The UK’s new age-gating rules are easy to bypass

Platforms like Reddit, Bluesky, Discord, and Pornhub have been rolling out mandatory age verification requirements in the UK over the past few weeks to comply with new online safety rules. While the age-gating aims to keep children from accessing pornographic material and other “harmful content” outlined by the UK’s communications regulator Ofcom, there’s a glaring issue: it relies on kids not knowing how to use a VPN.

As reports have noted across Reddit, Bluesky, and the comments on The Verge’s quick post this morning, many online platforms ask users to verify their age based on their IP address. If the user’s IP address doesn’t indicate that they’re located in the UK — a capability offered by even most free-to-use VPN services — they’re free to keep using the web without having their identity checked.

Ofcom didn’t specify exactly how it wanted online platforms to verify user ages, only that the methods must be “strong” and “highly effective.” Several of the age checkers I’ve seen offer similar options: users can either choose to confirm their age by uploading bank card information, an image of their government-issued ID, or a selfie used to estimate their age.

It’s unclear if those selfie options could be spoofed by simply getting an older-looking friend to complete to process. In my testing of the Bluesky and Reddit face scanners, both were at least unwilling to verify images on my phone that I was holding up to my webcam.

A VPN allows users to bypass age checks entirely, however, and teens are savvy enough to figure that out. I should know, given I was using them at 14 to bypass firewalls on my school computers. And VPNs aren’t the only workaround — some ad blockers like uBlock Origin allow users to create custom filters that can bypass age restrictions. Third-party Bluesky apps like Klearsky haven’t introduced age checkers yet, and there are more technical solutions that involve installing userscripts and using self-hosted data servers.