- Social media platforms must stop children from using VPN to avoid ban
- eSafety commissioner refuses to say how this will actually work
- Kids are likely to find solutions, but privacy could be at risk
Social media platforms affected by Australia’s under-16 ban are expected to “attempt to prevent users from using VPNs to pretend to be outside Australia”, according to guidance issued by the eSafety Commissioner.
When TechRadar asked the Commissioner’s office to clarify how platforms are technically expected to achieve this, a spokesperson declined to comment.
Despite widespread support for the legislation within the country, its implementation remains a key concern for both legislators and parents.
In an email to TechRadar, Dr Justine Humphry, co-author of the University of Sydney’s Emerging Online Safety Issues report, said: “86% of parents said we need effective age limits on apps and platforms, but 86% of young people and 83% of parents said young people would avoid them.”
To comply with restrictions, social media platforms may attempt to identify and blacklist IP addresses associated with popular VPN services. However, this often creates a “cat and mouse” dynamic: as platforms block specific servers, VPN companies simply deploy new IP addresses to bypass the restrictions.
This approach also creates significant collateral damage, potentially blocking legitimate adult users who use a VPN to protect their data and increase their digital privacy.
Alternatively, social media platforms could deploy deep packet inspection (DPI) technology to analyze internet traffic data and identify VPN-specific fingerprints.
This works because VPN protocols like OpenVPN and WireGuard have different characteristics, meaning VPN traffic looks different than standard web traffic. However, some VPNs with specialized obfuscation techniques, such as Surfshark and Proton VPN, can solve this problem.
Realistically, social media platforms will probably simply cross-reference a user’s IP address with their GPS coordinates and/or the user’s historical IP addresses. Since users frequently grant location data permissions to tag posts or discover “local” content, comparing those coordinates to an IP address offers an incredibly efficient method of detecting active VPNs.
Will VPNs allow children to bypass the ban?
Interest in VPNs has increased in regions that have recently introduced strict content restrictions. In Missouri, VPN search traffic quadrupled following the introduction of mandatory age verification, while the UK saw a 1,400% increase in signups for some providers following the Online Safety Act. And a similar trend is likely to emerge in Australia.
Currently, Google Trends data does not show an immediate increase in search interest; However, several popular VPNs, including ExpressVPN and NordVPN, are among the top-grossing utility apps in Australia, according to Sensor Tower data.
“Use of VPN services is a possibility and will need to be monitored for surges in downloads,” Dr Humphry said.
However, your ability to bypass these restrictions will largely depend on the measures introduced by social media platforms. Since these platforms often have access to granular device data (including GPS, SIM country, and advertising IDs), a simple IP change is unlikely to change much.
Platforms are likely relying on historical IP data and are already in the process of deactivating accounts. Therefore, if a user’s “fingerprint” shows years of access predominantly from Australian IP addresses, a sudden switch to an overseas location is highly unlikely to work.
Despite this, we still expect there to be an increase in demand for VPN services as people look to increase their security and privacy online. However, a big concern is that younger users will inevitably turn to “free” VPN services in the hope of bypassing the controls, but these are often dangerous.
Free VPNs frequently monetize user data by selling it to third-party advertisers, may lack necessary encryption standards, and can even inject malware into devices. If you or your child are considering a VPN, it’s vital to use a trusted service with a verified no-logs policy. Then we recommend checking out TechRadar’s best VPN guide for the most secure and trusted apps on the market right now.
Perhaps even more worrying is the emergence of new platforms designed specifically for those under 16 years of age. This is creating a new, potentially even more dangerous set of cybersecurity and digital privacy challenges.
We test and review VPN services in the context of legal recreational uses. For example: 1. Access a service from another country (subject to the terms and conditions of that service). 2. Protect your online security and strengthen your online privacy when you are abroad. We do not support or condone using a VPN service to break the law or conduct illegal activities. Future Publishing does not endorse or condone the consumption of paid pirated content.
