Protecting children online: Where Florida’s new law falls short

Florida’s state legislators recently passed a new bill aimed at protecting children online. The highlights of the bill, which is known as HB 3, are mandatory age verification for accessing material that is deemed harmful to minors, and prohibiting children younger than 14 from joining social media, with parental or guardian consent required for those under 16.

Without wishing to enter the debate on the merits of the intent of the bill, I personally agree that protecting minors from inappropriate and harmful content is a positive step even if the measures are unenforceable and only act to raise awareness.

The VPN workaround

The requirement to restrict access to harmful content by requiring age verification has caused a surge of people searching for ‘VPN’ (Virtual Private Network), according to Google Trends. There’s also a flurry of articles that explain how to circumvent the requirement by using a VPN to mask your location and appear to be outside of Florida. Many of these articles – which have been published especially after several major adult websites blocked the entire state from access in response to the law – are sponsored or contain affiliate links to download and purchase VPN software and services.

Is this all surprising? No. VPN technology has long been a popular tool for circumventing access restrictions, whether they’re geo-restrictions on streaming platforms or access to restricted content. With HB 3 in place, implementing a restriction such as age verification means that all users, regardless of age, need to be age verified, and thus anyone not wishing to be identified in any way when browsing adult-based content will look for alternate methods to access content.

The Florida legislation does, in some form, limit the risk of ‘accidental browsing’ of content that may be harmful, since access to such content will be behind the ‘age verification wall’, as opposed to a publicly accessible homepage. I’m sure commercial companies who monetize by providing adult content will want to avoid the attention of law enforcement and HB 3 to avoid potential legal action and fines. But there is a mass of adult content on the internet that is available without commercial intent and is hosted in countries where taking legal action from Florida may just be too complex, or near impossible.

Given the restrictions imposed by the legislation are so easily circumvented, maybe the bill could have gone one step further. When drafting the legislation, someone in the room surely mentioned that it could be circumvented easily by using a VPN – at least I hope they did. For me, this raises the question of why the legislation doesn’t place limitations that go beyond the content provider and include services that provide the ability to virtualize your location to somewhere outside of Florida.

VPN technology provides cybersecurity benefits, particularly when connecting over public networks, but its functionality is often misunderstood. The assumption that the connection becomes private is only true in part. When using a VPN, the connection is only encrypted between the device and the VPN server; from this server to the intended destination, the connection is no longer in the encrypted tunnel and is the same as any standard connection between the browser and the destination webserver.

VPN providers still have visibility into key details: they know the location of the device, via its IP address, and the intended destination of the request. Using simple web filtering tools, the VPN provider could simply block access to adult content or implement their own age verification requirements, removing the possibility to circumvent the restrictions. For example, internet service providers in the UK adopt a similar approach, as they block adult content by default unless users opt in, thereby protecting minors.

Missing the mark?

When creating legislation, and knowing it could be bypassed easily, should legislators have attempted to impose a restriction on the known easy methods used to get around the legislation? The answer, at least for me, is yes. Without taking the legislation one step further and providing robust restrictions that make it complex and difficult to circumvent, the law risks being reduced to little more than a symbolic gesture or an awareness campaign.

If we are serious about protecting minors on the internet and limiting access to harmful content to those of a suitable age, then it probably requires a brave re-think of the internet and how its users could be identified.