The VPN dilemma: A regulatory loophole or gambling’s red herring?
When the UK Gambling Commission (GC) published its latest update on illegal gambling trends in April, it highlighted a growing challenge for regulators: virtual private networks, known as VPNs.
The regulator was not warning about a surge in black-market gambling itself. Instead, it was warning about something that makes measuring the black market harder. As VPN adoption rises, particularly following the implementation of the UK’s Online Safety Act, a growing share of online activity may be hidden from conventional traffic analysis.
VPNs have become one of the defining technologies of the modern internet. They allow users to mask their location, encrypt traffic and browse with greater privacy. They are also increasingly associated with attempts to bypass digital restrictions, whether those involve streaming rights, social media controls, age-verification requirements or gambling regulations.
For gambling regulators, that presents a difficult question. If growing VPN use obscures online activity, how can authorities accurately measure the size of the black market? More importantly, should governments attempt to limit or regulate VPN use itself, or would that amount to an attack on a legitimate privacy tool?
The debate has become particularly acute in Britain. The regulator recently acknowledged that increased VPN adoption following the implementation of the Online Safety Act has complicated its efforts to track illegal gambling activity. The regulator noted that it had already built a 30% VPN adjustment into its methodology but recognised that, after July 2025, a larger share of web traffic may be concealed. It therefore revised its assumptions using VPN usage data from Ofcom and Similarweb. The result was greater uncertainty, rather than greater clarity, about the true scale of illegal gambling engagement.
Harder to measure
The Commission relies on traffic estimates and trend analysis rather than precise measures of illegal gambling activity. It repeatedly stresses that no single dataset can fully capture black-market behaviour.
VPNs complicate this picture.
“The significant use of VPNs mean that web traffic data is an unreliable way to assess the scale of the black market,” says Melanie Ellis, partner at Northbridge Law. “The Commission will need to continue to use other indicators such as consumer research and information from the licensed industry.”
Ellis adds that VPN use reduces the effectiveness of geo-blocking and creates operational challenges even for offshore operators attempting to comply.
Elizabeth Cronan, vice president of government affairs at fraud-prevention technology company GeoComply, argues that VPNs do not fundamentally undermine regulated markets. “VPNs and other location-spoofing tools are widely available, but that does not mean they undermine regulated online gambling markets,” she says. “Modern geolocation technology is specifically designed to detect VPNs, proxies, remote desktop tools and other forms of location manipulation.”
She adds that the core issue lies elsewhere: “The bigger issue is that illegal operators often choose not to deploy these controls.”
James Baker, platform power and free expression programme manager at Open Rights Group – a UK-based digital rights and privacy advocacy organisation that campaigns to protect civil liberties in the digital world – cautions against misinterpreting reduced visibility. “Reduced visibility should not automatically be treated as evidence that illegal gambling has increased,” he says. “The appropriate response is to improve measurement methodologies and draw on multiple sources of evidence. Policymakers should avoid assuming that activity they can no longer measure has grown simply because it has become harder to measure.”
Diverging views
The implications of VPN growth remain sharply contested.
Mike Venner, director at Advanced Compliance Technology, sees VPN use as exposing real weaknesses in enforcement systems.
“The issue remains consistent: without effective enforcement technology, legislation is increasingly easy to circumvent. Basic geolocation checks are no longer sufficient in an environment where location spoofing tools are so widely accessed.”
Bethan Lloyd, partner at Wiggin, similarly argues that VPNs and related tools highlight the limits of geo-blocking, which will always lag behind evolving circumvention technology.
“VPN providers constantly adapt their technology – such as rotating IP addresses, obfuscating traffic to mimic standard HTTPS, and leveraging residential IPs – faster than detection methods can keep pace.”
Cronan takes a more compliance-focused view of the issue: “The technology exists and is already widely used successfully in highly regulated markets such as the United States,” she says. “Licensed operators are required to detect and verify a customer’s true location before accepting a wager, and regulators routinely audit and test those controls.”
Are VPNs a red herring?
By contrast, Ismail Vali, president of Gaming Compliance International, takes a more sceptical view of the debate itself. He argues that VPNs are often overstated in importance and are not central to how users access unlicensed gambling services.
“VPN use has always been a red herring,” he says.
