Australia's attempt to bar under-16s from social media has run into a problem no amount of regulatory bluster can hide: teenagers simply kept logging on. Months after the restriction took effect, the country's eSafety Commissioner is reportedly preparing legal action against five major platforms - Facebook, Instagram, TikTok, Snapchat and YouTube - accusing them of failing to enforce a law that regulators themselves struggled to make workable.
A Policy Built on Shaky Enforcement
The premise behind Australia's ban was straightforward: remove minors from platforms believed to harm their wellbeing, and do so through age verification requirements imposed on the companies. In practice, enforcing an age barrier online is far harder than legislating one. Verification systems can be bypassed with false birthdates, borrowed identities, or alternate accounts, and determined teenagers have no shortage of technical workarounds. Reports suggesting that youth engagement on these platforms has not dropped - and may have even risen - point to a basic mismatch between the law's ambitions and the tools available to enforce it.
Communications Minister Anika Wells has framed the shortfall as corporate noncompliance rather than policy failure, arguing that platforms possess the means to identify underage users and simply are not doing enough. Meta has pushed back on that narrative, pointing to its removal of hundreds of thousands of suspected underage accounts as evidence of good-faith enforcement. The dispute now appears headed for the Federal Court, where Australian regulators will need to prove not just that teens are present on these platforms, but that the companies failed a legal standard of care in keeping them off.
Why VPNs Complicate the Picture
Age-verification mandates rely on an assumption that a user's location and identity can be reliably established. Virtual private networks undermine that assumption by routing traffic through servers in other jurisdictions, masking a device's true location and making geographic or regulatory restrictions far easier to sidestep. A teenager blocked from signing up because of an Australian IP address can, with a VPN, appear to be connecting from a country with no such restriction at all.
This is not a new phenomenon. VPNs were originally built for secure remote business access and have since become a mainstream privacy tool, valued by journalists, activists, and ordinary users wary of surveillance or data collection. Their use by minors to evade content restrictions is a side effect of a technology designed for a different purpose: protecting the confidentiality of internet traffic through encryption and tunneling protocols, not facilitating rule-breaking. But that same privacy-preserving architecture makes VPNs uniquely resistant to jurisdiction-based enforcement, a tension regulators in Spain and Indonesia have also encountered as they roll out comparable youth restrictions.
What a Court Fight Would Actually Settle
A lawsuit against the five platforms would not resolve the underlying technical reality that identity and age are difficult to verify online without invasive data collection. What it could do is establish a legal precedent for how much responsibility platforms bear when users - minors included - route around restrictions using widely available privacy tools. That question has implications well beyond Australia, since governments from Europe to Southeast Asia are watching to see whether courts will treat VPN circumvention as a platform failure or an unavoidable limitation of internet architecture.
There is also a digital rights dimension that regulators may be underestimating. VPNs are legal in most democracies and serve legitimate privacy and security functions for users of all ages. A legal strategy that treats their use as evidence of corporate negligence risks setting a precedent that pressures platforms toward more invasive identity verification for everyone, not just minors - a trade-off that could erode privacy protections far beyond the policy's original target.