How will platforms verify age?
Under the new framework , social media companies may request government-issued identification but cannot make it mandatory to access the platform.
Other measures could include reviewing a user’s search history or using facial-recognition technology. Yet, a government trial this year found that face-scanning technology could estimate a user’s age only within an 18-month range in 85 per cent of cases.
Instagram has announced it will use artificial intelligence (AI) to estimate the ages of Australian users. Early testing suggests nine out of 10 teen accounts would remain active under the new system.
UNSW security and privacy expert Dr Rahat Masood , from the School of Computer Science and Engineering , says major technology companies already use AI to learn more about their users.
“Big tech companies don’t need traditional age-gating mechanisms to figure out how old their users are,” she says.
“They already know a lot from patterns of behaviour - when someone logs on, who they interact with, what they search for, or whether their geolocation matches a school during the day.”
Dr Masood says many under-16s also don’t have government-issued ID, so companies will likely rely on AI systems to verify age. But she warns these models are far from perfect – often experiencing hallucinations and biases.
“AI can misjudge age, especially across different demographic groups,” she says.
“And how does it tell the difference between someone who’s 15 years 364 days or 16 years and 1 day? The signals are almost identical.”
A safer alternative: zero-knowledge proofs
Whatever technology is used, the large-scale data collection could expose users to new risks if sensitive information is stored or shared.
UNSW cybersecurity expert Dr Hammond Pearce , also from the School of Computer Science and Engineering, says while no method is perfect, zero-knowledge proof (ZKP) technology could offer a privacy-first solution.
“ZKP is a cryptographic process that lets one party prove a statement – like being over 16 – without revealing any other personal information,” Dr Pearce says.
“We could have a system where the government issues digital tokens confirming a person’s age.
“Websites would consume the token to verify the user is over 16 but wouldn’t learn anything else – and the government wouldn’t track which sites use them, as well.
“It’s a much safer way to verify sensitive information online.”
While some European countries have already started to introduce secure digital identity apps, they’re also backed by stronger data protection laws – an area Australia lags in, says Dr Pearce.
“The European Union’s General Data Protection Regulation sets some of the world’s toughest data privacy standards,” he says.
“There are very harsh fines against those who violate their standards.
“Australia needs to follow suit – so companies take online privacy more seriously.”
Not a ban, but a delay
Dr Pearce says the new rules won’t ban young people from using social media, but aims to slow down how quickly they join the platforms.
“Around 60 to 80% of teenagers would need to stop using social media for the ‘network effect’ to take hold,” he says.
“The network effect is typically a positive feedback system, so users derive more value from a product or service as more users join the network.
“If their friends can’t access a platform, there’s less incentive to use it. You don’t need to verify every user for the policy to have an impact.”
Still, Dr Pearce says, achieving complete accuracy would require uploading ID – which could create the kind of privacy risk regulators are trying to avoid.
“The only way to be 100% sure is to upload a passport or government-issued ID – and that’s not what we want.”
Balancing safety and privacy
With just weeks until the new rules come into effect, both experts say the challenge is finding the right balance.
“There’s still a lack of clarity on how the government plans to audit social media companies on whether they’ve complied with the guidelines,” says Dr Masood.
“Protecting children online is crucial but we also need to ensure the solutions don’t create bigger risks in the process.”