Online Safety Regulation Increases Privacy Risk: Evidence from the UK Online Safety Act

The Secondary Costs of Digital Safety

New UK laws designed to protect children online are causing people to use VPNs more often to protect their privacy. This shift happens because users worry about government surveillance. They also fear being forced to share identity documents for age checks. While the intent is to mitigate online harms, the unintended consequence may be a massive migration toward tools that mask user identity.

Digital regulation often operates on a binary assumption. A platform either complies with access controls, or it fails. Current "online safety" approaches focus on forcing platforms to implement age-assurance mechanisms. These include facial recognition or identity document verification to gatekeep sensitive content. However, these mechanisms create a new friction point. For a user, providing a passport or a biometric scan to a commercial intermediary feels like a permanent surrender of privacy. When regulation creates these visible barriers, it does not necessarily stop the desire for access. Instead, it often triggers a "gateway effect" (where sudden blocks on services drive users to adopt circumvention tools). This allows users to preserve their existing digital habits and anonymity.

Measuring the legislative ripple effect

To quantify this behavioral shift, the authors developed a multi-stage analytical pipeline. This pipeline was designed to isolate the specific impact of the UK Online Safety Act (OSA) from general internet trends. The methodology centers on three distinct investigative tracks.

First, the researchers constructed a massive Reddit corpus spanning four years. They focused on VPN-related and UK Politics communities. Because a simple keyword search would return too much noise, the authors employed a hybrid pipeline. They used keyword pre-filtering followed by an LLM-based relevance classifier (specifically Gemini 2.5 Flash) to ensure the data actually discussed the OSA, age assurance, or surveillance.

Second, the team applied Bayesian Structural Time Series (BSTS) models to this classified data. This statistical technique works by building a "counterfactual" model. This is essentially a prediction of what the volume of discussion would have looked like if the OSA milestones had never occurred. By comparing the observed reality to this predicted baseline, the authors could isolate the causal impact of specific regulatory milestones.

Finally, the study analyzed the privacy risks of the tools being adopted. The authors used an LLM-based extraction pipeline to parse the archived privacy policies of 69 unique VPN services. They converted unstructured legal text into a structured set of "privacy markers" (indicators of whether a provider logs traffic, tracks users, or shares data). This allowed them to categorize services into low, medium, or high-risk tiers.

Stepwise surges in circumvention interest

The authors report that the OSA milestones acted as successive catalysts for increased digital circumvention. The data shows a clear, stepwise escalation in both social discourse and active information-seeking.

On Reddit, the impact was profound. Among likely UK-resident authors, the authors find that posts and comments explicitly discussing VPN use in a regulatory or privacy context rose by +100% at the Act's enactment. This rose further by +217% at the illegal-harms enforcement milestone. Finally, it jumped by +415% at the age-verification deadline .

This represents a massive increase in the volume of people discussing how to hide their digital footprint. The surge in political discourse was even more dramatic. OSA-related discussion in UK Politics subreddits jumped by +545% during the March 2025 enforcement phase.

This was not just a niche phenomenon limited to enthusiast forums. The researchers corroborated these findings using Google Trends data. This serves as a broader, population-level signal. They report that UK search interest for VPN-related terms rose by +89% at the age-verification deadline .

This nearly doubling of search interest confirms that the behavior moved beyond Reddit enthusiasts into the general public. Crucially, when the authors controlled for US search trends to account for global VPN demand, the UK-specific spike remained significant. This suggests the movement was a direct response to local legislation rather than a global trend.

The discourse itself was notably adversarial. Using topic modeling and sentiment analysis, the authors found that users did not view VPN adoption as a mere way to bypass content blocks. Instead, the conversation was dominated by concerns over "government surveillance" and "regulatory infringement." Most users framed VPN use as a defensive measure. They wanted to avoid intrusive identity checks and the potential for "client-side scanning" (analyzing private messages on a device before they are encrypted).

Stability in the risk landscape

A critical question for policymakers is whether regulation inadvertently pushes users toward dangerous, low-quality services. If a law drives millions of non-technical users toward "free" VPNs that sell browsing data, the regulation has effectively traded one harm for a more severe privacy risk.

The authors investigated this by linking Google Trends attention to the risk categories they identified in the privacy-policy analysis. They categorized VPNs into Low, Medium, and High Risk based on markers like traffic logging and third-party sharing. Their findings suggest that while the total volume of VPN interest exploded, the proportional distribution of that interest remained broadly stable .

In other words, the OSA appears to have increased demand across the entire market. It did not trigger a sudden, disproportionate shift toward high-risk providers. However, the authors warn that this "stability" might be deceptive. While the share of attention did not change, the sheer volume of new users entering the ecosystem has grown. This means the absolute number of people interacting with medium- and high-risk services has increased significantly.

Limitations and data fidelity

While the study provides a robust empirical look at regulatory displacement, several caveats remain. The researchers acknowledge that Reddit users are not a perfect proxy for the general UK population. They tend to be younger, more technically literate, and more politically engaged. Consequently, the intensities of the reported surges might be amplified compared to what a casual user experiences.

Furthermore, the UK-resident filter used to isolate local impact is an imperfect proxy. Identifying residency based on subreddit participation is a heuristic (a rule-of-thumb based on patterns), not a certainty. There is also the matter of the privacy-policy analysis itself. The authors' classification is based on what companies disclose in their documentation. As seen in historical leaks, a company's stated "no-log" policy does not always align with its actual backend operations. Finally, the study uses Google Trends to measure "attention." This is a proxy for interest but does not provide exact counts of active installations or paid subscriptions.

The verdict: A warning for regulators

The evidence suggests that the UK Online Safety Act is successfully driving digital discourse. However, it may not be doing so in the direction policymakers intended. The study demonstrates that when access-control mandates are perceived as invasive, they normalize the use of circumvention tools.

For practitioners and regulators, the takeaway is clear. Online safety interventions cannot be evaluated in isolation from the behavioral responses they trigger. If age-assurance mechanisms drive users toward VPNs, the regulator has essentially outsourced privacy management to a fragmented market of commercial intermediaries. To avoid a technical arms race, future policy must account for these secondary privacy costs. Regulators must recognize that circumvention is not a bug in the system, but a predictable feature of the regulatory environment.

Figures from the paper