Lawmakers Can’t Ban VPNs No Matter How Hard They Try

Earlier this year, many lawmakers and regulators around the world were, once again, trying to control and regulate the internet in the name of protecting children, but the latest round of policy discussions related to effective bans on the use of VPNs appear destined for failure. While governments can make particular websites or apps more difficult to access, completely closing the available workarounds for those restrictions would require levels of identity checking, network surveillance, and device control that most liberal democracies are simply not willing to accept. Indeed, governments across the West are increasingly turning to age-based restrictions on access to specific websites and apps, with some jurisdictions also moving those restrictions deeper into the lower layers of the tech stack. Australia became the first country to impose a nationwide under-16 restriction on covered social media platforms last year; Utah and Texas have pursued similar policies at the app store level, and California is pushing the responsibility of knowing a user’s age all the way down into commercial operating systems starting in 2027 (open source operating systems are exempt). Similar measures are being considered across other jurisdictions around North America and Europe. And because age restrictions that depend on a user’s geographic location can often be circumvented by masking their IP address, some governments have turned their attention to the next logical target: VPNs. Utah attempted to make adult-content sites potentially liable when minors get around age checks with VPNs, while U.K. regulators came under heavy fire while wrestling with how to deal with similar concerns. Every time users find a way around one checkpoint, lawmakers seemingly respond by going one level deeper into the tech stack. While all of these laws come with their own forms of intrusive regulation, the general trend seen by many observers is an overall crackdown on online anonymity. “I’m watching how quickly age verification is becoming a part of every policy proposal,” cryptographer and Johns Hopkins Associate Professor of Computer Science Matthew Green recently posted on X, kicking off a thread on his concerns regarding the push for these sorts of policies in a variety of areas. “None of this is about age, it’s all ultimately about identity.” Age verification is an especially potent vehicle for expanding online controls because it is marketed as protecting children, an invocation of the kind of politically unassailable threat that cypherpunk Timothy C. May associated with the Four Horsemen of the Infocalypse: terrorists, pedophiles, drug dealers, and money launderers. Even in places where true ID verification is not yet part of the law, there are worries that the basic infrastructure for such a requirement is now in place and available for future exploitation. Indeed, app developers themselves, especially those focused on respecting their users and enabling privacy and anonymity features, are becoming increasingly worried about the never-ending push towards complete surveillance of the internet. For example, Signal Foundation President Meredith Whittaker shared her concerns during an interview with Bloomberg, where she bluntly stated, “We would rather exit a market than undermine the technical guarantees that people trust for their privacy.” Is This All a LARP? Of course, if Signal were to leave the U.K. by withdrawing from local app stores, that wouldn’t necessarily prevent people in the country from continuing to use it. Signal could still be downloaded on Android-based devices by sidestepping the official Google Play app store. If Google continues to add more restrictions on sideloading, users could turn to privacy- and security-focused alternative operating systems like GrapheneOS. VPNs could also be used to get around potential blocks on Signal’s website or network connections. None of these workarounds would necessarily help if Signal itself stopped providing service to U.K. users, however. It ultimately depends on how Signal withdraws from the market and how deep into the tech stack lawmakers want to go in restricting access. “Even China struggles to enforce VPN and Tor bans despite having complete control of ISPs and providers throughout their country via the Great Firewall, as VPN technology advances and obfuscation and detection-prevention techniques get better over time,” the pseudonymous Seth for Privacy, who is chief operating officer at privacy-focused crypto wallet Cake Wallet, told Gizmodo. “And the UK and individual US states have far less total control over network policy than China.” Carl Dong, who is the founder and CEO of Obscura, a privacy-focused VPN provider where no single party can link who you are to what you do, shared a similar sentiment when we asked whether it’s possible to implement the sorts of anti-VPN policy proposals popping up in the U.K. and the U.S. in practice. “No,” Dong responded. “Anyone with $4 and ten minutes can spin up a personal VPN. As many countries have already learned after decades and billions spent on unsuccessful internet censorship: Information wants to be free.” From Dong’s point of view, these sorts of laws can have the direct opposite effect of their intended impact. “I find the proposed bans on VPN services particularly ironic,” Dong said. “In order to protect the children, we’re stopping them from using the technology that shields them from online tracking? This will simply push casual users from audited VPN providers to unaudited free VPNs whose only revenue stream is selling user data.” Dong added that tying government IDs to one’s browsing history and handing those IDs over to third parties puts those documents “one subpoena away from government eyes and one breach away from the open market,” in addition to entrenching the Apple and Google duopoly, as they’re the only two companies who are positioned to run device attestation at such a massive scale. “As they stand, these policies represent the biggest leap towards mass surveillance and censorship the Western world has seen in decades,” said Dong. According to Ben Arc, who works on the very sort of software that can be used to circumvent these kinds of policies at LNBits and Nostr.com, crackdowns on online privacy and anonymity can actually incentivize improvements in software tools focused on enhancing the protection of those features. “Governments battling online privacy strengthen online privacy solutions,” Arc told Gizmodo. “VPNs became popularised and mainstream by porn restrictions, so now governments have to battle VPNs. Next they will have to battle private servers and people creating their own VPNs using WireGuard. It all gets quite ridiculous