Traffic to VPN providers has exploded since the UK’s Online Safety Act took effect less than a week ago. ProtonVPN alone reported a 1,800% increase in UK sign-ups over the weekend.
For the Government, this was an unintended, if entirely predictable, consequence. For the media industry, it could be a bigger problem.
While the trigger for the VPN boom may have been users wanting to watch porn without uploading a selfie, new behaviours engendered by the shift could have lasting consequences for publishers, platforms and advertisers already struggling to monetise their audiences.
Virtual Private Networks, once clunky and niche, are now slick, fast and often free. With one tap, they mask location and encrypt traffic, spoofing the system into thinking you’re in France, or the US, or anywhere else where the law doesn’t apply. It’s not illegal and it works.
VPNs mask the user’s IP address, making it near-impossible to geo-target or segment them based on location. These tools also block or disable trackers and scripts, which means fewer cookies dropped, less behavioural data gathered and broken attribution models.
Crucially, once a user has downloaded and activated a VPN, there’s little reason to turn it off. If the government can’t see what you’re doing online, neither can advertisers, publishers or analytics platforms.
To make matters worse, many of the popular VPNs now bundle built-in ad blockers or make it frictionless to add one. Users who had never previously bothered to install an ad blocker may find themselves using one by default or be nudged into activating it alongside their VPN.
Data from Ad-Shield, reported by Press Gazette, shows that publishers are increasingly blind to their own readers. It found around 976 million users globally, almost one in five, are now effectively invisible due to ad blockers.
Initially niche, used only by tech-savvy power users, ad blockers went mainstream as frustration with pop-ups and tracking grew.
Today, VPNs are on the same path but with a broader cultural momentum. The public mood around surveillance, privacy and institutional trust is shifting. Clacton MP and leader of the Reform Party, Nigel Farage, has come out strongly against the Act because he knows there’s deep suspicion among the public.
For a case study in the ripple effects of the Act, consider Reddit. Over the past few years, Reddit has experienced explosive growth, becoming a critical source of user-generated content that powers everything from cultural conversations to AI training datasets. Yet the Online Safety Act poses a unique challenge for the platform’s expansion.
Reddit’s sprawling forums are rife not only with pornography but also with a wide range of other content deemed ‘adult’ under the Act — including discussions around sexual health, gender identity, drug use, mental health and artistic expression that includes nudity. This broad definition means accessing much of Reddit’s content now requires stringent age verification.
This disruption risks stalling Reddit’s UK growth and driving more users toward VPNs, further muddying the waters for advertisers and publishers trying to monetise them.
The Act may well go down in history as a victory for child protection, but it’s even more likely it will be seen as the catalyst for mass adoption of privacy tools — tools that make publisher monetisation models untenable.
No wonder the Act is coming under heavy criticism, and not just from right-wingers. Jim Killock, executive director of digital campaign organisation Open Rights Group, called the Act a ‘sprawling and broken piece of legislation’.
He added: ‘This complicated legislation favours Big Tech who have the means and capacity to comply with the Act’s onerous provisions. Meanwhile, small sites and not-for-profits such as Wikipedia are put in an impossible position.’
While publishers and advertisers struggle to adjust, Big Tech platforms are far less exposed. Walled gardens like Google, Meta and TikTok already operate on logged-in user environments, where identity is persistent and tracking is less reliant on IP addresses or third-party cookies. VPNs have limited impact on platforms where user behaviour is tied to accounts, apps and device-level identifiers.
As a result, these giants can continue offering targeted ads with confidence and may even gain from the shift, as advertisers divert spend from ‘dark’ open web environments into places where reach and attribution still function.
Just as publishers were beginning to find ways to stand on their own outside the walled gardens, the VPN boom triggered by the Online Safety Act kneecaps them, herding advertisers straight back into the arms of Big Tech, where identity is controlled, visibility is gated and monetisation remains a privilege of scale.
Main image by Privecstasy on Unsplash.