Age verification and your VPN: what Mullvad is warning about, and what it means in the UK

Age verification is no longer a niche subject. In a long post published on 1 June 2026, Mullvad VPN argued that the spread of age checks for social media is, in its words, the beginning of the end for a free internet. It is a company with a clear stake in the debate, so this article sets out what it reports as fact, what is its opinion, and why it matters if you live in the UK.

What Mullvad reports

According to the post, social media age limits are already in force in Australia (under 16), Indonesia and Brazil, and approved but not yet implemented in Denmark, Portugal and Malaysia; France has reached an agreement with details pending, and several other countries are discussing or investigating similar rules. In the United States, roughly half of states have enacted or are considering laws on age restrictions for content or social media.

At EU level, Mullvad says the European Commission launched an age verification app in April 2026, and that a month later Ursula von der Leyen presented plans for EU-wide age restrictions.

The UK picture, as Mullvad describes it

The post says the House of Lords proposed an 18+ age limit for VPNs, which the Commons rejected four times before passing its own proposal; that proposal became law and gives the government powers through secondary legislation. It adds that the government has said it will introduce some form of social media restriction for under-16s, and has hinted at identity checks for VPNs. It also states that Apple introduced operating-system-level age verification on British iPhones on 24 March 2026, with restrictions applied to those who did not verify.

Our own coverage of the latest VPN decision is in UK drops plans to restrict VPNs for under-16s; read it alongside this piece, since policy in this area is moving quickly.

Mullvad’s arguments (opinion)

• Platforms already know which users are children, so governments could require them to stop harmful practices rather than check everyone’s age.
• Most age checks are really identity checks, which could end anonymous browsing and posting and discourage criticism of governments.
• Restrictions tend to expand: from social media to VPNs, app stores and operating systems.
• Zero-knowledge proofs, which let you prove your age without revealing who you are, are better than full ID checks, but Mullvad says the EU app currently falls back to a model without them, which it calls a serious weakness.

Other people reasonably disagree, pointing to evidence of harm to children and the difficulty of enforcing rules without any checks. Both sides agree on one point: the way age is verified matters as much as whether it is.

Why a data breach is the practical risk

Mullvad cites a 2025 Discord breach that exposed ID documents of 70,000 users. Whatever you think of age limits, collecting identity documents creates a target. If you are asked to verify your age, prefer methods that do not retain your documents, and do not reuse photos of IDs across services. Our guide to passkeys in the UK covers a different, privacy-friendlier way to prove it is really you.

What you can do now

• Keep an eye on secondary legislation: the powers described above can be used without a new Act of Parliament.
• Choose a VPN provider with a clear audit record and keep its app updated: see our Android leak article.
• Read official guidance rather than relying only on advocacy from either side; we are still waiting for Ofcom’s VPN guidance.

Source: Mullvad VPN blog, “Age verification for social media – the beginning of the end for a free internet?”, 1 June 2026. Statements about laws and events are Mullvad’s account and should be checked against official sources.