Australia’s social media ban has an enforcement problem. These new laws aim to fix it

In the same week the federal government is preparing to introduce its landmark digital duty of care legislation, it is also returning to some unfinished business: strengthening its social media age restrictions. On Tuesday, the government will move an amendment through federal parliament to give the eSafety Commissioner stronger powers to investigate whether social media platforms are complying with the minimum age rules. The changes bring these investigative powers into line with those eSafety already has for other online safety obligations. Why is the government introducing these laws? Australia’s social media age restrictions came into effect in December last year. They require major social media platforms to take “reasonable steps” to stop Australians under 16 from holding accounts. Importantly, the law doesn’t punish teenagers for using designated platforms. The legal responsibility sits with the platforms to keep them from holding an account. However, there are already serious questions about platform compliance. A recent study provides some of the clearest evidence so far. Researchers followed more than 400 Australian teenagers before and after the restrictions took effect. Three months in, more than 85% of participants aged under 16 were still using social media platforms covered by the law. Most were accessing them through their own accounts. There was certainly some circumvention. Of those that attempted to use a restricted service, between 15% and 19% reported using a fake account, while 6% to 11% reported accessing social media through a private browser. But the problem isn’t simply crafty teenagers finding ways around the rules. Only about two-thirds of under-16s still using restricted platforms reported encountering any sophisticated age check at all. Common approaches included simply asking users to state their age or upload a selfie. The researchers ultimately found little evidence that the legislation had produced a substantial immediate reduction in social media use among under-16s. That suggests the gap between passing an age restriction and actually enforcing one is significant. This is the gap the new Online Safety Amendment Bill is trying to address. What’s included in the amendments? The most significant change is to eSafety’s information-gathering powers. The amendment will empower the commissioner to demand documents – not just information – from social media companies which show what they’ve done (or failed to do) to enforce age restrictions. It will also empower eSafety to gather information or documents from other people and organisations where it reasonably believes they have evidence relevant to an investigation. This matters because social media platforms don’t operate in isolation. They sit within a much larger digital ecosystem of app stores, technology vendors, advertising companies, and increasingly, specialist age-assurance providers. A platform may be legally responsible for keeping under-16s from holding accounts, but the systems it relies on to do that may be designed or operated by other companies. Imagine, for example, a social media platform engages a third-party company to provide its age-checking technology. Under the amendments, eSafety could seek information directly from that company to independently test whether the platform’s approach is actually working. App stores, which sit between platforms and many of their users, are another obvious potential source of information. This gives eSafety a better view of the whole system rather than just the platform at its centre. Effective regulation can’t depend entirely on asking a company whether it thinks it is complying with the rules. If responsibility is spread across an ecosystem of different technologies and providers, regulators need to be able to follow the evidence across that ecosystem too. The bill also doubles the fines that companies may be ordered to pay if they are found to have breached the age restrictions, bringing it up to a maximum of A$99 million. This brings the financial penalties in line with other corporate regulation in Australia. However, the 2024 Rickard Review of the Online Safety Act recommended that courts should be able to impose penalties in an amount that reflects a percentage of global turnover, say 5%, if that is greater. Other countries do this in their online safety laws. It is also in Australia’s competition and consumer law and privacy law. Are these changes likely to be effective? The amendment will give the regulator expanded access to important evidence, and a bigger stick when companies don’t comply. And it will bring the powers for enforcing the social media minimum age restriction into line with the other powers the eSafety Commissioner already has. But there is a limit to what stronger information gathering and higher penalties for this one measure can achieve. Researchers, including many of us working in this area, warned before the original legislation passed that age assurance would be difficult, young people would find ways around restrictions, and measuring whether the policy was actually working would be challenging. The early evidence bears out many of those concerns. Australia is simultaneously moving towards a digital duty of care, which starts from a somewhat different idea about online safety. Age restrictions essentially ask: how do we keep young people out of potentially harmful digital environments? A duty of care asks: how do we make all digital environments safer for everyone? Teenagers are highly motivated users of digital services, and their online lives stretch across apps, browsers, devices, messaging services and other parts of a complex digital ecosystem. Keeping them out of a handful of social media platforms won’t address the deeper problems of platform design, recommendation systems and business models that can make these environments harmful in the first place. That is why the digital duty of care may ultimately prove to be the better and more important reform. It puts responsibility back where much of it belongs: on platforms to identify and reduce foreseeable harms created by their services. The difficulties enforcing the age ban only strengthen the case for getting that broader reform right.