Disclosure: VPNFin is reader-supported. If you buy a VPN through links on this page, we may earn a commission at no extra cost to you. This never affects our ratings — here’s our full disclosure.
Ten frameworks into this series, Australia does something none of the others do. No law bans the tunnel. No fine reaches the person inside it. Instead, the platforms carry an instruction to defeat it.
That is a rule about companies, and it works on you anyway. Understanding which is which is the whole point of this page.
Is a VPN Legal in Australia?
Yes, completely. No Australian law prohibits buying, installing or using a VPN, and no government has proposed one. However, two age-assurance regimes now apply, and both put the duty and the fine on the platform. In fact, the regulator states plainly that under-16s and their parents face no penalty at all.
The Two Regimes That Arrived Nine Months Apart
Both are new, and both work the same way.
The under-16 social media rules started on 10 December 2025. Age-restricted platforms must take reasonable steps to stop Australians under sixteen from holding accounts. eSafety names ten: Facebook, Instagram, Kick, Reddit, Snapchat, Threads, TikTok, Twitch, X and YouTube. Fines reach A$49.5 million.
Adult-content age checks followed on 9 March 2026. Everyone now proves they are eighteen. The fine ceiling is the same figure.
⚠️ Neither regime creates an offence for a person. eSafety says there are no penalties for under-16s who get an account, and none for their parents or carers. That is the regulator’s own wording, and it matters more than any headline.
Plenty of services fall outside both. eSafety lists Discord, Messenger, WhatsApp, Pinterest, Roblox, Steam, GitHub, Google Classroom and YouTube Kids among them. Meanwhile, others self-assessed themselves in, including Bluesky, Lemon8, BigoLive, Wizz and Yubo.
The Part That Makes Australia Different
Here is the sentence that changes the shape of this comparison.
Platforms must also try to stop under-16s using a VPN to appear offshore. eSafety says so directly in its guidance for families. The September 2025 regulatory guidance went further and suggested providers integrate VPN detection services and IP intelligence to flag high-risk address ranges.
Read who that instruction is addressed to. Not the child. Not the parent. The company.
⚠️ The British rules put the duty on platforms too, and stopped there. Australia went one step further and named the countermeasure. That is the first time in any framework we have covered that a regulator has told private firms to identify and block a lawful privacy tool.
The technique is ordinary and public. For example, commercial databases label address ranges as belonging to hosting providers, and platforms buy that data. Protocol signatures are separate — our protocol guide covers what those look like on the wire.
Did Any of It Work
The numbers exist, which is rare this early.
eSafety reported 4.7 million under-16 accounts removed by mid-December 2025. The regulator sent monthly notices to ten platforms for six months, starting the day after the rules began.
VPN downloads climbed on both start dates. After the March 2026 adult-content checks, Sensor Tower data showed Proton VPN jumping from nineteenth to seventh on Google Play in a day, and TechRadar reported rises for other providers too.
⚠️ We are not going to explain how to get around either regime. This page is for adults asking a legal question. Anyone under sixteen reading it should know that the platforms are actively looking for exactly that, and that free VPNs are funded by selling data — which is a poor trade for anybody, and a worse one for a teenager.
The Older Law That Nobody Repealed
Age checks arrived recently. The surveillance framework has been running for a decade.
Metadata retention began in October 2015. Carriage service providers keep connection records for two years, and dozens of agencies can request them. The content of your traffic is not stored; the pattern of it is.
The Assistance and Access Act 2018 sits beside it. It lets authorities compel companies to help with investigations, and it binds firms rather than individuals.
Australia is a Five Eyes member, which is the argument our Australia guide sets out in full.
⚠️ A VPN moves the retention point rather than removing it. Your ISP stops seeing where you go. The provider you chose now does. What a VPN actually hides is the honest version of that trade, and it is why the audit record of the provider matters more here than the marketing.
Where Australia Sits Against the Rest
Ten frameworks, and the targets keep differing.
Russia penalises the search, not the connection. One provision reaches a person, and it is about what they looked for.
Twenty-seven American states check age and every duty lands on the platform. Utah wrote down in March 2026 that a VPN does not move your legal location.
