Interest in virtual private networks (VPNs) has risen following the introduction of the Online Safety Act, but Edinburgh academics have warned of the ‘privacy risks’ in using such platforms.
A new study led by the University of Edinburgh examined how individuals have responded to age verification checks enforced by the Online Safety Act and evaluated the potential risks from bypassing the rules.
The 2023 legislation is a set of UK laws and duties that require social media companies and search engines to protect users, especially children, from illegal content and harmful material.
Researchers found UK users’ online discussions about VPNs – tools used to avoid restrictions – increased by 145 per cent, whilst Google searches for VPNs rose by 147 per cent, using statistical analysis to compare with a typical day.
The academics, worked with colleagues from the universities of Newcastle and Durham, studied data from Google Trends and Reddit, the online forum and message board.
On Reddit, discussions relating to the act in UK political communities increased by 1,481 per cent, the study showed.
The increases were concentrated around 25 July 2025, when age checks for adult websites and some social media platforms came into force, researchers say.
Without data on VPN downloads, the team used online discussions as a ‘rough proxy’ for interest, even though discussion doesn’t directly reflect usage.
Age verification may require users to disclose sensitive information about themselves, such as facial scans, identity documents or payment details.
A VPN encrypts the connection between your device and the internet, hiding your IP address and scrambling your data so internet providers can’t see where you are or what you’re doing online.
But experts warn that people using VPNs to reach restricted sites without handing over personal details could be putting themselves at risk.
Some riskier VPN services track, store and share user data with third parties, and many users may not know how to tell safe providers from risky ones, and the researchers said people need to better understand VPN privacy risks to stay safe online.
Dr Tuğrulcan Elmas, lecturer in the School of Informatics, University of Edinburgh, said: “The sharp rise in interest in VPNs highlights an important unintended consequence: users seeking to avoid sharing sensitive information for age verification could unknowingly use services that collect and sell their data.”
Dr Marc Juarez, lecturer in cybersecurity and privacy, University of Edinburgh, added: “It surprised us that people trust VPN providers over the companies who have been certified to run the checks, especially as user interest also increased for high-risk VPNs. We urgently need to raise awareness of the privacy risks of VPNs and highlight that not all VPN providers are created equal.”
The paper was published in the journal Proceedings on Privacy Enhancing Technologies.