Social Media Minimum Age

From 10 December 2025, age-restricted social media platforms will have to take reasonable steps to prevent Australians under the age of 16 from creating or keeping an account on their platform.

This is called ‘social media minimum age’ (SMMA) but sometimes it is also referred to as the social media ‘ban’, ‘delay’, ‘age restriction’, or ‘age obligation’.

Quick facts: SMMA

• was introduced when the Online Safety Act 2021 (OSA) was amended in November 2024 to include Part 4A.
• will apply to all users, residing in Australia, who create or keep an account with an age-restricted social media platform.
• operates to remove or prevent the creation of social media accounts for users under the age of 16.
• puts the onus on age-restricted social media platforms, not parents or young people, to take reasonable steps to prevent under 16s from having accounts.
• will require social media platforms to introduce some form of age assurance, which is when methods are used to understand a person’s age online.
• incorporates strong privacy protections for the handling of personal information by age-restricted social media platforms, and third parties known as ‘age assurance providers’, for age assurance purposes.
• imposes robust obligations on age-restricted social media platforms to ‘ringfence and destroy’ any information collected for age assurance purposes, with serious penalties applicable for breach of these requirements.
• incorporates a review of the legislation within 2 years of effective commencement, including the effectiveness of privacy provisions.

To learn more about SMMA and latest updates, visit eSafety’s Social media age restrictions hub

The OAIC has the important role to enforce compliance of the privacy provisions set out in SMMA and the Privacy Act 1988.

The OAIC is an Australian government agency responsible for regulating privacy, meaning our goal is to protect the personal information of Australians. The OAIC does this with the Privacy Act 1988 and the Australian Privacy Principles.

There are three distinct roles in the implementation, oversight and enforcement of SMMA which include the Minister for Communications, eSafety and the OAIC.

The Minster for Communications is responsible for making the legislative rules regarding SMMA,while eSafety and the OAIC are co-regulators of SMMA.

Minister for Communications

The Minister for Communications is responsible for

• making any legislative rules specifying services that are or are not coveredby the definition of an age-restricted social media platform.
• making any legislative rules specifying kinds of information that providers of age restricted social media platforms must not collect for purposes of complying with the SMMA obligations. The Minister must seek and have regard to advice from the eSafety Commissioner and the Information Commissioner, before making any legislative rules of this type.
• specifying the day for the obligations to take effect, which is 10 December 2025.
• initiating an independent review of the operation of the SMMA within two years after it takes effect.

eSafety

eSafety is responsible for specifying the ‘reasonable steps’ that age-restricted social media platforms must take to comply with their SMMA obligations.

The regulatory guidance for age-restricted social media platforms can be accessed on eSafety’s website: Regulatory guidance | eSafety Commissioner

eSafety is also the place where you can find more information about SMMA, including:

• Why are under-16s being ‘banned’ from social media?
• Which platforms will be age-restricted?
• Which platforms have been excluded from the age restrictions?
• What can I do now to help my family prepare?

Check out Social media age restrictions hub | eSafety Commissioner

OAIC

The OAIC is here to guard and uplift the privacy protections of Australians by ensuring that the age assurance methods used by age-restricted social media platforms and age assurance providers are lawful.

Age-restricted social media platforms and age assurance providers compliance with the SMMA obligation will not be considered reasonable unlessthey also comply with their privacy obligations under Part 4A of the Online Safety Act 2021, as well as the Privacy Act 1988 and the Australian Privacy Principles regulated by the OAIC.

Specifically, the OAIC oversees and enforces the privacy provisions set out in Section 63F of SMMA, which specifies how age-restricted social media platforms and third parties must handle personal information for the purpose of age assurance.

The OAIC has published regulatory guidance for age-restricted social media platforms and third party age assurance providers. Check out Privacy Guidance on Part 4A (Social Media Minimum Age) of the Online Safety Act 2021 | OAIC

The Information Commissioner is also responsible for:

• Providing advice to the Minister for Communications, when requested, on the kinds of information that must not be collected by age-restricted social media platforms.
• Functions under the Privacy Act 1988 that are triggered if an ‘interference with the privacy of an individual’ occurs.
• Preparing and publishing platform provider notifications if satisfied that an age-restricted social media platform has failed to meet SMMA privacy obligations.
• Making sure regulated entities follow the Privacy Act 1988 and other laws when handling personal information, including sensitive information. This can involve conducting investigations and handling complaints.

