The fundamental policy aim is to prevent children stumbling accidentally across pornography when they are online. So to some extent, if more technically-aware children are determined to circumvent the protections being put in place, that does not mean the policy has failed. In the UK, the law requires “highly” rather than “perfectly” effective age assurance, for example.
That said, the Online Safety Act makes it an offence to allow children in the UK to access pornography and other primary priority content, whether that is directly, via a VPN or using two paper cups and a piece of string! Indeed, no age verification law anywhere in the world includes an exemption for children with a VPN.
So, age-restricted sites must either apply age checks to all their users globally, which is arguably the right thing to do anyway, or at least apply them for users known to be located in the regulated jurisdicton or who access via a VPN so might be based there.
BBC iPlayer, Netflix and many other services already block VPNs successfully with the IP addresses of the most commonly used widely known and blacklisted, and new IP addresses adopted by VPNs quickly detected based on high volumes of traffic. Pragmatic regulators may require that only VPN traffic whose users give away clues they may be underage and within their jurisdiction are required to prove their age or their location abroad.
More expensive VPN services do offer less traceable IP addresses, but these tend to be costly, so that acts as a barrier in its own right to children stumbling across pornography. Even if a child borrows a parent’s credit card, the payment to the VPN will show up on a statement, which gives the parent an added chance of detecting this unauthorised activity.
Read more here.