VPN location spoofing is on the rise… is it safe?

A few weeks ago, new laws made it necessary for British residents visiting certain websites to provide photo identification of themselves, to verify their age.

As we recently reported, it’s debatable whether the UK Government’s Online Safety Act will protect children or actually drive them into the clutches of less well-regulated online content.

What we can say is that nobody should voluntarily upload personally identifiable information (PII) like passport scans to mysterious overseas website administrators.

The potential for data loss, theft and misuse is difficult to sum up in a sentence, although “very likely in the long-term” probably covers it.

One potential workaround to the deeply flawed Online Safety Act is a process known as location spoofing.

Below, we explain how this process works, its legality, and other benefits it might bring.

Location location location

Although we think of the internet as a globally accessible resource, elements of it are country-specific – or even region-specific within individual nations.

As an example, some live BBC content is only available over the internet in certain parts of the country.

Even licence fee payers won’t be able to listen to commentary from an east-coast football match while you’re on the west coast. You’ve paid for it, but you can’t hear it.

Similarly, unless their own governments have similar policies, people visiting adult content websites from other countries won’t be subjected to the photo ID demands now levied on UK residents.

Individual locations are identified using a process called geolocation, which relies on the Internet Protocol (IP) address your ISP has allocated you.

There are over 140 million IP addresses assigned to the UK, each comprised of four numbers between zero and 255, and separated by full stops.

When you visit a website, it detects where you are using your IP address and adjusts elements like the default language and currency accordingly.

Some sites, apps, resources and services are automatically blocked when people in certain countries attempt to access or view them.

Location spoofing is a process whereby the online identifiers used to determine where people are (and consequently which restrictions apply) are disguised.

It’s typically conducted by a VPN – a virtual private network that encrypts data before it’s sent and channels it through the VPN’s own gateways.

The VPN itself becomes the nominal data endpoint as far as the host server is concerned, displaying location details which could potentially be anywhere in the world.

Often, the host website or service simply can’t tell where the end user is. Because it can’t be sure, the host is therefore unable to apply specific geolocation restrictions.

Are there any drawbacks to location spoofing?

VPNs have many other uses. They minimise tracking, support anonymous file sharing and dramatically reduce the risk of hackers or criminals being able to access PII while a user is online.

However, they do pose some potential drawbacks and challenges.

From a location spoofing perspective, you should only choose no-log VPN providers, since some VPNs record basic user data (logs) which could potentially be used to identify you.

Bear in mind that geolocation restrictions are imposed with specific intentions. You may not agree with them, but that doesn’t invalidate them.

Using location spoofing to access content you’re not supposed to be viewing may be deemed illegal, though it depends how you use the VPN.

Listening to a georestricted BBC Sport stream wouldn’t bring the police to your door, whereas viewing a movie not yet released in your country would breach copyright laws.

Because data is having to travel through a middleman’s servers, VPNs also slow down data transfers, so they might not be fast enough to support activities like video streaming.

Some VPNs also charge a fee, which is something to consider before signing up, although these are the services most likely to employ a no-logs policy.

Every internet service needs to be paid for somehow, so be mindful of how a free VPN covers its operational costs…