Age assurance is when a method is used to determine a person’s age or age range. There are many different methods of age assurance and there is no one-size-fits-all solution.

SMMA places the responsibility of determining who is under the age of 16 strictly on age-restricted social media platforms.

Age-restricted social media platforms may apply their own ‘in-house’ or ‘proprietary’ age assurance methods to meet their SMMA obligation, or they may use a third party known as an ‘age assurance provider’ to conduct the age check.

Different methods may be applied by different age-restricted social media platforms and a user may experience multiple age assurance methods on the one platform.

Methods of assurance

To determine who is an age-restricted social media users in Australia, every user – regardless of their age – will experience some kind of age check known as age assurance.

Some age assurance methods are quick and happen in the background. These methods use existing information, such as when an account was created, to detect potential age-restricted users without the user needing to provide more information. These ‘frictionless’ methods may appear as though no age assurance has taken place.

While these frictionless methods do not require a user to verify their age, that is, prove their age through other age assurance methods, a user’s personal information still goes through an age assurance method to infer that the account is not held by an age-restricted user.

Other methods might be more time-consuming and require a user to supply additional personal information. For example, a user may be requested to take a selfie, log into another online service, or capture an image of a government issued ID, to name a few.

There is no mandate on which method of age assurance age-restricted social media platforms must use. Age-restricted social media platforms may provide the option to choose which age assurance method takes place.

SMMA legislation specifically prohibits age-restricted social media platforms from compelling Australians to use government-issued identification, including Digital ID, to prove their age online.

Age-restricted social media platforms may offer providing government-issued ID as an option as part of their layered approach. But they must also always offer a reasonable alternative that doesn’t require the collection of government-issued ID.

Understanding what age assurance is and what different methods involve can help you make an informed decision.

There are three broad categories to age assurance:

Age Estimation – is when technologies like facial analysis and artificial intelligence are used to predict a user’s age or age range based on various data points, such as physical characteristics or online behavioural patterns.

This method estimates a user’s age through biometric or statistical techniques, such as facial analysis, voice modelling or motion pattern recognition, without the need for formal identity documents (age verification).

Age Inference – uses established information that implies that an individual’s likely age or age range based on contextual, behavioural, transactional or environmental signals, rather than biometric data (age estimation) or identity documents (age verification).

This method infers a user’s age by analysing information, known as ‘signals’, such as when the account was created, financial transactions, app settings, service usage or participation in age-specific activities. These age-related signals may include:

• Age of account (e.g. the account has existed for 10 or more years)
• Engagement with content targeted at children or early teens
• Linguistic analysis/language processing indicating the end-user is likely a child
• Analysis of end-user-provided information/posts (e.g. analysis of text indicating age)
• Visual content analysis (e.g. facial age analysis performed on photos and videos uploaded to the platform)
• Audio analysis (e.g. age estimation based on voice)
• Activity patterns consistent with school schedules
• Connections with other end-users who appear to be under 16
• Membership in youth-focused groups, forums or communities.

This information may be generated on the platform, or they may be received from elsewhere, such as an app store, operating system or third-party vendor.

Age Verification - uses official documents or data sources, such as government-issued IDs, including a driver’s licence or passport, to confirm a user’s age.

This method verifies age by referencing a verified date of birth and calculating an age from that known data point. Age verification is already in widespread use across many regulated industries, for example, showing government issued ID to purchase alcohol.

While age assurance methods vary, many involve the capture of new personal information, including sensitive information, for the purpose of determining the user’s age or age range.

SMMA requires age-restricted social media platforms and third parties to handle personal information for the purpose of determining if:

• a user is ordinarily a resident in Australia, through location information; and
• the account held or being created is owned by an age-restricted user, through age assurance methods.

