Online age checks came first — a VPN crackdown could be next