Australia
Australia's Online Safety Amendment (Social Media Minimum Age) Act 2024 requires age-restricted social media platforms to take reasonable steps to stop under-16s holding accounts, an obligation that took effect on 10 December 2025 and remains in force despite a pending High Court constitutional challenge that has not produced an injunction. Separately, nine eSafety-registered industry codes made under the Online Safety Act 2021 require age assurance for Class 1C and Class 2 material such as online pornography across search engines, websites and generative AI services, and app distribution platforms, phasing in between December 2025 and September 2026. A statutory children's online privacy design code is still in development: an exposure draft under section 26GC of the Privacy Act 1988 is out for consultation, but the Code need not be registered until 10 December 2026, so no enforceable design code exists yet. eSafety's voluntary Safety by Design principles and its 2023 age verification roadmap report informed this framework but are not themselves binding instruments.
National jurisdiction. Reviewed 2026-07-15.
Designated Internet Services Online Safety Code (Class 1C and Class 2 Material)
Requires providers of designated internet services, including websites hosting online pornography and generative AI services capable of producing Class 1C or Class 2 material, to implement age assurance and access controls to prevent access by children in Australia. Registered by the eSafety Commissioner on 9 September 2025.
- Citation
- Designated Internet Services Online Safety Code (Class 1C and Class 2 Material), registered under section 140 of the Online Safety Act 2021 (Cth)
- Status
- In force
- Effective date
- 2026-03-09
- Applies to
- Private sector
- Age threshold
- 18
- Verification methods
- gov id, facial estimation, third party service
- Covered services
- Websites and generative AI services accessed via a browser that host or generate online pornography or other Class 1C or Class 2 material.
- Penalties
- A direction to comply with the code that is not followed is enforceable through civil penalty proceedings under the Online Safety Act 2021.
- Enforcement body
- eSafety Commissioner
- Source
- Designated Internet Services Online Safety Code (Class 1C and Class 2 Material), registered under section 140 of the Online Safety Act 2021 (Cth)
Internet Search Engine Services Online Safety Code (Class 1C and Class 2 Material)
Requires providers of internet search engine services, such as Google Search and Bing, to implement appropriate age assurance measures so that account holders are checked as over or under 18 before search results can surface Class 1C or Class 2 material, including online pornography. Registered by the eSafety Commissioner on 27 June 2025, with the age assurance measure itself required within 6 months of the code coming into effect, by 27 June 2026.
- Citation
- Internet Search Engine Services Online Safety Code (Class 1C and Class 2 Material), registered under section 140 of the Online Safety Act 2021 (Cth)
- Status
- In force
- Effective date
- 2025-12-27
- Applies to
- Private sector
- Age threshold
- 18
- Verification methods
- gov id, facial estimation, third party service
- Covered services
- Internet search engine services. eSafety guidance states self-declaration of age is not sufficient to meet the code.
- Penalties
- A direction to comply with the code that is not followed is enforceable through civil penalty proceedings under the Online Safety Act 2021.
- Enforcement body
- eSafety Commissioner
- Source
- Internet Search Engine Services Online Safety Code (Class 1C and Class 2 Material), registered under section 140 of the Online Safety Act 2021 (Cth)
App Distribution Services Online Safety Code (Class 1C and Class 2 Material)
Requires app store and app distribution platform operators, such as the Apple App Store and Google Play, to take reasonable steps, including age assurance and access controls, before permitting the download or purchase of an app containing Class 1C or Class 2 material such as pornography. Registered by the eSafety Commissioner on 9 September 2025, with the age assurance measure required within 6 months of commencement, by about 9 September 2026.
- Citation
- App Distribution Services Online Safety Code (Class 1C and Class 2 Material), registered under section 140 of the Online Safety Act 2021 (Cth)
- Status
- In force
- Effective date
- 2026-03-09
- Applies to
- Private sector
- Age threshold
- 18
- Verification methods
- gov id, facial estimation, third party service
- Covered services
- App distribution platforms, chiefly the Apple App Store and Google Play, for apps containing online pornography or other Class 1C or Class 2 material.
- Penalties
- A direction to comply with the code that is not followed is enforceable through civil penalty proceedings under the Online Safety Act 2021.
