Australia has quietly built the most aggressive age verification regime in the world. While the UK argues about one law and Germany fights over DNS blocks, Australia is running three fronts at once : an under-16 social media ban with active investigations into five major platforms, industry codes that already cover search engines and AI chatbots, and — from 9 September 2026 — age assurance inside the app stores themselves.
Each front works differently, and each has different implications for what a VPN can and cannot do. This guide maps the whole system : what is in force today, what lands next month, which services complied, which withdrew from the country entirely — and where the practical workarounds sit.
Is age verification mandatory in Australia?
Yes, on multiple fronts. Since 10 December 2025, social media platforms must take reasonable steps to keep under-16s off their services. Since 9 March 2026, the Age-Restricted Material Codes require age assurance across a wide set of online services, with search engines covered since 27 June 2026 and app distribution services required to comply by 9 September 2026.
What you actually run into
The experience depends on the service. Social platforms ask for age signals at signup and increasingly re-check existing accounts. Adult sites either verify, geo-block Australia, or — like Pornhub — have been withdrawn by their owners. AI companion apps capable of explicit output must confirm you are 18 before serving that material : Character AI built the check in, while Chub AI simply switched Australia off.
The accepted methods are the familiar trio : facial age estimation, photo ID matching, and credit card checks. Self-declaration — ticking a box — is explicitly not enough on its own.
The three fronts at a glance
| Front | In force since | Who it hits | Status |
|---|---|---|---|
| Under-16 social media ban | 10 December 2025 | 10 designated platforms | Investigations open into Facebook, Instagram, Snapchat, TikTok and YouTube |
| Age-Restricted Material Codes | 9 March 2026 | Adult content, AI chatbots, then search (27 June) | Live and enforceable |
| App store age assurance | 9 September 2026 | Apple App Store, Google Play and other app distributors | Deadline in weeks |
Getting around Australian age checks in 5 steps
Most Australian checks trigger on your IP address : an Australian connection gets the Australian rules. Surfshark moves you outside that perimeter in seconds — though for app stores the story is more complicated, as covered below.
- Subscribe to Surfshark — from AU$3.29/month on the two-year plan, 30-day money-back guarantee.
- Install the app — Windows, macOS, iOS, Android, plus browser extensions.
- Connect to New Zealand, Singapore or the UK — low latency from Australia and no equivalent regime for the service you are using.
- Clear cookies and cache — services remember your Australian session locally, and that memory survives the IP change.
- Open the service — sites that gate by location stop asking; withdrawn services like Chub AI come back.
One caveat the other guides skip: app store age checks attach to your Apple or Google account region, not your IP. A VPN alone does not move your App Store — the account section below explains what actually does.
The law behind it: one act, two waves of codes
The framework rests on the Online Safety Amendment (Social Media Minimum Age) Act 2024 and the Phase 2 industry codes registered by the eSafety Commissioner. Between them they cover more ground than any other national regime.
The under-16 ban and the first investigations
Since the ban took effect, eSafety has issued 23 compulsory information-gathering notices to the 10 designated platforms and published a compliance update in March 2026 that found widespread gaps. The consequence followed in mid-2026 : formal investigations into Facebook, Instagram, Snapchat, TikTok and YouTube for suspected non-compliance. Civil penalties run up to AU$49.5 million per breach.
The codes: adult content, AI, search, app stores
The Phase 2 codes extend age assurance well beyond social media. Adult content services must verify or block. AI companion chatbots capable of sexually explicit, high-impact violent or self-harm material must confirm users are 18 before serving it. Search engines have applied age assurance since 27 June 2026, and app distribution services must gate 18+ app downloads from 9 September 2026.
Comply, verify or leave: how services responded
The market has split three ways, exactly as it did in France and Germany. Some services built the checks — Character AI added age assurance and removed the chat function from its under-18 experience. Some withdrew — Chub AI geo-blocked Australia entirely, and Aylo pulled Pornhub, a story we cover in our Pornhub in Australia guide. And some are betting on the courts, as the five platforms under investigation appear to be.
What the verification actually collects
The accepted methods do not expose you equally, and the codes leave the choice to each service — not to you.
Photo ID matching transmits far more than your age : full name, date of birth, document number, sometimes address, all in one upload. Facial age estimation processes biometric data but can run on-device without the image leaving your phone, depending on implementation. Credit card checks tie the verification to your financial identity. Every third-party verifier added to the chain is one more place a copy can leak from — and the documented breaches of recent years almost all started at subcontractors.
Three habits limit the exposure : prefer on-device facial estimation where offered, ask who processes the image and for how long, and keep a separate email address for accounts that require verification. A VPN works one step earlier — where no check triggers, no data exists.
