UK Internet Age Verification System explained for cyber security

The UK government created a new age-verification law under the Online Safety Act 2023, which has come into play as of 25 July 2025.

These rules require users to prove they are over 18 before accessing certain online content. Mainly pornographic websites or platforms that promote self-harm, suicide, eating disorders and other potentially harmful material.

The goal of the UK Internet Age Verification System is to protect children browsing on the internet.

While the aim to protect children is positive, age verification when done accurately often means exposing sensitive personal information. These checks come with new cybersecurity risks and privacy concerns. 

How the UK Internet Age Verification System works

1. Users must prove their age to access websites with adult content or websites that promote harmful subjects
2. Websites must use strict methods to prove users’ age, like:
   • Uploading an ID (passport or driver license)
   • Taking a selfie and using software to verify age by facial pattern matching
   • Confirming your age with a credit or debit card
3. Platforms like Reddit, X (Twitter) and other multi-purpose websites must ensure that minors cannot view adult content.
4. Non-compliant websites can be:
   • Blocked in the UK
   • Fined up to £18 million or 10% of global revenue

What this means in practice (and for cyber security)

1. People will use VPNs to bypass UK age verification laws

Websites use the requester’s IP to verify where the request is coming from, which is easily bypassed. To avoid these checks, many users are turning to VPNs and changing their location outside the UK. App Store search data already indicate a significant increase in VPN downloads following the rollout.

2. Rise of fake VPN sites, phishing pages and malware

Cybercriminals are aware of this change and are already launching fake VPN services targeting minors and phishing websites that mimic real age-verification portals. 

These mostly contain spyware, malware or crypto miners.

Even Google Search ads have featured malicious sponsored links that lead to dangerous downloads in the past. Chances are we will see this happening again.

This opens the door to a sharp rise in identity theft, credential harvesting and malware infections, especially among users trying to avoid verification.

3. Malicious JavaScript and third-party script abuse

Many websites outsource age checks to third-party SDKs or embedded widgets. This introduces massive client-side supply chain risks. Just like with other dependencies, attackers can launch Magecart-style attacks to collect:

• Uploaded photo IDs
• Credit card details
• Uploaded selfie
• Other personal information

Examples of an attack method:

• Injecting malicious <script> tags into verification flows
• Using fake <input> overlays to spoof identity forms
• Manipulating the DOM to exfiltrate data before it is encrypted or submitted

This is all well-known in the client-side security space where it’s become the most common attack. And one that traditional audits often miss.

4. Dangerous Browser Extensions

Again to the point of VPNs above, users trying to bypass restrictions may install shady VPN browser extensions. We recently wrote exactly why browser extensions are so dangerous.

They can:

• Hijack traffic
• Inject ads or affiliate links
• Log browsing history
• Be sold to bad actors - this is common practice

5. API and token exploits

Anywhere there is PII gathered, attacks will flock. As we saw in the recent Tea app, their backend got breached and all the user PII was leaked. Similar to the UK Internet Age Verification System, Tea also gathered verification via photo ID and other personal info. Since platforms themselves are in charge of this age verification, that just means more targets for possible attacks.

Future threats we can expect

Threat Type	Description
ID Theft via Phishing	Fake age-verification portals that collect uploaded ID documents
Deepfakes and Face Swaps	Stolen selfies used to create AI-generated impersonations
Malicious Age Verification SDKs	Client-side supply chain attacks targeting embedded age-check libraries
Surveillance and Tracking	Age-check tools that follow users across websites under the guise of safety
VPN Honeypots	Fake VPNs that log user activity and collect personal data
Credential Stuffing	Reused login credentials stolen from phishing or fake SDKs
Magecart-style PII Skimming	Malicious scripts scraping ID images and sensitive form inputs
Form Overlay Attacks	Fake form fields used to steal user data before submission

Best practices

For Users:

• Use only trusted VPN providers
• Never upload ID documents to unverified websites
• Avoid installing browser extensions from unknown developers and make sure the extension has positive and legitimate reviews
• Regularly clear cookies and session data. This helps reduce passive tracking and exposure to cross-site data leaks

For Developers:

• Audit all third-party JavaScript libraries and SDKs. Client-side, middleware and server side
• Implement a strict Content Security Policy (CSP) strategy - if you can
• Use Subresource Integrity (SRI) - if you can
• Set up Cross-Origin Resource Sharing (CORS)
• Prevent Cross-Site Scripting (XSS) by sanitizing user input and using secure templating frameworks
• Add a secure token system
• Monitor the DOM and network requests

Cside can help with a number of these.