Here is a sentence I have written, unironically, into enterprise security proposals: "We isolate high-risk browsing by rendering the session on a remote server and streaming only the pixels to the user's device, so nothing untrusted ever touches the endpoint." Boards nod. It is a genuinely good control. It is also, word for word, a description of how a fourteen-year-old defeats an age check — and that collision is the whole of this instalment.
The routes in part four were exotic: Tor, i2p, the things that get the headlines. This one is the opposite. It is mundane, free, requires nothing to install, runs in an ordinary browser tab, and is already deployed at industrial scale in every secondary school in the country. It is, I think, the single most under-appreciated hole in the entire scheme.
What an age check actually sees
Strip an online age check down to its mechanism and it is a conversation between two parties: the site, and whatever is visiting the site. The check inspects the visitor — its IP address, its location, sometimes a camera or an uploaded ID — and decides whether to open the door.
Every enforcement idea in this series has quietly assumed that "the visitor" and "the child" are the same thing. The VPN in part one already bent that assumption — it changed the visitor's apparent location. The browser-in-a-browser breaks it completely, because it makes the visitor a different computer altogether, in a different country, that the child is merely watching.
The parcel that browses for you
A cloud browser — the polite industry term is browser-as-a-service, or remote browser isolation — works like this. Somewhere in a data centre in Frankfurt or Virginia, a real, full web browser spins up on a rented server. That browser does the actual visiting: it loads the site, runs its code, submits its forms. Then it films itself and streams the video back to the child's screen, tab-in-a-tab. The child's taps and keystrokes are sent the other way, like a remote control.
Now ask the enforcement question. When the age check inspects its visitor, what does it see? Not a teenager in Fife. It sees a browser in Frankfurt, with a German IP address, a data-centre fingerprint, a timezone and language set to match, and no camera to point at anyone. There is nothing to fail. The check isn't bypassed so much as asked of the wrong entity — it interrogates the messenger and never meets the child at all.
And the barrier to entry is close to zero. These services advertise free tiers, thirty-day trials with no card required, sessions that launch in seconds, and — the crucial part — access through a normal browser tab. Nothing to install means nothing for a school filter or a parental control to spot. To the device, to the network, to the nervous parent looking over a shoulder, it looks like the child is on a perfectly ordinary website. Because, technically, they are. The website just happens to contain another website.
The proof it works: the school-proxy underground
If this sounds theoretical, I would like to introduce you to an entire subculture your children may already know better than you do.
Every school in Britain runs web filtering — it is a legal requirement. And for as long as it has existed, students have defeated it, not with hacking but with web proxies: services, many of them open-source and maintained by teenagers, that fetch a blocked site and re-serve it inside an allowed-looking page. Projects with names like Ultraviolet pass around GitHub and Discord with tens of thousands of enthusiasts; there are curated lists, mirror sites that pop up faster than schools can block them, and a genuine folk tradition of the craft. The mechanism is precisely the browser-in-a-browser: the blocked site is rendered somewhere the filter isn't looking, and delivered to the student as something the filter permits.
I want to be clear about what this proves, because it is bigger than truancy from the maths-department firewall. It proves that the technique is not a fringe curiosity — it is already the default circumvention culture of British teenagers, battle-tested daily against exactly the kind of centralised filtering the age-verification regime depends on. The school filter and the age check are the same kind of control facing the same kind of adversary, and the adversary has a fifteen-year head start and a thriving open-source community. A national age-verification scheme is not walking into an empty field. It is walking into a war that has been running, and being lost, in every ICT suite in the country since before the pupils were born.
The uncomfortable mirror
I said at the top that this is the control I sell. That is worth sitting with, because it is not a coincidence — it is the same idea wearing two uniforms.
Remote browser isolation is a pillar of serious enterprise security. When I want to let staff open a risky attachment or visit a sketchy site without endangering the corporate network, I render it far away and stream back only the harmless pixels. The entire value proposition is: the dangerous thing and the protected thing never actually meet. It is one of the better ideas in my field.
Flip the polarity and it is a child and an age gate that never actually meet. The technology does not know or care which side of the fence it is serving; it simply interposes a computer between two parties so they cannot directly inspect each other. That is a feature when I am protecting a bank, and a hole when a government is protecting a child, and it is the same feature. You cannot commission the one and outlaw the other, because they are one thing. This is the deepest reason the enforcement dream keeps failing: the tools of circumvention are not sinister inventions built to thwart child-protection law. They are the ordinary, valuable, load-bearing tools of the modern internet, viewed from the other side.
Where this leaves the law
The lesson compounds the one from federation and the dark routes. It is not merely that some operators are unreachable; it is that the point of inspection itself is the wrong place to stand. Any check applied at the destination — "prove your age to this site" — is asking the question of whatever computer happens to be visiting, and the modern internet makes it trivial to put a rented computer in that seat. You can build the most sophisticated age gate in the world and it will still, patiently, verify the age of a data centre.
Which is why this series keeps arriving at the same door. The only inspection point that meets the actual child is the device in their actual hand — the phone or laptop a parent set up, that knows whose it is, and can hold an age setting that a Frankfurt server cannot launder away. Enforce at the destination and you are checking the messenger. Enforce at the device and you are, at last, checking the person. Every layer in between can be interposed, streamed, or proxied around, because that is what the internet is for.
What to do tonight, regardless
This is the one route where the technical bypass and the parental signal are almost the same object, which makes it unusually catchable. If a child is spending time on a website that is visibly another website inside it — a plain-looking page with a search box that then shows a game, a video site, a social app that "shouldn't" load there — that is a proxy, and it is worth a calm question about what it's reaching. On the school front, know that filtering is not the same as safety and never was; the proxy culture guarantees a motivated pupil is through it by lunchtime, so the conversation about why certain things are worth avoiding will always outperform the fence that says they can't be reached. And keep returning to the device: the browser-in-a-browser can move the inspection offshore, but it cannot move the child — and the device in their hand is the one thing in this entire series that is always, unavoidably, in the room with them.
Next in the series: the lessons from pornography age verification — a control we already switched on, a year of data, and what it predicts for the spring.