On December 10, 2025, Australia became the first country to make social platforms legally responsible for the age of their users. Not their sign-up forms, their users: the Online Safety Amendment (Social Media Minimum Age) Act obliges every "age-restricted social media platform" to "take reasonable steps to prevent age-restricted users having accounts," where an age-restricted user is an Australian child under 16. There is no parental-consent path, no penalty for the child or their parents, and no grandfathering: accounts that existed before the law counted the same as new ones. Eleven months in, it is the largest live experiment in platform regulation, and the results are more complicated than either side predicted.
The law's actual shape
The duty lands on the platform's provider, full stop. App stores, operating systems, and other developers owe nothing under it, though Meta and Snap argued loudly that age checks belonged at the app-store level and Canberra refused. Whether your own service is in scope is a definition test: significant purpose of online social interaction, users can link or interact, users can post material, plus (per the minister's rules) a recommender feature or an engagement loop gated behind the account. Eight classes are excluded by purpose: messaging, email, and calling as one class, then online games, product or service information sharing, professional networking, education, health, and the dedicated channels for school-to-student and provider-to-patient communication.
eSafety's assessed list on day one named ten platforms: Facebook, Instagram, TikTok, Snapchat, X, YouTube, Reddit, Threads, Kick, and Twitch. The YouTube inclusion was the loud one: the government exempted it when the Act passed in November 2024, then reversed in July 2025 on eSafety's advice. Pinterest, Discord, WhatsApp, Messenger, Roblox, Steam, GitHub, and YouTube Kids were assessed and cleared. And the definition is a moving target: platforms are obliged to keep reassessing as they add features or usage shifts, so an excluded app can grow into scope.
The rules under the rule
Two constraints shape how the check may work. Platforms can never require government ID as the only way to prove age; an alternative must always exist. And whatever is collected for age assurance may be used for nothing else and must be destroyed after use, with the privacy regulator co-enforcing. eSafety's standard is layered "reasonable steps": self-declared birthdays are insufficient alone, existing accounts must be found and deactivated, new under-16 sign-ups blocked, and circumvention mitigated. The penalty ceiling started at 150,000 penalty units for a corporation, roughly A$49.5 million, and Parliament doubled it in September 2026, the communications minister accusing platforms of "taking the mickey" on reporting.
What eleven months produced
The numbers tell two stories at once. Meta reported deactivating over half a million accounts in the first days, and eSafety's compulsory information-gathering notices put the aggregate above 4.7 million accounts deactivated, removed, or restricted almost immediately, a figure the government now states as more than 5 million. But a University of Newcastle study found about 85 percent of under-16s still on the prohibited platforms three months in, and independent estimates around the seven-month mark put retention near 80 percent: fake ages, VPNs, parents' accounts, and migration to apps outside the list. eSafety's own March 2026 compliance update conceded "a substantial proportion" of under-16s still hold or create accounts, announced a shift from monitoring to enforcement with five platforms under investigation, and November closed with the same headline as December opened: zero fines issued. The constitutional challenge is live too. Reddit and the Digital Freedom Project joined forces in the High Court, arguing the ban impermissibly burdens the implied freedom of political communication; the full court heard the case November 3 to 4 and reserved judgment, expected early 2027.
What it means if you build apps
The direct read: if your app is social, run the definition test against it now, because the law's trigger is features, not category labels. A community feature bolted onto a utility app can drag the whole product into scope if social interaction becomes a significant purpose. The indirect read is broader: Australia made proving your users' ages a supply-chain problem for platforms, and the pattern is spreading fast enough to be a roadmap. Malaysia's ban started June 1, 2026. The European Commission proposed its KIDS Act in September 2026, a graduated scheme: no social accounts under 13, guardian-managed accounts at 13 and 14, independent accounts at 15. The UK announced its own ban in June 2026, with regulations expected in force in spring 2027. And the same week's news in the US is the state-level version: Texas made app stores verify age, with the duties split differently. Every government that follows picks a side in the fight Australia settled by force: platforms check ages at the platform, not the store.
Our position
The honest verdict on year one is that the ban works exactly as designed and fails exactly as predicted. The design was always about liability transfer: putting the obligation on the party with the engineering capacity. Removing 5 million accounts proved platforms could find underage users all along, which is the fact that will outlive the law. The failure is the one critics named on day one: the duty covers the named platforms, not the internet, so the audience just moved. For builders, the durable lesson is neither political: age is becoming an input your app may be asked to consume or produce, the reasonable-steps standard punishes checkbox compliance while tolerating circumvention, and the safest architecture treats age assurance like consent management: a service layer, not a form field.
The takeaway
keep under-16s from holding accounts;
applies to pre-existing accounts too
features and purpose, not by category;
keep reassessing as your app changes
must exist; age data used for nothing else
and destroyed after
on platforms; five under investigation;
zero fines; penalties doubled to ~a$109m
speech challenge; expected early 2027
proposed sept 2026, uk targeting 2027;
us states chose the app-store route
Compliance-by-features is the same trap we walk clients through in our custom software work, where a social add-on changes the whole regulatory surface of a product like CashTaq. If your app is drifting toward the definition, send us the listing.
// sources
// next step
We work this way on client projects too.
Tell us what you are making. We reply with a plan, a timeline, and a price.
