New Zealand’s Online Safety (Minimum Age and Child Safety Risk Assessment) Bill was introduced on August 24, 2026, but it’s not going anywhere for the time being. Two of the three parties in the current governing coalition, ACT and New Zealand First, have announced they will vote against it, and with the parliament set to dissolve before the November 7 election, the proposal is currently stalled.
However, documents obtained by Newstalk ZB under the Official Information Act have shown that the Department of Internal Affairs (DIA) has been exploring ways of linking digital ID with online age verification, as part of the country’s wider digital identity efforts.
The bill would require platforms to “take reasonable steps” to ensure that New Zealanders under 16 cannot have accounts on social media, and simply typing in an age or date of birth would not be considered sufficient. The proposal did not allow platforms to rely solely on formal ID or digital identity services to comply, and they would have to offer their users alternative age verification methods.
These could include facial age estimation, or inferences based on information a platform already has about a user, such as activity patterns, and account or device attributes. The bill states that the information used for age assurance can only be used for that purpose and must be deleted when no longer necessary.
ACT leader David Seymour is strongly opposed to the idea, calling it “a terrible solution” that will inevitably lead to “widespread online identification” and restrictions on “legitimate privacy tools.” As he put it, “any system strong enough to reliably stop them will inevitably start asking a lot more of everybody else.”
Seymour believes that teenagers will easily find ways to bypass the proposed restrictions, while others will be subjected to “age checks, identification requirements, and more New Zealanders proving who they are simply to use ordinary parts of the internet.”
New Zealand First is also unhappy with the bill, saying that there is “no method that would fulfil” its intent “without banning VPNs or the use of digital ID to enforce the law.” The party considers Australia’s attempt at introducing online age verification “a colossal failure” and warns that New Zealand could end up with “some sort of soviet era outcome” that would take away citizens’ freedom and privacy.
The DIA documents describe work on a digital version of the Kiwi Access Card, a physical proof-of-age card, that could be used to “support any future age assurance requirements.” This information was contained in a February 2026 briefing for Education Minister Erica Stanford, who later that month met with Hospitality New Zealand to discuss the possibility of digitizing the card.
In the February briefing, officials said that a digital version of the card “could be used for online age verification if the Government were to introduce requirements for social media platforms to require age assurance.”
The documents also reveal that the government’s digital wallet app, Govt.nz, could be used to “prove you are over 16 without handing over your full birth date” and “only share what’s needed.” This would work through the “selective disclosure” method, where a user shares only a portion of the information contained in a digital ID credential.
However, critics of digital ID schemes have long warned that while this might sound like a convenient and privacy-protecting way to share information, it still means that digital ID is being used to gate access to services, in this case, online speech and social media platforms.
As for the Online Safety (Minimum Age and Child Safety Risk Assessment) Bill, it would have introduced a requirement for covered platforms to carry out written child-safety risk assessments and submit them to the regulator. They would have to review and update these assessments every year, and whenever there are changes to the design, features, terms, or operations of a service. The regulator would also have the power to order a new assessment.
The bill covers platforms that facilitate user-to-user content exchanges and use “higher-risk” features such as recommenders, endless feeds, engagement tools, or disappearing content. Social AI companions designed primarily to simulate emotional or personal relationships are also covered, but services primarily for messaging or calls, gaming, music and podcasts, product information, professional networking, education, or health are generally excluded. The draft lists WhatsApp, Discord, Roblox, Minecraft, Spotify, and LinkedIn as examples of those that would not fall under its rules.
The online safety regulator, which would be part of the DIA, would have the power to demand information, issue warnings and corrective notices, and seek court injunctions, as well as service and access restriction orders. The maximum penalty for breaching the bill’s provisions would be the greater of NZ$40 million or 10 percent of global turnover.
The bill also creates several offenses, including for providing materially false information in a risk assessment, or for breaching the conditions of information disclosure, or disclosing information unauthorized. For some of those offenses, individuals could face up to 12 months in prison or a NZ$500,000 fine.
