The controversial Online Safety Act is pushing many users, including minors, towards risky free VPN services to protect their privacy. However, a new investigation reveals a disturbing irony: in seeking to protect their data, many are unwittingly exposing their data to servers in China and Russia.

Intended to make the UK the “safest place in the world to be online,” the Online Safety Act imposes a duty of care on tech companies to protect users from harmful content. A key component of this is stringent age verification for sites hosting adult content.

While great in theory, critics argue the bill is a dystopian overreach. The bill is accused of threatening free expression and digital privacy by forcing platforms to monitor user activity, weaken end-to-end encryption, and censor what content authorities deem harmful, including legitimate protest. High-profile data leaks have proven that concerns about uploading personal data to services aren’t unwarranted.

This has all led to a surge in VPN adoption. By masking a user’s IP address and encrypting their traffic, VPNs can bypass ISP-level blocks and age gates, offering a semblance of the open internet that many fear the new legislation will erode. For young people, in particular, these tools represent an easy workaround to access restricted content without providing personal identification.

While users believe they are securing their digital footprint from the Online Safety Act’s overreach, many are turning to free VPN services that present a more insidious threat. Research from Comparitech found that many popular free VPN apps on both Apple’s App Store and the Google Play Store are secretly communicating with servers in jurisdictions known for their disregard for privacy.

The investigation, which builds on an earlier report from the Tech Transparency Project (TTP), analysed 24 popular VPN applications. The TTP had previously found that “more than 20 out of the top 100 free VPNs on US app stores showed evidence of Chinese ownership,” with none clearly disclosing these connections.

Comparitech’s deeper dive confirmed these fears. Researchers discovered that six of the analysed apps – including Turbo VPN, VPN Proxy Master, and Signal Secure VPN on Android, and Now VPN on iOS – were communicating with Chinese domains.

Even more troubling, eight of the Android applications – such as QuarkVPN and VPNify – were found to be in contact with Russian IP addresses linked to major tech firms like Yandex and Mail.ru.

In an effort to escape the perceived surveillance and censorship of the Online Safety Act, users are funnelling their entire internet activity through services that could be sharing their data with entities in China and Russia. The very tool used to achieve privacy becomes a potential instrument of foreign state surveillance, nullifying any intended benefit.

Determining a VPN’s true operational base is notoriously difficult. Many providers use a complex web of shell companies in privacy-friendly nations to mask that their infrastructure and staff may reside elsewhere. This corporate obfuscation makes it nearly impossible for the average user to know who is handling their sensitive data.

For UK residents concerned about their digital privacy, the solution is not to jump from one potential threat to another. Before installing a VPN, especially a free one, users should attempt to investigate its origins. A simple WHOIS search can at least reveal a website’s registrant country, and checking government business databases can offer further clues.

Reputable VPN providers often publish transparency reports, including independent audits of their no-logs policies. If a service is not transparent about its ownership, jurisdiction, and practices, it is best to assume the worst. In the quest for online freedom amid intrusive legislation such as the Online Safety Act, users globally must ensure they are not simply trading one set of monitors for another, potentially more dangerous, one.

See also: UK full fibre adoption surges despite stagnant broadband market

Want to learn more about cybersecurity and the cloud from industry leaders? Check out Cyber Security & Cloud Expo taking place in Amsterdam, California, and London. The comprehensive event is co-located with other leading events including Digital Transformation Week, IoT Tech Expo, Blockchain Expo, and AI & Big Data Expo.

Explore other upcoming enterprise technology events and webinars powered by TechForge here.