VPN Age Verification Laws: UK, US, Australia and Brazil

Is a VPN legal where age verification is in force?

Yes. This page covers the United Kingdom, the United States, Australia, Brazil, the European Union and France, and Canada. In each of them, the age-verification laws place duties on companies. These are the companies that publish adult content, run app stores or operate social media platforms.

None of the statutes, codes or court rulings we read on 31 October 2026 bans VPNs. None requires a VPN provider to check its customers’ ages or penalizes an adult for connecting through one. The UK has come closest. Its consultation response of 15 July 2026 commits to “an onus on social media companies to detect and prevent VPN use among under-16s to access their services”. That duty falls on platforms, not on VPN providers or adult users.

The question keeps coming up because a VPN is the most visible way people react to these laws. Some sites apply their check only to visitors who appear to be in a particular country. If you connect through a server elsewhere, the check is never shown. That is lawful for an adult in all of the places listed here. It can still breach a service’s terms, and it does nothing against checks tied to an account, a payment card or a device.

How the laws work: site, account and device checks

A law can put the check in three places. A VPN only affects the first.

Site-level checks. The UK Online Safety Act, Australia’s codes and the US state laws all work this way. The service that publishes the content must confirm that a visitor is an adult. The methods are set out in law or guidance:

• Texas HB 1181 allows “digital identification” or a “commercial age verification system” that uses “government-issued identification” or “public or private transactional data”.
• Australia’s codes let each service choose a method that meets Australian privacy law. On 9 March 2026, ABC News listed facial age estimation, digital wallets and photo ID as the options under discussion.
• Ofcom’s UK guidance calls for “highly effective” age assurance, which means ways to check or estimate a user’s age.

These checks are usually triggered by where the visitor appears to be.

Account-level checks. Australia’s Social Media Minimum Age Act defines an “age-restricted user” as “an Australian child who has not reached 16 years”. Section 63D requires platforms to “take reasonable steps to prevent age-restricted users having accounts”, with a civil penalty of 30,000 penalty units. Under article 24 of Brazil’s ECA Digital, the accounts of users up to 16 must be linked to a parent or guardian’s account.

The EU’s age-verification app lets a user prove once that they are over 18 and reuse that proof. The Commission describes the app as feature-ready since 15 April 2026. A VPN does not change the age a platform has already attached to an account.

Device and app-store checks. Utah’s SB 142 and Texas’s SB 2420 require app stores to verify a user’s age category when an account is created. The stores must also get parental consent before a minor downloads an app. Utah’s store and developer duties took effect on 6 May 2026. Texas’s law has been enforceable since 4 June 2026. On that day the Fifth Circuit paused a court order, called a preliminary injunction, that had blocked it.

Australia’s codes require app stores to stop under-18s buying or downloading R18+ apps. Brazil’s article 12 makes app stores and operating systems take “medidas proporcionais, auditáveis e tecnicamente seguras” to assess age. In English, that means proportionate, auditable and technically secure measures. These checks happen before any website is visited, so a VPN is irrelevant to them.

What changed, country by country

United Kingdom: age checks in force. Ofcom’s child-protection duties took effect on 25 July 2025. A national consultation ran from 2 March to 26 May 2026. It asked whether children’s access to VPNs should be restricted. On 9 March 2026 the House of Commons rejected a Lords amendment by 321 votes to 106. The amendment would have written VPN restrictions into the Children’s Wellbeing and Schools Bill.

The government’s response of 15 July 2026 acts through social media companies’ detection of under-16s on VPNs. It announces nothing for adults. Research published by the Department for Science, Innovation and Technology on 14 July 2026 found that 26 percent of 11- to 17-year-olds had used a VPN. Full detail: Is a VPN legal in the UK?.

