Australia has passed some of the world’s toughest laws around children and social media. The legislation is real, the fines for platforms are substantial, and the intent is genuine. But laws have limits — and one of those limits has a name: VPN.

A 14-year-old with a free app on their phone can make it look like they’re browsing from New Zealand, the United States, or anywhere else on earth. That doesn’t make the law pointless — far from it — but it does mean parents need to understand what the legislation actually does, what it doesn’t do, and what practical steps still fall to us.

This article covers the law itself, Australia’s online content rules, what VPNs are and why kids use them, and what you can do at home to support the intent of the legislation.

Australia’s Under-16 Social Media Ban: What the Law Actually Says

The Online Safety Amendment (Social Media Minimum Age) Act 2024 passed the Australian Parliament in November 2024. It bans children under 16 from holding accounts on “age-restricted platforms” — a defined category that covers the major social media services most Australian kids are already using.

The burden is on platforms, not parents or children

Under the Act, platforms must take “reasonable steps” to verify that users are 16 or older before allowing them to create an account. The legal responsibility sits with the companies, not with families. Children who find their way onto a platform are not criminalised — they won’t be fined or punished. The law’s enforcement mechanism targets the platforms themselves, with fines of up to $50 million for systemic non-compliance.

Which platforms are affected?

The exact list of age-restricted platforms is to be confirmed by the eSafety Commissioner, but the legislation is expected to cover:

  • TikTok
  • Instagram
  • Facebook
  • Snapchat
  • X (formerly Twitter)

Messaging-only services and platforms used primarily for education are expected to be exempt. YouTube sits in a grey area — rather than a blanket ban on under-16s, YouTube is expected to face rules around algorithmic recommendations and autoplay for minors, rather than a prohibition on account creation.

How will age be verified?

This is the part still being worked out. Age verification methods under consideration include government ID checks and third-party age verification services. The Australian government has flagged interest in “age assurance” approaches — methods that can confirm someone is over a threshold age without necessarily requiring platforms to store copies of identity documents. The technical implementation details are still being finalised, and the system will take time to bed in.

Existing accounts and the transition period

The law applies primarily to new account creation. Enforcement will take time to roll out, and the practical reality is that many children will continue to access platforms during the transition period. Parents shouldn’t assume the law has already solved the problem.

The value of the law is in raising the barrier and shifting legal responsibility to platforms — not in creating a perfect technical blockade overnight.

Australia’s Online Content Classification System

Separate to the social media age ban, Australia has a National Classification Scheme covering films, video games, and increasingly online content. You’ll recognise the ratings: G, PG, M, MA15+, R18+, and X18+. These have existed for decades for physical media and cinema, but the online world has long operated largely outside them.

The eSafety Commissioner has powers to require the removal of certain categories of illegal and harmful online content — including child sexual abuse material, pro-terror content, and non-consensual intimate images. Australia is also in the process of extending classification requirements to streaming services and online video, meaning platforms like Netflix and Stan are increasingly expected to apply the same content ratings as cinema releases.

Most online content — social media posts, YouTube videos, general websites — is not classified. The classification scheme primarily applies to commercial content like games and streaming films. The broader internet remains largely unrated territory, which is part of why the eSafety Commissioner’s role has expanded so significantly in recent years.

What Is a VPN — and Why Do Kids Use Them?

VPN stands for Virtual Private Network. In plain English: a VPN is like a tunnel for your internet traffic.

Normally, when your child’s device connects to a website, the request goes directly from your home to that site’s servers — and the site can see the request is coming from an Australian IP address. A VPN routes that traffic through a server somewhere else first — often in another country. To the website, it looks like the connection is coming from wherever that server is located.

Here’s why kids use them:

  • To bypass school or home network filters. If your home router is running DNS-based content filtering, a VPN can route around it entirely.
  • To access content not available in Australia. Some streaming libraries, games, and platforms have different content available in different regions.
  • To appear to be connecting from outside Australia if platforms implement age verification only for Australian IP addresses.
  • To hide browsing activity from parental controls and router-level monitoring.

