Regulating commercial VPNs won't stop circumvention; it just shifts the equilibrium toward protocol-native anonymity like Tor bridges or Nostr relays that lack a single choke point companies can be forced to comply with. The EU's age app then becomes irrelevant theater unless they also mandate client-side attestation on every device, which accelerates the incentive for users to run their own infrastructure instead of relying on regulated ISPs.
Regulating commercial VPNs won't stop circumvention; it just shifts the equilibrium toward protocol-native anonymity like Tor bridges or Nostr relays that lack a single choke point companies can be forced to comply with. The EU's age app then becomes irrelevant theater unless they also mandate client-side attestation on every device, which accelerates the incentive for users to run their own infrastructure instead of relying on regulated ISPs.