From 10 December 2025, age-restricted social media platforms will have to take reasonable steps to prevent Australians under the age of 16 from creating or keeping an account.
Experts warn new social media ban for young people under 16 could create fresh privacy challenges.
Social-media companies will soon be forced to do what many of them have long avoided: confirm how old their users really are.
Age-gating, the digital version of “No ID, no entry”, has existed in a loose form for years. Most adult-oriented websites, such as alcohol or gambling sites, rely on users ticking a box or entering a birth date to verify their age. Now, Australian regulators are demanding more.
From 10 December, new rules introduced by the eSafety Commissioner will require social media platforms to take reasonable steps to prevent anyone under 16 from holding an account.
The restrictions aim to reduce the risks young people face online and will apply to platforms such as Facebook, Instagram, Snapchat, TikTok, YouTube, and X (formerly Twitter). Messaging, educational and gaming services such as Google Classroom, WhatsApp, Messenger, Discord and Roblox are exempt.
Platforms aren’t required to verify every user, but must detect, deactivate and remove under-age accounts and avoid relying solely on self-declaration – or risk fines of up to $49.5 million.
But while the move is designed to protect children, it raises new questions about privacy and how age can be safely verified online.
How will platforms verify age?
Under the new framework, social-media companies may request government-issued identification but cannot make it mandatory to access the platform.
Other measures could include reviewing a user’s search history or using facial-recognition technology. Yet, a government trial earlier this year found that face-scanning technology could estimate a user’s age only within an 18-month range in 85 per cent of cases.
Instagram has announced it will use artificial intelligence (AI) to estimate the ages of Australian users. Early testing suggests nine out of 10 teen accounts would remain active under the new system.
UNSW security and privacy expert Dr Rahat Masood, from School of Computer Science and Engineering, says major technology companies already use AI to learn more about their users.
“Big tech companies don’t need traditional age-gating mechanisms to figure out how old their users are,” she says.
“They already know a lot from patterns of behaviour – when someone logs on, who they interact with, what they search for, or whether their geolocation matches a school during the day.”
Dr Masood says many under-16s also don’t have government-issued ID, so companies will likely rely on AI systems to verify age. But she warns these models are far from perfect – often experiencing hallucinations and biases.
“AI can misjudge age, especially across different demographic groups,” she says.
“And how does it tell the difference between someone who’s 15 years 364 days or 16 years and 1 day? The signals are almost identical.”
A safer alternative: zero-knowledge proofs
Whatever technology is used, the large-scale data collection could expose users to new risks if sensitive information is stored or shared.
UNSW cybersecurity expert, Dr Hammond Pearce also from School of Computer Science and Engineering, says while no method is perfect, zero-knowledge proof (ZKP) technology could offer a privacy-first solution.
“ZKP is a cryptographic process that lets one party prove a statement – like being over 16 – without revealing any other personal information,” Dr Pearce says.
“We could have a system where the government issues digital tokens confirming a person’s age.
“Websites would consume the token to verify the user is over 16 but wouldn’t learn anything else – and the government wouldn’t track which sites use them as well.
“It’s a much safer way to verify sensitive information online.”
While some European countries have already started to introduce secure digital identity apps, they’re also backed by stronger data-protection laws – an area Australia lags in, says Dr Pearce.
“The European Union’s General Data Protection Regulation sets some of the world’s toughest data-privacy standards,” he says.
“There are very harsh fines against those who violate their standards.
“Australia needs to follow suit – so companies take online privacy more seriously.”
Not a ban, but a delay
Dr Pearce says the new rules won’t ban young people from using social media, but aims to slow down how quickly they join the platforms.
“Around 60 to 80 per cent of teenagers would need to stop using social media for the ‘network effect’ to take hold,” he says.
“The network effect is typically a positive feedback system, so users derive more value from a product or service as more users join the network.
“If their friends can’t access a platform, there’s less incentive to use it. You don’t need to verify every user for the policy to have an impact.”
Still, Dr Pearce says achieving complete accuracy would require uploading ID – which could create the kind of privacy risk regulators are trying to avoid.
“The only way to be 100 per cent sure is to upload a passport or government-issued ID – and that’s not what we want.”
Balancing safety and privacy
With just weeks until the new rules come into effect, both experts say the challenge is finding the right balance.
“There’s still a lack of clarity on how the government plan to audit social media companies on whether they’ve complied the guidelines,” says Dr Masood.
“Protecting children online is crucial but we also need to ensure the solutions don’t create bigger risks in the process.”
Contact details:
Cecilia Duong
