VPN Guild: Statement in Support of the Global Defend VPNs Day of Action
As an association of VPN developers committed to a secure, private, and open internet, we join civil society, technologists, and users worldwide in the second Defend VPNs Day of Action. Today's coordinated mobilization underscores a simple truth: VPNs are essential infrastructure for human rights, economic opportunity, and personal safety online — not loopholes to be closed. Our particular concern this year is the spread of age verification rules that conflict with the right to privacy. Our position is simple: a VPN does not conflict with a well-built age check. It conflicts with a badly built one. We urge lawmakers, regulators, and platforms to protect access to VPNs and to reject measures that, intentionally or not, undermine privacy and free expression and endanger vulnerable communities.
ADVOCACYSTATEMENTSCAMPAIGN
Date: September 25, 2026
Why age verification is on the agenda today
As an association of VPN developers committed to a secure, private, and open internet, the VPN Guild joins civil society, technologists, and users worldwide in the second Defend VPNs Day of Action. Today's coordinated mobilization underscores a simple truth: VPNs are essential infrastructure for human rights, economic opportunity, and personal safety online — not loopholes to be closed. Our particular concern this year is the spread of age verification rules that conflict with the right to privacy. Our position is simple: a VPN does not conflict with a well-built age check. It conflicts with a badly built one. We urge lawmakers, regulators, and platforms to protect access to VPNs and to reject measures that, intentionally or not, undermine privacy and free expression and endanger vulnerable communities.
The design problem
A site-level check reads two things at once — your age and your IP address. Hide the IP and the check breaks. That is why every country that builds age checks this way ends up debating VPN bans.
An age attestation reads neither. You get a credential once, then prove one fact — "I am over 18" — from your own device, and the site learns nothing else. The EU's age verification approach works this way. Under that design there is nothing for a VPN to break, and no reason to regulate one.
What the wrong design produced in twelve months
Utah, SB 73, in force September 3, 2026. Websites must age-check anyone physically in Utah even behind a VPN — a location they cannot determine, because hiding it is what the tool does. $2,500 per violation. Covered sites are also barred from explaining how VPNs work.
Wisconsin stripped a VPN-blocking clause from its age verification bill in February 2026 after public pressure. It would have blocked VPN traffic even from users who had already proved their age.
Michigan, HB 4938 — a total VPN ban requiring ISPs to detect and block — is still live.
Brazil made VPN use an aggravating factor in crimes.
The UK is keeping open the option of restricting VPNs to stop age-check bypass. Australia is discussing "closing the VPN loophole."
None of this protects a child. All of it follows from tying enforcement to location.
The numbers do not support it either
UK government research on 2,299 children: about 10% use location-changing tools to get past checks. 24% simply enter a false age. 53% go to services where the check is weak or missing. VPNs are the third route — and 43% of the children who use one say a parent pays for it.
Meanwhile, the identity data leaks. Discord's 70,000 government ID images were exposed through an outsourced support desk, not through cryptography.
Four things we support
Name the architecture in law. "Reasonable verification" lets a passport upload count the same as a cryptographic proof. Specify double anonymity or zero-knowledge proofs.
Publish measurable accuracy, broken down by age group, sex, skin tone and disability. Judge success by children's actual exposure, not by traffic to compliant sites.
Enforce the duties that already exist. Self-declaration is where almost every workaround happens.
Regulate design: safe defaults for minors, no engagement optimization, limits on contact from strangers. No VPN restores a feature that is not there.
One red line
No one should be required to detect how a user's network is set up and report it. Utah asks for the weaker version — detection by a website — and it is already impossible. Rule out the stronger version, code on a user's own device inspecting their network, before it reaches a bill.
That stronger version is not hypothetical. Russia reached it this spring: platforms were instructed to detect whether a user has a VPN running, deny them service, and report newly found addresses to the regulator. Russia began with advertising restrictions and site blocking, and each step was justified by the gap the last one left. Lawmakers in democracies should not assume they will stop earlier. The measures are the same whatever the motive.
Take action
Sign the open letter at DefendVPNs.com and tell lawmakers to leave these tools alone.
We do not claim children never use VPNs, but the response is out of proportion — and that a design already exists in which the question does not arise.
Signed, VPN Guild
(With thanks to the coalition partners organizing the Defend VPNs Day of Action and to researchers documenting state pressure and platform responses.)
Legal
Contacts
info@vpnguild.org
© 2024. VPN Guild. All rights reserved.