A proposed US age-verification law named SCREEN Act could force VPN users to surrender identifying information before accessing lawful online content, according to the Electronic Frontier Foundation (EFF).
The digital rights group says the SCREEN Act’s broad scope would weaken online anonymity while creating databases of sensitive personal data.
EFF’s India McKinney said S. 737 would require online services to verify users’ ages before allowing access to sexually explicit material. The Senate Commerce Committee is considering legislation that explicitly states that simply asking users to confirm they are adults is insufficient.
The bill would instead push platforms toward verification methods tied to users’ real identities, potentially involving government identification, facial age estimation, financial records, or third-party verification providers. EFF argues that these systems differ significantly from presenting identification in person because verification companies may collect, process, and retain digital copies or associated personal information.
Unlike some state age-verification laws, the federal proposal does not require that sexually explicit content constitute a substantial portion of a service. A platform hosting even a single qualifying item could therefore fall under the rules. EFF says this could affect services such as Netflix, Reddit, Discord, Bluesky, OnlyFans, and Pornhub.
VPN traffic receives particular attention under the proposal. Covered services would generally determine whether verification is required using a visitor’s IP address, while traffic originating from known VPN addresses would specifically trigger age checks.
VPNs conceal a user’s public IP address by routing traffic through an intermediary server. They are widely used to secure connections on public Wi-Fi, reduce tracking, protect journalists and activists, and prevent websites from learning a visitor’s approximate location.
Under the SCREEN Act, people using these privacy protections could be treated as higher-risk visitors and required to identify themselves. This creates a situation in which users who take deliberate steps to preserve their anonymity may face more invasive verification than those who connect directly.
The legislation requires companies to take “reasonable” measures to protect the data they collect and to avoid retaining it longer than necessary. However, EFF says those safeguards provide no firm restrictions on what information can be collected, how it may be used, or precisely how long it may remain stored.
Centralized age-verification records could also become attractive targets for cybercriminals, particularly when they connect real identities with visits to sensitive websites or services.
Leave a Reply