VPN Restrictions Are Following Age Verification Laws

Key Takeaways

• September 25th is the second annual Day of Action, organized by Fight for the Future, calling on lawmakers to reject VPN bans.
• VPN restrictions are increasingly proposed alongside age verification bills rather than as standalone measures.
• Utah's approach requires websites to detect and block suspected VPN traffic, which places enforcement on site operators rather than on users directly.
• We sell a VPN, so read this with that in mind. The argument is about what these measures do, not about what anyone proposing them intends.

Today, September 25th, is the second annual Defend VPNs Day of Action, organized by Fight for the Future. The campaign asks lawmakers to reject proposals that would ban or restrict VPN use. What's worth examining is where those proposals are coming from, because most of them aren't standalone bills. They're appearing as provisions inside age verification legislation.

The Restrictions Are Arriving Inside Other Bills

The sequence is consistent across several jurisdictions.

An age verification law passes, making people verify their age before accessing certain categories of content, usually through an identity document or a facial age estimate. Usage data then shows increased VPN adoption in that jurisdiction. A follow-up proposal appears addressing what supporters describe as a gap in enforcement.

The stated reasoning is straightforward and worth taking seriously on its own terms. If a law is meant to prevent minors from reaching certain material, and a widely available tool allows that material to be reached anyway, supporters argue the law isn't doing what it was meant to do.

The disagreement isn't about whether that gap exists. It's about what closing it costs, and who pays.

An age verification requirement affects people seeking specific content. A VPN restriction affects everyone using the tool for any reason, in that jurisdiction, regardless of what they're doing. Those are different scopes, and the second one is considerably wider than the problem it's responding to. Age verification has already expanded well beyond adult sites into social media, app stores, and operating systems, which means the population affected by a VPN restriction grows with it.

Utah Shows One Version of the Mechanism

Utah offers the clearest example of how this works in practice. According to Fight for the Future's campaign materials, it became the first US state to meaningfully restrict VPN use.

Rather than penalizing individual users, the approach requires websites to identify and block traffic they believe is coming through a VPN. Enforcement sits with site operators rather than with the state.

That creates a predictable incentive. A website facing liability for letting unverified traffic through, and facing no penalty for blocking legitimate traffic by mistake, has good reason to over-block. Someone connecting through a VPN for a corporate security policy, while traveling, or on a network they don't control can end up treated the same as someone attempting to reach restricted content.

Other jurisdictions are taking different approaches. Fight for the Future's campaign documents a proposed VPN ban under consideration in Michigan, a VPN provision removed from Wisconsin's age verification bill before passage, discussion among Australian lawmakers following the country's under-16 social media restrictions, and a change in Brazil treating VPN use as an aggravating factor in criminal sentencing.

Who Would Be Affected

The practical question is who currently relies on these tools and what happens if access is restricted.

Journalists use VPNs to reach sources and access material that's blocked where they're reporting from. Researchers and human rights workers use them in environments where browsing history carries legal risk. People in countries with extensive censorship use them to read news their governments have blocked.

There's also a group that rarely comes up in legislative debate. People looking up health information they'd rather not have linked to their name. People in households where someone else monitors the connection. People researching how to leave a situation they're in.

None of those uses have anything to do with age verification, and none of them are addressed by the laws that prompted the restrictions. They're affected anyway, because the restriction applies to the tool rather than to the use.

There's also a practical question about effectiveness. Age verification systems have proven possible to work around through several methods, of which VPN use is one. Restricting VPNs closes one route. Whether that meaningfully changes outcomes for determined users, while removing a privacy tool from everyone else, is the tradeoff worth debating openly.

Where We Stand

Mysterium VPN is a member of the VPN Trust Initiative, an industry coalition run through the i2Coalition, where participating providers commit to standards covering security, privacy, advertising practices, transparency, and social responsibility. Part of that commitment involves engaging with regulation that affects VPN services.

Other providers, digital rights organizations, and people with no commercial stake are taking part in today's Day of Action as well.

Our position is that the ability to access information without first identifying yourself is worth protecting, and that restrictions on privacy tools should be judged by their full effect rather than by the problem that prompted them. Reasonable people disagree about age verification itself. The narrower question of whether to restrict a general-purpose privacy tool in service of it deserves to be argued on its own, rather than passed as an attachment to a bill about something else.

The Day of Action asks for something small: sign on at DefendVPNs.com to register that position with lawmakers. Nearly 20,000 VPN users did so last year.