The Under-16 Ban Didn't Ban Anything. It Just Made Everyone Prove They're Not a Child

Australia's under-16 social media ban came into effect on 10 December 2025. Ten months later I think it failed on its own terms, and that the privacy cost of trying has been considerably higher than advertised.

First, the numbers

eSafety's headline figure is that platforms restricted access to about 4.7 million under-16 accounts in the first half of December.

That's a lot of accounts. It's also a count of accounts closed, not children protected, and the three numbers that matter point the other way:

• The eSafety Commissioner reported that the proportion of under-16s still using social media platforms fell by 4.4 percentage points.
• A study published in July 2026 found more than eight in ten Australian teenagers under 16 were still using social media three months after the law took effect, and that children aged 10 to 15 were using it just as frequently as before.
• Researchers who advised the government's own rollout opened 50 accounts declaring themselves as 16-year-olds after the law commenced and were asked to verify their age none of the times.

That last one is the damning figure. Before any of the sophisticated age-assurance machinery even comes into play, the first gate a new account declaring itself over the minimum age isn't being checked at all.

The law is better than its reputation

I want to give the drafting credit it deserves, because what follows is more effective if I'm honest about the parts that were well done.

Section 63DB of the Online Safety Act 2021 says a provider of an age-restricted social media platform must not:

(a) collect government-issued identification material; or
(b) use an accredited service (within the meaning of the Digital ID Act 2024)

for the purpose of complying with the minimum age obligation. Civil penalty: 60,000 penalty units. Section 63DA covers information that must not be collected at all, and Division 3 puts age assurance on privacy footing alongside the Privacy Act 1988.

That is a considered attempt to force privacy-preserving verification rather than the obvious and cruder approach of demanding a passport upload. It deserves credit.

Except it doesn't close the door it thinks it closes

Here's what's interesting about the OAIC's own guidance from October 2025. It lists an accepted age assurance method as:

Document check via on-device scan that reads the date of birth (DOB) from a government ID via an on-device app and returns a '16+ yes/no' result.

And then, in footnote twelve, notes that alternatives must be provided because this method involves government-issued identification and therefore engages s 63DB.

Read the two provisions together carefully and the gap becomes visible. Section 63DB prohibits collecting government-issued identification material, and prohibits using an accredited service under the Digital ID Act. An on-device scan does neither. It reads your licence in memory, hands back a boolean, and keeps nothing. The capture path is untouched; only the storage path is closed.

I'm reading that as the text works, not as a settled legal position but if my reading is right, it's the mechanism by which a law written specifically to prevent a de facto national ID requirement produces a de facto national ID requirement anyway.

The same guidance helpfully names the practices it considers high risk: storing selfie frames, "logging tokens in a way that enables cross-service tracking," and making escalation to stronger verification automatic without clear consent. Those are exactly the implementation choices the law leaves to each platform's discretion.

And they have been left to each platform. The Online Search Engine Services code now carries the same model into search, where Google offers a government ID, a selfie processed by third-party provider PrivateID, or a credit card check. A thirteen-year-old who wants to look up a school assignment now has three routes to proving their age to a search engine, and so does every adult in the country.

The asymmetry of getting it wrong

Facial age estimation carries, per RMIT's Lisa Given, a one-to-three-year error rate. That's not a rounding error. It's the difference between a person being allowed into a service and being locked out of it.

Which produces an asymmetry that runs one direction. If a fifteen-year-old slips through, nothing happens. If a nineteen-year-old is misclassified, that person loses access to a service they are legally entitled to use. If a thirty-five-year-old who looks younger than they are gets misclassified, they lose it too and they get entered into a database they never asked to be in.

The regulator's own framing, from the January release, is that success is measured by cultural norms rather than perfect compliance:

just like other safety laws we have in our society, success is measured by reduction in harm and in re-setting cultural norms. Speed limits for instance are not a failure because some people speed. Most would agree that roads are safer because of them.

I'll take the speed limit analogy seriously. But speed limits don't require you to identify yourself to the state to use the road. The cheap error is forgiven and the expensive one is paid by the user, and that's a poor trade for a population where every adult is also a subject of the requirement.

When a regulator can't prove anything, the answer is more power

In its own submission to the Senate, eSafety acknowledged that it has no power to compel documents, and that without access to primary documents the Commissioner:

would likely be unable to discharge the onus of proof required in any civil penalty proceeding brought to the courts against a provider of an ARSMP

In plain terms: the regulator told Parliament it could not prove a platform had breached the law, and would probably fail to prove it in court.

The government's response was the Online Safety Amendment (Strengthening Enforcement for the Social Media Minimum Age) Act 2026, Act No. 83 of 2026, in force 12 September. Penalties doubled, to a maximum of $109.2 million. Powers expanded to allow the Commissioner to compel information from third parties, including people who aren't platforms.

