UK age verification hits: VPN use soars, backlash peaks and privacy debates reignite

Now, those publishers face hefty fines (up to £18m or 10% of global revenue, whichever is greater) and criminal liability for executives if they fail to restrict children’s access to harmful content, including pornography and material that promotes self-harm or eating disorders.

Mandated measures include filtering harmful content out of recommendation algorithms, procedures to take down offending content rapidly and reporting methods for children who do find concerning material.

Websites and apps deemed “riskiest” for delivering harmful content for kids are now also required to either deliver a fully “child-appropriate” experience or to institute “highly effective” age checks for any mature content.

What those age checks look like in practice is not mandated by the bill, but methods instituted so far include ‘facial age estimation,’ age confirmation via users’ banks and credit card providers, matching selfies to verified IDs and ‘digital identity wallets.’

The Age Verification Providers Association, an international trade body for the organizations carrying out such checks, has said that providers are now carrying out an extra 5m such checks a day.

But not all UK internet users are submitting to checks. Amid widespread backlash and colorful debate this week, usage of virtual private networks (VPNs), which mask your location and can circumvent the age-gates, has rocketed. One service, Proton, has logged a 1,800% increase in daily sign-ups. The most-downloaded lists on app stores have been dominated by VPNs all week.

Advertisers have been watching with interest. The act’s rocky first week of implementation throws into stark contrast the internet’s oldest debate about the balance between safety and privacy. But which side will marketers be rooting for?

The critics: just about everyone

Criticism has amassed on all sides. Campaigner Ian Russell of the Molly Rose Foundation has widely panned the Bill’s implementation, insisting it doesn’t go far enough or fast enough to curb harms to children online. On the other end of the spectrum, Elon Musk posted on his own service, X, that the bill’s “purpose is suppression of the people.” US lawmaker Jim Jordan panned the bill as “the UK’s online censorship law.” (Then it got ugly: right-wing politician Nigel Farage called for repeal, prompting technology secretary Peter Kyle to say that Farage was on the side of “people like Jimmy Saville.”)

Perhaps surprisingly, Aylo, the company that operates several of the UK’s most popular porn sites, including PornHub, is striking a more conciliatory note. In a statement shared by The Drum, Alex Kekesi, its vice-president of brand and community, insists that the government’s and the platform’s goals are aligned and praises Ofcom’s approach.

“Keeping minors off adult sites is a shared responsibility that requires a global solution. It requires cooperation between government, tech platforms and adults,” said Kekesi. “We want to be part of the solution and are hopeful that the UK model stands to set a strong precedent to that end.

“We continue to believe that to make the internet safer for everyone, every phone, tablet or computer should start as a kid-safe device. Only verified adults should unlock access to things like dating apps, gambling or adult content. This is the core premise of device-based age verification, which we believe is the safest and most effective option for protecting children and maintaining user privacy online.”

A long-term opportunity for VPNs?

The government’s strongest critics, though, remain digital liberties groups that will continue to fight identity checks online, viewing them as erosive of online freedom and evidence of serious government overreach. VPN providers are closely aligned to this viewpoint and, as the UK government continues to insist that it will not repeal the legislation, they’ll be seeing a ripe new customer market.

Sweden-headquartered Mullvad VPN, for example, has already been on an extensive IRL advertising drive with eye-catching billboards carrying messages like “free the internet from mass surveillance” and “imagine a world where your inner thoughts are your own.”

The company’s chief executive, Jan Jonsson, tells The Drum that he hopes a recent uptick in downloads is sustained by a wider rejection of surveillance “for political and commercial purposes.”

“There are real problems on the internet and there are solutions that don’t require infringing on fundamental human rights. The internet needs to be fundamentally restructured so that people’s lives are not surveilled for political and commercial purposes… Hopefully, this type of legislation can help bring these discussions to the table and raise awareness about privacy.”

Are marketers concerned by rising VPN usage?

A UK with widely expanded VPN usage would directly prevent some marketing tactics, such as geotargeting, but it would also have a halo effect, says Jonsson, of greater understanding about data privacy that would be to the wider detriment of tracking- and ID-based advertising.

“Increased privacy awareness and the use of privacy-focused services (VPN plus browser) are a problem for the advertising industry, which is a good thing since the ad networks are used to map people’s lives. Reducing tracking and targeting is a positive by-product of people downloading privacy-focused products… This business model (commercial data collection, behavioral ads, surveillance capitalism) is based on big tech and data brokers mapping people entirely without transparency, real consent or any control over where the data ends up. The fact that governments purchase this data and thereby circumvent constitutions, laws and rights is one problem. That big tech uses the data for political and commercial purposes without transparency is another.”

To Jonsson, rising awareness is a good thing. Marketers who rely on data collection and profile building will be less enthused. But should they be concerned?

Sam Fenton-Elstone is chief executive of media and tech agency Anything is Possible. He says the agency has fielded several calls from clients this week, asking whether they should be concerned about the emerging landscape.

His answer? The digital ad ecosystem isn’t under immediate existential threat because of an uptick in VPN usage, but privacy is firmly back on the docket. “I don’t think you’re ever going to get to a situation where VPNs are completely mass-adoption. We’re talking about a segment of society. But that segment is highly valuable. And I do think that we’re seeing a continuation of a trend towards the individual agency of your privacy and data. That’s important and positive for society.”

That trend can be seen in the wider legislative landscape: GDPR, the EU Digital Services Act and similar laws worldwide. Those laws and developing user behaviour are facts that marketers should already be well aware of, Fenton-Elstone says. The result, he says, is that “the value of strength and targeting has been eroding over time… it’s getting harder to rely on tactics that have worked in the past.”

Fenton-Elstone, then, is among a broad coalition of moderate critics of the bill in the ‘good intention, imperfect execution’ camp. “Causing friction on the internet is a bad thing and this causes friction. Friction is a problem not just from an advertising perspective, but for growth: growth for brands and growth for the economy.”

Others will be more friction-positive. Mike Follett, chief executive of adtech shop Lumen Research, tells The Drum that he smells a little hypocrisy in so many of us willingly handing over so much personal information to everyone from video services to supermarkets, only to reject so strongly to identity around adult viewing behaviors.

Such liberty infringements, he argues, pale in comparison with the horrors that the bill is designed to address. “We have to remember that we are dealing with very serious harms here… We need to remember that there’s more to life than free speech. We’re already giving away an awful lot of information about ourselves. We do this normally. In this instance, the act is trying to prevent very, very serious harms to young kids and choke off the torrent of money that’s going towards paying for the creation of these videos.”

For Follett, as with GDPR, heightened regulation here may be a pain for some marketers (especially if it reinvigorates privacy debates), but it’ll be worth it. “The very point of GDPR, frankly, makes it harder for digital marketers to do their job… That is a cost to one industry, but a gain to society. Yes, it cost us money, but society as a whole has benefited. Get this: some things are more important than money.”