The European Parliamentary Research Service (EPRS) - the EU Parliament's official research arm - published a paper this week calling VPNs "a loophole in the legislation that needs closing."
The context is age verification. Across Europe and the UK, governments have been rolling out laws that require online platforms to verify users' ages before showing adult or age-restricted content. The problem regulators have run into: when those laws come into force, VPN usage spikes, because people use VPNs to make it look like they're logging in from a country that doesn't have the restrictions.
So regulators are starting to talk about the next step: restricting VPN access itself.
What's Actually Happening
The UK enacted its Online Safety Act, which requires platforms to block children from certain content. After it came into force, VPN apps shot to the top of download charts. Children - and adults - were using VPNs to route around the age checks.
The EPRS paper notes the same pattern across multiple EU countries. It describes self-declaration, age estimation, and identity verification as "relatively easy for minors to bypass." And it explicitly frames VPN tools as part of the problem.
England's Children's Commissioner has gone further, calling for VPN services to be restricted to adults only - which would mean age-verifying users before they could even download or use a VPN.
For what it's worth, the EU's own age-verification app - rolled out under its Digital Services Act framework - was found by researchers last month to have security flaws including unencrypted storage of biometric images. So the technology being proposed as the solution has its own problems.
Why Small Businesses Should Track This
If you run a business that operates internationally, a few things are worth watching:
If you sell to European customers: Age-verification requirements can mean you need to add compliance layers to your checkout or account-creation process, even if your primary market is the US. The EU's Digital Services Act already has obligations for platforms reaching EU users.
If your team uses VPNs for remote work: Most small businesses use VPNs to let remote employees securely connect to business systems. If VPNs become more regulated, the friction of using them goes up - and so may the cost.
If you're in content, media, or adult retail: Any sector that already navigates age-gating in the US is likely to face tighter, more technically demanding requirements in Europe. The compliance bar is rising.
If you store customer data: The age-verification conversation is also a data-collection conversation. Verifying ages means collecting or cross-referencing sensitive personal information. How that data is stored and protected matters, and the EU takes data protection seriously.
The Broader Regulatory Direction
The EU has been the most aggressive major economy on digital regulation. The General Data Protection Regulation (GDPR) started as a European rule and became the de facto global standard because companies didn't want to maintain two sets of compliance systems. The same dynamic could play out with age verification.
The US is moving in its own direction - several states now have age-verification laws for social media and adult content sites - but at a slower and more fragmented pace. The EU tends to move faster and with more uniformity.
For small businesses, the practical lesson from GDPR is: don't ignore EU regulatory trends. What starts as a European rule often becomes a global compliance question within a few years.
What to Do Now
For most small businesses, no immediate action is required. This is still a regulatory proposal and policy debate, not a final rule.
But if you're in e-commerce or digital services with any European exposure, it's worth flagging for your legal or compliance team - or at minimum, noting in a future quarterly review. The GDPR gave businesses roughly two years' notice before it became law; the age-verification push is still in the warning-shot stage.
Alex Rivera covers regulatory and policy news affecting small businesses for The Useful Daily. Sources: European Parliamentary Research Service paper on VPNs and age verification (May 6, 2026); reporting via CyberInsider.