No platform has been fined. In March, eSafety flagged five platforms for compliance issues and moved into what it called an enforcement stance. That's a regulator still assembling the ability to act, a year after the law started, on a policy that has measurably moved the number it's meant to move by 4.4 points.

The direction of travel is also widening. The Digital Duty of Care Bill 2026 exposure draft, released 8 September, moves past content entirely. It's about design features, recommender systems and "user empowerment tools." The subject is no longer what gets posted. It's how products get built.

The part nobody voted for

Here's what I find most troubling, and it's not really about children at all.

The Digital ID Act 2024 established the Australian Government Digital ID System. It commenced on 30 November 2024, the ACCC is the regulator, and it drew substantial privacy criticism at passage the Opposition said publicly that the bill did not provide adequate privacy safeguards, and a private member's Digital ID Repeal Bill 2024 has been sitting in front of the House ever since.

That legislation follows a decade in which Australia repeatedly refused to build a national identity system. The Identity Services Bill 2019 died in parliament after an argument that is essentially the argument in this post.

Now note what s 63DB does: it prohibits using "an accredited service within the meaning of the Digital ID Act 2024." The age-assurance provision and the national digital identity framework are already cross-referenced in statute. And what the age ban actually creates is the thing legislation couldn't a daily, per-use, private-sector demand for verified identity across the entire adult population, generated as a side effect of a policy about minors.

The historical precedent for this is not foreign. Under the Immigration Restriction Act 1901, people who were exempt from the dictation test carried a certificate. Its stated purpose was to let someone prove they didn't need to pass the test. Its actual function was to make people findable. Critics at the time made exactly the argument that gets made about age verification: that a scheme justified on identification grounds never stays scoped to identification.

The mechanism is always the same, and it's why the EU has taken a completely different approach. Its digital identity wallet blueprint stores only age_over_18: true no name, no date of birth does selective disclosure, is open source, and is being deployed across member states by 31 December 2026 under Regulation 2024/1183. That is a genuinely good design and it is the strongest argument against anything I've written above.

Which is why I don't think the technology is the problem. The governance is. The EU made the privacy-preserving architecture compulsory. Australia mandated a legal outcome take reasonable steps and let every platform choose the method. Selfie capture, cross-service tokens and stored identity data aren't necessary consequences of age verification. They're consequences of not mandating the architecture.

And the international trend runs the wrong way. The Philippines has required Meta to verify against the national identity card. Singapore's Infocomm Media Development Authority required app stores to check government ID or facial scans from 1 April 2026. Ofcom opened an inquiry into Pornhub's age assurance in September. Every jurisdiction that adopts universal age verification makes the aggregate more valuable to anyone who wants to misuse it, and makes a single breach scale further.

The alternative was already on the phone

Which brings me to what I think should have happened instead, because it's almost embarrassingly simple.

Parental controls ship on every mainstream device and they are good. Apple's Screen Time does per-app and per-category time limits, downtime scheduling, content and privacy restrictions, Communication Limits that control who a child can contact through Phone, FaceTime and Messages, and Communication Safety, which screens for sensitive images on-device Apple states it has no access to the photos or videos themselves. Google's Family Link does the same alongside location sharing, app approval, Chrome site restrictions, SafeSearch and permission management for apps and extensions.

None of that requires a fourteen-year-old to submit to a biometric scan so that a social network can check a number the child already typed in.

The gap isn't engineering. It's distribution. Australia spent twenty million dollars on an awareness campaign for the ban, and nothing comparable telling parents what they already have installed.

There's a neater point too. Screen Time and Family Link run on exactly the trust model the law assumes should exist: Family Sharing is a parent identifying their own child to their own device vendor. The alternative requires every Australian, including every adult, to prove their age to a private social network. Same premise about who is responsible for a child. Radically different privacy cost.

It's also better suited to how success is actually measured. If the goal is shifting norms toward parents being responsible for their children's online activity, parental responsibility is a norm. A national age-assurance mandate is a technical requirement, and technical requirements don't change what anybody believes they're accountable for.

The honest objection is that parental controls need an engaged parent, and a determined teenager with a second cheap phone walks around them. True and equally true that KJR got through fifty accounts without being asked once. Neither instrument is a wall. The difference is that one of them costs nothing in the privacy of the entire adult population to administer.

What I actually think

Self-harm, grooming, sextortion and image-based abuse are real harms, and eSafety's work removing illegal material and responding to reports of non-consensual intimate images has genuine value. I haven't found a reason to think that work is made worse by a different regulatory model.

The argument isn't that children don't need protecting. It's that making every Australian prove they're not a child, in order to do it, is the wrong instrument one that has measurably failed to deliver, is now being extended to search engines, is building the demand for a national identity system the country spent a decade refusing, and hands a future government with a verified-identity population whether or not anyone ever decided it should have one.

The useful tool was installed on the phone years ago. We just never told anyone.