VPN bans: the age check was never the point. Encryption was

Short answer: Every internet ID law ends at the same wall: people route around it with a VPN, so the next bill goes after the VPN, and the one after that goes after encryption itself. Days after the UK switched on age checks in July 2025, views of the "Virtual private network" Wikipedia article hit 2.4x their June level, and Proton said UK signups jumped 1,400%. Michigan answered with a bill that names VPNs as contraband. Our read: the age check was the opening move, and private tools were always the target.

TL;DR: The UK's Online Safety Act checks went live on July 25 2025; the English Wikipedia VPN article went from a 913-a-day June average to 2,184 views on July 29, and it still runs about 22% above that baseline in fall 2026. Michigan's HB 4938 would make internet providers "actively monitor and block" VPNs, proxies and "encrypted tunneling", and Wisconsin's AB 105 passed its Assembly 69 to 22 with a clause forcing sites to block VPN visitors. Apple pulled its strongest iCloud encryption from the UK in February 2025 rather than build a back door, and the EU's Chat Control scanning plan was pulled from a vote only after Germany walked. If you build or use private-by-default tools, you are now the policy target, so act like it.

Key numbers

What	Number	Source, checked Oct 26 2026
"Virtual private network" Wikipedia views, Jun 1 to Jul 20 2025 daily average	913	Wikimedia pageviews API
Same article, peak day after UK checks (Jul 29 2025)	2,184 (2.4x)	Wikimedia pageviews API
Same article, Sep 1 to Oct 25 2026 daily average	1,114 (+22% vs baseline)	Wikimedia pageviews API
"Online Safety Act 2023" article, Jul 25-31 vs June baseline	95.3x	Wikimedia pageviews API
Proton VPN UK signups after Jul 25 2025, per Proton	+1,400% over baseline	The Register
Wisconsin AB 105 Assembly vote (with VPN-blocking clause)	69 to 22	Tom's Guide
Michigan HB 4938 reported top fine for promoting VPNs	$500,000	TechSpot

The law failed in a week, and the exit was a free app

The UK's age checks went live on Friday July 25 2025. By the next Tuesday, the English Wikipedia article on VPNs was pulling 2,184 human views a day, 2.4 times its June average.

Proton, the Swiss privacy company, said its UK signups jumped more than 1,400% over baseline and stayed there, higher than when France lost access to adult sites. VPN apps crowded the top of the UK App Store chart.

That is a law being repealed by its own citizens in real time, with a few taps. A VPN (virtual private network) is just an encrypted tunnel that makes your traffic look like it comes from somewhere else. It is the same tool every company already uses for remote work.

Step two is always the tunnel

Here is the pattern nobody in the "protect the kids" camp says out loud. When the check fails, they do not admit the check was a bad idea. They go after the thing people used to get around it.

Michigan's HB 4938, filed by Rep. Josh Schriver on September 11 2025, defines "circumvention tools" as "any software, hardware, or service designed to bypass internet filtering mechanisms or content restrictions, including virtual private networks (VPNs), proxy servers, and encrypted tunneling methods." Internet providers would have to "actively monitor and block" them, per Reclaim The Net's bill tracker.

Read that list again. "Encrypted tunneling methods" is not a porn filter. It is a description of how the modern internet works, from your bank's app to your company's laptop.

Wisconsin went further on paper. AB 105 passed the Assembly 69 to 22 in March 2025 with a clause forcing sites to detect and block any visitor on a VPN. Lawmakers stripped the clause in February 2026 after backlash, and the bill then died or was vetoed (trackers disagree). It still got 69 votes with the clause in it.

Follow the pattern: one project, five fronts

Put the moves side by side and they stop looking like separate stories.

• February 2025: Apple pulls Advanced Data Protection, its end-to-end encrypted iCloud tier, for UK users after a reported Home Office order under the Investigatory Powers Act. Apple: "we have never built a backdoor or master key to any of our products or services and we never will."
• March 2025: Wisconsin's Assembly votes for VPN blocking.
• July 2025: UK age checks go live; VPN demand spikes the same week.
• September 2025: Michigan files a bill naming encrypted tunnels as contraband.
• October 2025: The EU's Chat Control plan, which would have scanned messages including on encrypted apps, is pulled from an October 14 vote only after Germany says no on October 8. Denmark drops mandatory scanning but keeps the rest of the machine, per The Record.

The documented part: each of those happened. Our reading: they are one project with different cover stories. Kids in Michigan, terror in the Home Office, abuse images in Brussels. The constant is the demand that private communication become inspectable, and the VPN is just the most visible piece of it.

The steelman, and why it breaks

The best case for the other side: criminals really do hide behind encryption, and a law that anyone can skip with a free app is a law with no teeth. If you want the rule to work, you have to close the hole.

Fine. Now price the fix. To block VPNs you need deep packet inspection at every provider, a list of banned tools, and penalties for anyone who ships one. That is the Great Firewall's spec sheet. China and Russia run exactly this, and VPNs still leak through.

So the trade on offer is: everyone's traffic becomes inspectable, the determined criminal still gets out, and the only people actually stopped are ordinary users and small builders who cannot afford compliance. That is not a safety rule. It is a control rule with a safety label.

Who wins when the tunnel is illegal

Follow the money. The age verification vendors get a mandated toll on every visit, which we broke down in our piece on 27 states and one ID database. The platforms with compliance departments get a moat that a two-person startup cannot cross.

And the state gets the thing it has wanted since the 1990s crypto wars: a network where looking is the default. The twist is the timing. The privacy tool becomes illegal exactly when the law that made people need it fails. The failure is the justification.

The quiet part: people noticed, and they stayed

Interest did not crash back after the panic week. In September and October 2026 the VPN article still averages 1,114 views a day, about 22% above the June 2025 baseline. Proton's own Wikipedia page ran at 2.5x its normal traffic the week the checks landed.

That is a whole country of people who learned, in one week, that the internet has an exit. You cannot unteach that. Our bet: the next two years of internet law are a fight over whether the exit stays legal, and the builders who ship private-by-default tools are the opposition whether they signed up for it or not.

More takes like this live on our opinion page and in AI industry coverage; for how platform gatekeepers use "security" as the lever, see GrapheneOS and Google's Play Integrity.

What this means for you

If you use a VPN: pick one with a public audit and a no-logs record, pay for it, and keep it on. Free VPNs sell the very data you were hiding. If you build software: ship encryption on by default, collect less data than you think you need, and assume a regulator will one day ask what you can hand over. The best answer is "nothing, we never had it."

If you are shipping an app and want to know what it leaks, what it stores, and what a regulator could demand from you, our $49 Launch Check runs 26 checks on your launch. If a problem we checked turns up later, we keep fixing it at no extra cost until it does what it promises.

Sources

• Wikimedia pageviews API: "Virtual private network", "Online Safety Act 2023", "Proton VPN", en.wikipedia, users, Jan 2025 to Oct 25 2026, pulled Oct 26 2026 (data.csv on this page)
• The Register, UK VPN demand soars after debut of Online Safety Act, Jul 28 2025
• CyberInsider, Proton VPN signups in UK surge 1,400%, Jul 2025
• Reclaim The Net, Michigan HB 4938 tracker, checked Oct 26 2026
• TechSpot, Michigan bill seeks total ban on porn and VPNs, Sep 2025
• Tom's Guide, VPN ban one step closer in Wisconsin, 2025
• Reclaim The Net, Wisconsin AB 105 tracker, checked Oct 26 2026
• TechRadar, Apple kills iCloud end-to-end encryption feature in the UK, Feb 2025
• The Record, Denmark reportedly withdraws Chat Control proposal, Oct 2025