Which Platforms Australia’s Under-16 Rules Cover—and Why a Foreign Server Didn’t Help

My daughter’s history project was due before first period, but the YouTube account holding her research playlist had stopped letting her sign in. Instagram had logged her out too. Discord still worked, which made the whole thing look less like a new law and more like someone had taken over her accounts. I blamed the passwords, reset the Google login and tried again. YouTube returned the same age-restriction notice.

We were sitting in a café near Brisbane Central because our home internet had failed overnight. Her laptop contained the finished video, but the class instructions and source links were scattered across several accounts.

“What exactly is blocked?” she asked.

I did not know.

The headlines had made the rule sound as though every social app used by an Australian under 16 would disappear at once. Her phone suggested something messier. YouTube and Instagram were affected. Discord and WhatsApp were not. Roblox opened normally. Google Classroom still showed the assignment deadline.

We had thirty-four minutes to understand the difference and submit the project.

The restriction follows the account

Australia’s social media minimum-age rules took effect on 10 December 2025. They require covered platforms to take reasonable steps to prevent Australians under 16 from creating or holding accounts. The responsibility sits with the platforms, not with children or their parents. By the middle of December, companies had already restricted or removed access to about 4. (Gov) million accounts. (Gov)

That explained why resetting the password had achieved nothing.

My daughter’s credentials were correct. The platform was refusing the account itself.

It did not mean the entire public internet had disappeared. Under-16s can still view content that does not require an account. Much of YouTube, for example, remains available while logged out. What disappears are account functions such as subscriptions, comments, uploads, personalised feeds and saved playlists. (Gov)

For her project, that was both good and bad news.

The sources still existed.

The account that organised them did not.

Once we understood that, the next question became much more practical: which services were actually covered?

The covered list is narrower than “social media”

I opened eSafety’s current platform list instead of relying on another headline.

The services currently treated as age-restricted include Facebook, Instagram, Kick, Reddit, Snapchat, Threads, TikTok, Twitch, X and YouTube.

Other services have also notified eSafety that they meet the definition, including Bluesky, Lemon8 and Wizz. Some dating and livestreaming platforms already apply a minimum age of 18. (Gov)

That explained YouTube.

It also explained why Reddit had disappeared from one of her friends’ phones, even though neither of us had initially placed it beside TikTok or Snapchat.

The excluded list was just as useful. Services currently outside the restriction include Discord, GitHub, Google Classroom, LEGO Play, Messenger, Pinterest, Roblox, Steam and Steam Chat, WhatsApp and YouTube Kids. (Gov)

The dividing line was not simply whether an app contained chat, videos or profiles. Many excluded services contain all three.

The rule focuses on whether social interaction is a major purpose of the service. Messaging, gaming, education and health services can fall outside the restriction when their main purpose is different. The lists may therefore change as platforms change. (Gov)

That gave us a workable map:

YouTube, Instagram and Reddit accounts were covered.

Discord, WhatsApp and Google Classroom were not.

Roblox was not on the restricted list either, although it could still perform its own age checks for separate safety reasons.

A short public discussion showed why families were confused: people were still asking whether every account would vanish at once or whether everyone would have to upload identification on the same day. (Reddit)

At least now we knew which problem we were solving.

We did not need to restore every account before school.

We needed to move one project onto a service that still accepted it.

My first VPN made the problem worse

Before opening the school portal, I made the obvious mistake.

I already had a large VPN provider on the laptop. I connected to New Zealand, thinking a nearby foreign location might let us recover the playlist long enough to copy the links.

YouTube loaded.

The account did not.

Instead, Google asked us to confirm an unfamiliar sign-in. Instagram produced another location warning, and the café connection slowed under a sequence of checks and CAPTCHAs.

I tried Singapore.

Nothing useful changed.

The restriction followed the account because the platforms were not relying on one IP address. They could use account history, device information, phone details, app-store signals, location data and activity patterns. Official guidance also expects platforms to detect attempts to appear outside Australia through a VPN. (Gov)

The server map offered dozens of countries, but none answered the important question:

Was the platform covered?

