Australia’s online safety regulator is looking beyond whether adult websites show an age gate and toward whether people can dodge those gates with a VPN. That shift matters because virtual private networks are not exotic contraband. They are ordinary privacy and security tools, used to hide traffic from local networks, internet providers and some forms of tracking.
The eSafety commissioner said nine in 10 of the most visited adult sites used by Australians now have age checks in place, according to the Guardian. The regulator also said it would assess whether those sites allow users to get around restrictions through virtual private networks.
Under the relevant codes, eSafety said sites are expected to “take reasonable steps” to prevent workarounds such as VPNs, and that the regulator would consider this when judging compliance, the Guardian reported. The same expectation applies to social media companies under Australia’s under-16s social media ban, according to the regulator’s comments cited by the Guardian.
That is the mechanism: a site can display an age-check system to Australian visitors, but a VPN can make a user appear to be connecting from somewhere else. If the law treats that as a compliance failure by the site, platforms are pushed toward detecting, degrading or blocking VPN traffic. The target becomes not only access to adult material or social media, but the tools people use to keep their browsing less exposed.
Age checks become identity checks
Mullvad, a company that sells VPN service, argued in a recent blog post that modern age verification is better understood as identity verification. The company said current internet infrastructure makes it unrealistic to assume identity data gathered for age checks will stay walled off from commercial sharing or government access.
Mullvad’s business gives it an obvious stake in the argument. More age-check mandates may drive more people toward VPNs. Its warning still gets at the technical problem lawmakers keep trying to wave away: proving age online often means introducing a third party that can link a person, a device or a credential to a visit or account.
Mullvad said that removing anonymous access to regulated websites and social platforms would affect political speech and activism, especially in countries where criticizing authorities can carry serious consequences. The company also argued that identity-linked posting creates a chilling effect because users may self-censor if they believe future governments, employers or investigators could connect them to lawful speech.
Regulators and vendors move closer
Privacy and technology policy expert Heather Burns has raised a related concern: age-verification providers are acting less like neutral compliance vendors and more like delegated enforcement actors. Burns said some providers have reported people to law enforcement for using an alternative operating system, an example she cited as evidence that age-check systems can be used for purposes unrelated to child safety.
The debate has also moved into parental authority. Iain Corby, who runs the trade association for age-verification providers, said in remarks circulated online that parents are sometimes complicit in helping children access age-limited services. He argued that services may need independent age verification rather than accepting a parent’s statement about a child’s age.
Australia’s VPN scrutiny shows how age-verification rules can expand after the first mandate is in place. The compliance question starts with whether a site checks age. It then becomes whether the site can defeat VPNs and other privacy tools that make the check less reliable. That is a much broader intervention than a pop-up at the door.
This story draws on original reporting from Techdirt.
