Australia's latest attempt to regulate online behaviour through mandatory age verification went into effect a week ago. The results have been, well, illuminating.
On March 9, 2026, the eSafety Commissioner's new codes required anyone in Australia wanting to play R18-rated online games like Grand Theft Auto Online, Mortal Kombat 1, or Dead Island 2 to verify their age using one of several methods: a government-issued photo ID, facial age estimation, a credit card check, or a digital identity wallet. The intention is sound. Gaming Commissioner Julie Inman Grant put it simply: "We don't allow children to walk into bars or bottle shops, but when it comes to online spaces where they are spending a lot of their time, there are no such safeguards." That's hard to argue with.
Within hours, something unexpected happened. VPN downloads exploded. By March 10, three VPN applications were ranking in Australia's top 15 most-downloaded free apps on iOS, with VPN Super Unlimited Proxy jumping ahead of every major social media platform.
This wasn't a conspiracy. It was a rational response. If you're an adult Australian gamer who finds ID verification intrusive, or a younger person determined to access content, a VPN lets you appear to be in a country without such restrictions. The whole system can be circumvented in roughly the time it takes to download an app.
But here's where it gets stranger. As of this week, GTA Online itself still doesn't consistently ask for verification. Players report logging in without prompts, without QR codes, without facial recognition. Despite penalties of up to A$49.5 million per breach, the enforcement has been more Swiss cheese than wall.
This isn't to mock the government's intentions. Child safety matters. But it reveals something uncomfortable about how regulation works in the digital age. You can write rules. You can impose huge penalties. But if circumventing those rules takes less effort than complying with them, those rules become a performance of governance rather than actual governance.
The real question isn't whether age verification works. It's whether regulation-by-friction, where governments try to make bad choices inconvenient rather than impossible, can ever succeed when the inconvenience is minor and the workaround is free.