Online Safety Regulation Increases Attention to VPNs: Privacy Implications of the UK Online Safety Act

Abstract

Governments worldwide are increasingly regulating digital platforms to reduce online harms, but access restrictions can alter user behaviour and create new privacy risks. The UK Online Safety Act, passed in 2023, rolled out in phases - illegal-content enforcement in March 2025 and mandatory age verification in July 2025. We analyse Reddit discourse across VPN and UK Politics communities and conduct a privacy-policy risk analysis of 69 VPN services. We find that the behavioural response is concentrated at the July 2025 deadline, when platforms hosting pornographic content were required to deploy age checks. UK VPN search interest on Google increased by 147% at this deadline. UK-resident users' VPN-subreddit activity increased by 145%. Their regulatory- or privacy-related VPN posts and comments rose by 1,265% at this deadline. UK Politics communities show the same concentration at a larger magnitude, with OSA-related political discourse rising by 1481%. These effects were far smaller or statistically indistinguishable from pre-existing trends at Royal Assent and the illegal-harms enforcement deadline, indicating that the deployed age checks drove the response. Users primarily frame this response around privacy, surveillance, and distrust of age-verification intermediaries rather than access-seeking, with near-zero genuine pro-OSA sentiment across two independent classifiers. Several users noted that those least able to pay for reputable VPNs are most likely to turn to free services that monetise their data. Search attention increases across all disclosed privacy-risk categories, with no evidence of a shift toward higher-risk VPN providers. Crucially, after a full year, this attention is still elevated, arguing against a temporary news-cycle reaction. Thus, online safety regulation may create secondary privacy costs without disproportionately directing attention toward higher-risk VPNs.