Australia is preparing to enforce one of the most invasive online measures in its history under the guise of child safety.
With the introduction of mandatory age verification across social media platforms, privacy advocates are warning that the policy, set to begin December 10, 2025, risks eroding fundamental digital rights for every user, not just those under 16.
eSafety Commissioner Julie Inman Grant has told tech giants like Google, Meta, TikTok, and Snap that they must be ready to detect and shut down accounts held by Australians under the age threshold.
She has made it clear that platforms are expected to implement broad “age assurance” systems across their services, and that “self-declaration of age will not, on its own, be enough to constitute reasonable steps.”
The new rules stem from the Online Safety Amendment (Social Media Minimum Age) Act 2024, which gives the government sweeping new authority to dictate how users verify their age before accessing digital services. Any platform that doesn’t comply could be fined up to $31M USD.
While the government claims the law isn’t a ban on social media for children under 16, in practice, it forces platforms to block these users unless they can pass age checks, which means a digital ID.
There will be no penalties for children or their parents, but platforms face immense legal and financial pressure to enforce restrictions, pressure that almost inevitably leads to surveillance-based systems.
The Commissioner said companies must “detect and de-activate these accounts from 10 December, and provide account holders with appropriate information and support before then.”
These expectations extend to providing “clear, age-appropriate communications” and making sure users can download their data and find emotional or mental health resources when their accounts are terminated.
She further stated that “efficacy will require layered safety measures, sometimes known as a ‘waterfall approach’,” a term often associated with collecting increasing amounts of personal data at multiple steps of user interaction.
Such layered systems often rely on facial scanning, government ID uploads, biometric estimation, or AI-powered surveillance tools to estimate age.
Privacy campaigners warn that these approaches risk normalizing the constant collection of sensitive personal data, building infrastructure that could easily be repurposed for broader tracking or profiling.
To support enforcement, eSafety has launched a self-assessment tool for companies to determine whether their services are covered by the law.
The Commissioner noted that the tool would help companies figure out if “any of their services may be excluded” under the legislative rules issued by the Minister for Communications.
However, most major social media platforms such as Facebook, Instagram, TikTok, Snapchat, YouTube, and X are almost certain to be included.
eSafety is also developing regulatory guidance to clarify what “reasonable steps” will mean in practice.
The Commissioner has made it clear that platforms must already be preparing to prevent children from manipulating settings to bypass restrictions, ensure that complaint mechanisms are functional and accessible, and plan for full implementation ahead of the December deadline.
Citing consultations with over 160 organizations and more than 50 young people aged 13 to 23, the Commissioner claims there is “strong community support for measures to better protect children online.”
She added, “Australians have told us they want strong, practical protections that keep children safe without compromising privacy or fairness. We have listened, and this feedback is shaping the guidance we are putting in place for industry.”
However, many in the privacy and digital rights communities question whether such a balance is possible when the state’s approach is to compel private companies to verify the age of every user, regardless of whether they’re children.
The phrase “without compromising privacy” rings hollow for those who recognize that age verification at this scale often relies on intrusive surveillance methods that compromise anonymity for everyone, not just young users.
The government maintains that only services with core social networking features are affected.
Online games and basic messaging apps may be excluded. But messaging functions embedded in social media platforms, like DMs on Instagram or group chats on Snapchat, will fall under the new restrictions. The definition is broad enough that many widely used platforms could be swept into the regulatory net.
Although the Commissioner has publicly insisted that safety and privacy “do not have to be mutually exclusive,” the architecture required to meet the government’s demands suggests otherwise.
Once systems are in place to scan faces, verify IDs, or track user activity for the sake of age assurance, they can be leveraged for other purposes by platforms or the state.
Australia’s move places it at the frontier of a growing global trend where safety rhetoric is used to justify mass surveillance.
Privacy advocates argue that introducing mandatory identification online not only limits access but also normalizes tracking in digital spaces that once allowed for anonymity, freedom of expression, and private communication.
Despite these concerns, the Commissioner urged platforms not to delay. “This is the time for companies to start mobilizing and planning for implementation,” she said, adding that “children, parents and carers are counting on services to deliver on their obligations and prepare their young users and the trusted adults in their lives for this monumental change.”
