Show your ID to see the internet: the age-verification era has arrived
Roughly half of US states and the UK now demand you prove your age, often with a government ID or a face scan, to reach legal content. Sign-ups for VPNs that sidestep the checks have surged. Here is what changed, why privacy experts are alarmed, and whether any of it actually works.
Age verification has gone from a fringe idea to a fast-spreading law. After the US Supreme Court's June 2025 Paxton ruling removed the main constitutional obstacle, roughly 25 states now require adult sites to check your age, and the UK's Online Safety Act began mandating "highly effective age assurance" in July 2025. In practice that often means uploading a government ID or letting a camera estimate your age. The result: VPN providers reported sign-ups spiking (Proton said UK sign-ups jumped about 1,400%), privacy groups warn the checks create honeypots of sensitive data, and the whole system is easily bypassed by a VPN. Real child-safety goal, real privacy cost, and a genuine question about whether it works.
For most of the internet's life, accessing legal adult content took a single click on "I am over 18." That era is ending. In a growing number of places you now have to prove it, by uploading a photo of your driver's licence, matching your face to your ID, or letting an algorithm guess your age from a selfie. This is one of the more consequential changes in how the internet works, it is spreading quickly, and it sits on a genuine collision between protecting children and protecting everyone's privacy. Here is the honest map of where we are.
What changed, and why now?
Two events flipped the switch.
In the United States, the Supreme Court decided Free Speech Coalition v. Paxton on 27 June 2025, upholding a Texas age-verification law in a 6-3 ruling. Crucially, the Court judged these laws under "intermediate scrutiny" rather than the stricter standard that had blocked similar rules for two decades. That removed the main First Amendment obstacle hanging over the two-dozen-plus states that had already passed such laws, clearing the way for them to be enforced and for more to follow. Today about half the country, around 26 states and still climbing, requires age verification for adult sites, according to trackers kept by the Free Speech Coalition and the age-verification industry. The frontier has since moved from individual websites to the devices themselves: under Texas's App Store Accountability Act, in effect since 1 June 2026 after the Supreme Court declined to block it, Apple and Google must verify users' ages at account setup and gate what minors can download, a model other states are moving to copy.
In the United Kingdom, the Online Safety Act's "highly effective age assurance" duty took effect on 25 July 2025, policed by the regulator Ofcom. Sites hosting adult content that are accessible in the UK must now verify users are adults or face enforcement. Ofcom has opened dozens of investigations into adult services and fined at least four operators, the largest a £1.35 million penalty, and warned in July 2026 that "tougher action is needed" on age checks. The EU is moving in a similar direction with its own age-verification pilots.
How do these checks actually work?
This is where the privacy stakes live, so be precise. The laws generally set an effectiveness standard rather than mandating one method, and sites use a mix:
- Government ID upload. You photograph your passport or driving licence and send it to the site or a third-party verifier.
- Photo-ID matching. You upload an ID and a live selfie, and software checks they match.
- Facial age estimation. A camera and algorithm guess your age from your face, no ID required, which the industry favours as less intrusive but which is still a biometric scan.
Ofcom's data shows facial age estimation and photo-ID matching are among the most common approaches. Not every law demands a government ID, but every one of these methods means handing sensitive personal data, your face or your identity document, to a website or a verification company just to view legal content.
Why did everyone suddenly download a VPN?
Because a VPN makes you appear to be somewhere the law does not apply, and the checks are usually geographic, so switching your apparent location sidesteps them in seconds.
When the rules landed, VPN companies reported enormous sign-up spikes, though it is worth being clear about who is counting. Proton VPN said UK sign-ups jumped roughly 1,400% in the hours after the Online Safety Act checks began, briefly making it the top free app on the UK App Store; NordVPN reported a surge of around 1,000%. In Florida, the review site vpnMentor measured a roughly 1,150% jump in VPN demand within hours of that state's law taking effect on 1 January 2025. Treat the exact percentages with caution, they come from companies that sell VPNs or review them, but the direction is independently corroborated by app-store charts and Google Trends spikes for "VPN" in the affected places. The demand was real.
That is also the first sign of the system's central weakness: a law meant to be a wall has an obvious, legal door next to it.
What is the privacy problem?
Handing your ID or face to a website to prove your age creates exactly the kind of sensitive data trove that gets breached. As the Electronic Frontier Foundation puts it, "once that valuable data is centralized, it becomes an immediate target for leaks, hacks, and misuse." This is not hypothetical: age-verification and identity vendors have already suffered high-profile breaches. Every new mandate multiplies the number of places your identity documents are stored, and therefore the number of places they can leak from.
There are two deeper worries stacked on top. The first is normalisation: once you are used to showing ID to visit one kind of site, extending the requirement to social media, search or the whole web becomes an easier sell, which is why critics see age verification as a stepping stone to broader digital-ID and surveillance systems. The second is chilling effects: some adults will simply not access legal content rather than attach their real identity to it. Privacy groups argue the trade, real ID for legal browsing, is a bad bargain that mostly inconveniences adults while barely slowing determined teenagers.
Is it even working?
The honest answer is: partly, and it is early. Ofcom's first statutory report on age assurance, published in July 2026, found real movement: the share of children who encountered "highly effective" age checks rose from 25% to 43% between July 2025 and January 2026, and more than 69 million age checks were completed across 32 services in the second half of 2025, a 23-fold increase. So the checks are being deployed and are catching some under-18s who would previously have sailed through.
But the same design that makes them work on casual users makes them easy to defeat for motivated ones: a free VPN, a borrowed ID, or a site based in a country that ignores the rules. The result is a policy that raises friction for the average person, collects a lot of sensitive data, and is porous exactly where it is aimed. Whether that is a reasonable price for keeping some children off adult sites, or a privacy cost that will keep expanding to less defensible targets, is the real debate, and it is only beginning. For more, see the Privacy section, our explainer on what a VPN actually hides, and our guide to the best VPN of 2026.
Where age checks are landing
| Where | What triggers it | How it is checked |
|---|---|---|
| ~25 US states | Post-Paxton laws for adult sites | Government ID or age-estimation, varies by state |
| United Kingdom | Online Safety Act (from July 2025) | "Highly effective age assurance": ID matching + facial estimation |
| European Union | Age-verification pilots underway | App-based / EU digital-ID approaches being tested |
The best VPN of 2026, after six weeks of real testing
We ran the major providers as our only connection for six weeks and measured what actually matters: sustained speed, leak safety, and whether the no-log audits hold up. NordVPN won; Proton VPN is the value and privacy pick.
What a VPN actually hides, and the myths that oversell it
A VPN does two genuinely useful things and gets sold as if it does ten. Here is the honest version: what it really hides, why it does not make you anonymous, and the tracking it cannot touch.
The best VPN for streaming in 2026, tested on real libraries
We ran the major VPNs against Netflix, Disney+ and BBC iPlayer to see which actually unblock, hold 4K without buffering, and keep working when the streaming services fight back. NordVPN won overall; ExpressVPN is the most consistent unblocker.