Australia’s under-16 social media ban has a loophole: the honor system.
A Reuters-reported study found that major platforms did not require proof of age from any of the 50 test accounts that declared themselves as 16 after the law took effect. The result puts early pressure on platforms to show they can detect underage users without relying only on self-declared birthdates, while giving regulators an early test of how “reasonable steps” will work in practice.
Age checks stall at sign-up
Since December 2025, Australia’s social media law has required platforms, including Instagram, Snapchat, YouTube, TikTok, and others, to bar people under 16 from holding accounts. To ensure compliance, the government recommended layered verification rather than a single-check method.
According to Reuters, a team of software testers that previously trialled age-assurance software on more than 1,000 Australians later opened 50 accounts after the law came into force. Each account declared the user’s age as 16, yet none was asked for proof of age.
“You should be asked to demonstrate how old you are, and not once have we been asked to verify our age or use age-assurance measures,” Andrew Hammond, director at testing firm KJR, told Reuters.
Reuters also noted that all 50 test accounts remained active across nine of the 10 platforms covered by the age restrictions. One account that signed up to X as a 16-year-old was served pornographic content, Hammond reported. Only Australia-based live-streaming platform Kick refused to allow account creation without proof of age.
Platforms face a harder compliance test
Australia’s law only works if platforms can spot risky or potentially underage accounts before they slip through the sign-up process. If users can bypass that first layer by entering a false birthdate, enforcement becomes much harder.
The Daily Star, citing Reuters, said the findings highlight a flaw in the rollout, while public debate has focused more heavily on photo-based age-estimation tools. The issue is not only whether facial estimation works, but whether platforms know when to trigger verification at all.
For Australian businesses, this is a compliance warning.
Platforms may need better behavioral signals, reporting flows, and escalation systems to prove they are taking reasonable steps. Advertisers and brands also face reputational risk if youth-targeted ads or unsafe content reach accounts that should have been flagged.
Must-read security coverage
- UK Police Convicts Pair in £5.5 Billion Bitcoin Launder Case
- Blackpoint Cyber vs. Arctic Wolf: Which MDR Solution is Right for You?
- How GitHub Is Securing the Software Supply Chain
- 8 Best Enterprise Password Managers
Privacy remains the policy tradeoff
Australia’s approach faces another hurdle: privacy
Platforms cannot solely rely on government-issued identification, a rule meant to prevent online safety checks from becoming a broad digital ID requirement. This creates a difficult tradeoff for regulators and companies.
Stronger checks may reduce underage access, but they can also add friction, collect sensitive data, or push young users toward less regulated platforms. The testing also suggests that circumvention may need more attention.
Colm Gannon, Australia’s CEO of the International Centre for Missing & Exploited Children and an adviser to the original project, told Reuters that the issue was overlooked during the earlier trial.
“We did want to talk about circumvention, but we kept on being told that that wasn’t part of the actual trial. What we are now seeing is that circumvention has become the go-to by young people,” Gannon said.
The eSafety Commissioner’s office told Reuters it remains confident that platforms have the technology and resources to prevent under-16s from holding accounts, adding that layered checks avoid a single point of failure if implemented correctly.
For Australia, the next test is enforcement, but the implications will not stop at its borders.
Other countries considering similar age restrictions will have to show that age bans can work in practice, not just on paper. This can be achieved with the right technical design, privacy limits, platform incentives, and regulatory follow-through.
More Australia tech news: Want the bigger security picture? Learn why AI-driven identity attacks are accelerating across Australia and the broader APAC region.