The United Kingdom's Online Safety Act, now in force, is already producing unintended consequences. Over the weekend following its activation, VPN usage across the UK surged dramatically, with services such as Proton VPN reporting a 1,400% increase in signups just minutes after the regulation took effect.

The law requires websites hosting adult content or material related to self-harm, suicide, and eating disorders to implement "highly effective" age verification checks. These can include uploading government-issued ID and selfies for verification, a move critics argue compromises user privacy and pushes users toward circumvention technologies.

While regulators like Ofcom report that over 6,600 pornographic websites have implemented age checks, and platforms such as Reddit, X (formerly Twitter), and Bluesky are adapting their systems accordingly, the sharp spike in VPN adoption has highlighted widespread resistance. Proton VPN has seen sustained 1,800% increases in daily signups, and NordVPN confirmed a 1,000% spike in purchases from UK users in the same timeframe. Other providers, including Windscribe and AdGuard, have posted similar figures.

The law's rollout appears to be following patterns seen in other jurisdictions where content restrictions led to surges in circumvention tool usage. The American Civil Liberties Union’s Daniel Kahn Gillmor called the UK’s approach a “quick technological fix” that fails to address the deeper issues behind content access and youth safety. “Those technological fixes have consequences,” he warned.

Seema Shah, VP of research at Sensor Tower, noted that VPN downloads on iOS devices in the UK grew an average of 100% day-over-day in the four days following implementation—compared to a 5% increase on Android. Five VPN apps reached the top 10 in Apple’s UK App Store by Monday, illustrating the scale of user response.

For governments, the result is a complex enforcement dilemma. Implementing age checks limited to users within a jurisdiction risks being undermined by circumvention. Applying them globally raises jurisdictional questions and could pressure international platforms to adopt broader surveillance measures.

Digital rights organizations warn of potential future overreach. By normalizing invasive ID checks, critics argue, the UK risks drifting into an enforcement model that mirrors more authoritarian regimes, where privacy tools are often restricted and heavily penalized. The legal frameworks used to justify these shifts, they argue, must be closely monitored by privacy counsel and corporate legal teams alike.

With similar age-verification measures under consideration in the U.S. and other democracies, the UK may serve as a bellwether for how legislative intent collides with practical digital behaviors—and how quickly users turn to tools that reassert their autonomy online.