Can VPNs defeat age checks? What platforms need to know and what actually works
Can VPNs defeat age checks? What platforms need to know and what actually works
On 25 July 2025, Ofcom began enforcing the Online Safety Act – and with it, a long-delayed obligation for websites hosting adult content to verify the age of UK users. For adult content platforms operating in this space, it marks a clear regulatory line in the sand: implement effective age checks, or face consequences.
But one question keeps coming up: can’t under-18s just use a VPN to get around it?
The short answer is yes – some can and do. VPNs let users appear as though they’re browsing from another country. More sophisticated setups, like residential proxies, route traffic through real, ISP-issued IP addresses, making them much harder to detect. This presents a challenge not just to regulators but to the platforms doing their best to comply.
Ofcom knows this. It doesn’t expect perfection. Instead, it expects “reasonable and proportionate” steps to minimise circumvention – which means making it significantly harder to get around age checks, not necessarily impossible. But that’s where the limitations of conventional verification start to show.
Most current age verification tools are built on inputs that are easy to fake, borrow, or work around: a tickbox here, a credit card there, maybe an uploaded document for the more compliant. Some systems use location data – for instance, checking the user’s IP address to determine if UK rules apply. But this is exactly the kind of thing VPNs are designed to spoof.
This arms race between regulation and circumvention was always going to come down to data. And the question isn’t “Is this user in the UK?” – it’s “Can we be confident this user is who they say they are, and old enough to be here?”
That’s where mobile networks enter the picture.
A more grounded signal
Every mobile phone relies on a SIM card, and every SIM is issued by a mobile network operator. That operator holds a wealth of verified subscriber information – including, in many countries, the user’s date of birth. Crucially, this data isn’t based on what a user types into a form – it’s linked to how the SIM was issued and maintained, often involving real-world ID checks and billing credentials.
Because of this, verifying a user’s age against the records held by their mobile operator offers something rare in online interactions: high assurance. It bypasses the need for the user to upload anything, removes reliance on spoofable IP addresses, and doesn’t require them to even know their phone is doing the heavy lifting. It just works – behind the scenes – and crucially, it doesn’t reveal anything unnecessary.
This type of check isn’t theoretical. It’s live. And it’s already being used in the UK and beyond to verify that users are old enough to access restricted content, without exposing or over-collecting their data. No documents. No friction. No tickboxes.
And importantly, no VPN workaround – because the check isn’t reliant on geographic guesswork or user-submitted information. It’s bound to the SIM card, the mobile network, and the verified subscriber data behind it.
The Ofcom balancing act
Ofcom has been clear that compliance must not come at the expense of user privacy. Any system must avoid becoming a honeypot of personal data, especially when dealing with such sensitive content. That rules out many of the document-heavy models that failed under the UK’s previous attempt at age-gating in 2019.
But VPNs have exposed a bigger weakness: any model that relies solely on IP-based detection or user-supplied information is fundamentally flawed. It puts the onus on the platform to detect deception, rather than verifying truth.
The shift towards mobile network-based verification represents a different approach entirely. Rather than starting from a position of mistrust – trying to catch users lying – it begins from a foundation of verified infrastructure and builds outward. If the SIM card checks out, and the network confirms the user is over 18, then the platform can decide. If not, access is blocked.
For regulators like Ofcom, this opens a new path forward: one that’s both privacy-preserving and fraud-resistant. Mobile verification doesn’t require users to share unnecessary personal data, but it also doesn’t trust easily faked inputs. And when done right, it operates invisibly to the end user – no switching tabs, copying codes, or digging out documents.
Global implications
The UK may be leading the charge, but it won’t be alone for long. Australia, the EU, and several US states are actively exploring similar legislation. And with the rise of AI-generated content and deepfakes, age verification isn’t just about protecting children anymore – it’s rapidly becoming a cornerstone of broader online safety efforts.
As regulations evolve, so too must the technology. Any solution that relies on where a user appears to be – rather than who they actually are – will always have an expiry date. VPNs, proxies, and decentralised browsers will continue to erode location-based controls. What’s needed is a way to ground age checks in real-world identity, not perceived geography.
That’s the beauty of mobile network-based verification. It doesn’t matter where the user appears to be – only who they are and whether they meet the legal threshold. It’s this anchoring to verified infrastructure that makes it resilient, reliable, and far harder to circumvent.
For platforms that want to comply with Ofcom regulations and not lose users, well, that’s a very powerful proposition.
Age Verify from Sekura.id, enables real-time age verification using trusted data held by mobile network operators. It requires only a mobile number, performs no document or IP checks, and returns a simple yes/no based on verified subscriber records – all while preserving user privacy. Learn more at https://www.sekura.id/age-verify
