Nobody in Canberra has stood up and said “we’re banning VPNs.” They don’t have to. If you’ve watched how this government operates, you already know where this is heading.
The under-16 social media ban kicked in back in December. TikTok, Instagram, Snapchat, YouTube, all of them now have to take “reasonable steps” to keep kids off, or cop fines up to $49.5 million. Fine. Whatever you think of the policy, that’s the law now.
Buried in the eSafety Commissioner’s guidance, those “reasonable steps” include detecting and restricting VPNs. So the platforms are now legally on the hook to stop people using one. They’re told to blacklist VPN IP addresses, watch traffic patterns for Australians pretending to be overseas, and use location signals to sniff out anyone who looks like they’re really in Brisbane while claiming to be in Auckland.
TechRadar asked the obvious question, which is how a platform is meant to do that without breaking VPNs for everyone. The Commissioner’s office declined to comment. The “how” was never their problem. They set the expectation, dangled the fine, and walked off.
This is how you ban something without banning it. No bill, no debate, no vote anyone can be blamed for. You just write it into guidance, point the fines at a few companies, and let them do the dirty work of breaking VPNs so you never have to.
The funny part is VPNs were never what the kids were using in the first place.
The surveys since December are embarrassing. Over 60% of teens who had accounts before the ban still have access to at least one platform. Around 70% of the ones still getting through say it was easy. And the share using a VPN to do it?
Four to five percent.
That’s it. The rest are borrowing mum’s ID, using an old adult account, or holding a photo up to a face scanner that genuinely cannot tell a 15yo from a 17yo. The VPN crowd is a rounding error, which makes you wonder why they’re the ones getting named in the guidance.
It’s because the ban isn’t working and admitting that is off the table. So you bolt another control on top to look like you’re getting serious. The thing leaks like a sieve, so we’ll loudly plug one of the smallest holes and call it enforcement.
If you want to see where this actually ends up, just look at the UK. They started a year before us.
Britain switched on age verification last July. Within a day, VPN signups went absolutely vertical. Proton reported sustained daily increases of 1,400% and higher, the sort of spike they said they normally only see during civil unrest. An entire country of adults got told they’d have to upload their ID or scan their face to read a forum, and collectively went “nah, I’ll route through Switzerland.”
The UK government’s response to that was not to back off. Ministers now keep saying VPNs will stay legal, while in the same breath openly floating the idea of age-gating access to the VPNs themselves. Once you’ve decided a ban only counts if people can’t get around it, you’re locked into going after the thing they use to get around it. There’s no comfortable middle ground between “we asked platforms to detect VPNs” and “prove you’re 18 to install one.” The first one already contains the second. It just takes a year of the numbers humiliating everyone to get there.
We don’t even need to look overseas. Australia has been running this exact play for years.
Remember Stephen Conroy’s internet filter? Back in 2008 the government wanted a mandatory ISP-level filter, sold to us as protecting kids from child abuse material and other illegal content. Who could possibly be against that? Except the moment anyone looked at the secret blacklist, it had a dentist’s office, a tuckshop, and a bunch of perfectly legal sites on it. The thing was technically useless and trivial to get around, and after four years of pretending otherwise the government quietly killed it in 2012. The talking points never changed though. It was always about the children.
Then there’s the Assistance and Access Act in 2018, the anti-encryption law. Same playbook. Justified partly on stopping the sexual exploitation of children and terrorism, rammed through both houses in under a week, days before Christmas, while every security expert in the country was yelling that you cannot build a backdoor only the good guys can use. Doesn’t matter. It passed. And the warning was the same one I’m about to make about VPNs, because it’s the same problem wearing a different hat.
A VPN is not a teenager’s toy.
It’s how a journalist talks to a source. It’s how someone in a dodgy household reads something private. It’s the bare minimum you should be running on hotel wifi. It’s how half the country connects to work. Treating it as primarily a thing 14yos use to sneak onto TikTok is just wrong, and anything you do to break VPNs for the kids breaks them for the nurse, the contractor, and the bloke checking his bank balance at the airport. The technology can’t tell those people apart. That’s not a bug you can engineer around. You can’t weaken a privacy tool for some people and leave it intact for everyone else.
I’m not even saying kids should be glued to Instagram. I get why parents feel like they’re losing the plot. But going from “this is a problem” to “the state will lean on companies to break the tools people use to protect themselves” is a massive leap, and we made it barely putting up a fight, on the back of a policy the government’s own data says doesn’t work.
And this was never just about social media. Strip away the kids and the panic about TikTok and look at what a VPN actually does. It beats all of it at once. The social media age check, the porn age-gates the UK is rolling out, the old site filter, the encryption backdoor. Doesn’t matter what wall they build, a VPN goes straight over it. That’s the entire point of the thing. Which is exactly why every government that wants real control eventually comes for it.
China worked this out years ago. Unauthorised VPNs have been illegal there since 2017, and the only legal ones are state-approved, so they log everything and hand it to Beijing. The Great Firewall is useless if people can just tunnel under it. So they made the tunnel illegal. That’s the whole model in one move.
And we love pointing at China. The Firewall, the surveillance, the social credit stuff, our politicians will happily call it a dystopia on a Tuesday. The same people cannot roll out age verification, site blocking and VPN detection fast enough. They want the exact machinery they keep condemning. They just want to call it child safety instead of stability and bet that nobody clocks it’s the same gear.
Australia’s own Human Rights Commission said the ban “normalises broad-based age checks … and creates vast new datasets about how we live and interact, all just to prove we’re old enough to be on social media.” That’s the surveillance, described in the brochure. We didn’t dodge the Chinese model. We’re building a politer copy of it and feeling good about ourselves because we did it for the children.
So watch the language over the next year. It won’t show up as “Australia bans VPNs,” because that polls like a dead fish and it’s the kind of thing we’d happily mock China for. It’ll show up as platforms being expected to do more. Reasonable steps getting a little less reasonable. A line in some future guidance about making sure VPN users aren’t minors.
The ban already exists. They’re just building the machine to make it mean something. And your privacy is standing right where the machine wants to go.