Australia's eSafety Commissioner (eSafety) has recently published regulatory guidance (Guidance) to support age-restricted social media platforms comply with the Online Safety Amendment (Social Media Minimum) Act 2024 (Act). Platforms captured by this amendment will be required to take "reasonable steps" to prevent individuals under 16 from holding social media accounts on their platforms by 10 December 2025.
The Guidance sets out principles to help platforms comply with their obligations under the Act and explains eSafety's intended approach to monitoring and enforcing compliance, including requirements to use age assurance methods. This Guidance builds on the self-assessment guide (also published recently) that assists services to determine if they are considered "age-restricted social media platforms" under the Act.
What is an age-restricted social media platform?
The Act's restrictions will apply to "age-restricted social media platforms." A platform will be considered an age-restricted social media platform, and captured by the Act, if:
- The sole purpose, or a significant purpose, of the service is to enable online social interaction between two or more end-users
- The service allows end‐users to link to, or interact with, some or all of the other end‐users
- The service allows end‐users to post material on the service
- The service meets other conditions (if any) set out in rules made under the Act.
What is age assurance?
Age assurance is a broad term used to describe a range of methods and technologies that can be used to determine, estimate or infer a user's age.
Australia's Age Assurance Technology Trial
The Australian Government's independent Age Assurance Technology Trial (the Trial) was a key input into producing the Guidance (read the trial report here). The Trial's primary aim was to determine whether age assurance could be implemented without compromising individuals' privacy and security, and to inform the development of potential regulatory frameworks. It considered a variety of age assurance tools, including biometric age estimation, facial age analysis, identity document verification and parental controls.
Ultimately, the report concluded that there are no substantial technological barriers to implementing age assurance systems in Australia. The report found that a waterfall or layered approach to age assurance was a useful method for undertaking age assurance. Under a waterfall approach, multiple age assurance processes are used depending on the risks posed. This proportional approach allows organisations to use the "lightest" effective method where possible, only escalating to more involved (and potentially more privacy intrusive) options such as biometric estimation or validation based on documents (eg passports) if the results are uncertain.
Social Media Minimum Age Regulatory Guidance
The Guidance sets out the following guiding principles that providers' steps to comply with the Act should be informed by:
- Reliable, accurate, robust and effective age assurance measures
- Privacy-preserving and data-minimising
- Accessible, inclusive and fair
- Transparent
- Proportionate
- Evidence-based and responsive to emerging technology and risk.
The Guidance discusses these principles in more detail, providing case studies to assist platforms determine what practical steps they can and should take to comply with the Act.
Implications for New Zealand
We expect that this Guidance will be of interest to New Zealand organisations as our government considers similar regulatory approaches to online age verification. The Social Media (Age-Restricted Users) Bill (Bill), has been drafted to closely align to the Australian regime. The Bill proposes placing responsibility on social media platforms to verify users' ages before granting access.
The Office of the Privacy Commissioner has raised concerns about the privacy risks associated with having age restrictions on online material. In its submission on the Bill, it discussed that this is because online age verification inherently requires the collection of sensitive identity information about individuals, raising risks of over-collection. Additionally, the use of age assurance technologies like facial analysis to detect age involves collecting sensitive biometric information, which may be inaccurate and pose further privacy risks.
We will be watching developments in this space with interest.
Co-authored by Emily Newbury (solicitor).
