welcomed the scrutiny and insisted that his company has "no interest" in UK patient data.

"It’s not the legal basis on which we operate, in the same way that Microsoft Excel or Microsoft Word or email is used in the NHS, and again that is NHS data, Microsoft doesn’t have access to it, nor do we to NHS data," he said.

Looking at the company’s track record, however, there is a demonstrable risk that NHS patient health data could one day be repurposed.

For example, January revelations from 404media suggest that US citizen health data is fed to a Palantir-developed app called ELITE, which is used by Immigration and Customs Enforcement (ICE) agents to map and target suspected illegal immigrants.

This cross-pollination of healthcare data and immigration enforcement is exactly what critics of Palantir’s involvement with the NHS fear the most.

Why is Palantir so controversial?

Palantir co-founder Peter Thiel is well-known for his polarizing views.

As reported by The Guardian in 2023, Thiel previously stated that the "NHS makes people sick" and described the British public's affection for the health service as a case of "Stockholm syndrome".

In a 22-point manifesto published in April, Palantir CEO Alex Karp expanded on the moral duty of tech companies in defense and AI warfare, controversially asserting that "some cultures have produced vital advances; others remain dysfunctional and regressive".

This sparked a backlash within the digital rights community, prompting NymVPN CEO Harry Halpin to publish his own "anti-Palantir" manifesto outlining the necessity to fight the company's vision.

However, the opposition to Palantir extends far beyond philosophical disagreements.

For over a decade, Palantir has been the backbone behind ICE’s controversial tracking and deportation operations, and, more recently, a deal with the Israeli military has also become a source of public concern.

Is there something we can do about it?

While it is difficult to predict whether the UK government will activate the break clause in Palantir's contract, there are steps citizen can take if they wish to restrict access to their health data — though they do come with significant caveats.

Patients can opt out of sharing their health records, which prevents GP practices, hospitals, and other providers from distributing their data more broadly.

However, you cannot currently opt out specifically from "products used in the NHS Federated Data Platform".

Crucially, a mass opt-out of health data sharing would severely impact the efficacy of these datasets, undermining the overall quality of medical research and public health planning.

Beyond immediate privacy risks, this erosion of data quality is exactly what NHS employees fear most. A 2023 YouGov poll found that nearly half of UK adults would likely opt out of data sharing if a private company like Palantir began processing their personal information.

Whether this potential erosion of trust between UK patients and the health service will prompt a U-turn in the Palantir-NHS collaboration remains to be seen. What is certain, however, is that the intense debate surrounding the future of UK health data privacy is far from over.

We have contacted Palantir and the NHS for comment and will update this article if we receive a response.