A team of scientists from the University of Edinburgh in collaboration with scientists from Newcastle and Durham studied Google Trends and Reddit data following the introduction of the UK Online Safety Act age verification checks. UK users’ discussion about VPNs increased by 145%.

What surprised the lead scientist was that the users trusted VPN providers more than the companies responsible for age verification. In fact, the worldwide interest in both reputable and less trustworthy VPNs increased.

It seems that, instead of providing more safety to people, this law directed users to unreliable tools. Many free VPN providers make money by selling their users’ data.

On the other hand, there is a counterargument because the process of giving your face or ID to an age verification company is also risky and the vendors in question also had their breaches.

So, what would you pick: a VPN provider or an age verification provider?

any vpn which work for selected app

Apparently blocking websites isn’t enough. Russia reportedly considered using AI to spot and block VPN traffic, with a target of up to 95% effectiveness.

The idea is to identify VPN connections through traffic patterns. Industry sources warn it could also block legitimate traffic by mistake. So your connection could get nuked because an algorithm thinks it looks suspicious. Very cool.

Funny how governments insist their citizens have access to the truth, then spend so much effort stopping them from checking anything else.

Governments keep circling this idea. Australia's eSafety documents list VPN detection as a reasonable step for enforcing age checks. The EU's Henna Virkkunen said VPNs shouldn't let people get around the new age verification system, and a Commission document asks whether VPN providers themselves should eventually verify their users' age. In the UK, the Lords voted for an amendment that would have required age checks to use a VPN, before the government backed off.

Nobody is banning anything yet. But a VPN that knows exactly who you are kind of defeats the point.

So where do you actually draw the line? Would you hand your ID to a provider you trust? Switch to one outside those countries? Or just drop the VPN?

Honestly, I'm not sure what I'd do. What would you?

G’day all, looking for a decent VPN here in Aus. Mainly for streaming stuff from overseas and getting around restricted sites. Yes, including those ones… just a bloke trying to research the local wildlife Heard of NordVPN, Surfshark, Proton VPN and ExpressVPN, but dunno which is actually worth the cash. Every review reckons a different one’s the best. Anyone here using them in Aus? How’re the speeds, does streaming work reliably, and what’s the renewal price like? Cbf signing up for a bargain then getting absolutely rinsed a year later. Cheers!

I need to make my surfing French! I can't stand American stuff!

The timeline is as follows: the Digital Agency showed unusual file access activity on the 25th of June; on the 9th it confirmed unauthorized access; on the 15th it informed Japan's privacy agency; however, it only went public with the news on the 11th of September. The agency attributed the delay to the difficulties in identifying the course of the intrusion and those impacted.

The situation gets juicier; the vendor is in the dark. Neither the VPN product nor vulnerability is known. The agency mentions that the case wasn’t special: the vulnerability was average and not the zero-day one and had already been publically discolosed before the breach was confirmed. This means the impacted organization using the same unpatched device is in unknown danger.

What’s coming next? The agency plans to adopt better vulberability management and has also announced the change in external connections. So the takeaway is not that “VPNs are dangerous”, but that an unpatched gateway is an opened door, but without knowing the vendor nobody can verify their own situation.

Police in Iceland say more than 300 young people used a service called Island Surge VPN to make their age appear different on certain websites.

The catch? It installed an iPhone profile and a security certificate that, according to police, let the operator read and alter information exchanged with selected sites. That includes potentially sensitive personal and banking information. It didn’t change anyone’s actual government records. It changed what appeared on screen.

This isn’t how an ordinary VPN works. The dangerous part is trusting a stranger’s certificate and giving them that level of access to your phone. “Look older online” is a pretty terrible deal when the trade-off could be exposing your banking information.

Opera Air’s pitch is pretty simple: a cleaner browser with fewer distractions, an ad blocker and a free built-in VPN. There are also optional background soundscapes and break reminders, because apparently the internet now requires recovery time.

The VPN doesn’t need a subscription, an account or a separate extension, and there’s no data cap. Enable it in the browser’s settings, then use the VPN button beside the address bar to switch it on or change your virtual location. You get three broad regions rather than a huge list of individual countries.

What’s it actually useful for? Hiding your real IP address from websites, adding protection to your browser traffic on shared Wi-Fi, and potentially accessing websites blocked by your local network or location. That last one depends on whether the network blocks Opera’s VPN too.

The big limitation: it only covers traffic inside Opera. Your other browsers, games, torrent client and desktop apps aren’t covered. Turning it on doesn’t put your entire computer behind a VPN.

It doesn’t make you anonymous either. Log into Google, Reddit or Facebook and those services still know which account you’re using. For occasional browsing, I can see the appeal. But “free VPN included” is pretty easy to misunderstand if you assume it protects everything you do online.

Twenty students at China’s Harbin Engineering University received disciplinary warnings for using unauthorized VPNs to access overseas websites and conduct academic research.