and unenforceable.” “Providers like Obscura have [been] built from the ground up to avoid VPN detection by ISPs via QUIC, a technology that makes VPN traffic look exactly like regular HTTP3 traffic,” Seth for Privacy added. “Mullvad and Proton VPN also provide strong obfuscation techniques to power users, and Tor has continued to improve their censorship resistance via tools like Snowflake over the years to allow those in even harder jurisdictions (i.e., China or Iran) to still be able to access the free and open internet.” In other words, efforts to completely prevent particular kinds of internet use are largely performative unless governments are prepared to impose extremely intrusive controls. Governments can make circumvention difficult enough to alter the behavior of ordinary users, but eliminating it completely requires increasingly draconian control over networks, software distribution, hardware, and user identity. And even those measures may not stop the most determined users. Satellite systems such as Starlink can provide another route around national internet shutdowns for people able to obtain and safely operate physical terminals, leaving governments to criminalize, confiscate, locate, or attempt to jam the physical Starlink hardware itself. As mentioned by Arc, one of the most directly applicable examples is the age-verification systems already imposed on adult websites in various jurisdictions. Multiple studies have found that these sorts of restrictions increase interest in VPNs and shift traffic or search activity from compliant platforms toward noncompliant or ungated alternatives. A study of the situation in Australia specifically also found that 85% of those aged 12-15 still use social media despite the under-16 account ban. Crypto is another area where VPNs have been widely used to circumvent geographic restrictions that allow offshore platforms to avoid applying the full U.S. KYC and anti-money-laundering regime to their users. For example, an analysis by Rutgers statistics professor Harry Crane, commissioned by an industry group representing Polymarket competitors, estimated that Americans account for roughly 22% to 30% of trading volume on Polymarket’s offshore platform, despite those in the U.S. being barred from using it. Binance and KuCoin similarly allowed U.S. customers to access their offshore crypto exchanges through geographic workarounds before pleading guilty in separate federal cases involving failures to comply with applicable registration and anti-money-laundering requirements. More recently, Polymarket has stepped up efforts to identify and block users accessing its offshore platform through VPNs amid growing legal and regulatory pressure around the world. Beyond VPNs and Tor, Arc also pointed to Nostr as a newer potential obstacle for lawmakers trying to regulate social media through centralized platforms. Nostr is an open protocol that allows users to communicate through independently operated relays rather than through a single company that can be ordered to block accounts or police access. “Nostr is a real challenge to all these laws,” said Arc. “For example, profiles are just a cryptographic keypair, so to stop a user creating a profile would mean governments regulating and banning maths. The relays that pass the content are easy to run, so it becomes whack-a-mole. Nostr is itself a troll machine designed to discredit ill-thought-out blanket laws that attack privacy and anonymity.” In many ways, Nostr can be seen as a continuation of the free/libre and open-source software (FLOSS) movement, which was also previously instrumental in pushing back on attempted government crackdowns of internet activity related to strong, end-to-end encryption in the 1990s and internet piracy in the 2000s. “Governments can absolutely make access harder for platforms with centralised platforms, but for decentralised ecosystems and free libre and open-source it is much harder, which is why most of us work in FLOSS and things like Nostr and imagine FLOSS wins out,” said Arc. In other words, the key problem for lawmakers and regulators is that cypherpunks write code. Developers have repeatedly responded to these sorts of regulatory developments by writing software that encrypts data and decentralizes infrastructure as much as necessary to get around the new restrictions. And in this most recent round of potential restrictions on VPNs, most of the software necessary to circumvent the regulations already exists. Lawmakers and Regulators are Already Retreating In Utah, Pornhub’s parent company, Aylo, sued the state to block the law that would make companies like Pornhub liable when an underage user in Utah reaches the site via a VPN. Aylo argued that because websites cannot reliably determine whether a visitor masking their location is physically in Utah, the only way to eliminate the risk of liability would be to apply Utah-compliant age verification to every visitor worldwide. A judge issued a preliminary injunction in September against enforcement of the relevant provision after finding it likely unconstitutional. The case was later stayed until the end of the 2027 legislative session so lawmakers could consider amendments; in the meantime, the associated injunction remains in place. Utah State Senator Todd Weiler, Utah Representative Steve Eliason, and Utah State Senator Calvin R. Musselman did not respond to emailed questions about how the laws can be reconciled with civil liberties or effectively enforced in the face of technological workarounds. It’s unclear whether other states will follow Utah’s lead on the VPN-specific language or pull back once the practical and constitutional problems become clearer. Across the pond, then-U.K. Online Safety Minister Kanishka Narayan stated in July, “We decided not to limit VPNs,” and then-U.K. Technology Secretary Liz Kendall confirmed the same in a written parliamentary statement, saying VPNs have “legitimate privacy and security uses.” Most recently, U.S. Representative Darrell Issa introduced the American Copyright Protection Act in mid-September, which would let copyright holders obtain court orders requiring large VPN providers (those serving at least 100,000 monthly U.S. users or subscribers), ISPs, and DNS resolvers to take commercially reasonable steps to block designated foreign piracy sites. A competing bicameral bill, the DEFEND IP Act, was introduced shortly afterward by Senator Thom Tillis, Representative Zoe Lofgren, and others, but it explicitly excludes entities that exclusively provide VPN services. Neither bill has received a hearing. On top of that, Issa is retiring at the end of this term, and Tillis is not seeking reelection, so both measures are expected to expire with the current Congress and go nowhere.