UK Age Verification Is Being Outsmarted by Eyebrow Pencils and Fake Birthdays

Key Takeaways

• A third of UK children (32%) admit bypassing age checks under the Online Safety Act, with the most common methods being fake birthdays, borrowed logins, and using someone else's device.
• Children in focus groups described drawing fake facial hair with an eyebrow pencil to trick facial age estimation tools, with at least one parent confirming it worked on her 12-year-old son, who was verified as 15.
• Only 7% of children report using a VPN to circumvent age checks, yet the UK government's main legislative response targets VPNs, with a broad power to restrict them now embedded in the Children's Wellbeing and Schools Act.
• Internet Matters found that 46% of children believe age checks are easy to bypass, while only 17% consider them difficult.
• Age verification as implemented under the Online Safety Act collects biometric and identity data from users, representing a significant privacy cost in exchange for protections that children routinely sidestep.

The Moustache Test and Other Peer-Reviewed Bypasses

A new Internet Matters report on the Online Safety Act's impact on children, published in May 2026, puts some useful numbers on what most people with a functioning memory of adolescence could have predicted: children are getting around age checks with ease, using methods that are impressively low-tech.

A third of children surveyed admit to bypassing age restrictions in the past two months. The most common approach was entering a fake birthday, followed by using someone else's login and someone else's device. In focus groups, children described submitting video game character faces to fool facial recognition tools, and one mother even reported catching her 12-year-old son using an eyebrow pencil to draw a mustache before the age estimation check, which verified him as 15, a trick that reportedly worked in multiple instances.

The UK's "highly effective age assurance" regime, the one platforms are legally required to implement, was defeated by a biro and twenty seconds of creative thinking. Some 46% of children believe age checks are easy to bypass, against only 17% who find them difficult, with that easy-to-bypass figure rising to 52% among children aged 13 and over.

The VPN Panic Is Aimed at the Wrong Target

So where do VPNs fit in all of this? Only 7% of children report using one to get around age checks, making it the smallest category among the reported bypass methods. Internet Matters also notes that VPN use among children aged 9 to 17 has held steady at around 8% since OSA enforcement began, with no post-OSA spike. Some children used VPNs for reasons unrelated to age restrictions entirely, such as accessing sports broadcasts unavailable in the UK.

Yet the government's legislative energy has concentrated almost entirely on VPNs. In January 2026, the House of Lords voted 207 to 159 to ban VPN provision to under-18s as part of the Children's Wellbeing and Schools Bill. The Commons rejected that specific ban in March but substituted a broad ministerial power to "restrict or limit children's VPN use," alongside powers to restrict social media access for minors. As of late April 2026, the bill remains in parliamentary ping-pong between both houses, with neither chamber fully settled on the final shape of either measure.

The obvious truth here is that going after VPNs while eyebrow pencils are doing the heavy lifting is hardly any kind of child safety policy. It is a surveillance infrastructure project with a child-shaped excuse, and the 7% figure was available to every peer and MP who voted on these amendments.

If this shows anything, it's that the UK government is very much set on finding ways to erode our privacy, and they’ll keep going for it no matter what the data actually shows. That's why it makes all the sense in the world to make sure you acquire the necessary tools to protect yourself online before they get banned, too. Get Mysterium VPN with 82% off now.

The Privacy Cost of Theater That Does Not Work

There is a reason age verification feels invasive, because it is. Under the OSA framework, platforms use facial age estimation, government ID uploads, and third-party verification apps to confirm users' ages. Internet Matters found that 88 to 89% of children described these methods as "easy to complete," meaning the friction that was supposed to deter underage access barely registers as friction for the people it was designed to stop. Meanwhile, a quarter of parents have helped their children bypass age checks, with 17% actively assisting and 9% quietly allowing it.

Yet, the data collected in this process does not evaporate. Biometric scans, facial images, and document uploads create an infrastructure that can be breached, misused, or expanded in scope. Every adult user who submits a government ID pays a real privacy price. The children who drew on mustaches paid nothing and got through anyway.

The UK has built a surveillance tollgate that stops almost no one, extracts privacy from everyone, and is now being extended in the name of a VPN problem that accounts for 7% of the bypasses the government's own commissioned research identified. If the policymakers still debating the Children's Wellbeing and Schools Act had seen the Internet Matters report or paid attention to the situation at all, they would have no credible basis for treating VPN restrictions as a meaningful answer. The question worth asking is what they think it is actually for.