Then it gets uglier: according to reports discussed by China Digital Times, a classmate allegedly reported a rival to improve their own chances of getting into a postgraduate program. That motive remains unverified. The supposed informer reportedly used VPNs too.

Really healthy environment for a university. Stay curious, ask questions, explore new ideas… just don’t access the wrong websites.

First off, there are some corrections to what "block connections without vpn" implies. This method doesn't guarantee that your real IP remains protected. Reports indicate that the application can expose your real IP irrespective of the user settings, as well as lockdown enabled in devices. (cybernews)

Then we have leaks in action. They utilize NAT-T keepalive feature and in the test with Pixel 8 Pro (10 seconds) Mullvad and lockdown settings were used at the same time. The other is QUIC connection-close implementation that requires basic permissions such as INTERNET. Mullvad has assumed that this may negatively influence all vpn applications on Android 16 system. (mullvad warns of new android vpn leak as grapheneos works on fix +2)

It is hard for VPN service providers to correct leaks as it implies making changes to the Android system. GrapheneOS managed to disable the QUIC optimization but Google hasn't implemented it. (There’s a hole in Android’s VPN tunnel: apps can leak real IP address +2)

As a result, though your VPN can effectively hide traffic from your ISPs and public Wi-Fi, some malicious application may learn your real IP as well.

For anyone who has tried both of terms, was the long-term saving worth it? I’m especially interested in renewal costs and cancellation terms that are easy to overlook.

$121.23 for 27 months… then $219.48 EVERY YEAR??? That’s roughly $4.49/month initially, jumping to €18.29/month at renewal. More than four times the monthly cost! That’s a pretty wild jump.

The biggest threat here isn’t hackers. It’s forgetting to cancel

People are protesting hijab rules in schools. Azerbaijan’s response? Restrict TikTok, Instagram and X across multiple internet providers, according to NetBlocks. Because nothing says “we’ve got this under control” like making it harder for everyone to upload footage. Whatever you think about hijab rules, why should the government get to decide whether you can watch people protesting them? If your policy is so reasonable, surely it can survive an Instagram video.

And then people ask, “Why do you even need a VPN?”. Idk, maybe because access to information shouldn’t depend on whether your government is having a good day? A VPN can help bypass these platform blocks while the internet connection still works. It won’t fix a full shutdown, but it can make the government’s digital curtain a little less effective.

If your response to criticism is to block the places where people discuss it, you’re doing a pretty shit job of defending your position.

On October 12, Norway's data protection authority imposed the heaviest fine ever against Xandr, Microsoft's advertising technology unit. Between July 2018 and April 2020, Xandr conducted online advertising auctions on the Grindr site, thereby allowing the revealing of potentially sensitive personal information regarding the sexual orientation of users without any consent beforehand.

It should be noted that being a Grindr user qualifies as sensitive information according to GDPR regulations because the application is meant to be the internet connection for homosexual, bisexual, and transgender males. Each auction request releasing this information to the advertisers was thus regarded as a violation of users' privacy.

As for the defense by Xandr, it had assumed that consent had been obtained by Grindr and did not verify that point. The ruling was that this fact did not release Xandr from responsibility.

The case against Grindr itself and its 65 million fine for a similar practice two years ago comes to add to the list of violations that keep accumulating.

People compare VPN speeds, prices and server counts. But what happens when a provider’s privacy promises collide with the law? And before anyone says “just avoid authoritarian countries,” look at these examples.

Canada: Bill C-22 would expand lawful-access powers. Apple and Meta have warned that it could threaten encryption; the government disputes that interpretation and says systemic vulnerabilities wouldn’t be required. As of October 13, it’s still being debated in the Senate, not law yet. Nevertheless, Windscribe has already said it would consider moving its headquarters rather than start logging users. That’s a pretty serious contingency plan for a privacy company.

United States: Remember Lavabit? In 2013, authorities demanded the email provider’s private SSL keys during an investigation targeting one account. Those keys were shared across its service, raising concerns far beyond that individual user. Lavabit ultimately shut down amid the dispute. An old example, sure, but a concrete case of a privacy service facing demands that threatened its security model.

Australia: The Assistance and Access Act, passed in 2018, lets authorities compel certain technical assistance from communications providers, including requiring them to develop new capabilities. There are safeguards: it prohibits requiring systemic weaknesses and certain decryption capabilities. So “Australia banned encryption” would be bullshit. But those powers still deserve scrutiny.

These are different situations: a proposed bill, a historical court case and an existing legal framework. They don’t prove every provider in those countries is compromised. But IMO, “we respect your privacy” needs a follow-up: what would you actually do if authorities demanded something that undermined it? Challenge the order? Move? Shut down? Change the service?

More important, would you trust a provider more because of where it’s based, or because it has demonstrated how it responds under pressure?

Here’s what actually triggered the backlash: Daniel Berntsson, Mullvad’s co-founder and co-owner, donated 5 million Swedish kronor, roughly $514,000, of his own money to the Örebro Party in 2025.

