EU calls VPNs "a loophole that needs closing" in age verification push

European regulators are targeting VPNs as a regulatory loophole in age-verification enforcement, with proposals to require age verification for VPN access itself—creating a critical tension between child safety mandates and privacy/security infrastructure that IT organizations depend on for legitimate purposes like secure remote work. This regulatory push, exemplified by Utah's SB 73 and upcoming EU Cybersecurity Act revisions, will likely force technology leaders to navigate conflicting compliance requirements while managing VPN services that are foundational to enterprise security architecture. IT organizations must prepare for potential restrictions on VPN accessibility and implement alternative secure access controls while advocating for technically feasible, privacy-preserving solutions that don't compromise organizational security posture.