"A privacy tradeoff" – privacy experts slam new UK age verification checks

Mandatory age verification has landed in the UK, though not without controversy.

The impact of age verification on Britons' privacy is the obvious concern. Yet, according to some digital rights experts, it looks like a potential privacy nightmare may be only one of the downsides.

Privacy at risk

If you're in the UK, you are now forced to prove you are over 18 to access a host of content on the internet.

However, as the Internet Society's Senior Director for Internet Trust, Robin Wilton, points out, the UK's current age checking solutions force internet users – both adults and children – to over-disclose personal data, including sensitive personal data, while not guaranteeing such data is kept safe and used only for the intended purpose.

"There are more, and less, privacy-preserving ways to assert age, and regrettably, the UK Government seems to have settled for whatever’s on the market at the moment."

You either need to scan your face, a credit card, or an identity document if you want to watch adult-only content. The same applies if you want to play a new over-18 video game, find a match on a dating app, or read a post considered potentially harmful on X, Reddit, or Bluesky.

Age verification is certainly a complex issue, yet, according to the Co-founder and CEO of Canada-based Windscribe VPN, Yegor Sak, the way the UK rolled it out "does more harm than good."

For Sak, the biggest problem is the privacy tradeoff. "You’re asking millions of people to submit sensitive information to access legal content. That opens the door to leaks, abuse, and misuse of data."

Big data, big leaks

While the Online Safety Act is a 300-page-long legislation aimed at making the internet a safer place, experts believe that, as implemented, new age checks may end up having exactly the opposite effect.

Why? Mass data collection that, as Privacy Advocate and Director of Communications at ExpressVPN, Jack Buckley, told TechRadar, "creates an enormous attack surface."

"If this data is leaked or mishandled, it can lead to identity theft, blackmail, scams, or long-term privacy erosion, with little visibility or control for the people affected."

Such a data security disaster isn't so difficult to envisage, either. The recent Tea app hack saw hackers manage to steal 72,000 images submitted by its users and their private messages. An enormous database that may soon be minor compared to what service providers in the UK are expected to handle.

Commenting on this point, the Free Expression Project's Director at the Center for Democracy and Technology, Kate Ruane, told TechRadar: "Unfortunately, as more laws requiring age verification are passed around the world, these breaches are set to become the norm."

"A risk of overreach"

Besides the privacy and security implications, experts are also concerned about the negative impact that age checks will have on people's rights to free speech and access to information.

Under the Online Safety Act's new rules, social media and other providers offering users-to-users communication or search services have a duty of care to shield minors from dangerous material online, "including self-harm and suicide, eating disorder or extreme violence/gore," the UK's regulator body, Ofcom, explains.

However, Buckley from ExpressVPN is especially concerned that "vague definitions" of what constitutes harmful content could result in restricted access to important, sensitive conversations.

"On social platforms and dating apps, where content is constantly generated, shared, and blurred across categories, it’s far harder to draw a clean line between what’s harmful and what’s helpful or important. That ambiguity raises the risk of overreach," Buckley told TechRadar.

You now need to scan your face even to listen to some music, with Spotify being perhaps the least expected provider to implement age checks. This has prompted furious fans to threaten to return to piracy.

On Reddit, which enforced age checks in the UK from July, communities supporting mental health or sharing news about ongoing conflicts have already reportedly been affected.

"Once you start filtering access to social platforms based on age, you’re not just blocking adult content – you’re potentially blocking news, activism, and political speech," said Sak from Windscribe. "That’s how you end up with real censorship under the label of safety."

Easy to bypass

These concerns have pushed some people in the UK to turn to workarounds to avoid handing over their data to keep using their favorite apps as usual.

For instance, gamers have used Death Stranding's photo mode to evade age checks on Discord and Reddit.

Some Brits have also turned to VPNs to attempt to bypass the new rules, with popular provider Proton VPN recording an hourly increase in sign-ups of over 1,400% starting from July 25 at midnight.

This sudden spike has raised the alarm that virtual private network (VPN) tools may become the next target of British authorities.

This option has, however, been strongly dismissed by the UK Science Secretary, Peter Kyle, who insists there are no plans to ban VPNs. That said, Kyle confirmed the government would be looking "very closely" at how VPNs are being used.

At the same time, experts also fear that mandatory age checks could lead to a rise in fake IDs online.

What's next?

Despite the conflicting views, it does appear age verification is not only here to stay, but will likely spread across other areas worldwide.

However, many privacy experts believe that age verification may not be the best way to protect children online, after all.

"A more effective, privacy-preserving approach would be to empower parents with device-level content controls," Proton VPN General Manager, David Peterson, told TechRadar.

Wilton, Buckley, and Sak see digital education and device-level controls as better alternatives.

What's needed then, according to experts, is investment in finding balanced age verification solutions that can preserve users' data privacy and security. A challenging task, but surely not impossible.

"There are methods by which identity or age verification can be delivered without personally identifiable information (PII) being exchanged. The problem is that the UK government has not provided a clear privacy-first framework," explains Buckely.

You might also like

• US age verification laws put your privacy at risk – and "VPNs are not a solution”
• Apple just expanded its child safety features with age ratings that could lessen the chance of an inappropriate download
• No, VPNs don't guarantee absolute anonymity – but too many users still think they do