Australia does both of those and adds the countermeasure. Duty on the platform, no penalty for the person, and an instruction to detect the tool.
France moved the order one step further. Its courts named five VPN companies and told them to block domains themselves, aiming at the provider rather than at the platform.
⚠️ That combination is more effective than a ban would be. A prohibition needs enforcement against millions of people. This needs ten compliance departments.
| Country | What the rule aims at | Reaches the user? |
|---|---|---|
| Turkey | The tunnel — ISPs must block | No |
| The UAE | Conduct behind an address | No |
| India | The provider's records | Not nationally |
| China | Provider, tunnel and user | Yes |
| Brazil | Nothing, until a court acts | For 39 days |
| Indonesia | Paperwork — registration | No |
| The UK | The destination you visit | No, and ministers said so |
| The US | The platform, state by state | No, in all twenty-seven |
| Russia | The search, not the tool | Only if you went looking |
| Australia | The platform, and the tunnel itself | No — platforms must detect it |
| France | The VPN provider itself | No, the orders bind five companies |
| Italy | The provider, by regulator order | No, but one VPN left the market |
| Spain | The provider, by injunction without a hearing | No, and only two firms were named |
| Germany | The provider's logfile, for three months | No, and the courts twice removed it |
If You Are Visiting or Living There
Practical points, all lawful.
Nothing here restricts an adult. Install what you like, connect where you like, and expect age checks on some sites.
Set it up before you fly. Provider websites work fine in Australia, so this is only ordinary preparation — our travel guide covers the parts that break in hotels.
Test the connection once. Running the leak checks takes ten minutes and confirms the tunnel does what the app claims.
⚠️ Not legal advice. We are not lawyers, the rules changed twice in nine months, and the Minister amended them again in March 2026.
What to Look For in a Provider Here
Jurisdiction and audits carry the weight, because the retention obligation moves to whoever you choose. Proton VPN operates from Switzerland with five published audits. NordVPN sits in Panama with six.
Neither claim means anything without the report behind it. Australian VPN providers themselves have disagreed about whether the retention scheme covers them, and iTnews reported in 2017 that the Attorney-General’s Department declined to clarify.
How We Research
This page draws on the eSafety Commissioner’s published guidance on social media age restrictions and its FAQ list of covered and excluded services, the Commissioner’s September 2025 regulatory guidance as reported by ACS Information Age, Associated Press reporting on the penalty ceiling and the monthly notice regime, eSafety’s January 2026 figure for removed accounts, TechRadar’s reporting on VPN downloads after the March 2026 adult-content checks, and iTnews on the unresolved question of whether Australian VPN providers fall under the 2015 retention scheme. We do not run our own tests and we do not publish circumvention instructions for any jurisdiction. Our full approach lives on the About Us page.
Australia VPN Law FAQ
No. No Australian law prohibits using, buying or installing one, and no government has proposed a ban. Two age-assurance regimes now apply to platforms rather than to people, and businesses across the country rely on the technology every day.
No. The eSafety Commissioner states there are no penalties for under-16s who access an account on an age-restricted platform, and none for their parents or carers. The fine falls on the platform, and it reaches A$49.5 million.
They are expected to try. eSafety guidance tells age-restricted platforms to take steps against under-16s appearing offshore, and the September 2025 regulatory guidance suggested integrating VPN detection services and IP intelligence to flag high-risk address ranges.
Partly, and it moves the problem. Your ISP stops recording which sites you reach, because it sees only the tunnel. The VPN provider now holds that position instead, which is why its audit record and jurisdiction matter.
Partly, on the numbers published so far. eSafety reported 4.7 million under-16 accounts removed by mid-December 2025. VPN downloads also rose on both start dates, and the regulator has been sending platforms monthly compliance notices.
The Verdict
Using a VPN in Australia is lawful, and nothing suggests that will change. No offence exists, no fine attaches, and no government has proposed a ban.
What changed is the instruction to platforms. Detect the tool, flag the address ranges, keep the under-16s out. The duty sits with ten companies and the penalty reaches A$49.5 million.
For an adult the practical question is the older one. Two years of metadata, a Five Eyes member state, and a choice about which company holds the record instead.