Social media use in Australia to be restricted for under 16s

Australia has introduced a world-first social media ban for under 16-year olds. Certain social media platforms will be required to take reasonable steps to prevent Australian children under the age of 16 from having accounts on their platform.

On 10 December 2024, the Online Safety Amendment (Social Media Minimum Age) Act 2024 (Amendment Act) received Royal Assent and added a new Part 4A to the Online Safety Act 2021 with the following key features:

1. ‘Age-restricted social media platforms’ must take reasonable steps to prevent users under the age of 16 having accounts with the platform.
   
   
2. The penalty for non-compliance is up to AUD $49.5 million, but only comes into effect, at the earliest, 12 months after the legislation takes force.
   
   
3. A social media platform must not use or disclose any personal information collected for the purpose of taking those reasonable steps for any other purposes.
   
   
4. The eSafety Commissioner has new powers to formulate guidelines for taking reasonable steps, and to obtain information about a platform’s compliance with the reasonable steps obligation.

Social media platforms regulated

‘Age-restricted social media platforms’ is defined as an electronic service that satisfies the following conditions:

• the sole or significant purpose of the service is to enable online social interaction between two or more end-users;
  
  
• the service allows end-users to link or interact with other end-users; and
  
  
• the service allows end-users to post material on the service.

The definition is broad and covers the vast majority of social media and other platforms with online interaction capabilities in Australia. However, the Minster for Communications has indicated that exemptions will be provided for certain platforms, including messaging apps, online gaming services and services with a primary purpose of health or education.

Reasonable steps obligation

Age-restricted social media platforms must take ‘reasonable steps’ to prevent Australian children under 16 from having accounts. The obligation will apply to new accounts registered by age-restricted users, as well as existing accounts as at the date of commencement. There is a 12 month lead-in period for this obligation, which will come into effect on a date specified by the Minister.

The Amendment Act does not prescribe what measures will constitutes ‘reasonable steps’. However, the explanatory memorandum notes that, at a minimum, platforms must implement some form of age assurance to identify whether an account holder is an Australian child under the age of 16. Regulatory guidelines to assist in determining what would be considered ‘reasonable steps’ will be prepared by the eSafety Commissioner.

Penalties

There are significant penalties for failing to take reasonable steps to prevent age-restricted users from having accounts. Relevant social media platform providers may be subject to civil penalties of up to 150,000 penalty units (currently AUD $49.5 million).

The penalty applies systematically (i.e. the obligation is for the platform to take reasonable steps to prevent all persons under 16 having accounts). There is no user-by-user penalty. In other words, if one 15 year old makes an account on a social media platform, but the platform is found to have reasonable steps in place to prevent users under the age of 16 having accounts, the penalty will not apply.

The Amendment Act also increases the penalties for non-compliance with industry codes and standards under the Online Safety Act 2021 to 30,000 penalty units (AUD $49.5 million) for bodies corporate.

Privacy protections

Operators of age-restricted social media platforms will need to collect and use personal information to verify the age of potential end-users.

Platforms are prohibited from using or disclosing information collected for the purposes of age verification for any other purposes, unless consent is obtained from the individual. Doing so is expressly said to be an interference with the privacy of the individual for the purposes of the Privacy Act 1988 (Privacy Act). Platforms must also destroy the information after using or disclosing it for the purposes for which it was collected.

eSafety Commissioner functions and powers

The Amendment Act enhances the powers and functions of the eSafety Commissioner to:

• Formulate guidelines: The Commissioner's functions now include to formulate guidelines outlining the reasonable steps that age-restricted social media platforms should take to prevent age-restricted users having accounts on their platform.
  
  
• Obtain information: The Commissioner has the power to obtain information about a platform's compliance with the reasonable steps obligation. That power appears to be unfettered.
  
  
• Publish non-compliance: The Commissioner can also publish a statement on the eSafety website if satisfied that a platform has failed to take reasonable steps or has used information in a way that infringes privacy.

Next steps

The eSafety Commissioner will be responsible for drafting guidelines on ‘reasonable steps’ to prevent age-restricted users from registering accounts on age-restricted social media platform. The timeline for preparing and releasing these guidelines is currently unclear.