Under the legal framework for SMMA, age-restricted social media platforms and third parties will need to provide notice that a user’s personal information is being handled, but they are not always required to ask for consent to use and collect this information.  If they collect this information and offer to use it for another purpose, such as advertising, they must ask for the user’s consent.

Location information

SMMA requires that only children under the age of 16 who are ordinarily a resident in Australia are prevented from having an account on an age-restricted social media platform. This means that methods need to be employed to determine whether a user is ordinarily a resident in Australia.

Location-related information that may indicate if a user ordinary resides in Australia include:

• An Australian mobile number
• IP address
• Wi-Fi network information
• GPS information or other location services
• Device language and time settings
• Device identifiers
• Information about the mobile service provider
• App store, operating systems and account settings
• Shared through photos, tags, connections, engagement and other activity indicating they are ordinarily a resident in Australia.

Determining a user’s likely country of residence can be based on a combination or aggregate of location information.

Age Assurance

Age assurance is when a method is used to determine a user’s age or age range online.

There is no single method to age assurance. This means that the personal information handled for age assurance purposes will vary, depending on the method applied.

Personal information includes a broad range of information, or an opinion, that could reasonably identify an individual.

The types of personal information handled for the purpose of age assurance may include:

• a person’s name
• date of birth
• contact details
• government issued ID
• images, voice recording or videos where the person is identifiable.

Age assurance methods may also require the handling of sensitive information, which is a category of personal information that, if exposed, can cause harm or discrimination.  Sensitive information is afforded a higher level of privacy protection.

Examples of sensitive information handled for the purpose of age assurance may include:

• photographs, videos or voice recordings where sensitive information such as race, ethnicity or health information can be inferred
• biometric information such as ‘biometric templates’ which analyse physical characteristics.

Privacy safeguards are the set of rules designed to protect a person’s personal information by specifying the legal obligations for data collection, use, storage, disclosure and destruction.

SMMA has multiple privacy safeguards that work together. These include:

• Section 63F in Part 4A of the Online Safety Act 2021
• the Privacy Act 1988
• the Australian Privacy Principles.

Together, these privacy safeguards impose robust legal obligations on age-restricted social media platforms and third parties regarding their handling of personal information for age assurance purposes of the SMMA scheme.

Section 63F

The OAIC oversees and enforces the privacy provisions set out in Section 63F in Part 4A of the Online Safety Act 2021, which specifies that age-restricted social media platforms and age assurance providers must:

• ringfence and destroy any personal information collected for the purpose of age assurance
• use or disclose the personal information otherwise than
• for the purpose of determining whether or not the individual is an age-restricted user; or
• in circumstances where APP 6.2(b), (c), (d) or (e) of the Australian Privacy Principles applies; or
• with the consent of the individual, whereby that consent must voluntary, informed, current, specific and unambiguous; and the individual must be able to withdraw the consent in a manner that is easily accessible to the individual.

Failure to meet these obligations will be deemed as ‘an interference with the privacy of an individual’ and trigger the complaint function under Section 36 of the Privacy Act 1988.

Other safeguards

Section 63F in Part 4A of the Online Safety Act 2021 operates alongside the Privacy Act 1988 and the Australian Privacy Principles.

Additionally, under the Privacy Act 1988, sensitive information is afforded higher privacy protections. This means that any sensitive information handled for the purpose of age assurance, such as biometric templates like physical characteristics used for facial analysis, receives higher protections.

SMMA also includes two information protecting provisions, that:

• empower the Minister to exclude specified types of information being collected and used by age-restricted social media platforms and third parties for the purposes of meeting SMMA obligations.
• specify that age-restricted social media platforms must not collect government-issued identification (including Digital ID), for age assurance purposes, unless a reasonable alternate method is also offered.

Collectively, SMMA’s legal framework alongside the Privacy Act 1988, provides stringent and robust privacy protections for handling personal information, for the purpose of age assurance by age-restricted social media platforms and third parties, as they comply with their SMMA obligations.

You may have the option to choose what age assurance method is applied. This means you may have a choice on what personal information is handled by age-restricted social media platforms for SMMA’s age assurance purposes.

