On 9 September 2026, the last and least discussed piece of Australia’s age verification system clicks into place : the app stores themselves. From that date, app distribution services — the Apple App Store, Google Play and comparable stores — must have age assurance in place before enabling downloads of 18+ apps.
This front is different from every other one, and most guides get it wrong : app store checks do not hang on your IP address. They hang on your account. That changes what a VPN can do, what it cannot, and what actually works — which is exactly what this guide covers.
What changes on 9 September 2026?
From 9 September 2026, app distribution services operating in Australia must implement age assurance before allowing downloads of apps classified 18+. The obligation comes from the Phase 2 Age-Restricted Material Codes registered by the eSafety Commissioner, which have applied to other service types since 9 March 2026 — app stores are the final deadline in the sequence.
What the stores must actually do
The codes are technology-neutral : stores choose their own measures, as long as they are accurate, robust, fair and reliable. The accepted examples are facial age estimation, photo ID matching and credit card checks. Self-declaration — the age you typed when creating the account years ago — is explicitly not sufficient in isolation.
In practice, expect the checks to surface at two moments : when downloading an app classified 18+, and progressively when the store re-evaluates the age attached to an existing Australian account.
Which apps are affected
Anything the store classifies 18+ : adult content apps, gambling, dating apps with explicit sections, and — following the AI chatbot codes — companion apps capable of explicit output. The classification belongs to the store, which means the list can widen without any change in law.
Why a VPN alone does not move your App Store
Here is the part most articles skip. Your Apple App Store and Google Play region is a property of your account, set by the country of your payment method and billing address. Connect to a Singapore server and open the App Store : you still see the Australian store, because Apple reads your account, not your IP.
That means the honest answer has two parts. For checks that trigger on location — websites, streaming, geo-blocked services — a VPN is the whole solution. For the store itself, the VPN is one half ; the other half is the account region.
Changing your account region: what it takes
Both Apple and Google allow a region change, with conditions : outstanding balances spent, subscriptions cancelled, and a payment method valid in the new country. Google Play additionally limits changes to once per year. It is a real decision, not a toggle — existing app licences and store credit can be affected.
The practical combination for those who go that route : set the account to the new region while connected through a matching VPN server, and keep the two aligned afterwards. A mismatch between account region and visible location is the most common cause of store errors.
The simpler routes most people should try first
Before moving an account, two lighter options cover most cases. First, the browser : many 18+ services are websites as well as apps, and the web version answers to your IP — which a VPN controls — rather than your store account. Second, on Android, direct APK installation from the developer sidesteps the store entirely for apps that offer it.
- Subscribe to Surfshark — from AU$3.29/month, 30-day money-back guarantee.
- Connect to New Zealand, Singapore or the UK.
- Use the service in the browser — the web version follows your IP, not your store account.
- On Android, check whether the developer offers a direct APK download.
- Only if the app itself is essential: consider the account-region change described above, VPN aligned.
Rule of thumb: IP-based checks answer to the VPN, account-based checks answer to the account. Knowing which one you are facing saves an hour of wrong troubleshooting.
What the store checks collect
The store deadline moves verification to the most central chokepoint yet. A website check covers one site ; a store check sits in front of every 18+ app on your phone, tied to the account that also holds your payment cards, purchase history and device list.
The exposure math is familiar : photo ID transmits name, date of birth and document number in one upload, facial estimation can run on-device depending on implementation, and credit card checks link age to financial identity. What is new is the aggregation — all of it lands next to an account profile that already knows more about you than any single website does.
The browser route is therefore also the privacy route : the check never triggers, and nothing new attaches to the account.
The best VPNs for the browser route
The VPN carries the browser route and the aligned-region setup, so pick for Oceania coverage. Tested this month; prices verified 23 August 2026.
Surfshark — best value, unlimited devices
From AU$3.29/month with no device limit — phone, tablet and laptop on one plan. Solid Auckland and Singapore servers, plus CleanWeb ad filtering. Get Surfshark here.
NordVPN — deepest regional bench
Around 9,200 servers in 129 countries with strong Oceania capacity. From AU$4.09/month; Deloitte-audited no-logs policy (February 2026). Get NordVPN here.
ExpressVPN — most consistent on NBN
Exceptionally stable speeds on Australian connections and a genuinely easy router app for whole-home coverage. Currently 80% off with 4 months free. Get ExpressVPN here.
Is any of this legal?
Using a VPN is legal in Australia, full stop. Changing your app store account region is a settings choice both Apple and Google expose — it can conflict with store terms of service, which is a contractual matter with the platform, not a legal one. The age assurance obligations and the AU$49.5 million penalties are written for the stores and platforms, not for users.
Frequently asked questions
Does the 9 September deadline affect existing installed apps?
The obligation covers enabling downloads of 18+ apps. Already installed apps are not retroactively removed, but updates and re-downloads can trigger the check.
Will Apple and Google use the same method?
Not necessarily. The codes are technology-neutral — each store picks its own measures, as long as they are accurate, robust, fair and reliable. Expect different flows on iOS and Android.
Can a VPN change my App Store region?
No. Store region is an account property set by your payment method and billing address. A VPN controls what websites see — for the store itself you would need an account-region change.
Is the browser version really equivalent to the app?
For most services, functionally yes — and the web version answers to your IP rather than your store account, which puts it back in VPN territory. Push notifications and some device features are the usual trade-off.
Is sideloading APKs on Android safe?
Only from the developer’s own site — never from mirror repositories. Check the download over HTTPS and prefer apps that publish signatures. Sideloading trades the store’s vetting for independence; treat it accordingly.
How often can I change my Google Play country?
Once per year, and you need a payment method valid in the new country. Apple has no fixed cooldown but requires balances spent and subscriptions cancelled first.
Is bypassing the store check illegal for adults?
No. The obligations target the stores. An adult using the browser, an APK or another region satisfies the condition the rule exists to enforce.
Final thoughts
The app store deadline is the quiet endpoint of Australia’s system : once the stores gate 18+ downloads, every other check has a backstop. It is also the first check that a VPN alone does not solve — which makes the browser route, and knowing the IP-versus-account distinction, more valuable than any single tool.
The setup that covers the most ground : Surfshark for every IP-based check and the browser route, and the account-region decision saved for the rare app that has no web equivalent.
📖 The full picture of Australia’s three-front system : our Australia age verification guide. The AI side is covered in the AI chatbot age checks guide.
Sources
- eSafety Commissioner — regulatory guidance and age assurance deadlines
- eSafety Commissioner — Phase 2 Online Safety Codes
- eSafety — Overview of the Phase 2 Industry Codes (PDF)
Last updated: 23 August 2026
I’m on the road about half the year, watching what people actually turn a VPN on for — opening a banking app from back home, finding an online course cheaper abroad, catching a match free on a public broadcaster but paywalled at home, sometimes just the news without a filter. The guides here come from those notes — translated whenever the topic matters elsewhere.