Vali emphasises practical limitations that reduce VPN relevance in gambling environments. “Latency means delay,” he explains. “If you’re live sports betting, using a live dealer casino, playing slots with community features, or taking part in games such as poker, that delay becomes a major issue.”
He argues that users often find the experience degraded: betting windows close, streams lag and compliance checks introduce friction. “There is effectively no reliable way to use a VPN with modern gambling products and have a satisfactory experience,” he says.
Crucially, Vali disputes that VPNs are central to black-market access at all.
“The key point is that VPN users have always represented a tiny proportion of the overall audience. In virtually every country, users can access unlicensed gambling operators without needing a VPN.”
That, he suggests, is the real enforcement gap – not circumvention tools, but the continued availability of offshore sites.
A problem bigger than gambling
The debate extends beyond gambling into broader digital regulation.
The UK’s Online Safety Act has increased VPN usage as users attempt to bypass age-verification requirements, complicating traffic analysis used by the Gambling Commission.
For Venner, this reflects a broader systemic enforcement issue that extends beyond gambling into other areas of online regulation, including the Online Safety Act.
He argues that rising VPN use exposes the same underlying weakness across these frameworks: “Rising VPN use highlights the same enforcement challenges that we have previously raised with the UK government in the context of the adult content and the Online Safety Act.”
Venner warns that the problem is becoming more difficult to manage as circumvention tools become more widely available. In his view, traditional geolocation checks are no longer sufficient to guarantee compliance.
“The issue remains consistent: without effective enforcement technology, legislation is increasingly easy to circumvent,” he says. “Basic geolocation checks are no longer sufficient in an environment where location spoofing tools are so widely accessed.”
Advanced approach required
To address this, he calls for a more advanced and layered approach to compliance systems, combining multiple forms of verification.
“To protect bettors and uphold market integrity, regulators and operators must employ real-time, multi-layered solutions that combine location, network, device, identity and behavioural intelligence,” Venner explains. “Without this, geo compliance challenges could become more prominent than ever.”
Cronan similarily connects regulatory changes to changes in behaviour. “The implementation of the Online Safety Act last year spiked demand for VPNs, as both minors and adults used VPNs to get around mandatory age checks,” she says. “This induced demand has made VPN usage more widespread in the UK, which, if anything, has likely resulted in increased VPN use to access offshore gambling platforms.”
She also warns against unintended consequences of regulation. According to Cronan, a proposed consultation from the Department for Science, Innovation and Technology would require VPN providers to age-verify users, but she argues this “will likely be unproductive, as it will drive people away from compliant VPNs and towards more dangerous forms of location obfuscation technology, such as Tor and unregulated proxies with dubious data security and privacy practices”.
The burden on operators
Responsibility for enforcement remains contested.
Lloyd argues that while operators can deploy geo-blocking, currency controls and VPN detection, none are fully reliable. “VPN providers constantly adapt their technology faster than detection methods can keep pace.
“Ultimately, it is not the job of licensed operators to police the black market.”
Cronan agrees that enforcement requires regulatory backing. “Strong geolocation controls work when operators are required to use them and regulators have the authority to enforce compliance,” she says.
Ellis adds that rising taxes may further weaken licensed operators’ competitiveness, potentially pushing users toward unlicensed sites.
Ongoing uncertainty
VPNs remain dual-use technologies: tools for privacy and cybersecurity, but also for circumvention.
The UK´s communications regulator Ofcom states: “VPNs are lawful services which can be marketed and used by people in the UK,” adding that decisions on restrictions are for the government rather than the Online Safety Act framework.
Baker stresses that VPN use should not be conflated with illegal gambling activity, given its legitimate applications.
The regulator’s findings point to a broader structural shift: geographic enforcement is becoming harder in a borderless internet.
Cronan highlights the difficulty of measuring the issue. VPN usage, she argues, means regulators must rely on multiple indicators rather than any single dataset.
“What VPN activity does show is that consumer demand does not disappear when access is restricted,” she says.
That leaves regulators with ongoing uncertainty. VPNs are neither the main problem nor irrelevant, but they make measurement, enforcement and interpretation more difficult.
The Commission’s challenge is therefore not just about VPNs, but about adapting regulation to a digital environment where visibility can no longer be guaranteed.