A child-safety law is quietly turning the open web into an ID checkpoint, and the privacy bill lands on every adult.
Since the UK's Online Safety Act took effect in July 2025, adult sites demand a photo ID, bank check, or face scan. VPN signups spiked (Proton reported a surge over 1,400 percent), so Parliament's answer is to put age checks on the VPNs too. A check "highly effective at correctly determining whether or not that person is a child" is, in practice, a check on everyone, to catch the roughly 3 percent of children who use a VPN to reach adult content.
Close that loophole and the check does not vanish; it moves upstream to whoever ends up holding the ID photo. Discord lost at least 70,000 government-ID images in 2025. As the EFF puts it, "every age-verification system is, at its core, a surveillance system."