Being aware of what personal information may be handled for the purpose of age assurance on age-restricted social media platforms, provides you the opportunity to make informed decisions.

eSafety has specified in its guidance to age-restricted social media platforms that it is reasonable to expect that any age assurance methods and surrounding systems and processes, should be transparent and clear to users.

Specifically, information provided by age-restricted social media platforms about age assurance methods should:

• use plain-language explanations of when and why age assurance is required.
• provide guidance on what age assurance optionsare being used or are available to users.
• explain what personal informationwill be collected, used, how it will be stored and protected, possible outcomes and what the platform or provider will do with the result – including what is retained or destroyed and what other privacy protections are in place and relevant transparency obligations under the Privacy Act 1988.
• provide information about what is happening or may happen to age-restricted users accounts, how they can download their information, the basis of and right to seek review of any decision, and where they can go for support.

You may choose not to engage with an age assurance method on an age-restricted social media platform for any reason. However, this may impact your ability to create or access a social media account on an age-restricted social media platform.

Here are some general tips to protect your personal information online:

Value your information: Personal information is valuable, and not just to the person it belongs to. Personal information can be used for targeted advertising and make money for online companies. Treat personal information like the asset it is. Don’t share it without good reason and only share what’s necessary. Also, know your rights. Learn more about Your privacy rights | OAIC

Check before sharing: Make sure you trust who you share your information with. Check that the organisation or person is who they say they are and has a good reputation. If it looks suspicious, don’t risk it. Scamwatch has some great advice on how to spot a ‘fake’, whether it’s an email, phone call or document. Scammers are getting increasingly sophisticated, so staying alert is more important than ever.

Read privacy policies and notices: If you’re sharing your information, it’s important to be clear on how it will be used. Check that the privacy practices of the organisations that you deal with are up to scratch. A good place to start is by reading their privacy policy. There is a range of information that should be included in an organisations’ privacy policy, including how personal information is collected and held, how it will be used, and how to lodge a complaint. If you can’t understand an organisation or agency’s privacy policy, ask them to explain it.

Update your privacy settings: Always check what you are saying ‘yes’ to. Many websites, apps and devices share your personal information by default. Check if you are sharing any information that you’d rather keep private. Make an informed choice. Choose your advertising preferences. Say ‘no’ to cookies (or delete them) if that is your preference. And consider limiting things like location tracking.

Protect your accounts: Use multi-factor authentication (eg., 2-step verification) and strong passphrases to protect your accounts. Passphrases are made up of 4 or more random words, making them longer (and safer) than a traditional password. This makes them harder to guess but easy to remember. If multi-factor authentication is given as an option for a system or app you are on, use it. It provides an important extra layer of security for your accounts.

Respond to breaches: Sometimes things go wrong. If your privacy is breached, act quickly to reduce your risk of harm. Steps you can take include:

• Changing your passphrases (password)
• Watching out for phone or email scams
• Checking your credit report
• Checking your financial accounts for suspicious activity.

If you have any questions about breaches, contact the relevant agency, such as the age-restricted social media platform. You should also keep a record of any action you take or help you get. This may be useful if you experience harm as a result of the data breach.

Talk about privacy: Protecting privacy is important at all ages, but it’s not necessarily something people talk about. Make a point of talking about privacy with your friends and family, and especially children. Its essential young people understand how important their privacy is as soon as they start using digital devices and going online. You may also be able to help others you know be more confident in navigating online privacy settings and having good privacy measures in place. Learn more Privacy tips for parents and carers | OAIC

If you’re concerned your personal information has been mishandled, you should first complain to the age-restricted social media platform or third party you think has mishandled it.

If they don’t resolve your complaint, you can make a complaint to the OAIC.

A step-by-step guide on how to make a complaint to an organisation or agency is available on our website.

eSafety is the place where you can find more information about SMMA, including:

• Why are under-16s being ‘banned’ from social media?
• Which platforms will be age-restricted?
• Which platforms have been excluded from the age restrictions?
• What can I do now to help my family prepare?

Check out Social media age restrictions hub | eSafety Commissioner