VPNs And Digital Hygiene: How Aussies Are Protecting Privacy

Ask an Australian how they feel about the companies holding their personal information and the answer tends to come out somewhere between weary and resigned. The Office of the Australian Information Commissioner put numbers to that mood in its 2026 Australian Community Attitudes to Privacy Survey, which found 87 per cent of us are more worried about privacy than we were five years ago, while just 4 per cent believe AI companies deserve our trust. Concern is not the problem. The gap between concern and confidence is. Plenty of people know their data is being collected in ways they never agreed to, and have no clear sense of what to actually do on a Tuesday night with a laptop and twenty spare minutes. Virtual private networks and a handful of unglamorous habits are where most of that gap gets closed.

Why Digital Privacy Matters For Australians

Australia sits in an unusual spot. Under the Telecommunications (Interception and Access) Act 1979, telcos and internet providers must keep a defined set of customer data for at least two years. Worth knowing, because a lot of coverage gets it wrong: the scheme does not compel providers to store your web browsing history. What it does capture is the shape of your communications, who you contacted, when, for how long, which service you used and roughly where your device was. That is metadata, and it is often more revealing than people assume. A record showing repeated late-night calls to a crisis line says plenty without a single word of content attached.

Then there are the breaches, which land with grim regularity. The OAIC’s notifiable data breach statistics recorded 1,205 notifications across 2025, the highest annual figure since the scheme started in 2018. Those are the reported ones, from organisations that noticed and complied. Most Australians have now had a letter of the “we take your privacy seriously” variety land in their inbox, which does more to explain the national mood than any survey.

The everyday exposure is quieter. A banking app, a cloud drive, a work laptop on the kitchen table, a fitness tracker sharing location with a company nobody has heard of. Reused passwords, permissions granted years ago and never reviewed, a browser signed into everything at once. None of it feels risky in isolation. Together it forms a fairly complete picture of a life.

How VPNs Strengthen Everyday Security

A VPN builds an encrypted tunnel between your device and a server run by the VPN provider. Anyone watching the local network sees traffic going to that server and not much else. The websites you reach see the server’s IP address rather than yours. That is genuinely useful, and it is also narrower than the marketing suggests.

Here is the honest version. Most of the web already runs on HTTPS, so the barista at the café cannot read your banking password whether you use a VPN or not. What a VPN changes is who gets to see the pattern of your activity: the café’s network operator, your ISP, and anyone with lawful or unlawful access to their records. It also breaks the link between your home IP address and the sites you visit. What it will not do is make you anonymous, stop a site tracking you once you have logged in, block malware, or save you from a convincing phishing email.

The catch is that a VPN does not remove trust from the equation. It moves it. You stop trusting your ISP and start trusting a company that may be registered offshore and audited by nobody. That distinction matters, and the research is not comforting. Australian and US researchers who pulled apart 283 Android VPN apps found embedded tracking libraries, malware flagged by antivirus engines, DNS and IPv6 leaks, and apps intercepting encrypted traffic outright. A follow-up study of 62 commercial VPN providers found that many leaked user traffic and that a meaningful share misrepresented where their servers physically sat.

So the selection criteria are not “which one has the best sale”. Look for an independently audited no-logs policy rather than a claimed one, modern protocols such as WireGuard or OpenVPN, working DNS leak protection, a kill switch, and a jurisdiction you are comfortable with. Pay for it. Free VPNs have to earn revenue somewhere, and the product is usually you.

Encryption also protects the connection, not the credentials. Any account holding payment details deserves the full treatment, whether it is your bank, a retailer or an entertainment platform. If you route your session through a VPN before signing in to a site such as syndicate casino, that tunnel does nothing about a password you have used on four other sites. Unique credentials and multi-factor authentication do the heavy lifting there.

Building Strong Digital Hygiene Habits

Tools fail quietly when habits are missing. Digital hygiene is the boring maintenance layer that decides whether a single leaked password becomes an inconvenience or a very long fortnight. The good news is that it is mostly front-loaded effort. An afternoon of setup buys years of coasting.

These are the practices worth building first:

• Install a reputable password manager and let it generate long, unique passwords. You need to remember exactly one.
• Switch on multi-factor authentication, favouring an authenticator app or a passkey over SMS codes, since SIM swap fraud makes phone numbers a weak second factor.
• Enable automatic updates on your operating system, browser and apps, then stop postponing the restart prompt.
• Review app permissions every few months and revoke anything that no longer earns its access, particularly location, microphone and contacts.
• Treat urgency as a red flag. Verify unexpected requests through a number or address you looked up yourself, not one supplied in the message.
• Run your email address through Have I Been Pwned to see which breaches have already caught you, then change those passwords first.