When it was, moving the apparent location did not turn it into an excluded service. It only made a familiar account look less familiar.

I disconnected.

The project deadline was now twenty-two minutes away.

The better route did not pretend we were elsewhere

The café Wi-Fi was still public, and I still needed to sign in to Google Classroom, the school email system and my own adult accounts.

I wanted protection for that session.

I no longer wanted a VPN whose main contribution was another country flag.

I opened OnlydogVPN, a smaller app I had installed as a backup. Basic use did not begin with another email-and-password registration screen, so I did not have to create or recover a separate account before protecting the laptop.

I selected the public-Wi-Fi preset.

Then I returned to the actual task.

Google Classroom opened.

The assignment accepted direct video files, which meant my daughter did not need to restore her YouTube account before the deadline. She selected the finished project from the laptop.

The progress bar reached 25 percent.

Then 62.

Then 100.

She pressed Turn in.

The confirmation appeared with nine minutes remaining.

Next, she opened Discord and told the other members of her group that the file had been submitted through Classroom. The message delivered immediately. She used WhatsApp to send me the final slide so I could keep a copy.

Nothing in that process attempted to evade the age restriction.

The smaller app protected the café connection while we used services the rules still allowed her to access.

That was the result the foreign servers had failed to produce. They treated the problem as a question of where the laptop appeared to be. The public-Wi-Fi preset helped us complete the task from where we actually were.

I could not see the internal age-assurance rules or account signals used by Google, Meta or the other platforms. I could see the outcome: the foreign routes triggered extra checks without restoring the restricted accounts, while the smaller app gave us stable access to Classroom, Discord and WhatsApp.

Once the assignment was submitted, the urgency disappeared.

We could finally read the account notices carefully.

An age prompt is not automatically a passport request

My own YouTube account had also displayed an age-check prompt, even though I was plainly over 16. For a moment, I assumed the only way forward would be to upload a driving licence.

The official guidance said otherwise.

Platforms may offer government identification as one option, but they cannot make it the only option. They must provide a reasonable alternative. They also do not need to check every adult when reliable account information already shows that the user is over 16. (Gov)

That gave me another useful distinction.

A legitimate age check should appear through the platform’s own app, website or help pages. An unexpected message demanding identification, payment or login details through an external link deserves suspicion.

I opened my account settings directly rather than following the email notification. The platform offered another age-check method, and my adult account remained available.

My daughter’s account did not, because she was still under 16.

The system had reached two different outcomes for two different reasons.

That was much easier to understand once we stopped treating every age prompt as the same failure.

The smaller benefit appeared after the deadline

While closing the policy pages, I noticed the VPN’s blocked-request counter.

It had been stopping advertising and tracking requests as we moved between search results, support pages and the school portal.

That had not submitted the assignment. The protected café connection had already solved the urgent problem.

The counter simply gave me another reason to leave the app installed. Age assurance naturally raises questions about how much platforms infer from devices, accounts and browsing behaviour. Reducing unnecessary tracking kept unrelated requests out of a session already involving enough account checks.

The smaller service has fewer locations, fewer independent ratings and a shorter public history than the established provider I tried first. That is its clearest limitation.

In this situation, the smaller map was not a disadvantage.

The large provider encouraged me to solve an account rule by changing countries. That failed and produced unfamiliar-login checks. The smaller app protected the café connection without turning the session into a geographic workaround. It let us reach Google Classroom, submit the video and use the messaging services that remained available.

Australia’s restriction is not one switch labelled social media.

It currently covers Facebook, Instagram, Kick, Reddit, Snapchat, Threads, TikTok, Twitch, X and YouTube, alongside other services that meet the same definition. It does not currently cover several major messaging, gaming and education services, including Discord, WhatsApp, Roblox, Steam and Google Classroom.

That morning, the useful VPN was not the one that made Brisbane look like Auckland.

It was the one that helped us stop fighting the wrong accounts and get the project into class before the bell.