From March 9, all websites, AI chatbots, and online services hosting adult-only material must verify that users are at least 18 years old, under the latest phase of Australia's eSafety Online Safety Codes. What was designed to shield minors from explicit content has instead created a privacy minefield for adults, sparking a backlash that reveals the genuine tensions between child protection and individual liberty.
The regulations allow service providers to choose their own appropriate age-assurance measures, which typically involve scanning government-issued IDs, performing credit card checks, or using biometric facial age estimation. On the surface, the flexibility seems reasonable. In practice, it has created a complex landscape where adults must decide whether to surrender sensitive personal data to verify they are legally entitled to view lawful content.
Major porn sites including Pornhub, RedTube and YouPorn unceremoniously blocked Australian users from their adult content, with Australians visiting Pornhub now finding a landing page of safe-for-work content, dominated by podcast thumbnails. Aylo, the parent company owning these sites, stated that the measure "creates harms relating to data privacy and exposure to illegal content on non-compliant platforms". Rather than attempt compliance, they chose withdrawal entirely.
The industry's resistance points to a real problem. Age verification measures generate additional privacy and data security concerns for adults, as users may need to submit sensitive information, such as identification documents or biometric data. Online identification processes often retain copies of identifying information, and there may be no guarantees that the disclosed data is not stored, even if claims as to data minimization are made.
The response from users has been swift. There has been a surge in VPN downloads since the pornography age verification requirement came into effect, with three VPN apps currently among Australia's top 20 apps in Apple's app store. The popular Proton VPN jumped from number 19 to number 7 on Google Play on the first day, while NordVPN also saw significant rises in downloads across both iOS and Android. This raises an uncomfortable irony: adults concerned about handing sensitive data to one set of companies are turning to VPN providers about whom they know little.
Government and industry argue the technology is sound. Peter Violaris, head of global privacy at IDVerse, an Australian age verification provider, says his company only sends the 18-plus status across to the adult site with no name, email addresses, or mobile number, then deletes it immediately. Prime Minister Albanese has tried to assuage privacy fears by confirming that social media firms will have an obligation to destroy information provided once age assurance has been completed.
Yet the systems are not without flaw. Facial analysis technology is still nascent and few providers have achieved high accuracy, with some research raising concerns of ethnic and gender bias by some facial analysis technologies. Companies like AU10TIX and platforms like Discord have faced high-profile data breaches, exposing users' most sensitive information for months or even years.
While there is no data available on what VPNs are being used for, experts say this could be a combination of under-18s seeking to bypass verification blocks, as well as adults seeking to access blocked sites and adults who want to avoid handing over details for age verification. Belinda Barnet, a senior media lecturer at Swinburne University of Technology, says many adults may continue to use VPNs for the long term even if sites like Pornhub unblock content—as long as they get a good VPN and not a cheap random one.
The policy reveals a genuine dilemma. Protecting children from accidental exposure to explicit content is a legitimate government interest, and research shows one in three young people reported their first encounter with pornography was before age 13. But the solutions implemented—requiring identity verification for lawful adult conduct—create new problems while solving others. Aylo argued that the codes do not effectively protect minors, and instead create harms relating to data privacy and exposure to illegal content on non-compliant platforms, a concern worth taking seriously.
Belinda Barnet believes that in the long term, a trusted and standardised third-party platform should be introduced to mitigate privacy concerns. This suggests a middle path: rather than every adult site managing sensitive data individually, a single trusted intermediary could verify age and pass only an anonymous confirmation to the platform itself. The eSafety commissioner has called for a "double-blind tokenized approach" to age verification, which would theoretically achieve this outcome. The question is whether implementation will match the ambition.
For now, Australians navigating these rules face a choice between surrendering personal data to verify lawful conduct, or outsourcing their privacy to a VPN provider. Neither option is ideal. The government's goal was sound, but the path chosen has created friction that may ultimately make ordinary adults less safe online, not more.