New minimum age law for social media platforms

Chris Papas
Jul 7
4 min read

The Online Safety Amendment (Social Media Minimum Age) Act 2024 (Cth)(Act) establishes a new minimum age of 16 for users of certain social media platforms. The Act is intended to help prevent online harm to children and create safer, age-appropriate online experiences. The Act will take effect on a date specified by the Minister for Communications, which will be no later than 11 December 2025.

The Act introduces critical new obligations for certain social media platforms which place the onus firmly on such platforms to implement systems and processes to prevent children under 16 having user accounts.

In this update we outline the key elements of the Act and discuss some of the practical compliance considerations for platforms that will be regulated by the Act.

Which platforms must comply?

The new obligations apply to "age-restricted social media platforms" which include any electronic service that meets all of the following conditions:

Its sole or significant purpose is to enable online social interaction between two or more end-users;
It allows end-users of the platform to link to, or interact with, other end-users; and
It allows end-users of the platform to post material on the service.

The conditions are broadly defined and are designed to capture a wide range of social media services. However, they are expected to initially exclude messaging apps, online gaming services, health and educational focused services. The Act also does not apply to online business interactions. The categories of platforms regulated by the Act may change over time as the Minister has been granted powers to make legislative rules to narrow or expand these as needed.

The key obligation: taking "reasonable steps"

The Act’s central requirement is that age-restricted social media platforms must take “reasonable steps” to prevent Australian children under 16 from having accounts on their platforms.

The Act does not prescribe exactly what "reasonable steps" are. However, the Minister has indicated that platforms are expected to implement some form of “age assurance” which refers to the various methods used to determine a person's age. These methods fall into two main categories:

Age estimation. This infers an approximate age or age range without using external confirmed information. It can involve using biometric data from facial scans or analysing behavioural patterns.
Age verification. This determines a person's age with a high degree of certainty, typically by checking data against an external source, such as a government identity document.

Whether an age assurance practice meets the "reasonable steps" test is to be determined by having regard to the suite of methods available, their relative efficacy, costs associated with their implementation, and data and privacy implications on users, among others. The eSafety Commissioner (the regulator) has indicated that multiple measures can work together to apply age restrictions to online goods and services. For example, a social media service might use age gates based on users’ self-declared age while also using AI profiling and user reporting mechanisms to detect potential underage accounts.

Data restrictions and privacy considerations

The Act restricts the types of information that may be collected and used by platforms for the purposes of complying with their minimum age obligations as follows:

A platform may only rely on government-issued identification or an accredited service if it has given the individual an alternate, reasonable option for demonstrating they are over 16.
The Minister may make legislative rules to exclude certain types of information being collected and used by platforms for the purposes of the minimum age obligation.

Additionally, the Act also includes privacy protections and safeguards in relation to the management, use and disclosure of personal information collected by platforms for the purpose of complying with their minimum age obligations. Specifically, platforms may only use or disclose personal information collected for this purpose:

to determine whether the individual is an age-restricted user;
in circumstances where an exception under Australian Privacy Principle 6 of the Privacy Act 1988 (Cth) applies; or
for another purpose, with the consent of the individual, which must be voluntary, informed, current, specific and unambiguous (this is designed to preclude platforms from seeking consent through preselected settings or opt-outs).

Personal information collected for compliance must also be destroyed in accordance with the Privacy Act if that information is no longer required for any of the purposes for which it was obtained.

Penalties and enforcement

The eSafety Commissioner has been granted powers to seek information relevant to monitoring compliance and to issue notices regarding non-compliance. The penalties for non-compliance with the Act are substantial. A breach of the minimum age obligation carries a current maximum penalty of $9.9 million for individuals and $49.5 million for companies. Additionally, failure to comply with the privacy protections above will be taken to be an interference with the privacy of the individual for the purposes of the Privacy Act that, for serious offences, could result in maximum penalties of up to $50 million for companies.

Practical takeaways for platform vendors

Assess age assurance options: Evaluate which age assurance methods are most appropriate for your platform. Consider the varying levels of assurance, from self-declaration for low-risk activities to more robust verification for higher-risk scenarios.
Prioritise privacy by design: Design your compliance systems to minimise data use. Collect data only for its intended purpose and provide users with clear, accessible information about how their data is handled.
Offer user choice and review: Give users a choice of age assurance methods and ensure that you have responsive and genuine review procedures for disputed age assurance results, especially for automated decisions.

Legal Notice

The contents of this article are for reference purposes only and may not be current as at the date of accessing this article. The contents of this article do not constitute legal advice and should not be relied upon as such. Legal advice about your specific circumstances should always be sought separately before taking any action based on this article.