Australia's Social Media Minimum Age Act: Reasonable Steps in Practice
Australia's under-16 social media law expects reasonable steps to assure age and proof you took them. Here's where VPN and proxy detection fits, and how to keep a defensible record.
Australia's Social Media Minimum Age Act, live since December 2025, pushed age assurance into new territory: covered platforms must take reasonable steps to keep under-16s from holding accounts, with the eSafety Commissioner watching. The phrase that matters for engineers is "reasonable steps," and the unspoken second half is proving you took them.
Reasonable steps, and proof of them
The law does not hand you a single approved method. It expects measures proportionate to the risk, and it expects you to stand behind them. In practice that means two things your stack has to deliver: a check that actually works, and a record that shows you ran it.
Both halves get tested. A strong check with no durable record is hard to defend, and a record that can be quietly edited is no record at all.
Where location masking comes in
Age assurance often leans on signals tied to where a connection comes from. The weak point is that IP geolocation reads an apparent location, and a VPN changes it on demand. Every time age rules tighten somewhere, VPN usage climbs, because relocating the apparent origin is exactly what a VPN sells.
Check whether a connection hides its real origin
A measure that counts as reasonable
- Check the origin for masking with VPN detection, proxy detection and Tor exit checks. A masked origin is a flag to act on.
- Decide deliberately. Step up to stronger verification for masked traffic, and log the reason either way. A documented decision beats a silent pass.
- Seal the record. Store each check so it cannot be altered after the fact.
Why tamper-evidence is the point
If your audit log can be edited, it cannot prove what happened at the moment of the check. A hash-chained log fixes this: each entry hashes the previous entry plus the payload, so editing history breaks the chain and a verification pass flags it. That is what turns "we kept logs" into "we can prove these logs are intact."
Provenance packages both halves into one server-side call. It detects VPN, proxy and Tor masking on the engine behind our detection tools, applies per-jurisdiction policy including Australia, and writes a tamper-evident, hash-chained audit log you can export as signed evidence.
Bottom line
Reasonable steps under the Social Media Minimum Age Act are not satisfied by a location guess that a VPN defeats. See the masking, act on it, and keep proof that holds up. Pair the control with your age-assurance vendor and legal advice, this post is a compliance measure walkthrough, not legal advice.
FAQ