We often hear the argument that age verification is pointless because “Kids will just use VPNs”. That’s not a valid argument, given how the relevant laws are drafted, and indeed, may lead adult sites into a false sense of security if they think the use of a VPN provides them with any immunity
None of the laws we have considered in US states or globally include any exception if a child in that jurisdiction used a VPN or any other locating-spoofing device to pretend they are not located in a state requiring age verification.
So, faced with this, to avoid the risk of regulatory enforcement or lawsuits where a private right of action has been created, adult sites have limited choices:
- They apply age checks to all traffic, whether it comes direct, via a VPN or through any other technical means.
- They apply age checks to all traffic except that which they can be confident comes from a state where age checks are NOT required. (This would be similar to the technology used to confirm a gambler is in a state where online betting is legal before accepting a bet.)
- They apply age checks to traffic appearing to be from a state where these are required, and to all traffic from known VPNs, as the latter might be from a user located in such a state.
- They apply age checks to traffic appearing to be from a state where these are required, and block VPN traffic because they cannot know where users are located.
We are not advocating for any of the above – merely setting out the legal requirement placed on adult sites by these new laws and the options that logically defines. There is no get-out-of-jail free card if a child uses a VPN, and sites which ignore the risk that their users might still be in a state requiring age verification may be subject to enforcement or lawsuits.
VPNs have benefits for both anonymity and security, and we do not oppose their use in any way. It would be a mistake to advise adult sites to promote the use of VPNs to circumvent age verification requirements, as they would be putting those sites at risk of legal consequences, and giving them a false sense of security. It is concerning that sites are promoting VPNs on pages which block user access in states where AV is already required – even leading sites who presumably have their own attorneys on hand to highlight this risk.