Online Safety: Australia's Social Media Minimum Age Bill

On 29 November 2024 the Federal Government passed the Online Safety Amendment (Social Media Minimum Age) Bill 2024 (Bill) requiring social media platforms to take reasonable steps to prevent users under 16 from having an account on their platforms. The world first legislation aims to combat ongoing online safety concerns and protecting young Australians by minimising the risk of online harm.

The Bill amends the Online Safety Act 2021 (Cth), with key changes include:

• requirement for certain social media platforms to enforce a minimum age requirement of 16 to create or hold an account, referred to as an ‘age-restricted social media platforms’;
• an obligation on age-restricted social media platforms to take ‘reasonable steps’ through age assurance processes and technology to prevent underage users from creating and holding accounts on their platforms;
• additional privacy obligations on use or disclosure and destruction of personal information collected for age assurance purposes;
• the eSafety Commissioner will be empowered to create legislative rules and is conferred with greater regulatory tools and powers to enforce the new regime;
• a penalty regime for non-compliance with the new obligations and significantly increased penalties for breaches of industry codes and standards.

The Bill will also amend to the Age Discrimination Act 2004 (Cth) to facilitate the reform.

In this article, we provide an overview of the proposed regime including who it will apply to, the new obligations and powers imposed, and the consequences for non-compliance.

Who will this apply to?

The new regime will apply to ‘age-restricted social media platforms’ defined as being an ‘electronic service’ that:

• has the ‘sole’ or ‘significant’ purpose to enable social interaction between two (2) or more end-users;
• allows end-users to link to, or interact with, some or all of the other end-users; and
• allows users to post material on the service for social purposes.

Additional conditions or identification of specific services may be also included in the legislative rules.

The Minister’s Second Reading Speech, expressed the Federal Government’s minimum expectations of in scope providers, quoted saying: “To be clear, the Government expects that this broader definition will capture services that are commonly accepted to be social media, and the services that are causing many parents the most concern. This will, at a minimum, include TikTok, Facebook, Snapchat, Reddit, Instagram, X (formerly Twitter), among others.”

The Bill also provides a ‘categorical rule-making’ power to exclude certain services from the definition. The Federal Government initially intends to exclude messenger, online gaming, health and educational focused services. The ‘out-of-scope’ status will apply to services like Facebook Messenger Kids, WhatsApp, Google Classroom or YouTube.

New obligations on age-restricted social media platforms

Obligation to take reasonable steps

The Bill provides an obligation to take reasonable steps to ensure age-restricted users do not use the platform. However, it does not prescribe what ‘reasonable steps’ are required to ensure compliance or provide any technology or methodology requirements on age assurance.

The eSafety Commissioner will be responsible for writing guidelines on the ‘reasonable steps’ to be taken by age-restricted social media platforms. These may also be dealt with in the legislative rules, or as otherwise prescribed by the Minister in consultation with the eSafety Commissioner.

Collection of personal information for age assurance

The Bill also includes a number of provisions that address the potential personal information that may be collected for age assurance purposes. In particular, the Bill expressly addresses the consequences of platform providers not complying with core privacy law requirements, including that:

• any personal information collected for age assurance purposes, and used or disclosed for any other purpose without consent of the individual (or certain other specific circumstances) is deemed to be an interference with the privacy of the relevant individual for the purpose of the Privacy Act 1988 (Cth). The Bill also expressly requires consent of an individual for this purpose to be voluntary, informed, current, specific, unambiguous and is able to be withdrawn by the individual easily; and
• any personal information collected for age assurance purposes, and not destroyed after using or disclosing it for age assurance purposes, is deemed to be an interference with the privacy of the relevant individual for the purpose of the Privacy Act 1988 (Cth).

Age-restricted social media platforms providers are also required to ensure that identification issued by government, or that require the use of an accredited service (within the meaning of section 9 of the Digital ID Act 2024), are not the only means of age assuring to comply with the minimum age obligation.

Obligation to provide information about compliance

On request by the eSafety Commissioner, age-restricted social media platform providers will be required to provide information, or documents as required by the notice and within the notice period specified by the Commissioner.

When will the new obligations come into effect?

The new obligation for age-restricted social media platforms to take reasonable steps to prevent age-restricted users having accounts will not apply for at least 12 months with the date to be set by the Minister.

Consequences for non-compliance

The new obligation for age-restricted social media platforms to take reasonable steps to prevent age-restricted users having accounts is a civil penalty provision with a maximum penalty of 30,000 penalty units (equivalent to $9.9 million) and for bodies corporate this increases to 150,000 penalty units (equivalent to $49.5 million).

As part of this specific reform, the Federal Government has taken the opportunity to increase all civil penalties under the Online Safety Act to these amounts. As pointed out in the Explanatory Memorandum, these penalties are now consistent with the maximum penalties currently available for contraventions of the Australian Consumer Law under the Competition and Consumer Act 2010 (Cth), and for serious and repeated interferences with privacy under the Privacy Act 1988 (Cth). They also bring Australia in line with the online safety maximum financial penalties in Ireland, the European Union and the UK.

Related developments

November has been a busy month for the Federal Government. This Bill among many others was passed on the same day as the Privacy and Other Legislation Amendment Bill 2024 (Cth).

See our dedicated page for the latest developments in relation to technology, privacy and data.