The under-16 ban is why the platforms want this

Last week I gave you two names, myID and ConnectID, and said the jobs start to cross on 1 December. This week, the reason the platforms are in such a hurry to have either of them. It isn't the government opening the doors. It's the law that already closed one.

The ban is older than it feels. Parliament passed it in November 2024. It took effect on 10 December 2025. As of today eSafety names ten platforms that have to keep under-16s off: Facebook, Instagram, Kick, Reddit, Snapchat, Threads, TikTok, Twitch, X and YouTube. Messaging apps, games and the likes of YouTube Kids sit outside it. The onus is on the platforms, not the kids and not the parents, and the words the law uses are "reasonable steps".

What that has looked like so far, in eSafety's own numbers: about 4.7 million accounts "identified as belonging to children under 16" had their access removed in the first half of December. By the start of March another 310,000-odd had been stopped from signing in or signing up. And in March eSafety said it had "significant concerns" about five of the ten, Facebook, Instagram, Snapchat, TikTok and YouTube, and that it was "moving into an enforcement stance". Its survey of parents found around seven in ten whose child had an account before 10 December said the child still had one. The most common reason: the platform hadn't asked yet.

The fine for not taking reasonable steps is now up to $109.2 million, per eSafety's page, updated last month. When the bill passed, the number was $49.5 million. I don't know the mechanics of how it doubled and I'm not going to pretend I do; the page says what it says.

Here is the bind the platforms are in. eSafety has told them a birthdate typed at sign-up no longer counts. They're expected to stop fake identity documents, "AI tools or deepfakes", and kids using a VPN to look like they're overseas. So they need something that actually proves a person is sixteen or more.

And in the same breath the law tells them what they can't do. In eSafety's words: the legislation "specifically prohibits platforms from compelling Australians to provide a government-issued ID or use an Australian Government accredited digital ID service to prove their age." They can offer it, but they must also offer "a reasonable alternative", so that nobody over sixteen loses an account for refusing to hand over a licence. Making you use government ID carries the same $109.2 million.

So the platforms have to check millions of ages, properly, without demanding the one document that would make it easy. Now go back and read ConnectID's own pitch from last week: social media age checks "may only need confirmation that you're over 16 — without needing to share your name or upload identity documents like your driver licence or passport." That sentence was written for this exact bind. Snapchat has offered it to its users since the day the ban took effect. The bank already knows how old you are; the bank says "yes, over 16" and nothing else; the platform never sees your licence. For the platform it's an answer to "reasonable steps" that doesn't cost it a privacy breach. For the provider it's the biggest customer base in the country lining up at once.

And it isn't only social media. From March this year a second set of rules, the industry codes, reaches further. Search engines blur the rough stuff until you log in and confirm you're eighteen, with the checks required from 27 June. AI chatbots that can produce adult material have to keep kids out. App stores, for apps rated 18+, from 9 September. The codes say they "do not require services to verify age using government ID" either. Same shape as the ban: prove your age, but we won't say how, and you can't be made to show your licence.

Put the two together and you get the thing I actually want you to see. Age checks are becoming the toll gate on the ordinary internet, for adults as much as kids. Every toll gate needs a key that proves something about you without telling the gate everything about you. That is precisely what the accredited digital ID providers sell, and on 1 December the government's own key, myID, goes on the market to businesses too, at a per-transaction fee still being set. The ban made the demand. December supplies the keys.

What I like, and what I'm watching. I like that the law wrote the "no compulsory ID" line in, and wrote a fine next to it. I like that ConnectID's answer to "are you sixteen" is a yes or a no, not a photo of your licence in some company's filing cabinet. And I like that platforms have to ring-fence the age data and destroy it once it's used; the Prime Minister's own release says a failure to destroy it is a Privacy Act breach.

What I'm watching is the word "reasonable" in "reasonable alternative". Out here the alternative has to work for a sixteen-year-old with no bank account of her own, no passport, one bar of signal and a parent whose bank isn't one of the four. I'm watching the kitchen table: the kid, the tablet, and the parent's banking app open beside it, because that's how "verify with your bank" plays out in a lot of houses, and nobody has written down what that means. And I'm watching the register. eSafety already warns that scammers are sending fake "prove your age or lose your account" messages. The platform tells you how it checks; the ACCC's register tells you who's accredited; anything else is noise.

Next Monday: anonymity, the bush, and the questions worth asking before you hand anyone a key.

What I'd do this week, and why. Not what you should do. What I'd do.

• If a platform asks me to prove my age, I'd read every option it offers before I pick one, and pick the one that shares the least. A yes-or-no from a bank beats a photo of a licence. The law says there has to be a choice; I'd use it.
• If there's an under-16 in the house, I'd have the conversation before the platform does. eSafety says platforms must let a kid download their photos and messages before the account goes; I'd make sure that happened, because once it's gone it's gone.
• I'd treat any age-check message that arrives by text or email as a scam until I'd found the same instruction inside the app's own Help section. eSafety says the platforms will tell you their steps there, and only there.