How easy are VPNs to get?

Very easy. Many VPN apps are free, available directly from the App Store and Google Play, and carry names that don’t obviously signal what they do. Some are marketed as “privacy” or “security” tools. A child who knows what to search for can have one installed and running in under five minutes.

Can a VPN Bypass the Under-16 Social Media Ban?

It depends on how platforms implement the law.

A VPN by itself does not change a user’s age. If a platform’s age verification requires users to submit documentation confirming they are 16 or over — a government ID, a credit card, a biometric check — a VPN does nothing to help. The platform still sees a user who can’t prove their age.

However, if platforms take a simpler approach and restrict account creation only for users connecting from Australian IP addresses, a VPN routing traffic through an overseas server could potentially allow an Australian child to appear to be connecting from another country — and sidestep the verification requirement entirely.

The more robust and identity-based the age verification, the less effective VPN workarounds will be. The weaker and geography-based the verification, the more easily it can be circumvented.

Australia is not the first country to attempt these kinds of restrictions. Similar laws in other jurisdictions have consistently seen tech-savvy teenagers find workarounds. Regulators are aware of this. The goal of the legislation isn’t to create an impenetrable wall — it’s to raise the barrier meaningfully and ensure platforms can no longer claim there is nothing they can do.

What Can Parents Do About VPNs?

Check devices for VPN apps

  • iPhone/iPad: Go to Settings and look for a VPN section near the top. You can also search “VPN” in the Settings search bar.
  • Android: Go to Settings → Network & Internet → VPN (exact path varies by device). Also check the installed apps list for anything unfamiliar.

Use router-level filtering that blocks VPN traffic

Some DNS-based filtering services — including CleanBrowsing’s family filter — are designed to block known VPN endpoints and proxy services as well as adult content. It’s not perfect, but it adds meaningful friction. See our router settings guide for how to set this up.

Control which apps can be installed

If a child can’t install new apps without parental approval, they can’t easily install a VPN.

  • Apple Screen Time (Settings → Screen Time → Content & Privacy Restrictions → iTunes & App Store Purchases) lets you require a passcode for all app installations.
  • Google Family Link allows parents to approve or block app downloads on Android devices.

Note: a device on mobile data bypasses your home router entirely — device-level controls matter alongside router controls.

Have the conversation

A teenager who understands why certain restrictions exist — what the evidence says about social media and adolescent wellbeing, what the platforms’ business models actually are — is far more likely to respect those limits than one who sees them as arbitrary obstacles. It’s also worth acknowledging honestly: VPNs have legitimate uses for privacy and security. The issue isn’t VPNs themselves — it’s the specific context of using one to sidestep parental controls or age restrictions.

A Note on Age Verification and Privacy

Age verification that requires government-issued ID raises legitimate questions: Who holds that data? How is it stored? Could it be breached? Any system that requires millions of Australian children to upload identity documents to third-party services creates a new category of sensitive data — and a new category of risk.

The Australian government has flagged “age assurance” approaches that don’t require storing or transmitting identity documents. This debate is ongoing and the final implementation details have not been confirmed at the time of writing. Be cautious about any third-party age verification service asking your child to submit identity documents, and check the privacy policy carefully. The eSafety Commissioner’s website at esafety.gov.au is the best place to monitor how the framework develops.

The Bottom Line

Australia’s under-16 social media law is a genuine step forward. For the first time, the platforms themselves bear legal responsibility for keeping young children off their services — rather than that responsibility falling entirely on parents.

But technology has always created workarounds, and it always will. The most resilient protection you can give your child isn’t a router setting or a piece of legislation — it’s a relationship in which they feel comfortable coming to you when they see something online that troubles them, and a set of critical thinking tools that help them navigate what they encounter.

The law raises the floor. The conversation is what builds the ceiling.

For the latest information on the eSafety Commissioner’s implementation of the age assurance framework, visit esafety.gov.au. For children needing to talk to someone, Kids Helpline is available 24/7 on 1800 55 1800.