Pavel Durov, the founder of Telegram, has publicly challenged the United Kingdom's proposed prohibition on social media access for users under 16, warning that the policy risks achieving the opposite of its stated goals. Rather than protecting children, Durov argues, mandatory age-verification systems could expose millions of users to new privacy threats while pushing teenagers toward VPNs and other circumvention tools that operate with far less oversight than the platforms the regulations target.
The UK Proposal and What It Would Require
The United Kingdom has been advancing one of the most restrictive approaches to youth social media access among major Western democracies. Under the proposed framework, platforms would be required to verify users' ages before granting access - a process that, in practice, typically involves submitting government-issued identification, undergoing biometric checks, or using third-party verification services. The political backing for the measure has been substantial, driven largely by mounting concern over the documented links between heavy social media use and mental health difficulties in adolescents, including anxiety, cyberbullying, and exposure to harmful content.
Supporters argue that voluntary measures by technology companies have consistently fallen short. Platforms have introduced parental controls and AI-driven content filters, but critics of self-regulation contend those tools have been applied unevenly and are too easily circumvented. The proposed ban represents a shift toward mandatory compliance - placing legal obligations on platforms rather than relying on their willingness to act.
Why Age Verification Creates the Privacy Problem It Claims to Solve
Durov's objection is not principally about protecting teenagers' access to social media. It is about what age verification requires everyone to surrender in order to make that access conditional. Any system capable of reliably confirming that a user is above or below a specific age must, by definition, know who that user is. That knowledge has to be stored somewhere, verified by someone, and often shared with third parties.
The result is a structural privacy trade-off that operates at scale. Age-verification databases containing identity documents, facial scans, or biometric data become high-value targets for cybercriminals. A breach involving the identity records of millions of users - including children - would carry consequences far more serious than the harms the legislation aims to prevent. Privacy advocates have raised this concern consistently across multiple jurisdictions where similar proposals have been debated, and it has yet to receive a satisfying technical answer from policymakers.
There is also a secondary surveillance concern. Once infrastructure exists to verify identity before granting access to a communication platform, the same infrastructure can, in principle, be repurposed. The question of who controls verification systems, under what legal authority, and with what oversight is rarely addressed in detail during the early stages of such proposals.
VPNs as the Predictable Response
Durov's warning about VPN adoption is grounded in a pattern that has repeated itself wherever regional content restrictions have been imposed. VPN services work by routing a user's internet traffic through a server in a different location, masking the user's actual IP address and, in many configurations, encrypting the connection between the user and that server. For a teenager blocked from accessing a social media platform in the UK, connecting through a VPN server located in a country without equivalent restrictions would restore access with minimal technical effort.
The barrier to entry is low. VPN applications are widely available, often free at a basic level, and require no particular technical knowledge to install and use. Following the introduction of age restrictions in other markets, including certain content platforms in the United States, measurable increases in VPN downloads among younger users have been reported - a dynamic that illustrates the limits of geographic or demographic access controls when applied to a globally networked medium.
The deeper problem Durov identifies is not simply that the ban would fail, but that the failure mode is worse than the original condition. A teenager accessing social media directly, through an age-verified account, does so on a platform that is at least nominally subject to regulation, content moderation, and legal accountability. A teenager accessing the same content through a free VPN of uncertain provenance, with no moderation layer and potentially with their traffic being logged by an opaque third-party provider, has substantially fewer protections - not more.
A Policy Debate Without Easy Answers
Durov's criticism does not dismiss the underlying problem. The concerns driving the UK proposal are real: the evidence connecting early adolescent social media use with psychological harm is serious enough that governments feel compelled to act. The disagreement is about method, not objective.
The broader international debate reflects precisely this tension. Australia has moved to implement age-based restrictions. Several European Union member states are examining similar frameworks. Each has encountered the same core dilemma: effective age verification requires identity disclosure, identity disclosure creates privacy risk, and restrictions without effective verification merely redirect users rather than protect them.
What remains absent from most of these discussions is a credible technical architecture that achieves age verification without centralizing sensitive personal data. Privacy-preserving approaches using cryptographic proofs - where a third party confirms an attribute like age without revealing the underlying identity document - exist in research and limited commercial deployment, but none has been adopted at the scale these proposals would require. Until that gap is closed, any age-verification mandate will force a choice between privacy and enforceability. The UK proposal, like its counterparts elsewhere, has not yet clearly resolved which it is willing to sacrifice.
