'Grossly disproportionate' and 'discriminatory' – why Australia's social media ban risks creating more problems than it solves

Australia's social media "ban" has come into effect today – Wednesday, December 10, 2025 – and it sees the social media accounts of thousands of children shut down.

The bill – titled the "Online Safety Amendment (Social Media Minimum Age) Act 2024" – aims to protect those under the age of 16 from the "pressures and risks" of social media.

However, critics argue the ban may also negatively impact children's online privacy and cybersecurity. There will be attempts to stop children from using one of the best VPNs to bypass the ban, and those incorrectly identified as under 16 will have to complete age verification checks.

The role of VPNs

The bill's guidance states that social media companies must "stop under-16s from using VPNs to pretend to be outside Australia."

VPNs are privacy tools that encrypt internet traffic and protect your data online. Connecting to a VPN server grants you a new IP address, hiding your original IP address, and therefore your location, and protecting your privacy.

Connecting to a VPN server in a different country would see you given an IP address located in that country, and a website would believe that's where you're located.

The practicalities of using a VPN to bypass the social media ban have yet to be tested. However, there is belief that connecting to a non-Australian VPN server could circumvent the ban.

It's also unclear as to whether children would be able to regain access to their accounts, or if they could make new ones when connected to a VPN.

There is no indication of how social media companies will go about stopping VPN usage. Phone numbers, device identifiers, language and time settings, and GPS location are all examples of data that can be used to work out a user's country – even when connected to a VPN.

Known as metadata, this information reveals a lot about a user, and analyzing and collecting it is a serious violation of privacy. Analyzing metadata, along with account information, is invasive and breaches the privacy of all internet users – not only children.

While this bill may protect children from the harms of social media and its algorithms, it instead puts their highly sensitive personal information in the lap of big tech companies.

Risky free VPNs

Any child who explores VPN usage is unlikely to pay for one. Free VPNs exist, but many are dangerous and will do more harm to children than anything Australia's bill is trying to protect against.

The UK saw downloads of suspicious free VPNs skyrocket in the wake of the Online Safety Act. These free VPNs can collect and sell usage data, monitor online activity, and even contain malware. This could unnecessarily open children up to online threats with potentially dangerous consequences.

Regardless of use, only the best free VPNs can be considered safe to use. Run by reputable, big-name providers, they will protect your data and provide basic VPN features.

NordVPN: the best VPN overall
If you're planning on using a VPN, we recommend going with a premium service that has been verified to never store your data. From our testing, our top choice is NordVPN. It's fast, has undergone multiple audits, offers excellent privacy, and unblocked the most global streaming sites of any VPN we've tested.

Prices start at $2.99 per month (about $83 in total), and there's a 30-day money-back guarantee so you can test it out before committing.

Invasive age checks

Social media companies can assess the age of users via numerous methods – Meta has already begun this process.

Examples of ways social media companies assess age include:

• How long the account has been active
• Engagement in content aimed at under-16s
• Analysis of language
• Visual checks of photos and videos
• Audio analysis of a user's voice
• Activity patterns consistent with school hours
• Connections with other users who appear to be under 16

This amounts to a highly invasive level of analysis, even before any age checks have been completed. Users who see their accounts blocked following this analysis can appeal the decision by completing age verification checks.

Age checks can include submitting live selfies, government-issued ID, and credit card information. How age verification procedures are implemented is down to the individual social media company, and the process will need to be completed on multiple platforms.

Meta has argued this isn't the most effective way to conduct age checks. The company believes age verification should be completed at an app store level, with apps only available to download once age has been verified.

The Australian government has confirmed users won't be compelled to submit government-issued ID. Social media companies include it as an option but must offer alternatives.

UK-based age check company Yoti is playing a leading role in verifying the age of Australians, but experts are concerned about the implications of non-Australian companies complying with Australian data protection laws.

Yoti says its age-estimation technology is more accurate than humans and it can estimate the age of 16-17 year olds "to within 1 year of accuracy." Some reports suggest otherwise, adding that the technology is "less accurate for people with an Indigenous or south-east Asian background."

Tom Sulston, Head of Policy at Australia-based Digital Rights Watch, believed that handing over biometric data to read social media "is grossly disproportionate" and "discriminatory." He also highlighted the potential failures in identifying people of color and "the key 14-17 age range."

Sulston added that he has "very little confidence that the companies handling this data will meet Australian privacy expectations around the handling of our biometric data, and not using it to further train facial surveillance models."

Other opponents to age verification have cited the cybersecurity risks of highly sensitive data collection and its attractiveness to hackers. It has been described as a "disaster waiting to happen."

Is there an alternative?

The Australian government said it is "protecting young Australians at a critical stage of their development." It is absolutely the correct move to try and shield children from harmful content, bullying, and other negative impacts of social media. But doing so by invading privacy and exposing them to cybersecurity risks isn't the answer.

The law also states that children can still see "publicly available social media content that doesn’t require being logged into an account." Although it will reduce it, this won't entirely remove a child's risk. For example, YouTube videos can be watched without an account – something the Australian government themselves state. While children won't be able to comment or engage without an account, they can still watch videos and become susceptible to harmful algorithms.

Regulation of social media algorithms is something critics have pushed as an alternative to age verification. It's also something that would benefit all social media users, not just children.

Sulston said he'd "like to see the social media companies' use of our private information restricted" and for them to have "a legislated duty of care to users." He called for "algorithmic resets" in the hope "young people won’t be profiled by the algorithms for the rest of their lives."

Like age verification laws in the US and UK, Australia's social media ban, while well intentioned, creates as many problems as it solves. Online privacy and cybersecurity is put at risk and legislation appears shallow – with VPNs being attacked in the process.

The bill and its implementation is evolving and there won't be 100% effectiveness overnight. We will be following the progress of the ban, and its impact, closely over its first few days and weeks.