What I mean by what you quoted was only now in 2026 when VPNs are soon to be 'in scope' (in UK) and surely covered elsewhere is that VPN providers finally starting to raise the alarms.
That a VPN provider backs the EFF who was active early on is good and my comments aren't really directed at AirVPN whom I don't think has been as some of the 'leopards at my face' VPN providers I have seen on social media/tech news sites as of late.
Per the Discord hack, this is part of what I call the "big platform AV fallacy". Not a single AV law requires *only* face scans and/or submitting an ID.
Every one allows third-party database checking. In other words, for US and UK at least, simply typing in a phone # or inputting one's street address *and nothing more* for almost all users is enough.
Discord will stick to face scans/ID submissions because they are a freemium platform that wants to stay as much in the black as possible.
This means they will only use the verification methods with the highest friction as any user who doesn't want to do that has a high chance of never becoming a Nitro user/not that active on Discord to begin with.
Of course, they messed up badly per the leak but if they allowed third-party DB checking, there would not have been a leak to begin with (or at worst a significantly smaller one).
But just like some VPN providers (again, not Air), when the writing was on the wall leading up to AV bills working through the government, they were quiet.
Censorship may begin with the lowest hanging fruit (adult), but it will rise and affect other venues of free speech in good time.
Per the EU AV methods via an app/device, looks promising! TBD per actual implementation. I'm hopeful though.