Mr Louis Hourany, Course Director and Lecturer in Information Technology in the Charles Sturt School of Computing, Mathematics and Engineering, offers a technical commentary from a network lecturer and practitioner perspective. He cautions:

Under 16s, their parents and others might think a Virtual Personal Network (VPN) can hide where a connection appears to come from, but they don’t understand that it does not make a user anonymous to platforms that analyse device data, behaviour and account history.

Will VPNs be an effective means of circumventing the ban?

VPNs are not a guaranteed or long-term solution for bypassing geographic restrictions.

Most major social platforms already maintain extensive blocklists of known commercial VPN exit nodes (the shared computers on the internet through which thousands of customers’ VPN traffic appears) and cloud-hosted Internet Protocol (IP) ranges (internet addresses rented from providers like Amazon or Google rather than from a local home internet provider).

VPN usage leaves identifiable patterns in metadata, including shared IP space, predictable routing paths and Transport Layer Security (TLS) signatures, meaning that when many users appear to come from the same type of service or shared location, it becomes a clear indicator the connection may not reflect the actual country or person behind it.

While a VPN may initially obscure location, platforms have become far less reliant on IP addresses as the primary indicator of where a user actually is.

Understanding how these systems operate is becoming part of general digital literacy, because location is only one of many signals used online.

How might social media companies detect under 16s in Australia despite a VPN?

Platforms now correlate multiple signals, not just geolocation. This may include device fingerprinting (details about the phone or laptop that uniquely identify it), metadata, such as time zone and language settings that align with Australia, and account history such as SIM or phone number origin and where the account first connected from.

Many platforms also use behavioural analytics and machine-learning models to detect patterns that do not align with historical usage, a capability originally developed for fraud and bot prevention.

From a networking perspective, IP address is now only one small part of the identity puzzle.

Teaching young people how their digital footprint is formed, and what information they unknowingly provide, is becoming increasingly important for making informed choices online.

Does the ban risk driving young people toward free, data-invasive VPN products?

That is a legitimate technical concern. When mainstream VPN services are blocked or degraded, users often migrate to lesser-known or free providers that may operate outside Australia’s privacy expectations.

Many free VPN providers operate by monetising user data, injecting advertising, or harvesting telemetry across apps. This may include browsing history, app usage, advertising data, or device information.

Parents often assume VPN equals privacy, but in some cases, the operator of the VPN may see far more than the social media platform ever could.

There is a cybersecurity and privacy dimension to consider if increased demand pushes young users toward unvetted offshore products.

Digital literacy and privacy education play a role here, helping young people understand that the tool they use to stay private can sometimes expose even more.

For a wider analysis of this topic see the Australian Computer Society Information Age article which cites Mr Hourany and others.