British House of Lords wants age verification for VPNs and social media

The British House of Lords has voted for a significant tightening of age verification on the internet. By 207 votes to 159, the Lords adopted Amendment 92, which obliges VPN providers to introduce effective age controls for British users. This marks the first time an age limit has been set for VPN services. A further amendment prohibits individuals under 16 from accessing social media.

VPN services have come under scrutiny in Great Britain because they have been used to circumvent other age limits online, such as for pornography sites. Amendment 92 aims to prevent circumvention of the Online Safety Act. Lawmakers fear that minors could use VPN services to bypass age restrictions on social media platforms. Under the new regulation, the responsible ministry must issue regulations within twelve months of the act coming into force, prohibiting VPN providers from offering their services to children. This affects commercial VPN services that are offered in Great Britain or marketed to a significant number of British users.

The regulatory authority Ofcom is to develop guidelines for implementation and monitor compliance. According to Amendment 92, any person under the age of 18 is considered a child. The required "highly effective age assurance" could include methods such as uploading a photo of an identity document, facial recognition, or bank verification.

Social Media from 16 years old

With an even clearer majority of 261 votes to 150, the Lords passed Amendment 94a. This amendment prohibits individuals under 16 years of age from accessing "user-to-user services." According to the Online Safety Act, this includes social networks, messaging apps, forums, and online gaming platforms – services where users can post, share, and interact with content. Excluded are email, SMS, MMS, and individual voice calls.

Two further amendments were unsuccessful: Lord Nash withdrew Amendment 93, which would have required tamper-proof software on smartphones and tablets against depictions of child sexual abuse. He cited ongoing discussions with ministers. Amendment 108 by Lord Storey, which would have allowed platforms to set their own minimum age limits, was rejected.

Data Protection versus Youth Protection

The planned regulations raise significant data protection concerns. VPN services would have to identify users and verify their age – precisely the opposite of what they were designed for. Providers from abroad would have to treat British users separately and set up separate verification systems, which could lead to higher costs and potential loss of users. After the Online Safety Act 2023 came into force, demand for VPN services in Great Britain already increased massively: ProtonVPN reported an increase of 1400 percent.

Ofcom, as the regulatory authority, plays a central role in implementing the Online Safety Act. The authority creates codes of conduct, monitors compliance, and can impose fines of up to ten percent of global annual turnover or order services to be blocked in case of violations. For VPN providers, Ofcom is now to develop guidelines on how the required age verification can be technically implemented.

Great Britain is not alone in its plans internationally. France is currently discussing a ban on social networks for under-15s. Australia has introduced a social media ban for under-16s, resulting in the deactivation of over 4.7 million accounts. Spain and Greece are also considering similar regulations with an age limit of 16.

After the third reading in the House of Lords, both amendments must still pass the House of Commons. The Labour government has a majority there and has already announced that it may seek to stop the proposals. The government has promised a consultation on minimum ages for social media and VPNs but apparently does not want to be pressured by Parliament into making quick decisions. Therefore, it is still unclear when and whether the regulations will actually come into force.

(mki)