How to Disappear From the Surveillance Internet

The UK's under-16 social media ban means age-checks for everyone. Here's how to opt out with Nostr, Bitcoin, NostrVPN &amp

The UK just decided that being online should require showing your papers. Here's how to opt out — with tools that already exist, that nobody can revoke, and that you can run for the price of a coffee.

On June 15, 2026, the UK government announced it would ban social media for everyone under 16. TikTok, Instagram, Snapchat, Facebook, X, YouTube — blocked for kids, with a "graduated" set of restrictions stacked on 16- and 17-year-olds and overnight curfews "under consideration" for under-18s. The government is calling it "Australia plus," because Australia did it first in December 2025 and the UK decided to go further. Regulations are expected to pass before Christmas, with the ban live by spring 2027.

I'm not here to argue about whether kids should be on TikTok. That's a real conversation for real parents, and I'm not going to pretend it isn't.

I'm here to talk about the machine you have to build to enforce a thing like this. Because you cannot stop a 15-year-old from opening Instagram without first answering one question for everyone: who are you, and prove it.

That's the part nobody voted for. And that's the part that doesn't go away.

The Quiet Part

To ban under-16s from social media, you need to know everyone's age. To know everyone's age, you need to check everyone's identity. So the actual policy isn't "kids off social media." The actual policy is age verification for the entire population — every adult, every login, forever.

This isn't speculative. It's already happening. The Online Safety Act's age-verification rules went live on July 25, 2025. Within minutes, Proton VPN reported UK signups surging over 1,400% in an hour, settling into a sustained 1,800% daily increase. NordVPN reported a 1,000% jump in purchases. Five VPN apps hit the top 10 free apps on the UK App Store by the following Monday. The Age Verification Providers Association reported around 5 million extra age checks per day.

Five million people a day, proving who they are to look at the internet.

The approved ways to prove it tell you everything: facial age estimation from a live selfie, credit card checks, passport-to-selfie matching, or a "digital ID wallet." Read that last one again. The end state of "protect the children" is a government ID you carry to use the web.

And we already know how that ends, because it already leaked. In October 2025, an age-verification vendor breach reportedly exposed the photo IDs of around 70,000 Discord users. The Open Rights Group put it plainly: it's becoming "virtually impossible" to be online in the UK without handing over identity documents or biometric data. Big Brother Watch called it a "papers please" internet.

Then They Came for the Escape Hatch

When millions of Brits reached for VPNs, the government noticed.

Ofcom declared that platforms "must not host, share or permit content encouraging use of VPNs to get around age checks" — and the government confirmed to the BBC that under the Online Safety Act, it's now illegal for platforms to do so. Ofcom told parents they "should block or control VPN usage" at home.

Then it escalated. A national consultation — "Growing up in the online world" — closed in May 2026 explicitly contemplating whether VPNs should be age-restricted if they undermine the rules. The House of Lords went further and floated an outright VPN ban for children. Ministers have so far said a blanket ban is "not on the cards" because VPNs are "essential to data protection for businesses" — which is a careful way of saying not yet, and not for everyone.

Mozilla — the people who make Firefox — warned UK regulators that age-restricting VPNs "will create massive cybersecurity risks" and "undermine the privacy and security of all users while failing to protect kids." They're right. But notice the shape of this. First you verify identity to protect kids. Then people route around it. Then you move to close the route. Each step is sold as discrete and reasonable. Stacked together, they're an architecture.

Pair this with the digital ID push — Keir Starmer's mandatory ID scheme announced in September 2025, the one the press nicknamed "BritCard," the one a parliamentary committee later called "nothing short of a fiasco" — and the trajectory is impossible to miss. Age verification trains you to prove identity online. Digital ID gives you the thing to prove it with. VPN restrictions close the exit. That's not a conspiracy theory. That's just three news cycles read in order.

This Is Why We Build What We Build

At Soapbox, we don't build tools for a hypothetical dystopia. We build them with activists who are already living in one.

We built Agora with Leopoldo López, a Venezuelan opposition leader who spent years as a political prisoner. We built Zuka with Anaïse Kanimba, whose father is the man from Hotel Rwanda, three days after a Rwandan YouTuber with 60,000 followers died in custody on the day he was supposed to be released. The threat models in those rooms make the UK look gentle. X gets banned. Bank accounts get frozen. The internet goes dark. The person speaking gets killed.

