Age Verification Roadmap – key updates on the regulation of online safety and age verification

The release of the eSafety Commissioner’s Roadmap for Age Verification and the Australian Government’s response puts a pause on mandatory age verification, but signals a focus on further regulatory reform.

On 31 August 2023, the Australian Government jointly released:

• the eSafety Commissioner’s Roadmap for Age Verification (Roadmap), which was originally submitted to the Government in March 2023; and
• its response to the Roadmap (Response).

The Roadmap sets out the Commissioner’s recommendations on the implementation of a regime of mandatory age verification, focused primarily on protecting children from online pornography. The Roadmap is accompanied by a background report which provides comprehensive analysis of the evidence which supports the Roadmap’s findings.

In this instalment of our online safety series, we set out the key takeaways and implications for online service providers of the Roadmap and Response. You can see our previous briefing on the regulation of age verification technologies here. 

Further regulatory reform and action

The Roadmap and Response sets out some of the regulatory commitments of the eSafety Commissioner and Government. This includes eSafety continuing to issue reporting notices to online service providers to enhance transparency and accountability under the Basic Online Safety Expectations. The Roadmap indicates the notices could be informed by issues considered in the Roadmap, including in relation to the provision of content filters, online pornography policies and enforcement, and the enforcement of minimum age requirements.

The Government has also:

• committed to bringing forward the mandated independent statutory review of the Online Safety Act 2021 (Cth) to sometime in 2024; and
• expressed support for the introduction of a Children’s Online Privacy Code, mirroring the UK’s Age Appropriate Design Code. This was a recommendation made in the Attorney-General’s recent Privacy Act Review Report, and the Response suggests this code could address the steps that entities may need to take to establish an individual’s age.

New industry codes forthcoming

Another key focus of the Roadmap and Response is the development of new industry codes covering ‘class 2 content’, which is content that is legal but not appropriate for children (e.g. pornography).

As explained in our previous instalment, industry codes create mandatory compliance requirements for online service providers. Current industry codes only cover ‘class 1 content’, which is content that would likely be refused classification in Australia (e.g. child sexual exploitation), and not all proposed class 1 codes have been finalised to date.

In the Response, the Government has urged the eSafety Commissioner to commence work on the class 2 codes as soon as possible following completion of the class 1 codes. The potential scope of the class 2 codes is broad and could include technological solutions to limit access to class 2 material and actions to implement online content filtering.

Age assurance pilot

One of the Roadmap’s key findings is that the market for age assurance (which includes both age verification and age estimation technologies) is currently too immature to mandate the uptake of these technologies. Instead, the Roadmap recommends an initial pilot be conducted using dummy sites with different use cases (e.g. online pornography, online wagering and online alcohol sales). In particular, the Roadmap recommended the trial of a ‘double-blind token’, which would involve an age assurance provider issuing a token that could be stored on a browser or digital wallet and used by an online service provider to verify a user’s age.

However, the Government has indicated in the Response that it will await the outcomes of the class 2 industry code process before deciding on a potential age assurance pilot.

Other key recommendations

Additional recommendations made in the Roadmap which have been supported by the Government include:

• investing in further research around the potential impacts of online pornography on children;
• establishing an Online Safety Tech Centre to support parents, carers and other to understand and apply safety technologies; and
• conducting further work to identify barriers to the uptake of safety technologies such as internet filters and parental controls.

What next?

Online service providers should brace for further regulatory notices being issued with a focus on minimum age requirements and steps being taken to combat online pornography. They should also prepare for further regulatory change with respect to online pornography and age assurance requirements.

Although the Government has postponed the introduction of mandatory age verification, online service providers should start considering the impact that such requirements may have on their service. This includes consideration of the privacy, security and expense involved with potential age assurance technologies.