Governments around the world have decided that VPNs are a loophole. In 2026, they are trying to close it. The results so far: technically naive legislation, record VPN adoption, and a lot of furious privacy advocates.
The global wave: what is actually happening
As of mid-2026, 25 US states have active age verification laws on the books, including Texas, Florida, Arizona, Missouri, Georgia, South Dakota, and Ohio. The UK’s Online Safety Act took effect July 25, 2025. Australia banned under-16s from social media on December 10, 2025, and extended adult content enforcement in March 2026. Brazil’s age verification law went live in March 2026. Turkey passed a ban on under-15s from social media on April 22, 2026. The EU is preparing a unified age verification framework across all 27 member states by the end of this year.
Every single one of these laws triggered the same response: people downloaded more VPNs.
In the UK, VPN downloads hit 2 million in August 2025 alone, the month after the Online Safety Act took effect, and stayed above 1 million per month after that. One app saw a 1,800% download surge in the first month following the UK law. Australia’s March 2026 enforcement triggered a similar spike. These are not bad actors finding workarounds. They are ordinary people reacting rationally to surveillance infrastructure being built around legal content.
Utah went further than anyone else
Most age verification laws work around VPNs by ignoring them. Utah did something different.
Utah SB 73, signed by Governor Spencer Cox on March 19, 2026, is the first US law to directly target VPN users. Under its provisions, a person is considered to be in Utah regardless of what tools they use to mask their location. Websites are held liable if Utah-based users bypass age verification with a VPN, proxy, or similar tool. Covered sites are also banned from publishing instructions on how to use these tools.
Digital rights experts called it a “technical whack-a-mole.” The Electronic Frontier Foundation’s position is blunt: “VPNs Are Not a Solution to Age-Gating Mandates”. Holding platforms liable for tools users bring to the table is not a technical problem with a technical solution. It is an enforcement fantasy dressed up as legislation.
Aylo, the parent company of Pornhub, sued Utah in federal court on May 13. Utah agreed to delay enforcement until September 3, 2026 while the case proceeds. The core constitutional question is real: can a state regulate users whose physical location it cannot verify?
Wisconsin went through the same debate and reached a different conclusion. The VPN ban provision was removed from SB 130 / AB 105 after public pushback. That is the first concrete example of a legislature pulling back from VPN targeting after seeing the reaction.
The UK took a different approach
Rather than targeting VPNs directly, the UK went after the under-18 population. In January 2026, the House of Lords voted 207 to 159 to ban VPN access for under-18s as part of online safety measures. Banning a demographic from using a tool requires device-level enforcement (monitoring every internet connection), ISP-level blocking, or both.
The Online Safety Act was sold as child protection. The House of Lords vote shows where that logic leads when it runs into the reality that VPNs exist. It is not about adult content anymore. It is about controlling which privacy tools specific groups of people are allowed to use.
Australia and the rest of the world scramble
Australia’s social media ban for under-16s, which took effect December 10, 2025, was one of the strictest anywhere. The March 2026 adult content enforcement extension pushed it further. Both triggered VPN surges. Australian authorities have not yet moved to target VPN providers directly, but the EU research arm has already labeled VPNs a “loophole,” which is the kind of language that precedes legislative action.
Brazil went live with mandatory age verification in March 2026. Turkey followed in April. Together with the EU framework being assembled for late 2026, the picture is of a loosely coordinated international effort to verify who is online. The internet that some legislators appear to have imagined, one where location and identity are reliably known, has never existed.
Who actually gets hurt
The people most affected by VPN crackdowns and platform-level IP blocks are not teenagers finding workarounds. Teenagers are resourceful. They find workarounds.
The people affected are privacy-conscious adults who use ProtonVPN or similar services because they do not want their browsing data sold to brokers. Journalists working in sensitive environments. Abuse survivors keeping their location private. Remote workers on public networks. The entire population of people with a legitimate reason to use a VPN gets caught in the same net designed for a different target.
The EFF made this point directly in its analysis of Utah SB 73. The collateral damage is not incidental, it is structural. When you build enforcement around blocking or surveilling VPN traffic, you build surveillance infrastructure that will be used beyond its original purpose. That is not speculation. It is the observable pattern in every jurisdiction that has gone down this road.
Why these laws will not work as intended
The technical problem is real. You cannot reliably identify the physical location of a user who does not want to be identified. This is not a bug in VPN technology that can be patched. It is the core function of the tool. Holding websites liable for this reality, as Utah does, does not solve the problem. It creates a compliance crisis for website operators while the actual problem persists.
Most people using a VPN to access age-restricted content are also not teenagers. They are adults who would rather not submit ID to a site with unclear data practices. Age verification laws push both groups toward VPNs at the same time.
The international dimension makes it worse. A law passed in Utah or the UK does not reach VPN providers incorporated in Switzerland or Panama. NordVPN is headquartered in Panama. ProtonVPN operates under Swiss law. Neither is going to restructure their product because of a Utah statute. The EU framework will have more reach simply because of market size, but enforcement against non-EU providers operating across borders is a different problem than passing a directive.
What to watch in the second half of 2026
September 3, 2026 is when Utah’s enforcement pause ends. If Aylo’s lawsuit has not produced an injunction by then, websites will face a real compliance decision. The outcome shapes whether other states follow Utah’s model or treat it as a cautionary example.
The EU’s unified framework is targeted for end of 2026. Whether it focuses on platforms or directly targets VPN providers will matter for everyone in Europe.
Wisconsin’s retreat from VPN banning language is worth tracking. It is the first legislature to walk back this specific provision under pressure. If that pattern repeats, the Utah approach may be a dead end before the courts even settle it.
Governments want to verify who is online. VPNs make that harder. None of the legislative approaches tried so far have solved the underlying technical problem, and none of them will.
Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.
Age verification laws are multiplying faster than effective enforcement mechanisms exist. Targeting VPNs specifically, as Utah did, is the most aggressive approach taken so far, and it is currently under legal challenge. The laws that are working are mostly making legal content harder to access for adults, not stopping minors. If you rely on a VPN for legitimate privacy reasons, the tool still works. The regulatory environment around it is changing, though, and that is worth paying attention to.
Keep reading: Utah Just Passed a Law Targeting VPN Users. Here’s What It Actually Does. and Chat Control Is Dead. Going Dark Is the EU’s Next Attempt, and This Time VPNs Are on the List..
Sources: EFF on Utah SB 73 | TechRadar on Utah VPN targeting | Tom’s Hardware on EU research and VPN adoption | AndroidHeadlines on VPN download surges