Under the pretense of protecting minors and preserving morals, lawmakers in the United States and the United Kingdom are putting the privacy of millions of citizens at risk. Age verification bills that are aimed at preventing minors from accessing adult content online are nothing new, as the Free Speech Coalition lists 130 proposed bills across much of the US since 2022 (30 of which have been enacted). But in the US, the latest proposals from legislators in Wisconsin and Michigan take aim not just at access to adult content, but at virtual private networks as well.
As the UK and individual states have begun enacting age verification laws, internet users have been turning to VPNs to make it appear as though their connection is originating from a different location, effectively bypassing the verification requirements. As a result, VPN use has skyrocketed, which is a boon for VPN providers, but due to the risks related to most free VPNs, it is also a big deal for cybercriminals.
Someone looking to change their virtual location could download any one of the thousands of free VPNs available without realizing the risks involved. Google has even issued a warning to consumers on the dangers of downloading malicious VPN apps, which might inject user devices with malware, log their internet activity or misuse their personal data. Age verification laws and proposed VPN bans come with distinct privacy implications that are manifold and wide-ranging, putting people unnecessarily at risk.
What the proposed state legislation says
In Wisconsin, Senate Bill 130 proposes that sites use “reasonable age verification methods” and requires the publishers and distributors of “material harmful to minors” to prevent access from known VPN IP addresses. Under the bill, entities in violation of the law would be subject to civil penalties.
In Michigan, House Bill 4938 takes it a step further and proposes an all-out ban on VPNs entirely. The lawmakers in support of the bill, called the Anticorruption of Public Morals Act, want internet service providers in the state to “actively monitor and block known circumvention tools.” The bill prohibits “the promotion or sale of circumvention tools to access prohibited material.” Violators would be subject to civil and criminal penalties of up to 25 years in prison and fines of up to $500,000 under the proposed legislation.
Both state proposals focus on the distribution of content and possible methods to get around blocks or verification, rather than accessing that content. But requiring internet providers to enforce content laws can be messy, as many Starlink users have discovered.
The fallout from online age verification
The proposed legislation is a tangle of different considerations, but one of the most important threads is age verification, an important piece in the Wisconsin legislation. Online age verification is not just a major invasion of privacy, but a potential bonanza for cybercriminals. With millions of internet users uploading images of their faces alongside their government-issued IDs so they can access online content, age verification companies have become extremely attractive targets for hackers.
The wealth of personal information — including full name, birthdate, address, nationality, ID number and likeness — collected by ID verification companies is putting people at risk of having their data compromised in a breach, which can lead to identity theft and other real-life perils. Promises to keep data safe do not always work out. Several recent instances of ID verification data being compromised and shared online have made headlines.
... continue reading