Age verification in Australia: what the social media minimum age law means for businesses

Since 10 December 2025, Australia's social media minimum age law requires age-restricted platforms to take "reasonable steps" to stop people under 16 from creating or keeping an account. The law is deliberately technology-neutral — it does not mandate any single method — and non-compliance can attract significant civil penalties. The original maximum was A$49.5 million; in mid-2026 the government moved to double that to around A$99 million for systematic breaches. This is general information, not legal advice.

What changed

Australia introduced a minimum age of 16 for age-restricted social media platforms, administered by the eSafety Commissioner. Rather than prescribe a specific verification technology, the law places the onus on platforms to justify how their chosen approach amounts to reasonable steps. Named age-restricted platforms include Facebook, Instagram, Snapchat, Threads, TikTok, Twitch, X, YouTube, Kick and Reddit. The regulator has already opened compliance investigations.

Beyond social media

The social media law is the most visible example, but age assurance matters wherever a product or service is age-gated — online gambling and wagering, alcohol delivery, adult content, and in-venue gaming. Businesses in those areas face the same underlying question: how do you confirm someone is old enough, reliably, without collecting more personal data than you need?

What "reasonable steps" means in practice

Because the standard is outcome-based, the expectation is a proportionate, layered approach rather than one silver bullet. In practice that means:

• Choosing methods appropriate to the risk and your users.
• Being able to demonstrate the method actually works.
• Minimising the personal data you collect and retain (privacy-by-design).
• Offering more than one path so you don't exclude legitimate users.

How age verification actually works

There are three broad families of age-assurance methods, often combined:

• Document-based verification — read a driver licence, passport or ID with ID document OCR, extract the date of birth, and confirm the document is genuine.
• Verify the person is real and present — pair the document with liveness detection and 1:1 face matching so the ID belongs to the person using it.
• Facial age estimation — estimate an age range from a selfie without identifying the person; useful as a privacy-preserving first gate, with document verification as a fallback near the threshold.

A strong deployment layers these: a low-friction estimate for the clear cases, and a document + biometric check where the result is close to the age limit.

Privacy: collect less, not more

Age assurance is under scrutiny precisely because it can invite over-collection of identity data. The privacy-preserving pattern is to confirm the fact you need ("is this person over 16/18?") without retaining the underlying document or building a database. Systems that anonymise or discard PII after the check, and that support on-device or ephemeral processing, are much easier to defend in a privacy impact assessment.

How to choose an age verification approach

• Match the method to the risk — a proportionate, layered approach is the point of "reasonable steps".
• Insist on liveness so a photo of an older person can't pass the check.
• Prefer solutions that minimise and delete personal data by default.
• Keep an audit trail you can show a regulator — that you took reasonable steps and why.

Frequently asked questions

When did Australia's social media age law start?

The minimum age requirement took effect on 10 December 2025, with enforcement activity underway.

Does the law require a specific age verification technology?

No. It is technology-neutral — platforms must take "reasonable steps" and justify their chosen method, rather than use a mandated tool.

What is the penalty for non-compliance?

The original maximum civil penalty was A$49.5 million; in mid-2026 the government moved to double it to around A$99 million for systematic breaches. Confirm the current figure with the eSafety Commissioner — this is general information, not legal advice.

What's the difference between age verification and age estimation?

Age verification confirms a specific age from evidence such as an ID document; age estimation predicts an age range from a selfie without identifying the person. They are often combined for a proportionate, privacy-preserving result.