On July 16, 2026, Ofcom published its first statutory report on age assurance under section 157 of the Online Safety Act. The headline number is big: across a sample of 32 regulated pornography, dating, and social media services, more than 69 million age checks were completed in the second half of 2025, a 23-fold increase on the six months before. The day before the report landed, Technology Secretary Liz Kendall told Parliament that the government "will therefore not age-gate or ban" VPNs, and that platforms are now expected to detect and prevent circumvention themselves.
That last sentence is the one that matters for anyone doing IP-based compliance. A year after UK age verification took effect on July 25, 2025, the policy's clearest measurable side effect is that a chunk of British traffic no longer looks British: it exits VPN servers in Amsterdam, Zurich, and Stockholm. A country lookup can no longer answer "is this user in the UK?" on its own. You need to detect VPN users, and the regulator has just made that everyone's job.
The spike that didn't come back down
The Online Safety Act's child safety duties took effect on Friday, July 25, 2025, requiring services that host pornography and other age-restricted content to run "highly effective age assurance": photo ID matching, facial age estimation, or similar, backed by fines of up to £18 million or 10 percent of worldwide revenue. The British public responded within minutes. Proton reported that UK sign-ups for Proton VPN jumped more than 1,400 percent as the deadline passed, then settled into a sustained increase of about 1,800 percent over baseline in the following days. In the company's own words: "Unlike previous surges, this one is sustained, and is significantly higher than when France lost access to adult content."
Proton VPN briefly became the most downloaded free app on Apple's UK App Store, ahead of ChatGPT.
Who are all these new VPN users? Mostly adults. Ofcom's own research found that 29 percent of 11 to 17-year-olds have used a VPN at some point and 25 percent had in the six months to March 2026, but when the House of Lords debated the issue on September 15, 2025, Baroness Kidron cited Ofcom guidance that only one in ten VPN users is a child. The surge is dominated by adults who would rather route through Amsterdam than upload a passport scan to a pornography site. That is a rational trade, and it is also a permanent shift in what UK traffic looks like from the outside.
What Ofcom's year-one report found
The section 157 report is more candid than you might expect from a regulator marking its own homework. On the success side: the share of children who encountered highly effective age checks when asked to verify their age rose from 25 percent in July 2025 to 43 percent by January 2026, and all ten of the UK's most visited pornography sites now run checks, along with a majority of the top 100. The Age Verification Providers Association counts an additional five million age checks per day since the duties began.
On the failure side, the report acknowledges that VPN use has increased since the measures came into force, and that 5 percent of children say they used a VPN in the past six months specifically to reach content meant for older users. Ofcom's overall verdict, as RPC's analysis puts it, is that age assurance deters children from pornography sites but is not yet delivering the intended protection from harmful content more broadly. The content did not disappear. The traffic moved.
What a VPN user looks like in IP data
When a user in Manchester connects through a VPN, their traffic leaves BT's network inside an encrypted tunnel and re-enters the public internet at an exit server, often in a datacenter abroad. The website only ever sees the exit server's IP address. Everything the site can learn from IP data now describes the exit, not the user.
The good news is that exits are hard to hide. Commercial VPN infrastructure lives in datacenters, and datacenters leave fingerprints in IP data. The exit's address space is allocated to a hosting company, not a consumer ISP: you see AS9009 (M247 Europe) or AS60068 (Datacamp), networks that host exits for many VPN brands, where a real British home connection sits on BT (AS2856), Sky (AS5607), or Virgin Media (AS5089). The RIPE allocation points at a server facility. There is no mobile carrier attached. And the same IP serves traffic for thousands of concurrent users, a density no household produces.
Layer on curated lists of known VPN ranges (many providers publish their server IPs, and the rest can be observed) and you get a per-IP answer. Here is Ipregistry's response for a typical Amsterdam exit, trimmed to the relevant fields:
{
"location": {
"country": { "code": "NL", "name": "Netherlands" },
"city": "Amsterdam"
},
"connection": {
"asn": 9009,
"organization": "M247 Europe SRL",
"type": "hosting"
},
"security": {
"is_vpn": true,
"is_proxy": false,
"is_tor": false,
"is_anonymous": true
}
}The country field is not wrong. The server really is in Amsterdam. The mistake is treating that field as if it described a person.
Why country blocking fails as compliance
The naive implementation of UK age rules reads: if country != GB, the duties don't apply, skip the check. That logic waves through every Manchester teenager with a VPN app, because by country code alone they are indistinguishable from a genuine resident of Rotterdam. Going the other way and blocking traffic from VPN-heavy countries is worse: you lock out real Dutch and Swiss users while the determined UK user just picks an exit somewhere else.
The workable model has three states, not two. UK: apply the duties. Non-UK on a consumer connection: out of scope. And a third state the binary version ignores: location unverifiable, because the IP belongs to an anonymizing service and its geolocation describes a rack, not a user. What you do with that third bucket is a risk decision (Ofcom has not mandated an answer yet), but a service that wants to show it took circumvention seriously runs the age check anyway.
Detect, don't ban
Through early 2026, ministers and children's safety campaigners floated the obvious-sounding fix: age checks on VPN purchases themselves, an idea that Biometric Update described in January as a policy traffic jam in the making. Kendall's July 15 statement killed it: "VPNs have legitimate privacy and security uses and we will therefore not age-gate or ban them."
Enforcing it would have been miserable anyway. VPN protocols hide inside ordinary TLS on port 443, WireGuard runs on any port you like, and a €4-a-month Hetzner VM running WireGuard is a fully functional VPN with a user base of one and no storefront to age-gate. The Lords had already signaled the same direction in September 2025, when Lord Leong said services promoting VPNs as a bypass could face enforcement, while ruling out a ban on the apps themselves.
What replaced the ban is more interesting for readers of this blog. Kendall has asked Ofcom to publish guidance by the end of October 2026 on "what more services can do to detect and prevent VPN use on their platforms," folded into the rapid assessment Ofcom owes Parliament ahead of the under-16 social media ban. The burden of the VPN problem now sits with platforms, and the tool the regulator expects them to use is exactly the one described above: recognizing anonymizing infrastructure at the IP level.
Measure your own VPN share first
If you operate a service with UK users, the useful first step is a number: what fraction of your traffic already arrives through anonymizing exits? Take a day of request IPs, look each one up, and count how many carry a VPN, proxy, or Tor flag or sit on a hosting ASN. For UK-facing consumer services that number has been drifting up since July 2025, and it is the denominator for every enforcement conversation you will have. (It also tells you how much of your "foreign" traffic, in the sense a plain GeoIP lookup reports, is foreign at all.)
This is the data Ipregistry maintains: geolocation, ASN and company type, and per-IP VPN, proxy, and Tor flags in a single API response, refreshed as anonymizing infrastructure moves. You can run the measurement above with 100,000 free lookups to get started.
Keep users in the loop Ship release notes that get read. Try Noticeable