Here's what we learned building for people who can't afford to be wrong: the answer to "what if they take it away" is to build things that don't have an owner to pressure, a server to seize, or a database to leak.

That's not idealism. It's architecture. And the same architecture that keeps a Venezuelan organizer online keeps a British adult from having to show their passport to read a forum. The surveillance internet has one weakness — it depends on choke points. Identity providers. App stores. ISPs. Payment processors. Remove the choke points and there's nothing left to lean on.

Identity providers

Broken by Nostr — an identity nobody issues you.

Payment processors

Broken by Bitcoin — money nobody can freeze.

App stores & hosts

Broken by a $5 VPS — your own corner of the web.

ISPs & networks

Broken by NostrVPN and FIPS — a mesh with no middle.

Here's the toolkit. None of this requires permission. Most of it is free or nearly free.

1. Get an Identity Nobody Issued You

The root of all of it is Nostr.

On the old internet, your identity is an account someone grants you — an email, a phone number, a profile on a platform that can suspend it. On Nostr, your identity is a cryptographic key pair you generate yourself. Your public key is who you are. Your private key proves it. No email, no phone number, no company in the loop. No one issued it, so no one can revoke it.

This is the thing that breaks the whole verification regime at the root. There's no central account to check, no platform to pressure into demanding your ID, no registry to join. Your followers follow your key, not your presence on someone's server. Switch apps and they come with you.

Soapbox builds Ditto on exactly this. It's a social platform where your account is a key, not a permission slip — posts, articles, video, livestreams, polls, communities, the works. "Your content, your vibe, your rules" isn't a slogan, it's a description of who holds the keys: you do. And because Ditto bridges to Bluesky and Mastodon, you're not stuck in a walled garden to use it.

Cost: free. Start at ditto.pub.

2. Get Money Nobody Can Freeze

The second choke point is money. Age-verification vendors, ad networks, app stores, the whole surveillance economy runs on payment rails that can be cut with a phone call.

Bitcoin removes that lever. When a Venezuelan activist's bank account is frozen, a $10 Lightning zap from Germany still lands in seconds, no permission required. The same property that makes Bitcoin matter in Caracas makes it matter when paying for a privacy tool that a regulator would rather you didn't have. No card linked to your real name. No processor deciding what you're allowed to buy.

On Nostr, this shows up as zaps — Bitcoin sent creator-to-creator with no middleman taking a cut and no ad model harvesting you to make up the difference. The money and the identity layer fit together: you can earn, spend, and support directly, as yourself, without a bank as a witness.

3. Run Your Own Corner of the Internet for $5 a Month

Here's the part people don't believe until they do it: you can host your own piece of the web for the price of a sandwich.

A VPS — a virtual private server — runs about $5 a month. On it you can run your own Nostr relay, host your own website, run your own services. Ditto is built specifically for this: it compiles to static files and deploys on a $5 VPS, GitHub Pages, Netlify, or a Raspberry Pi sitting in your closet. When your social platform is a folder of files you control on a box you rent, there is no company in between to serve you an ID prompt.

And you don't need to be an engineer anymore. Soapbox's Shakespeare lets you build and deploy real web apps by describing them in plain language — the same tool we used to ship Agora and Ditto 2.0. The gap between "I wish I controlled my own thing" and "I control my own thing" is now an afternoon.

Cost: ~$5/month. Owning your own infrastructure: priceless.

4. Move Packets They Can't Read

A commercial VPN helps. But it's still a company — one with servers to subpoena and a corporate stance that can change. For people who want to go further, a new class of tooling is emerging that has no company at all.

NostrVPN, from early Bitcoin contributor Martti Malmi, links your own devices into an encrypted private mesh with no control server, no accounts, and no email — your Nostr key is your device identity. Think Tailscale, but with nobody in the middle. It's free and open source.

Next up, we have FIPS — the Free Internetworking Peering System — a self-organizing encrypted mesh that works over anything that moves packets: WiFi, Ethernet, UDP, Tor, the Nym mixnet, even Bluetooth and serial cables. No DNS provider, no certificate authority, no exit node to seize. It elects its own root, merges with neighbors on contact, and reroutes around damage on its own. One Nostr keypair, zero registries. If the internet goes dark — or gets walled behind an ID check — a mesh that runs over Bluetooth doesn't care.

The Point

Every one of these tools breaks a different choke point. Nostr removes the identity gatekeeper. Bitcoin removes the payment gatekeeper. A $5 VPS removes the hosting gatekeeper. NostrVPN and FIPS remove the network gatekeeper. Stack them together and the surveillance internet has nothing left to grab.

