- Social media platforms must prevent children from using VPNs to circumvent the ban
- Electronic Security Commissioner refuses to say how it will actually work
- Kids will likely find workarounds, but privacy could be at risk
Social media platforms affected by Australia’s under-16s ban should “attempt to prevent users from using VPNs to pretend to be outside Australia”, according to guidelines released by the Electronic Safety Commissioner.
When TechRadar asked the commissioner’s office to clarify how platforms should technically achieve this, a spokesperson declined to comment.
Despite widespread support for the legislation in the country, its implementation remains a major concern for both lawmakers and parents.
In an email to TechRadar, Dr Justine Humphry – co-author of the University of Sydney’s Emerging Online Safety Issues report – said: “86% of parents said we need effective age limits on apps and platforms, but 86% of young people and 83% of parents said young people would bypass them.
To comply with restrictions, social media platforms may attempt to identify and blacklist IP addresses associated with popular VPN services. However, this often creates a “cat and mouse” dynamic: when platforms block specific servers, VPN companies simply deploy new IP addresses to circumvent the restrictions.
This approach also creates significant collateral damage, potentially locking out legitimate adult users who use a VPN to protect their data and increase their digital privacy.
Alternatively, social media platforms could deploy deep packet inspection (DPI) technology to analyze internet traffic data and identify VPN-specific fingerprints.
This works because VPN protocols like OpenVPN and WireGuard have distinct functionality, meaning VPN traffic is different from standard web traffic. However, some VPNs with specialized obfuscation techniques – such as Surfshark and Proton VPN – can overcome this problem.
In reality, social media platforms will likely simply cross-reference a user’s IP address with their GPS coordinates and/or the user’s historical IP addresses. Since users frequently grant location data permissions to tag posts or discover “local” content, comparing these coordinates with an IP address provides an incredibly effective method of spotting active VPNs.
Will VPNs allow children to bypass the ban?
Interest in VPNs has increased in regions that have recently introduced strict content restrictions. In Missouri, search traffic for VPNs quadrupled following the introduction of mandatory age verification, while the UK saw a 1,400% increase in listings for some providers following the Online Safety Act. And it is likely that a similar trend will emerge in Australia.
Currently, Google Trends data does not show an immediate increase in search interest, but several popular VPNs – including ExpressVPN and NordVPN – are among Australia’s most profitable utility apps, according to Sensor Tower data.
“Using VPN services is a possibility and will need to be monitored to see if there are download spikes,” Dr Humphry said.
However, their ability to circumvent these restrictions will largely depend on the measures introduced by social media platforms. Since these platforms often have access to granular device data – including GPS, SIM card country, and advertising IDs – a simple IP address change is unlikely to change much.
The platforms are likely relying on historical IP data and are already in the process of deactivating accounts. So if a user’s “digital footprint” shows years of access primarily from Australian IP addresses, a sudden change to an overseas location is very unlikely to work.
Despite this, we still expect demand for VPN services to increase as people look to increase their security and privacy online. However, a major concern is that younger users will inevitably turn to “free” VPN services in the hope of bypassing controls, but these are often dangerous.
Free VPNs frequently monetize user data by selling it to third-party advertisers, may not meet necessary encryption standards, and can even inject malware onto devices. If you or your child are considering using a VPN, it is essential to use a reputable service with a verified no-logging policy. We then recommend checking out TechRadar’s best VPN guide to get the most secure and reliable apps on the market today.
Perhaps even more concerning is the emergence of new platforms specifically designed for under-16s. These developments bring a new – and potentially even more dangerous – set of cybersecurity and digital privacy challenges.
We test and review VPN services in the context of legal recreational uses. For example: 1. Access a service from another country (subject to the terms and conditions of that service). 2. Protect your online security and strengthen your online privacy abroad. We do not support or approve the use of a VPN service to break the law or conduct illegal activities. Consumption of paid pirated content is not endorsed or endorsed by Future Publishing.
