Australia Age Verification and VPNs: Is a VPN Legal?

Is a VPN legal in Australia?

Yes. No Australian law bans buying, installing or using a VPN. The two laws behind the country’s age checks do not change that.

The first is the Online Safety Act 2021. It regulates online services and lets the eSafety Commissioner register industry codes that bind them. The rules on codes are in Part 9, sections 137 to 147. The second is the Online Safety Amendment (Social Media Minimum Age) Act 2024. It adds Part 4A, which puts duties on “age-restricted social media platforms”.

On 31 October 2026 we read the text of the amending Act as made. It does not mention VPNs, and every obligation and penalty in it falls on a platform. The age-restricted material codes that started on 9 March 2026 work the same way. They require pornography sites, app stores and other services to apply age assurance, which means checking or estimating a user’s age. ABC News reported maximum penalties of up to A$49.5 million for the services that fail to do so. No provision we could find creates an offense for an adult who connects through a VPN.

A VPN changes where you appear to be connecting from. Some sites apply their check only to Australian visitors, and some have blocked Australian visitors altogether. Both will usually treat a connection from a foreign server as foreign. That is why VPN downloads nearly tripled in the days before the deadline. For an adult this is lawful. It may still breach a site’s terms of service, and it does nothing against checks tied to an account.

What changed

Two separate sets of rules arrived three months apart, and they are often confused.

Under-16 social media accounts, from 10 December 2025. The Social Media Minimum Age Act received Royal Assent on 10 December 2024 and commenced the next day. It defines an “age-restricted user” as “an Australian child who has not reached 16 years”. Section 63D requires a provider of an age-restricted social media platform to “take reasonable steps to prevent age-restricted users having accounts”. The civil penalty is 30,000 penalty units.

Section 63E left the start date to the Minister, “not later than 12 months after” commencement. The obligations began on 10 December 2025. Section 63DB stops a platform from relying only on government-issued identification or the Digital ID system. It must offer “alternative means” that are “reasonable in the circumstances”. On 16 January 2026 the Prime Minister reported “more than 4.7 million under-16 accounts already deactivated, removed or restricted”. That was a preliminary figure from the first information given to eSafety.

Age-restricted material codes, from 9 March 2026. These are industry codes registered by eSafety under the Online Safety Act. They are often called the Phase 2 codes. The search engine code started first, on 27 December 2025. According to Professor Lisa M. Given of RMIT, writing in The Conversation, search engines must blur pornographic and violent results for logged-out users. They must also filter adult content for account holders under 18, with age assurance for account holders required by 27 June 2026.

The remaining codes commenced on 9 March 2026. ABC News summarized them that day:

• Pornography websites must ask users to confirm their age.
• Social media services that allow pornography or self-harm material must ensure users are 18 or older.
• App stores must prevent under-18s buying or downloading R18+ apps.
• Online gaming platforms must use age assurance for R18+ games.
• AI companion chatbots that can generate sexually explicit material must confirm users are adults.

The codes do not prescribe a single method. Services must use systems they manage themselves that meet Australian privacy law. The methods discussed in the ABC and Conversation coverage are facial age estimation, digital wallets and photo ID.

What the codes say about VPNs. eSafety’s website refused our direct requests on 31 October 2026, with HTTP 503 errors and dropped connections. So we could not read the code texts themselves.

Through a search index of esafety.gov.au, we could read eSafety’s FAQ on access to online pornography. It says service providers are expected to detect whether a user is using a VPN. One example it gives is integrating VPN-detection services and IP-intelligence APIs that flag and restrict high-risk address ranges. The FAQ also says the codes do not require any specific age-assurance method or government ID.

eSafety’s media release of 9 March 2026 confirms that the remaining Age-Restricted Material Codes commenced that day. It cites civil penalties of up to $49.5 million for breaching a direction to comply. An earlier release, on registering three codes, gives the search-engine code’s commencement as 27 December 2025. It gives 27 June 2026 as the date age assurance for logged-in users was due. We will quote the code texts directly once the site answers again.

The ABC’s summary on commencement day does not mention VPNs. The two Conversation articles we read say only that children “may also use VPNs to get around the restrictions” and that “people of all ages can still use VPNs”. The Act, which we did read in full, says nothing about them.

The withdrawal of major adult sites. Reuters reported that the Aylo group “restricted access to our platforms in a number of locations” in the days before 9 March 2026. Aylo cited “ineffective and haphazard age verification laws”. It had already done the same in France, the UK and a number of US states.

What a VPN changes, and what it does not

A VPN swaps your IP address for the server’s. Your IP address is the number websites see for your connection. A VPN also encrypts the traffic between your device and that server. Some site-level checks are keyed to Australian IP addresses, and some sites have blocked Australian addresses. With a foreign server, that check or block is not applied. That is the whole of what a VPN does for age verification.

It does not change the law that applies to you. It does not affect a check that a service applies to every visitor, wherever they are. It does not change what a social media platform already knows about an account. The minimum age rules work at account level, through the “reasonable steps” a platform takes using the signals it holds. So switching your apparent location does not alter an account’s assessed age.

It does not change the age category an app store has recorded. App store checks under the codes happen before any website is visited. And a service whose terms forbid evading its checks can suspend an account. For an adult, that contractual risk is the practical exposure, not a legal one.

The download charts carry one more warning. Tom’s Guide reported on 9 March 2026 that Sensor Tower data put NordVPN at number 15 on the Australian App Store’s overall free chart. It also reported that suspicious free apps were climbing alongside it. Tom Sulston of Digital Rights Watch told the outlet that “there have been instances of free VPNs being worse for users’ privacy as they capture more browsing data to sell adverts”. Our best VPNs for privacy page explains what to check before trusting one. The what is my IP tool shows what a site sees.

Enforcement so far

Enforcement to date has targeted platforms and sites. The only official figures we could load are the Prime Minister’s. More than 4.7 million under-16 accounts were deactivated, removed or restricted within weeks of 10 December 2025. The release adds that eSafety continues “to closely monitor platforms to assess their compliance”.

Under the March 2026 codes, the ABC’s report on commencement day named no enforcement action. We found none reported in the sources we could read. eSafety’s own newsroom and compliance updates refused our requests on 31 October 2026. So we cannot say whether any penalty has since been imposed.

The visible effect of the codes has been commercial rather than punitive. The largest adult-site operator withdrew from Australia, and VPN downloads rose. Reuters reported Apptopia figures of 28,722 downloads on 8 March 2026, against about 10,000 a day the previous week. Three of the ten most-downloaded free apps on Apple’s chart on 10 March 2026 were VPNs. No enforcement action has been reported against a VPN provider or a VPN user, and we found no legal basis for one.

What could change next

Three things are scheduled or plausible.

First, the codes phase in. The search engine code’s age assurance for account holders was due on 27 June 2026. Later-starting measures in the other codes follow their own dates. We could not confirm those dates because eSafety’s register did not load.

Second, the under-16 rules are being tested in practice. The government has said eSafety is studying the platforms’ data. Any enforcement decision against a platform would be the first under Part 4A.

Third, the UK decided in July 2026 to make social media companies detect and prevent VPN use by under-16s. That is the kind of measure that could be copied. Nothing of the sort has been proposed in Australia as of 31 October 2026, and nothing proposed anywhere touches adult VPN use.

We re-check this page at least every 30 days and record each development in the timeline above.

Related

• VPN laws and age-verification tracker
• Age verification and VPNs: the global picture
• Is a VPN legal in the UK?
• Age verification laws by state
• Best VPNs for privacy
• Best VPNs for age verification