UK, Australia evidence points to weak age checks, not VPNs, as main problem

Three letters trouble the biometric age assurance industry more than most: VPN. Virtual Private Networks are the poster child for easy workarounds to jurisdictional age checks. Make the computer think you are located somewhere without age restrictions, and it will let you into the online porn site, weapon shop or vape store without any qualms – or so say those who believe age assurance laws are a threat to online privacy.

The age assurance industry is often asked to address the question of whether VPNs render biometric age assurance systems ineffective. The answer is, in the main, no: per the Age Verification Providers Association (AVPA), “in practice, there are ways to detect and address circumvention and there is no need to even consider banning VPNs outright.”

Nonetheless. According to Australia’s eSafety, nine in 10 of the most visited adult sites used by Australians now have age checks for users – but it’s not certain whether those sites are allowing users to bypass restrictions with VPNs.

Now, the UK government has released a report on the issue of circumvention. Policymakers have already floated the idea of putting age checks on VPNs themselves. The new study, commissioned by the Department of Science and Technology (DSIT) and conducted by BMG Research shows that around a quarter of children use a VPN – but that their parents often help set them up, a problem when it comes to age assurance.

Tick-box age checks most common, least useful

More significantly, however, is the fact that nearly 2 in 5 of all children have successfully gotten around an age check directly – largely because they are age checks of the simplest, least effective sort.

Here is a particularly telling paragraph: “Children rate the more advanced checks as the most effective. Government ID upload is seen as effective by 86 percent of children who have come across this check, payment card verification by 74 percent and facial age estimation by 73 percent. By contrast, a majority (54 percent) of those who have come across tick box age checks think it is not effective.”

Even more illustrative is the finding that “the two checks the majority of children have met (ticking a box or providing a date of birth) are also the two they least believe work.”

VPNs, then, are less a primary concern and more a convenient talking point for critics of age assurance tech. The primary concern is clear, and has been for some time now: platforms are largely failing to implement highly effective age assurance.

SMMA is working, if slowly

A report in the Guardian cites briefing documents newly released under freedom of information laws, which show Australia’s eSafety monitoring compliance of the top 30 sites visited by Australians, 26 of which it contacted to point out a lack of age assurance measures.

A key issues brief states that “eSafety has observed poor practices by some platforms, giving rise to compliance concerns.” The poor practices in question range from inadequate reporting mechanisms to allowing repeated attempts at the same age-assurance method, “even where there are signals that it might be providing a false result.”

“As a result, eSafety is investigating potential non-compliance by Facebook, Instagram, Snapchat, TikTok and YouTube, with decisions on possible enforcement action for at least some platforms expected around mid-2026, subject to evidence. These platforms are the focus of eSafety’s investigations because they have the largest numbers of child users and present higher risks of harm.”

Moreover, “eSafety continues to monitor potential migratory patterns of social media use by children under the age of 16 and will adjust its regulatory focus as needed to ensure age-restricted social media platforms operating in Australia are complying with their obligations.”

Among the juiciest questions facing Australia – and by extension, every regulatory body targeting social media with age restrictions – remains, “is there any evidence the SMMA is having a positive impact?”

The briefing, while tentative, says yes. “Early research and feedback indicate a reduction in social media account ownership among children under 16. eSafety’s parent pulse survey found that almost half (49.7 percent) of surveyed parents reported their child had their own account on at least one platform prior to the restrictions coming into effect. This proportion decreased to 31.3 percent following the SMMA.”

The law appears to be generally effective, even when social media firms are ignoring it. Imagine how well it would work if they complied.

Article Topics

age verification  |  Australia age verification  |  eSafety Commissioner  |  social media  |  UK age verification  |  VPN (virtual private network)