Australia: age checks in force. The Online Safety Amendment (Social Media Minimum Age) Act 2024 received assent on 10 December 2024. Its account obligations began on 10 December 2025. On 16 January 2026 the Prime Minister reported that “more than 4.7 million under-16 accounts” had already been deactivated, removed or restricted. The search-engine code started on 27 December 2025, and the age-restricted material codes followed on 9 March 2026. Full detail: Australia age verification and VPNs.

United States: age checks in force in 25 states. The Free Speech Coalition’s tracker counts 25 states that “now require age verification for websites that contain ‘material harmful to minors’”. Louisiana was first, on 1 January 2023. On 27 June 2025 the Supreme Court upheld the Texas law in Free Speech Coalition v. Paxton by six votes to three. App-store age laws in Utah and Texas add a second layer.

Utah’s S.B. 73, effective 6 May 2026, is the only state law that mentions VPNs. Its provision deeming visitors actually located in Utah to be in Utah, even when they use a VPN, was preliminarily enjoined on 24 September 2026. That means a court blocked it while the case continues. The case is paused until after Utah’s 2027 legislative session. The law’s ban on covered sites publishing VPN instructions still stands. Utah’s Commerce Commissioner says enforcement of the rest of the law starts on 2 November 2026. Our reports cover the injunction and the enforcement start.

We found no federal age-verification statute in force, and no state law restricts adult VPN use. Full detail: age verification laws by state and Texas age verification and VPNs.

Brazil: age checks in force. Lei 15.211/2025, the Estatuto Digital da Criança e do Adolescente, is dated 17 September 2025. Under article 41-A, it entered into force on 17 March 2026. Article 9 requires “mecanismos confiáveis de verificação de idade a cada acesso do usuário”, meaning reliable age verification on every access. It adds “vedada a autodeclaração”: self-declaration of age is banned. Under article 35, fines reach 10 percent of the economic group’s revenue in Brazil, capped at R$50 million per infraction. The law does not mention VPNs.

European Union and France: age checks in force in France, EU framework building. The Commission’s Digital Services Act guidelines of 14 July 2025 recommend age verification to restrict access to pornography and gambling. The Commission asks member states to roll out age verification by the end of 2026.

In France, the SREN law of 21 May 2024 gave new powers to Arcom, the French media regulator. Arcom can issue formal notices to sites that do not keep minors out, and then fine, block and delist them. Its technical standard is dated 11 October 2024. On 3 June 2025 Arcom noted that the Aylo group had suspended access to its sites in France rather than comply. Aylo did so “y compris pour un public majeur”, which means including for adults. Arcom put two more sites on formal notice on 3 February 2026. It listed 31 more as targeted on 29 July 2026.

Canada: proposed. Bill S-209 would make it an offense to make pornographic material available to under-18s for commercial purposes without a “prescribed age-verification or age-estimation method”. The fine for a first offense would be up to C$250,000, and courts could order internet providers to block access. The bill passed second reading in the House of Commons and was referred to committee on 28 October 2026. It is not law. It mentions neither VPNs nor adults’ use of them.

Why VPN downloads surged

Every enforcement date has produced the same pattern.

In the UK, Tom’s Guide reported on 28 July 2025 that Proton VPN’s UK sign-ups had risen by 1,400 percent over its baseline from 25 July 2025. Cybernews research, reported by Compare the Cloud on 26 May 2026, put UK VPN downloads above two million in August 2025. Downloads eased to close to 800,000 a month by April 2026, still well above the pre-law level.

In Australia, Reuters reported Apptopia data showing that daily VPN downloads nearly tripled to 28,722 on 8 March 2026. That was the day before the codes started. The previous week, downloads had been about 10,000 a day. Three of the ten most-downloaded free apps on Apple’s chart on 10 March 2026 were VPNs. Sensor Tower data cited by Tom’s Guide put NordVPN at number 15 on the Australian App Store’s overall free chart.

In Brazil, TechRadar reported on 17 March 2026 that Proton VPN confirmed a 250 percent increase in downloads from the country against its baseline. The rise came as the ECA Digital took effect.