You do not need all six on day one. Two of them, done properly, put you ahead of most people a criminal will encounter this week.

Comparing Key Privacy Tools

No single tool covers the field. Each one closes a different gap, and the value comes from stacking them rather than picking a favourite. Cost, effort and the kind of risk you actually face should drive the decision.

Read the limitations alongside the functions. A VPN will not help if malware is already running on your laptop. Antivirus will not save an account whose password appeared in a 2019 dump. A password manager is superb until you protect it with a weak master password and no second factor. Layering works because each tool covers the others’ blind spots.

Staying Ahead Of Emerging Online Threats

The threat picture is not static, and the volume is genuinely striking. The Australian Signals Directorate’s Annual Cyber Threat Report for 2024-25 logged more than 84,700 cybercrime reports, roughly one every six minutes. Identity fraud topped the list of reported crime types, and the average self-reported cost to an individual reached about $33,000.

What has changed most is the quality of the bait. Generative tools have retired the badly spelled email. Scam messages now match brand tone, reference real transactions and arrive at plausible moments. Voice cloning has moved the classic “it’s me, I’m in trouble” call from implausible to unsettling, and a few seconds of audio from social media is enough raw material. The defence is procedural rather than technical: agree on a verification method with family, and treat any pressure to act immediately as evidence of a problem rather than a reason to hurry.

Sharing this stuff matters more than any single setting. Older relatives are targeted deliberately and often bank with institutions they have used for decades. Teenagers face a different mix built around gaming accounts, marketplace scams and sextortion. Both groups do better with a household norm that says checking something with someone else is normal and never embarrassing. When something does go wrong, ReportCyber and Scamwatch are the right first calls, and reporting genuinely feeds the national picture.

Protect Your Digital Identity Today

Privacy is not a purchase. It is a set of defaults you set once and revisit occasionally. A trustworthy VPN, a password manager doing the remembering, multi-factor authentication on anything holding money or identity documents, and a healthy scepticism toward urgent messages will handle the overwhelming majority of what comes your way. None of it is exotic, and none of it takes long.

If it has already gone wrong, act quickly rather than quietly. IDCARE provides free, government-funded support for Australians and New Zealanders dealing with identity theft and compromised accounts, and speaking to them early tends to shorten the recovery considerably.

The collection of personal data is not going to slow down, so the sensible move is to make the protective habits automatic while the stakes are still low. Set them up on a quiet evening, and they will be sitting there doing their job on the day you need them.

Disclaimer

References

• Australian Signals Directorate. (2025). Annual Cyber Threat Report 2024-25. Canberra: Commonwealth of Australia. Available at: https://www.cyber.gov.au/about-us/view-all-content/reports-and-statistics/annual-cyber-threat-report-2024-2025
• Department of Home Affairs. (2023). Data retention obligations. Canberra: Commonwealth of Australia. Available at: https://www.homeaffairs.gov.au/nat-security/Pages/Data-retention-obligations.aspx
• Ikram, M., Vallina-Rodriguez, N., Seneviratne, S., Kaafar, M. A., & Paxson, V. (2016). An analysis of the privacy and security risks of Android VPN permission-enabled apps. Proceedings of the 2016 ACM Internet Measurement Conference (IMC ’16), Santa Monica, CA, 14-16 November 2016. New York: Association for Computing Machinery, pp. 349-364. DOI: https://doi.org/10.1145/2987443.2987471
• Khan, M. T., DeBlasio, J., Voelker, G. M., Snoeren, A. C., Kanich, C., & Vallina-Rodriguez, N. (2018). An empirical analysis of the commercial VPN ecosystem. Proceedings of the Internet Measurement Conference 2018 (IMC ’18), Boston, MA, 31 October to 2 November 2018. New York: Association for Computing Machinery, pp. 443-456. DOI: https://doi.org/10.1145/3278532.3278570
• Office of the Australian Information Commissioner. (2026). Australian Community Attitudes to Privacy Survey 2026. Sydney: OAIC. Available at: https://www.oaic.gov.au/engage-with-us/research-and-training-resources/research/australian-community-attitudes-to-privacy-survey/australian-community-attitudes-to-privacy-survey2026
• Office of the Australian Information Commissioner. (2026). Notifiable data breach statistics dashboard. Sydney: OAIC. Available at: https://www.oaic.gov.au/privacy/notifiable-data-breaches/notifiable-data-breach-statistics-dashboard
• Parliament of Australia. (1979). Telecommunications (Interception and Access) Act 1979 (Cth). Canberra: Commonwealth of Australia.