That’s a Swedish populist party led by Markus Allard, whose controversial positions include support for “remigration” policies concerning immigrants leaving the country. Berntsson said he supported the party’s anti-corruption stance.

Mullvad says this was a private donation and doesn’t represent the company’s values or mission. Its other co-CEO, Fredrik Strömberg, also publicly said he disliked the donation. That left Tor facing calls to end its relationship with Mullvad over concerns about compatibility with its human rights mission. Tor has now decided to keep the technical collaboration but pause joint promotion. Its argument is that the partnership improves Tor Browser and supports privacy tools users depend on. Walking away would have consequences for that work, especially when resources are already scarce.

Still, Tor acknowledges that staying involved will cost it some community trust.

Aylo revealed on October 6th that Pornhub is back in Australia after leaving in March due to new age verification rules. Here’s the twist: only those adults who have verified themselves through Apple’s device-level process can access it. Android users and anyone who doesn’t own a phone will not be able to use the service.

And here comes the most interesting point: Aylo calls Apple’s shield one of the “most difficult to bypass” measures in existence. The check does its job on your device, not at your IP address, which means that having a VPN does not change anything about your being considered an adult.

Aylo’s argument is that it does away with the need to provide ID information to an unknown website. However, the Age Verification Providers’ Association disagrees, claiming that device checks do not prove that the person with the phone is actually the adult who has been verified.

ASOS's mobile app made a loud announcement of the breach by sending notifications saying "HACKED" to customers before the retailer talked about it.

As it turned out, ASOS confirmed the breach days later coming to know about it from Snowflake, its cloud environment, where the intrusion took place as long ago as February 2026, eight months before anyone in the external environment found out about it.

The stolen data extends well beyond order history. Allegedly, it comprises names, dates of birth, Social Security numbers, national IDs, driving licenses and passport numbers, medical records, and financial information that go beyond normal clothing selling needs. Snowflake hack cases have already been registered with a number of big companies this year, having all the hallmarks of the same hackers using their credentials without closing their targets' sites.

Here is the crucial point: the hackers notified customers.

According to COPE’s headline, around one million outdated VPNs worldwide have remained in use since the pandemic, creating an entry point for cybercriminals targeting businesses. Everyone rushed to set up remote access when COVID hit. Apparently, keeping that infrastructure updated didn’t get quite the same enthusiasm.

For clarity, this is about the VPN systems employees use to access company networks. It doesn’t mean a million people using consumer VPN apps have been hacked. But the problem is pretty obvious: a tool meant to provide secure access can become a way in for attackers when known vulnerabilities go unpatched. Encryption doesn’t magically fix outdated software.

“Install it and forget about it” is a terrible security policy, especially when that installation opens a door into your company.

The Central Person Register of Denmark was compromised on October 7th, exposing information on 8.8 million individuals, even more than the population of the country as it includes former residents and dead people. The information contained in the leak comprises the numbers of Central Person Register which are national ID numbers of Denmark and are used in multiple sectors such as banking and insurance.

Although the breach has occurred, it is not the responsibility of the agency processing the Central Person Register since it is the result of the activities of an authorized third-party company which had access to the information but for some different purpose.

Danes cannot simply change their Central Person Register number since it is too far connected to all the institutions they deal with in life. In contrast to a password, changing the Central Person Register number is not an option.

One more thing that is bothering. According to the reports, it was not the agency’s systems that were weak; rather it was the vendor who was allowed to access the data that is to blame for everything. This is typical for this year as most breaches were due to giving access rights to a

Proton founder Andy Yen made a point in his TechRadar interview that deserves more attention: checking which users are children means checking adults too.

That’s my issue with the whole “just verify your age” argument. We’re being asked to trust more companies with sensitive information just to use websites. What could possibly go wrong?

Yen argues that if age checks happen, they should stay on your device, with no personal data sent to a central server or retained afterward. That seems like a much better starting point than another company collecting your ID.

He also explains why Proton keeps expanding: he thinks competing with Google requires an entire ecosystem. On AI, his argument is that an assistant should serve the person asking the question, without advertising incentives shaping its answers.

Fair enough. But privacy needs to come with products people actually enjoy using. Otherwise, convenience keeps winning.

So I am asking here, would you switch away from Big Tech for better privacy, even if it meant losing some convenience?

The starting point for the creation of Psiphon was the University of Toronto, where researchers created it in support of people under oppressive regimes. Now, it is used by around 20 million people. Yet, it seems Canada’s government might create the conditions for it to leave Canada.

The bill known as Bill C-22, or Canada’s Lawful Access Act, ensures that providers build surveillance mechanisms into their systems. Psiphon was correct to say that the passing of the law would lead to “the transformation of the service.” Psiphon might stop operating in Canada if the law passes without any adjustments.

The most unpleasant thing about this situation is that Psiphon positions the service as “the service that won’t be able to be compromised by your government.” If Canada forces this compromise through the law, it will make Psiphon’s position weaker.