This is very not normal, not even slightly ok, and absolutely does warrant a conversation about boundaries and consent. It further warrants enforcement of the principles involved, including punishments if necessary. Your girlfriend's son needs to learn to respect consent to (hopefully) stop him from growing up into a bully and then an adult sexual predator.
Your girlfriend evidently is not willing to listen to reason on this topic from you. She might be more willing to listen to her own parents, or other people she trusts who have no connection to you. If you decide to try that avenue, I would strongly recommend clearing it with your girlfriend first. If you talk to her family and/or friends "behind her back", she will probably be upset and angry when she finds outs. Either convince her to ask them (or at least to approve in advance of you asking them), or don't ask them. Even with your girlfriend's approval, though, asking her family/friends is risky, because they might just agree with her.
Alternatively, instead of trying to convince her directly or via her family/friends, I suggest offering her an opportunity to convince you, which you expect to backfire on her. More specifically, appeal to her certainty about this being normal and generally accepted by society at large, and suggest that the two of you essentially "ask the whole damn Internet" to settle the argument. If she believes what she said, she should be very confident that "the Internet" will answer resoundingly in agreement with her.
Important points:
- Discuss this with her in advance, so there's no doubt about whether you "shopped around" for an Internet community that agrees with you. Let her believe that the verdict will be in her favor.
- Tell her where you want to post the question, and explain factors about it that should appeal to her expressed opinions and make her even more confident that the verdict will favor her.
- I suggest Am I the Asshole subreddit. I think your question should be ok by their rules, but there's a chance they might decide it breaks their "No relationship posts" rule. If that happens, you can use AITAH as a fallback option, which is a variant of "Am I the Asshole" created for the express purpose of allowing relationship posts.
- The base site, reddit.com, is so incredibly huge that I'd be astonished if your girlfriend hasn't already at least heard of it.
- r/AmItheAsshole has 18 million members. It's so enormous that its sheer size would force it to be mainstream whether or not its moderators want it to be, and its moderators want it to be mainstream anyway. r/AITAH, while smaller, still has 1.9 million members.
- The membership of r/AmItheAsshole is predominantly secular, not religious, and most certainly not prudish. If you need to convince your girlfriend of its non-prudishness, finding existing posts that demonstrate it beyond any reasonable doubt should be very easy.
- Ask your girlfriend for a mutual agreement that both of you will accept the consensus judgement of the community about your post, as expressed by their comments and upvotes. If she truly believes what she said, she should agree to this pretty readily because she'll expect the result to agree with her. If she thinks you might unfairly spin the situation, tell her you'll do it together with her so she can make sure it's fair.
- Word the post to focus on the dispute about your son's behavior. Specifically avoid or downplay the topic of your relationship with your girlfriend, to hopefully avoid having to repost on AITAH instead.
- Show her your draft of the post before you post it, and ask whether she thinks you're presenting the question fairly. If she points out any perceived unfairness, fix everything she points out until she explicitly agrees that your final version of the post is fair. Post the version of the question that she approved.
I am completely 10000% certain that the answer of the r/AmItheAsshole community will be that you are "NTA" (Not the Asshole), and that your girlfriend most definitely is The Asshole. I also predict multiple highly-upvoted comments saying things to the effect of "WTF is wrong with your girlfriend? How could she possibly believe this?"
Incidentally, I also predict a large number of comments declaring that this is such a major red flag that they believe you should break up with your girlfriend over it, and possibly advising you to call CPS (Child Protective Services) to report your girlfriend for neglecting/abusing your daughter by allowing her son's behavior to continue. Be mentally prepared to see those comments, and keep in mind that the subreddit's members tend to jump to that conclusion more quickly and easily than may be truly warranted.
Hopefully, the weight of numbers of having likely thousands of random non-religious non-prudish people telling her that she's wrong will be more than she can rationalize away and ignore.