Australia passes ‘world first’ social media platform age restriction law

Passage of the Online Safety Amendment (Social Media Minimum Age) Bill 2024 to amend the Online Safety Act 2021 (‘the Bill’) comes shortly after the Australian government announced its intention to introduce the new legislation on 9 November, meaning the Bill was rushed through by the government. Prime minister Anthony Albanese accepted the regulation was not perfect, but said that “social media is doing harm to kids”, that he is “calling time on it” and “it was the right thing to do”.

Privacy and technology law expert Veronica Scott of Pinsent Masons said: “The enactment of a minimum age for social media makes Australia a test case for governments worldwide in their efforts to address the growing public concerns about the harms associated with social media, but it’s not clear this will be liked and shared elsewhere as it’s a blunt instrument”.

Technology law expert Elly Krambias of Pinsent Masons added: “While other jurisdictions have introduced laws that require parental permission for children accessing social media, Australia's approach is absolute, setting a new benchmark for social media platforms”.

The minimum age obligation will begin within 12 months of the Bill receiving Royal Assent, on a date to be determined by the minister for communications (‘the minister’). There are no ‘grandfathering’ arrangements for existing accounts held by under-16s included in the legislation meaning that, once in force, the obligations will also apply to existing accounts.

The new obligations will apply to certain kinds of social media platforms that are “age-restricted’’. Electronic services will fall within the scope of the new definition if the “sole” or a “significant” purpose of the service is to enable online social interactions between two or more end users; they allow end users to link or interact with other end users; and they allow end users to post the material on the service.

While the definition of an age-restricted social media platform is broad, the minister has flexibility over the scope of the measures through legislative rule-making powers. The aims of these powers include enabling the regulations to be dynamic and responsive to emerging technologies and services, and allowing under-16s to retain access to platforms that are beneficial to them.

The government has indicated that it is considering excluding certain platforms from the age restrictions in its initial rules, such as messaging apps, online gaming services and services with the primary purpose of supporting the health and education of end users. Online business interactions are expressly excluded.

Platforms regulated by the new law will be required to take reasonable steps to prevent children under 16 from having accounts. The Bill does not specify what measures would constitute reasonable steps, but its object is to reduce the risk of harm. An explanatory memorandum published alongside the Bill indicates that, at a minimum, platforms will need to implement some method of age assurance. The government is due to complete an age assurance trial in 2025, which is likely to inform regulatory guidance on acceptable age verification methods. Digital platforms had called for the Bill to be delayed until a report had on this trial had been received.

The Bill also introduces strict privacy obligations, including to disincentivise and prohibit the overcollection and retention of personal information by platforms for the purposes of the minimum age obligation.

The changes coincide with the first tranche of reforms to the Privacy Act 1988 being passed by the Australian parliament, which create the mechanism for developing and approving a Children’s Online Privacy Code based on the UK model.

“Privacy is a key risk raised by the age restriction obligation given the potential for platforms to collect and hold personal including sensitive information about vulnerable groups,” said Veronica Scott. “The Bill expressly prohibits the use or disclosure of the information for any other purpose other than to determine if a user is age-restricted, unless certain permitted exceptions in the Privacy Act apply or the individual consents.”

Australia’s eSafety Commissioner will have various powers to enforce and issue guidance in relation to the new obligations. Platforms that fail to comply will face penalties of up to 150,000 penalty units, currently equivalent to approximately A$50 million (£25.7m).

A review is required to be conducted within two years of the new laws taking effect. This review will examine whether the measures are effective and delivering the desired outcomes for Australians, according to the explanatory memorandum published alongside the Bill. It will also consider if any changes to the scope or the minimum age are required. According to the minister's second reading speech, this could include a consideration of whether the scope should capture additional social media platforms that can be viewed without an account.