Australia expects platforms to "stop under-16s from using VPNs" to evade social media ban

• Social media platforms must stop kids from using VPNs to bypass ban
• eSafety Commissioner refuses to say how this will actually work
• Children likely to find workarounds but privacy could be at risk

Social media platforms affected by Australia's ban for under-16s are "expected to try to stop users from using VPNs to pretend to be outside Australia," according to guidance issued by the eSafety Commissioner.

When TechRadar asked the Commissioner’s office to clarify how platforms are expected to technically achieve this, a spokesperson declined to comment.

Despite broad support for the legislation within the country, enforcement remains a critical concern for legislators and parents alike.

In an email to TechRadar, Dr. Justine Humphry – co-author of the University of Sydney’s Emerging online safety issues report – said: "86% of parents said that we need effective age limits on apps and platforms, but 86% of young people and 83% of parents said that young people would get around these."

How will social media platform monitor VPN use?

To comply with the restrictions, social media platforms may attempt to identify and blacklist IP addresses associated with popular VPN services. However, this often creates a "cat-and-mouse" dynamic: as platforms block specific servers, VPN companies simply deploy new IP addresses to circumvent the restrictions.

This approach also creates significant collateral damage, potentially blocking legitimate adult users who are using a VPN to protect their data and increase their digital privacy.

Alternatively, social media platforms could roll out deep packet inspection (DPI) technology to analyze internet traffic data and identify VPN-specific fingerprints.

This works because VPN protocols like OpenVPN and WireGuard have distinct features, meaning VPN traffic looks different to standard web traffic. However, some VPNs with specialist obfuscation techniques – such as Surfshark and Proton VPN – may overcome this.

Realistically, social media platforms will likely just cross-reference a user's IP address with their GPS coordinates and/or the user's historic IP addresses. Since users frequently grant location data permissions for tagging posts or discovering "local" content, comparing those coordinates against an IP address offers an incredibly efficient method of spotting active VPNs.

Will VPNs enable kids to bypass the ban?

Interest in VPNs has surged in regions that have introduced strict content restrictions recently. In Missouri, search traffic for VPNs quadrupled following the introduction of mandatory age verification, while the UK saw a 1,400% spike in sign-ups for some providers following the Online Safety Act. And it's likely a similar trend will emerge in Australia.

Currently, Google Trends data shows no immediate spike in search interest, yet several popular VPNs – including ExpressVPN and NordVPN – are among Australia's top-grossing utility apps according to Sensor Tower data.

The "use of VPN services is a possibility and will need to be monitored to see if there are download surges," said Dr. Humphry.

However, their ability to bypass these restrictions will largely depend on the measures introduced by social media platforms. Given that these platforms often have access to granular device data – including GPS, sim card country, and advertising IDs – it's unlikely that a simple IP change will change much.

Platforms are likely relying on historical IP data and are already in the process of deactivating accounts. So, if a user’s "digital footprint" shows years of access predominantly from Australian IP addresses, a sudden switch to a location abroad is highly unlikely to work.

Despite this, we still expect there to be an increase in demand for VPN services as people look to increase their security and privacy online. However, a major concern is that younger users will inevitably turn to "free" VPN services in the hope of bypassing checks, but these are often dangerous.

Free VPNs frequently monetize user data by selling it to third-party advertisers, may lack necessary encryption standards, and can even inject malware onto devices. If you or your child is considering a VPN, it is vital to use a reputable service with a verified no-logs policy. We then recommend checking TechRadar's best VPN guide to get the most secure and reliable apps on the market right now.

Perhaps even more concerning is the emergence of new platforms that are specifically tailored for under-16s. These are leading to a fresh – and potentially even more dangerous – set of cybersecurity and digital privacy challenges.