The best VPNs for Australia
Distance is the technical constraint : Australia is far from everywhere, and a badly chosen server doubles your latency. The picks below have strong Oceania and Southeast Asia coverage, tested this month; prices verified 23 August 2026.
Surfshark — best value, unlimited devices
From AU$3.29/month on the two-year plan with no device limit. Servers in Sydney, Melbourne, Perth, Auckland and Singapore keep latency low, and CleanWeb strips ads and trackers. Get Surfshark here — 30-day money-back guarantee.
NordVPN — fastest across the Tasman
Around 9,200 servers in 129 countries, with deep Auckland and Singapore capacity — when one server fills, ten more wait in the same city. From AU$4.09/month; no-logs policy audited by Deloitte in February 2026. Get NordVPN here.
ExpressVPN — the consistency pick
Fewer servers but exceptionally reliable unblocking and consistently strong speeds on Australian NBN connections. Currently 80% off with 4 months free on the two-year plan. Get ExpressVPN here.
| Criteria | Surfshark | NordVPN | ExpressVPN |
|---|---|---|---|
| Best for | Value, whole household | Speed under load | Reliability on NBN |
| Price | From AU$3.29/mo | From AU$4.09/mo | 80% off + 4 months |
| Servers / countries | ~3,200 / ~100 | ~9,200 / 129 | Fewer, consistent |
| Devices | Unlimited | 10 | 8 |
| Standout | CleanWeb filter | Deloitte audit Feb 2026 | NBN speed |
| Guarantee | 30 days | 30 days | 30 days |
| Visit site | See Surfshark → | See NordVPN → | See ExpressVPN → |
Is using a VPN legal in Australia?
Yes. No Australian law restricts personal VPN use, and the age assurance obligations sit with the platforms, not with you. eSafety itself has acknowledged that the under-16 framework targets what services must do — the penalties, up to AU$49.5 million, are written for platforms, not users.
An adult bypassing an age gate satisfies the substantive condition the law protects. The open question in Australia — as in the UK before it — is whether platforms will be pushed to detect circumvention themselves. The UK examined and rejected a VPN ban, as our UK VPN ban analysis covers.
Frequently asked questions
Which platforms are under investigation?
eSafety has opened formal investigations into Facebook, Instagram, Snapchat, TikTok and YouTube for suspected non-compliance with the under-16 minimum age obligation, after 23 information notices and a critical March 2026 compliance update.
What happens on 9 September 2026?
App distribution services — the Apple App Store, Google Play and comparable stores — must have age assurance in place before enabling downloads of 18+ apps. It is the last of the Phase 2 code deadlines.
Are AI chatbots really covered?
Yes. AI companion chatbots capable of sexually explicit, high-impact violent or self-harm material must confirm users are 18 before serving it. Character AI complied; Chub AI geo-blocked Australia instead.
What counts as acceptable age assurance?
Facial age estimation, photo ID matching and credit card checks are the accepted examples. Self-declaration — ticking an “I am 18” box — is explicitly insufficient on its own.
Does a VPN get around all of it?
For IP-based gates — most websites and withdrawn services — yes. For app store checks, no: those attach to your Apple or Google account region, which a VPN alone does not change.
Is bypassing an age gate illegal for adults?
No. The obligations and penalties target platforms. An adult routing around a check satisfies the condition the law exists to enforce.
Which VPN server country works best from Australia?
New Zealand and Singapore for latency, the UK when you specifically want a market without the Australian rules for the service in question. Avoid US servers unless needed — the distance shows.
Final thoughts
Australia is the test case the rest of the world is watching. No other country runs enforcement on social media, adult content, AI chatbots, search and app stores simultaneously — and no other regulator has moved from law to formal investigations this fast.
For adults, the practical picture splits in two. IP-based checks respond to a VPN : Surfshark covers the household at the lowest price, NordVPN has the deepest server bench in the region. Account-based checks — the app stores — need the account-region approach covered in our dedicated guides below.
📖 The deep dives : app store age verification from 9 September, AI chatbot age checks, the under-16 social media ban and Pornhub’s withdrawal.
Sources
- eSafety Commissioner — social media age restrictions
- eSafety Commissioner — Online Safety Codes and Standards (Phase 2)
- eSafety — new industry codes covering AI companion chatbots
- eSafety — regulatory guidance on age assurance deadlines
Last updated: 23 August 2026
I’m on the road about half the year, watching what people actually turn a VPN on for — opening a banking app from back home, finding an online course cheaper abroad, catching a match free on a public broadcaster but paywalled at home, sometimes just the news without a filter. The guides here come from those notes — translated whenever the topic matters elsewhere.