Pavel Durov, the founder of Telegram, has publicly challenged the United Kingdom's proposal to bar children under the age of 16 from accessing social media platforms, arguing that the policy risks driving younger users toward VPNs while simultaneously eroding the privacy of everyone online. His intervention brings one of the technology sector's most prominent - and polarizing - voices into a debate that has, until now, been dominated largely by child safety advocates and legislators. The UK's proposal represents one of the most aggressive regulatory attempts by a major Western democracy to restrict youth access to social networking services.
The Restriction the UK Is Considering - and Why It Is Contentious
The proposed framework would require social media platforms to implement robust age-verification systems before granting access, effectively walling off services from tens of millions of teenagers. Proponents cite a well-documented cluster of concerns: links between heavy social media use and adolescent mental health difficulties, the prevalence of cyberbullying, algorithmically amplified harmful content, and addictive design patterns baked into platform architecture. These are not trivial concerns. Mental health researchers, educators, and pediatric organizations in several countries have raised credible alarms about the cumulative effects of unregulated social media exposure on developing minds.
The difficulty is that translating those concerns into enforceable policy is vastly more complex than it appears. Age on the internet has never been reliably verifiable. Platforms have historically relied on self-declaration - a user entering a birth date during sign-up - which imposes no real barrier. Moving beyond that requires systems that can authenticate identity without simply creating a new layer of surveillance infrastructure. That tension sits at the heart of Durov's objection.
VPNs as the Path of Least Resistance
Durov's argument about VPN adoption is not speculative - it reflects a pattern that regulators have observed repeatedly in other contexts. When governments impose geographic or demographic restrictions on online content, technically capable users route around them. A VPN works by establishing an encrypted tunnel between a user's device and a server in another location, masking the user's real IP address and, by extension, their apparent jurisdiction. Teenagers with even modest technical literacy can install a consumer VPN application in minutes.
The consequence Durov points to is significant: rather than preventing access, a blunt ban may push younger users onto less visible, less moderated corners of the internet. Within a VPN tunnel, activity becomes harder to monitor, platforms have less contextual information about their users, and any safeguards that were in place - content filters, reporting mechanisms, parental oversight tools - are effectively bypassed. The regulated environment that legislators are trying to create could, paradoxically, become less accessible to the very population it is meant to protect.
This dynamic is not unique to the UK debate. Similar outcomes have been documented in countries that implemented broad content restrictions, where VPN adoption surged in direct proportion to the perceived inconvenience of the new rules. Regulators elsewhere have acknowledged that enforcement at the network level, without deeper cooperation from device manufacturers, operating systems, and internet service providers, remains structurally limited.
Age Verification and the Privacy Problem It Creates
The second dimension of Durov's critique concerns the infrastructure that age restriction requires. Any system capable of genuinely verifying that a user is 16 or older must connect that user's online activity to an authenticated real-world identity. The methods available to do this - government-issued identification, biometric scans, facial recognition tools, third-party verification brokers - each carry their own risk profile.
Government ID-based verification creates a direct link between a legal identity and platform usage data. Third-party verification services introduce an additional actor whose own data-security standards may not be subject to adequate oversight. Biometric systems, including AI-powered age estimation using facial geometry, generate sensitive physiological data that persists well beyond any single verification event. Privacy advocates have consistently warned that these systems, once built, rarely remain narrowly scoped - they create infrastructure that can be repurposed, subpoenaed, or compromised.
Large centralized databases holding identity-linked browsing or platform-access records are, by definition, high-value targets for cybercriminals. A breach affecting an age-verification service used by multiple major platforms would expose not just usernames and email addresses, but verified legal identities matched to social media profiles. That is a qualitatively different category of exposure than the kind of data breach that has become, regrettably, routine.
Durov's concern, then, is not simply about teenagers using VPNs. It is about whether the regulatory solution creates a permanent privacy hazard for the entire population of internet users - including adults who must verify their age to access platforms they previously used without disclosing their identity.
A Global Debate With No Easy Resolution
The UK is not acting in isolation. Australia has moved toward its own restrictions on minors' social media access. European regulators have pursued platforms under the Digital Services Act and the General Data Protection Regulation, demanding stronger protections for underage users. Parts of North America are examining similar age-gating requirements at state and provincial levels. Each jurisdiction is working through the same fundamental conflict: the legitimate goal of protecting children from demonstrable online harms versus the structural costs that mandatory identity verification imposes on privacy, anonymity, and the openness of the internet.
Technology companies, meanwhile, have introduced parental controls, screen-time dashboards, content moderation powered by machine learning, and restricted modes for younger accounts. Regulators and advocacy groups widely regard these voluntary measures as insufficient - platforms have financial incentives to maximize engagement, and those incentives are not automatically aligned with user well-being. That skepticism is reasonable. But the alternative - outsourcing identity verification to third parties or building government-linked authentication into access flows - shifts risk rather than eliminating it.
What Durov's public intervention clarifies is that this debate cannot be resolved by focusing solely on child safety in isolation from the broader digital rights framework. Policies designed to protect one group of users can, if poorly constructed, degrade the security and freedom of all users. The challenge facing British legislators - and their counterparts elsewhere - is designing regulation specific enough to achieve its stated aims without building the surveillance scaffolding that critics fear. That balance has not yet been achieved anywhere. Whether the UK will manage it remains an open question.
