UK Online Safety Act: Age Assurance Past VPNs and Proxies
The Online Safety Act expects highly effective age assurance. Learn why VPN and proxy detection matters and how to keep a defensible record of every check.
The UK Online Safety Act raised the bar from "we have an age gate" to age assurance that is actually effective. For any team relying on where a user appears to be, that raises an awkward question: what happens the moment they switch on a VPN?
Effective is the operative word
The duty is not satisfied by a checkbox. It expects measures proportionate to the risk and strong enough to work in practice. A gate that a VPN walks straight through is not strong in practice, and regulators have been explicit that the bypass problem is on the operator to address.
VPNs are the obvious bypass
When age rules tightened, VPN sign-ups spiked. That is not a coincidence: a VPN relocates the apparent IP, so a geolocation or country check sees the server, not the user. If your assurance leans on apparent location, a VPN quietly defeats it.
Check whether a connection is routed through a VPN
Detect the masking, then decide
You do not have to block every VPN user outright, but you do have to see them. The pattern:
- Detect the anonymiser with VPN and proxy detection, plus Tor exit checks. A masked origin is a signal, not an automatic verdict.
- Apply your policy. Step up to stronger verification when the origin is masked, or block under the strictest content categories. The point is that the decision is deliberate and logged.
- Record it. Keep proof of the check and the action for each request.
The evidence half of the duty
Showing you applied a measure matters as much as applying it. A log that can be edited later is not evidence. A hash-chained log is: each entry seals a hash of the previous one plus the payload, so any tampering breaks the chain and is caught on verification.
Provenance does both halves in one call. It detects VPN, proxy and Tor masking on the same engine behind our detection tools, maps the verdict to your per-jurisdiction policy, and writes a tamper-evident audit log you can export as signed evidence for a regulator.
Bottom line
Highly effective age assurance and VPN bypass cannot coexist if your only signal is apparent location. Detect the masking, act on it under your policy, and keep a record that holds up. As always, pair the technical control with legal advice and your age-assurance provider, this is a compliance measure, not legal advice.