That's the whole strategy. Not one magic app. A set of independent tools, each owned by no one, that together let an ordinary person be online as themselves without asking anyone's permission and without leaving a trail for sale.

The UK is going to spend the next few years building a machine to verify who everyone is, all the time. They'll call it child safety, and some of them will even mean it. But the machine they're building doesn't know how to tell the difference between a kid sneaking onto Snapchat and an adult who simply refuses to show their papers to read the news. It treats everyone as a suspect to be cleared.

You don't have to live inside that machine. The exits already exist. They're open source, they're cheap, and the only thing standing between you and self-sovereignty is the afternoon it takes to set them up.

Your Escape Kit: Exactly What to Download

You don't need to do all of this at once. Start at Step 1. Each step stands on its own and makes you harder to track. Do as many as you want.

1Get a Nostr identity5 minutes · free

Open Ditto, let it generate your keys, and you're done. That's your account. No email, no phone number, nothing to verify.

Ditto · Soapbox's social platform. Your identity and a built-in Bitcoin wallet in one app, so it covers Step 2 too.

iOS Android Zapstore

Protect your keys

Your private key (nsec) is your account — treat it like the keys to your house. Back it up somewhere safe, and never paste it into a site you don't trust. (New to this? See our guide on managing your Nostr keys.)

1.5Harden the phone underneath it alloptional

This one's a bigger commitment, but it's the single biggest privacy upgrade most people can make. GrapheneOS is a hardened, de-Googled version of Android that strips out the tracking baked into a normal phone — while still running the apps you actually use. It only runs on Google Pixel phones, and you can install it from your web browser by clicking buttons — no command line.

GrapheneOS · install it straight from your browser with the official web installer. (Pixel 8 or newer recommended.)

2Use your built-in Bitcoin walletalready done

If you started with Ditto in Step 1, you already have this. Ditto ships with a built-in Bitcoin wallet, so you can send and receive money — and zap creators — right from the same app, without a bank watching. No separate download, no extra account.

That's how you support people directly: a few sats sent creator-to-creator, no middleman taking a cut, no payment processor deciding what you're allowed to fund. (See how it works under the hood in On-chain Zaps in Ditto.)

3Run your own corner of the web$5/month

Rent a small server and host your own site, relay, or social platform. No coding required.

Pick a VPS (cheapest): Hetzner (~€4/mo) · DigitalOcean · Vultr. These are the popular, low-cost options — but they're standard companies that want your real name and card.
Pick a VPS (for maximum privacy): 1984 Hosting · Njalla · OrangeWebsite. Privacy-first hosts in jurisdictions like Iceland that take minimal data and accept Bitcoin or Monero — pay with the wallet from Step 2 and you can sign up with no real name attached.
One honest caveat: no host is magic. A provider can still see what runs on the box and is bound by its country's laws — what "private" really buys you is how little they know about you (anonymous signup, crypto payment) and a friendlier jurisdiction.
Build the thing with AI: Shakespeare (describe an app in plain English, deploy it). New to it? Read how to build without coding.
Get apps without app-store gatekeepers (Android): Zapstore

4Move your packets across a meshadvanced

For when you want a network with no company in the middle at all.

NostrVPN — links your own devices privately. Install the app, or cargo install nvpn. (releases)
FIPS — the encrypted mesh underneath. Learn how it works.
Tor — not Nostr-native, but the most battle-tested option of all. The Tor Browser routes your traffic through volunteer-run relays to anonymize it and slip past blocks — a nonprofit network with no company to pressure. Free, and as simple as installing a browser. User guide.

For years, the case for this stuff sounded abstract to most people in the free world. Privacy was something you needed if you were a dissident, a journalist, someone living under a regime. Everyone else could afford not to care.

That excuse is gone. The surveillance is being built right here, in a democracy, in plain sight — wrapped in the language of child safety and rolled out by a government you can vote for. Age checks for everyone. A digital ID to carry. An open question about whether you're even allowed the tools to opt out. This isn't a warning about some other country's future. It's the news.

So don't wait for it to get worse before you take ten minutes to set yourself free. The exits are open source, they're cheap, and they work today.

It's all out there. Go own your corner of it.

Go own your corner of the internet.

Get a Nostr identity nobody issued you, or build your own freedom tech. The exits are open source, cheap, and work today.

Start on Ditto Build with Shakespeare