The prime minister, Anthony Albanese, has said the government will impose an as-yet-undefined ban on younger teenagers and children from accessing social media before the next election.
On Tuesday, Albanese announced the plan to introduce legislation into parliament by the end of 2024 to block children from social media and other digital platforms unless they are over a certain age – likely to be between 14 and 16. It will come after the $6.5m trial of age verification or assurance technology funded in May’s budget.
It followed South Australia’s plan, announced Monday, to restrict access to people aged 14 and over, and the Coalition announcing earlier this year it would ban children under 16 from social media within 100 days if it won the next election.
Questions remain about what methods may be used, and whether a ban will be enforceable, or effective.
What are the options for verifying ages?
On Tuesday, the federal government put out a tender for the age assurance trial but there is little detail of what will be included. Some sites, such as Instagram, already employ limited age verification for some users using ID, but there is not one method used by the industry.
Based on the experience of other countries, there are a few options.
Most proponents suggest Australia should follow the UK’s example. The UK scheme is still in its early stages and only applies to adult sites, not social media.
It outlines five ways companies can verify users’ age, but some would not work for under-16s:
Allowing banks to confirm a user is over 18.
Allowing mobile providers to confirm a user is an adult.
Credit card checks: credit card holders in the UK need to be over 18; the website can check with the issuer that the card is valid.
Asking site users to upload a photo that is then matched with photo ID.
Use of facial age estimation technology.
In last year’s roadmap for age verification, the eSafety commissioner recommended a “double-blind tokenised approach”. That is a device-based token where a third-party provider transfers proof-of-age information between sites and age assurance providers, to protect user privacy.
Meta, the parent company of Facebook and Instagram, has also advocated verification on the device level – meaning Google and Apple would verify the ages of people wanting to download specific social media apps.
Will it work?
In the South Australian review, a former chief justice of the high court, Robert French, noted compliance – and enforcing it on companies outside Australia – would be challenging.
Guardian Australia previously reported the UK’s regulator cast doubt on whether facial age estimation would be effective on younger people, but the facial estimation companies disputed this.
Documents uncovered by Guardian Australia include the communications department’s August 2023 survey of the international landscape of age assurance technology, released under FoI.
It said: “No countries have implemented an age verification mandate without issue.”
According to the documents, problems found overseas included:
UK age verification laws abandoned in 2019 due to “delays, technical difficulties and community concern for privacy”.
In the US, the report noted the states of Utah and Louisiana, where age verification was brought in, experienced an almost 1,000% and threefold respective increase in the use of virtual private network (VPN) technology to bypass the restrictions.
Estimates briefing documents prepared for the eSafety commissioner late last year – also released under FoI – also stated “no country in the world has solved this problem”.
The commissioner’s notes said any system in Australia would need to be “effective and enforceable”, and cover more than just the sites deemed unsuitable for minors, including search engines.
But French said these hurdles did not mean it was not worth pursuing.
“There will undoubtedly be workarounds by knowledgable child users. However, the perfect should not be the enemy of the good,” French said.
Will there be privacy concerns?
If the government pursues a method where companies require all users – not just those younger users – to verify their ages before being able to use a platform, it could result in social media companies being forced to collect user identification, which would raise privacy questions.
This is likely a less palatable option, given high-profile cyber-attacks on companies already required to collect ID – Optus and Medibank – that led to the personal information of millions of Australians being exposed.
The government might require the use of its planned digital ID service to reduce the risk, but that has yet to be decided.
Will social media companies comply?
The South Australian proposal, as well as the Coalition’s, suggests fines could be levied against companies that fail to enforce age restrictions.
The Online Safety Act already empowers the eSafety commissioner to seek fines against companies for failing to comply with notices, but those powers are now being tested in the courts against X.
The outcome, along with the current review of the Online Safety Act, will likely inform whether such laws can be enforced.
Legislation also likely needs to address what happens for new social media companies, or lesser-known platforms younger people may use if they can no longer access the main players. As French said, for platforms with little presence in Australia, this may be hard to enforce.
The Online Safety Act already empowers the commissioner to block websites and remove apps from app stores for failing to comply with orders – as a nuclear option.
