The EU called VPNs 'a loophole that needs closing.' Proton's UK signups rose 1,800%.

The European Parliamentary Research Service published a briefing calling VPN services “a loophole in the legislation that needs closing.” The document landed the same week that Executive Vice-President Henna Virkkunen told reporters, “VPN must not allow the system to be circumvented.”

Brussels is pushing mandatory age verification for online content deemed harmful to children. It already knows the first thing people will do to dodge it.

What the EU is proposing

On May 1, Virkkunen presented the EU’s new age-verification app, a centralized tool that member states can adopt for platforms hosting pornographic or otherwise regulated content. France’s “double-blind” model is the template: the verification provider confirms the user’s age without seeing which site they’re visiting, and the site receives an age confirmation without seeing the user’s identity.

The EPRS briefing goes further. It flags that VPNs let users spoof their location to jurisdictions without age checks, making any national or regional verification system trivially circumventable. The implied remedy: either VPN providers themselves should require age verification, or platforms should be able to detect and block VPN-routed traffic.

No formal legislative text has been filed yet. But Virkkunen framed VPN restrictions as “next steps” EU policymakers need to examine, and the EPRS briefing gives the policy apparatus something to cite.

The UK already tried this

The United Kingdom’s Online Safety Act imposed mandatory age checks on adult content sites starting July 25, 2025. The result was immediate and predictable. Proton VPN reported an 1,800% spike in daily UK signups. Half of the top 10 free apps in UK app stores within the first month were VPN services.

The EU’s own think tank acknowledges the UK data. The EPRS briefing cites the download surge as evidence that age verification without VPN restrictions is porous. But the lesson cuts both ways: the surge also shows that millions of ordinary users, not just privacy activists, will reach for a VPN the moment a government puts a gate in front of content.

Security experts say the cure is worse

French cybersecurity authority Cybermalveillance.gouv.fr warned directly against restricting VPNs. Director Jérôme Notin emphasized that VPN “use is very significant,” protecting “remote workers, journalists,” and businesses that rely on encrypted communications.

Security researchers Paul Moore and Olivier Blazy independently demonstrated critical flaws in the EU’s age-verification app itself, bypassing its protections in under two minutes. They found that the app’s PIN could be reset through file explorer manipulation, biometric checks could be disabled by editing a configuration file, and raw biometric data was stored in unencrypted plain text on the device.

NordVPN and Proton VPN, both already subject to Spanish court orders blocking specific IP addresses, have argued that VPNs function as encrypted tunnels, not content platforms, and can’t serve as content moderators without fundamentally breaking what they do.

Mozilla, Mullvad, and Proton signed a joint letter opposing the UK’s approach to age verification, a letter that the EU debate will likely inherit.

What this means for you

If you use a VPN for work, privacy, or security, watch this debate closely. The EU isn’t proposing to ban VPNs outright. But requiring identity verification to use one would mean handing your real identity to your VPN provider before you can use the tool whose entire purpose is keeping your identity private. It’s the same structural tension that killed Instagram’s end-to-end encryption last week: privacy infrastructure being dismantled in the name of child safety.

No legislation has been introduced yet. WWDC isn’t the only June date worth watching: the European Commission’s formal legislative proposal on age verification is expected before summer recess. If it includes VPN provisions, the fight moves from briefing papers to binding law.