Brits embrace VPNs as UK forces age verification

The surveillance-happy UK has hit another home run against personal privacy with a new set of laws that are stifling people’s digital experiences. Introduced as measures to protect child safety, these new rules are, of course, being applied in such a way as to damage legitimate internet use. 

That is probably what was intended in the first place.

The UK has introduced a legal requirement for internet age verification that is affecting social media services, websites, and apps worldwide. Apple itself has warned of flaws in the Act, saying last year: “The Online Safety Bill poses a serious threat to (this) protection and could put UK citizens at greater risk. Apple urges the government to amend the bill to protect strong end-to-end encryption for the benefit of all.”

Protecting young minds at the cost of privacy

The so-called Online Safety Act (OSA) went into effect on July 25; it makes websites and apps responsible for preventing children from accessing “age-inappropriate content.” But rather than target the young people it ostensibly wants to protect, the law is affecting all users — spawning a vast and unregulated industry in various kinds of age verification services.

Now, you might think that having nurtured introduction of such services, the UK could also have legislated to ensure that those services are themselves secure. Unfortunately, a government big on rhetoric and low on substance did not choose to do so, which means websites and services are free to work with age verification partners, no matter how secure those services might be. 

But who protects you?

To make matters worse, these services are requesting highly confidential data, which means images of passports, people, dates of birth and other identifying information is being shared with companies that are under no legal obligation to keep that information secure. We know this is dangerous, as there have been multiple instances in which companies have failed to protect such information. For example, just last year, US ID verification service called AU10TIX exposed names, dates of birth, nationality, identification numbers, the type of documents uploaded (such as a drivers’ license) and images of those document. 

We’ve also seen stories that suggest potential connections between these ID services and foreign intelligence agencies. In other words, when verification takes place, there’s no saying who will see that key data, and no strong safeguards in place to ensure the information is not sold, stolen, or otherwise misused. It opens people up to all kinds of abuse and seems to contradict all the protection of GDPR.

Shut up

Put it all together and it is pretty clear that the Online Safety Act in the UK does nothing to keep people safe online. Not only this, but by removing anonymity the law makes it super-easy for repressively authoritarian governments such as that of the UK to ban conversations it doesn’t like, silence free speech, and quell criticism. 

Finally, of course, the badly-written law also seems liable to be used as yet another stick with which to force Apple to insert surveillance back doors into end-to-end encrypted messaging platforms. 

As you might expect, people are tangibly unhappy with the new law and have little trust in the online entities with whom they are being told to share their personal information. This is prompting a massive increase in VPN installations, with Proton VPN reporting an astonishing 1,800% uptick in new users since the UK law went into effect. 

Into the fire

VPN services can help you sidestep these requests for age verification by making it seem as if the interaction takes place from outside of the UK — but there is a problem with services of this kind. Not every VPN is as secure as it should be. To enumerate the extent of this insecurity, Top10 VPN warns that 88% of free VPNs they test suffer from serious security issues, such as leaking of IP addresses.

That means — particularly where free VPN services are concerned — people need to be very careful which services they choose. ProtonVPN, NordVPN, ExpressVPN all usually score highly when these services are reviewed, and should be relatively secure — that is, until we see those services caught up in the same privacy-eroding dragnet, “For Your Protection.” It’s all gone very Alan Moore.

You can follow me on social media! Join me on BlueSky,  LinkedIn, and Mastodon.Brits embrace VPNs as UK forces age verification – ComputerworldRead More