Will Australia’s social media ban on children work? A look at the hidden challenges of age verification

As per the legislation, social media companies are liable for fines up to 50 million Australian dollars (Rs 275 crore approx.) if they fail to prevent children under the age of 16 from holding accounts on their platforms.

“Platforms now have a social responsibility to ensure the safety of our kids is a priority for them,” Australian Prime Minister Anthony Albanese said on Friday. The social media ban has been introduced to mitigate the physical and mental health risks faced by children due to excessive use of social media. It has also been rolled out in response to misogynist content and harmful depictions of body image shown to teenagers on these platforms.

However, the path to implementing the social media ban on children under 16 is dicey.

“Even though it’s been passed, there has been a lot of debate within Australia about whether a social media ban is the best way to go about addressing these risks,” said Aparajita Bharti, the co-founder of tech policy organisation The Quantum Hub (TQH).

First, what does the law say?

The newly approved legislation is titled the Online Safety Amendment (Social Media Minimum Age) Act 2024. While it bans under-16 children from holding a social media account, they are allowed to access these platforms in a “logged out state”. For example, they can visit the Facebook page of a business or service as this does not normally require users to log into the platform.

The onus of keeping age-restricted users out of social media is placed on platforms. Hence, there are no penalties for users or their parents.

The legislation requires platforms to take “reasonable steps” to ensure that the minimum age requirement is met, but it does not specify these measures. “Whether an age assurance methodology meets the ‘reasonable steps’ test is to be determined objectively, having regard to the suite of methods available, their relative efficacy, costs associated with their implementation, and data and privacy implications on users, amongst other things,” it reads.

As far as the scope of the law is concerned, it states that the minimum age obligation is only for “age-restricted social media platforms” which has been defined by drawing on the existing meaning of “social media service” in the country’s Online Safety Act.

Messaging apps, online gaming services, and platforms that are primarily used for health and education purposes are to be exempted from the ban. However, the law does not make an exception for age-restricted users who have the consent of their parents or carers.

To ensure user privacy, the legislation requires platforms to only use the information collected for the purpose of age assurance and nothing else – unless the user gives their clear, informed consent to do so. Platforms are also required to delete the data collected after a user’s age has been assured. Additionally, platforms cannot ask Australians to give their government-issued IDs for age assurance.

Why is Australia’s social media ban flawed?

With the law now having been passed, attention has shifted towards the challenges in its implementation. Stating that children are adept at finding ways to circumvent restrictions on internet and social media access, Bharti said, “I’ve heard of kids using Google Docs to do things they want to do on social media because they want to go around their parents. In that sense, it might put children at more risk as you wouldn’t know what platform they are using and whom to regulate.”

Australia’s social media ban could also have a disproportionate impact on youth from marginalised groups who rely on social media to connect with others and access information. “In cases of rape, abuse or trauma, support for victims may come from social media and it could be detrimental to them if you cut them off from these platforms,” said Pallavi Bedi, a senior policy researcher at the Centre for Internet and Society (CIS).

Bharti further emphasised that policy meant to protect children from online harm should be sensitive to the socio-economic context of the country and the nuances of how people interact with technology such as device sharing.

Referring to the situation in India, she cited a TQH survey of 5,000 children from low-income households in Delhi, Rajasthan, and Jharkhand. According to the survey, over 70 per cent of the children said that they use their parents’ phone to access social media while 80 per cent of them help their parents to navigate online.

How feasible are age-verification methods?

Several methods exist to verify a user’s age but nearly all of them come with drawbacks. Self-disclosure is easy to circumvent as users are just required to tick a box stating that they are above the minimum age. ID-based verification, on the other hand, raises privacy risks and could put an end to online anonymity which is often said to make the internet what it is.

Instagram’s ‘Teen Accounts’ require ‘social vouching’ where three of the user’s followers need to vouch that they are not under the minimum age. However, this method is only effective if users already have accounts on the platform. Estimating age based on user behaviour also suffers from the same flaw.

Given these limitations, there has been a shift away from age verification towards age estimation and age assurance. Instead of platforms knowing for sure that a user is of a certain age, they can use tools that estimate a user’s age in order to simply indicate whether they are above or below the threshold. Similarly, age assurance methods are used to indicate whether the user falls within the age-restricted bracket or not.

Highlighting a French company’s new tool that can estimate a person’s age based on their hand movements, Bharti said, “There is a lot of innovation happening in the age-verification tech space, and the reason for innovation is because everyone recognises that ID-based verification is not the best.”

The Australian government has also roped in tech companies and software testers to conduct a trial on age-gating technology. The trial will see participation from over 1,200 randomly chosen Australians between January to March next year, according to a report by Reuters.

While the purpose of the trial is to determine how the social media ban will be enforced in the country, the government has been criticised for rushing the new legislation through parliament before the outcomes of the trial are known.

How does India compare?

If Australia succeeds in obtaining a feasible technological solution to age verification that balances privacy and user rights, it would set a precedent for governments worldwide, including India, to require social media giants like Meta and X to take similar measures.

Currently, India’s Digital Personal Data Protection Act, 2023, has a higher level of requirement than age verification. “The Act requires “verifiable parental consent”. So, after the platform does age estimation, then the platform has to collect parental consent while also ascertaining that it is the parent of the child that is giving the consent. But is there a technical tool that can establish a parent-child relationship?” asked Bharti.

Earlier this year, The Indian Express reported that the IT Ministry had sought inputs from the tech industry on how the legal requirement can be enforced after failing to come up with a viable technological solution that would allow companies to gather parental consent to process children’s personal data.

While the Indian government was initially considering using Digilocker to establish the relationship between children and their parents, the idea was dropped due to the file storage app’s low adoption rate, Bharti said.

However, CIS’ Bedi said that verifying a user’s age will also involve asking their parents for consent. She further urged policymakers to take a graded approach that is similar to the UK’s legislative framework for ensuring children’s online safety.