As of 10 December 2025, age-restricted social media platforms in Australia must take reasonable steps to prevent Australians under 16 from creating or keeping accounts. The rules apply to platforms including Instagram, Facebook, Snapchat, TikTok, Twitch, X, YouTube, Kick, Reddit and Threads. eSafety's assessment can change as services evolve.
What's Not Age-Restricted
Several services are currently outside the age-restricted social-media rules, including many messaging and gaming services. eSafety currently lists services such as Discord, GitHub, Google Classroom, Messenger, Pinterest, Roblox, Steam, WhatsApp and YouTube Kids as not age-restricted.
That distinction matters: the law is about accounts on defined age-restricted social-media services, not a blanket ban on being online.
The Age Assurance Problem
How do you establish whether someone is over 16 without collecting more personal information?
Platforms can use different age-assurance approaches, and eSafety has published guidance around the reasonable steps expected under the law. Depending on the service, age assurance can involve signals from an existing account, age-estimation technology, or other verification methods.
The privacy question is straightforward: what information is collected, who receives it, how long is it retained, and can it be reused for another purpose?
Who Gets Penalized?
The rules focus on platforms rather than punishing children for having an account. Under-16 users are not the target of the penalties; platforms can face substantial enforcement consequences if they fail to take reasonable steps.
The Surveillance Creep
Age assurance can create privacy risks even when the policy goal is legitimate:
Verification infrastructure can become useful for identity profiling.
Biometric or identity signals can be more sensitive than the account data they replace.
Third-party verification introduces another organization into the trust chain.
The privacy test is therefore not simply whether age checks exist. It is whether the system minimizes the data needed to perform the check.
Global Implications
Other jurisdictions are watching Australia's implementation closely. Age-assurance proposals are appearing in different forms across the UK, US states and Europe, but the legal details vary significantly.
Australia is an important real-world test case because its rules are already operating rather than merely proposed.
The Real Cost
The stated goal—reducing harms associated with certain social-media design features—is a policy choice worth debating. The privacy trade-off deserves the same scrutiny.
The question is not whether children deserve protection online. They do. The question is whether protecting them requires creating another layer of identity infrastructure that can later be reused for something else.
Sources and dates matter here. This article was updated September 6, 2026 to reflect the current eSafety guidance and platform list.