- Enforcement body
- eSafety Commissioner
- Source
- App Distribution Services Online Safety Code (Class 1C and Class 2 Material), registered under section 140 of the Online Safety Act 2021 (Cth)
Online Safety (Age-Restricted Social Media Platforms) Rules 2025
Legislative instrument made by the Minister for Communications, registered and commencing on 30 July 2025, that excludes specified categories of service from the age-restricted social media platform definition, so the section 63D minimum age obligation (which itself commenced 10 December 2025) does not apply to them.
- Citation
- Online Safety (Age-Restricted Social Media Platforms) Rules 2025 (Cth), F2025L00889, made under the Online Safety Act 2021 (Cth)
- Status
- In force
- Effective date
- 2025-07-30
- Applies to
- Private sector
- Age threshold
- 16
- Covered services
- Excludes messaging and communication services, online gaming services, professional networking and development services, and services primarily for education or health support. eSafety guidance treats messaging apps, most gaming platforms and services such as Discord, Roblox, Steam, WhatsApp and YouTube Kids as out of scope.
- Enforcement body
- eSafety Commissioner
- Source
- Online Safety (Age-Restricted Social Media Platforms) Rules 2025 (Cth), F2025L00889, made under the Online Safety Act 2021 (Cth)
Online Safety Amendment (Social Media Minimum Age) Act 2024
Requires a provider of an age-restricted social media platform to take reasonable steps to prevent Australians under 16 from having an account. Received Royal Assent on 10 December 2024 and the section 63D civil penalty obligation commenced 12 months later, on 10 December 2025.
- Citation
- Online Safety Amendment (Social Media Minimum Age) Act 2024 (Cth), No. 127, 2024, inserting Part 4A into the Online Safety Act 2021 (Cth), No. 76, 2021
- Status
- In force
- Effective date
- 2025-12-10
- Applies to
- Private sector
- Age threshold
- 16
- Verification methods
- facial estimation, third party service, transactional data, self declaration
- Covered services
- Age-restricted social media platforms as defined in section 63C, including Facebook, Instagram, Snapchat, TikTok, X, Threads, YouTube, Twitch, Kick and Reddit. Section 63DB separately bars providers from relying on government issued identification documents or accredited digital ID services as the only means of age assurance; reasonable alternatives must be offered.
- Penalties
- Civil penalty of up to 150,000 penalty units for a body corporate, currently equivalent to about $49.5 million AUD, for systemic non-compliance under section 63D.
- Enforcement body
- eSafety Commissioner
- Private right of action
- no
- Litigation
- Digital Freedom Project (for plaintiffs Macy Neyland and Noah Jones) v Commonwealth of Australia, High Court of Australia, plus a related challenge pursued by Reddit Inc, High Court of Australia, On 4 December 2025 the High Court agreed to hear a constitutional challenge based on the implied freedom of political communication. No injunction was granted, so the section 63D obligation took effect as scheduled on 10 December 2025 and remains in force while the challenge proceeds.
- Source
- Online Safety Amendment (Social Media Minimum Age) Act 2024 (Cth), No. 127, 2024, inserting Part 4A into the Online Safety Act 2021 (Cth), No. 76, 2021
Children's Online Privacy Code (Privacy Act 1988, section 26GC)
Requires the Australian Information Commissioner to develop and register an Australian Privacy Principles code addressing the privacy of children, covering social media services, relevant electronic services and designated internet services likely to be accessed by children, within 24 months of the amending Act's Royal Assent on 10 December 2024, that is, by 10 December 2026. An exposure draft, drawing partly on the UK Age Appropriate Design Code, was released for public consultation from 31 March to 5 June 2026 and includes proportionate age assurance and limits on retaining facial age estimation data, but the Code is not yet finalised or registered.
- Citation
- Privacy Act 1988 (Cth), section 26GC, inserted by the Privacy and Other Legislation Amendment Act 2024 (Cth), No. 128, 2024
- Status
- Proposed
- Effective date
- Not yet effective
- Applies to
- Private sector
- Covered services
- Social media services, relevant electronic services and designated internet services that are likely to be accessed by children or primarily concern the activities of children, excluding health service providers.
- Penalties
- A breach of the registered code will be treated as an interference with privacy under the Privacy Act 1988, subject to the Act's existing civil penalty framework.
- Enforcement body
- Office of the Australian Information Commissioner (OAIC)
- Source
- Privacy Act 1988 (Cth), section 26GC, inserted by the Privacy and Other Legislation Amendment Act 2024 (Cth), No. 128, 2024
Reviewed 2026-07-15. Confidence: high. Fast-moving area, verify before relying. Not legal advice.