Age verification is a parents job, not yours.

And yes, the tooling for it sucks.

However, such efforts are technically flawed because the only reliable method for identifying VPN protocol signatures is deep packet inspection at the network level, which the EPRS paper doesn’t mention.

I mean, you can tunnel whatever over whatever. You can tunnel a VPN over anything else that's encrypted, so unless you also want to ban SSH and HTTPS connections and suchlike (well, okay, for UDP-based VPNs, you'd probably prefer something UDP-based, but I think that the point stands), you're going to have trouble, say, blocking OpenVPN connections.

Tor exists for the explicit purpose of not being blocked.

Maybe you could try to characterize VPN traffic and do traffic analysis without being able to look inside the encrypted payload, say "VPN traffic tends to look like this", but again, it's not that hard to add noise to the signal.

And you don't even mostly need a full-on VPN for most of this, since it's mostly just people trying to access Web services.

Get yourself any Linux system in some less-restrictive location (which I'll call server) running OpenSSH. SSH into it from client like so:

[tal@client ~] $ ssh server -N -D127.0.0.1:1080

On the client, install the Proxy Toggle Firefox plugin. Set it to use localhost, port 1080 as a SOCKS5 proxy. Click the toolbar button to toggle on proxy use. Now all your browser traffic is coming from that remote server. All a network provider can see is an SSH connection. Click again, and you're back to normal mode.

But tal, that's complicated. Some people won't know how to use SSH.

So is virtually everything that a computer does. Raytracing. Image composition. Decoding discrete cosine transformation encodings. Rendering real-time video game worlds. If there's a need, someone goes out and writes software that makes it easy for the end user. And if you create a situation where there is an unlimited quantity of stuff that a lot of end users want access to behind a wall which someone can make a one-click program to bypass, it's probably a reasonably safe bet that that those one-click programs are going to show up.

There is no loophole that can be trivially closed here. It's a fundamental limitation

if users are going to be able to send traffic that you cannot inspect the inside of

and avoiding that would mean encryption spanning your borders being disallowed, which you probably do not want

then they can appear to be coming from wherever in the outside world they want.

And plenty of people pointed out that this was a problem before age-verification stuff was put into force. This isn't a situation where one just does the thing and there are a few lingering minor issues to iron out. It's fundamental to the concept of doing age verification.

But voters don't want their kids seeing porn.

Well, frankly, if said kids have Internet access and they want to see porn, they probably are going to be able to see porn or otherwise enjoy use of the least-restrictive set of rules out there. That's part of having a world-spanning network where people can communicate with each other. There is going to be blasphemy and pornography and political extremism and stuff saying that Santa Claus doesn't exist out there. Some of that is going to be material that doesn't conform to the set of social norms where you live and will conform to social norms elsewhere in the world. I don't personally see that as all that catastrophic.

Can parents not parent?

This is the creeping fascism America is trying to warn you about. We seem to be going down this road as well.

Which "British research firm" labels them a loophole?

The paper is from the European Parliament Research Service, which is an in-house EU Parliament service. And the "briefing" they published has a section titled "A loop hole that needs closing" that starts "Some argue that this is a loophole in the legislation that needs closing and call for age verification to be required for VPNs as well". The words "Some argue" are a hyperlink to a South African news article / opinion piece by some random journalist who writes in a slightly snarky way about VPNs allowing people to bypass the Online Safety Act.

So the TomsHardware article is nonsense - it's an EU briefing paper which seems to think a random south african opinion piece counts as "research". No British research firm, and in fact no real research at all - just crap layerd on crap and making it's way into a crap briefing paper. If this is the quality of the information been given to MEPs, EU citizens should be worried.

Links:

• The briefing paper: https://www.europarl.europa.eu/RegData/etudes/ATAG/2026/782618/EPRS_ATA(2026)782618_EN.pdf
• The linked article that is being called "research": https://htxt.co.za/2025/08/the-uk-seems-to-have-just-realised-that-vpns-are-a-loophole-in-age-verification-measures/

A reminder that Tor's Snowflake exists, and running a node can help and is as easy as just installing a browser extension and never thinking about it again.

https://snowflake.torproject.org/

They were always going to come after VPNs, they just had to ram something through like age verification for protect the kids to make it happen.

oyy guv, you got a license for them bits?

If that happens I'm gonna buy a foreign VPN with Monero. Fuck you I'll never let you strip my anonymity. Unles they implement a way for the age verification to be anonymous and only send a token that says 18+ (yes/no)

Realistically speaking, if VPNs do get banned de jure, how will they enforce it? If forced to, will ISPs catch you sending traffic towards a VPN (not what traffic you're sending)?