In Texas, Newsweek reported a 234.8 percent rise in VPN demand on 15 March 2024. That was the day after Aylo blocked Texas visitors rather than verify ages. We could not verify a separate Texas surge in March 2026 from any primary page or named-reporter source.

What a VPN changes, and what it does not

A VPN replaces your IP address with the server’s. Your IP address is the number websites see for your connection. So a check that is triggered by a UK, Australian, Brazilian or Texan address is not triggered. A VPN also encrypts traffic between your device and the VPN server, so your network operator does not see which sites you visit. Those are the only two things it does.

It does not change which law applies to you. A UK resident on a foreign server is still subject to UK law, and an adult’s lawful activity stays lawful. It does not remove a check that a service applies to everyone, wherever they connect from. Brazil’s every-access rule and the EU wallet model are designed that way.

It also does not alter:

• the age already recorded on an account
• a payment card’s billing country
• the age category an app store has assigned to a device

It does not protect against a platform’s own detection of evasion either. The UK government now intends to require that kind of detection of social media companies for under-16s. In practice, the risk for an adult is contractual: a service whose terms forbid evading age assurance can suspend the account. Our is my VPN working? tool shows what a site can see about your connection.

The legal position for adults

For adults, using a VPN is legal in all of the countries above. None of the laws creates an offense of avoiding an age check. The Supreme Court’s opinion in Free Speech Coalition v. Paxton says that adults “have no First Amendment right to avoid age verification”. That sentence means a state may require the check. It does not make an adult who connects through a VPN a lawbreaker.

The UK consultation response, Australia’s Act and codes, Brazil’s statute and France’s SREN law all regulate services. Where one of them touches VPNs at all, as the UK’s July 2026 commitment does, it is aimed at how platforms handle under-16s.

Enforcement so far

Enforcement has been aimed at services, not users. In the UK, Ofcom opened investigations into pornography providers. In 2026 it fined an adult-site operator £1 million.

In Texas, the Attorney General sued Aylo Global Entertainment under HB 1181 on 26 February 2024. On 21 March 2024 the office sued Multi Media LLC and Hammy Media under the same law, which carries fines of up to $10,000 a day. On 1 July 2026 it obtained a court order placing the domain of a non-compliant site on registry lock. Kick Online Entertainment operated the site. The domain is recoverable only on a $9.14 million bond.

In France, Arcom has issued successive formal notices since 2025. It listed 31 further sites as targeted on 29 July 2026.

In Australia, platforms deactivated, removed or restricted more than 4.7 million under-16 accounts in the first weeks of the minimum-age rules. eSafety’s own enforcement pages refused our requests on 31 October 2026. We found no reported penalty under the March 2026 codes in the sources we could read.

In Brazil, we found no enforcement action reported by a primary source as of 31 October 2026.

We found no enforcement action anywhere against a VPN provider or a VPN user for the act of using a VPN.

What could change next

The UK is the one to watch. Its July 2026 response commits to making social media companies detect and prevent VPN use by under-16s. Ofcom is expected to turn that into codes of practice. Nothing in it touches adults or VPN apps.

In Australia, the search-engine code’s age-assurance step for account holders was due on 27 June 2026. Later-starting measures in the codes continue to phase in.

In the EU, member states are asked to roll out age verification by the end of 2026. That would make account-level proof more common and location-based workarounds less relevant.

In the US, the Fifth Circuit’s merits decision on Texas SB 2420 will decide whether app-store age verification spreads. A merits decision is the court’s ruling on the appeal itself, not on the stay. Most new state laws take effect on 1 January or 1 July.

Canada’s S-209 is in committee. We re-check this page at least every 30 days and record each development in the timeline above.

Related

• VPN laws and age-verification tracker
• Is a VPN legal in the UK?
• Australia age verification and VPNs
• Age verification laws by state
• Texas age verification and VPNs
• Best VPNs for privacy
• Best VPNs for age verification