How AI and VPNs undermined the UK Government’s online age verification rollout

With the introduction of mandatory age verification measures on 18+ sites in the UK, technology has demonstrated how crafting effective regulations is evermore difficult in the age of technology, specifically AI.

The legislation

The Online Safety Act was passed back in 2023 under the previous Conservative government with cross party support , introducing age verification requirements becoming enforceable as of late July this year. But the legislation was not passed without controversy. In fact, strong opposition has existed since the legislation was first conceptualised. 

Designed to protect young people, the legislation requires those who want to use 18+ websites to verify their age. Often using biometric technology and ID to do so, something many have branded a breach of privacy. The legislation has had particularly prominent impacts on adult content websites and websites, such as social media, where users can submit their own content.

Enforcement

Enforcement of the new legislation has been heavily criticised by privacy campaigners and libertarians across the country with privacy concerns just one of many concerns relating to the new rules.

Sites have reportedly used a series of checks, such as face scans and ID checks in an attempt to determine the age of users, but these measures have not been without flaws as users have been unable to verify their age and other users have breached the checks.

Virtual Private Networks (VPNs)

Using VPNs, many have bypassed the new legislation by virtually setting their location as in another country. An easy way to circumvent the legislation that the government thought was thorough. 

VPNs have been around for decades and are widely known for their privacy, security implications as well as their ability to permit users access to sites which may not be available in their region due to geographic limitations.

Now, they are being used by users to set their location in nations not affected by the new regulations. An accessible workaround that undermines the intended enforcement of the law.

Artificial Intelligence (AI)

Meanwhile, many users have used AI tools to pass identity checks, by creating artificial users who are visibly old enough to pass biometric checks by creating AI people or AI versions of real people who have the required biometric features to pass face scans.

Meanwhile, users have also used technology to create fake IDs to pass checks that require ID. Some users have reportedly even used AI ID’s and characters which resemble the Prime Minister, Keir Starmer.

What does this mean for legislation?

In a world where technology surrounds us everywhere and where the use of AI is growing, governments have a particular obligation to step up and ensure regulations cover every possibility, or else tech-savvy individuals who disagree with the legislation will find a way around.

VPNs and even AI have been around for years now, these are issues the government and parliament could have foreseen during the relentless scrutiny period that the online safety act would’ve gone through in Parliament. But it failed to do so and so the legislation is almost unenforceable – despite Labour MPs expressing concerns regarding the prospect of users circumventing the legislation with VPNs back in 2022.

Government response

The government is yet to respond to the surge in VPN usage and has not yet officially stated whether or not it will regulate or ban the use of VPNs in the UK. 

Ofcom already prohibits the promotion of VPNs by 18+ sites and reassures sites that the responsibility to block underage users accessing adult sites remains on the site – and not on the users who avoid the verification by using tools such as VPNs.

Future implications

If anything the bypassing of this new piece of legislation has proven the need for governments to adapt. It raised questions about how governments can ensure that legislation remains enforceable in an age where technology is advancing at great speed.

Will the government evaluate the possibility of amending the legislation to allow the use of orders in council and statutory instruments to enable increased flexibility in amending the legislation in future so it can adapt quickly to the issues presented by new technology or will it increase the powers of Ofcom?

What it means website owners and the tech industry

Website owners need to remain cautious, with an ear to the ground, to know what legislation may come their way and affect their website – especially given the wide scope of the regulations, requiring any websites which include user-generated content to verify the identity and age of users.

For the tech industry, it provides an equally pivotal time as new AI, VPN and other emerging technologies’ regulations are all on the table and subject to strong government consideration.

It’s crucial, now more than ever, that tech firms, website owners and all the stakeholders related to them understand the implications of potential government action and equally understand how they can influence government proposals to ensure not only business success but also the very survival of business.