Age Verification Laws in Australia: What They Require

Australia requires online age verification for pornography and other adult content through the Age-Restricted Material Codes made under the Online Safety Act 2021, nine industry codes registered by eSafety, a separate scheme from the country's under sixteen social media account ban.

This article addresses the Age-Restricted Material Codes, Australia's age assurance regime for online pornography, high impact violence, and material promoting self-harm or disordered eating, registered by eSafety under the Online Safety Act 2021. It does not cover the separate under sixteen social media minimum age scheme, covered in Social Media Minimum Age Laws in Australia, or Australian privacy law generally, covered on the Australia data privacy laws hub.

What Are the Age-Restricted Material Codes?

The Age-Restricted Material Codes are the official name eSafety uses for Australia's online age assurance regime for pornography, high impact violence, and material promoting self-harm or disordered eating. eSafety describes them as the second phase of its online safety codes. The first phase, the Unlawful Material Codes and Standards (six codes and two standards), is a separate regime dealing with the most seriously harmful illegal material, such as child sexual exploitation and pro-terror material.

There are nine Age-Restricted Material Codes, all industry codes made under Part 9 of the Online Safety Act 2021 and focused on class 1C and class 2 material. Three were registered on 27 June 2025, covering hosting services, internet carriage services and search engine services. The other six were registered on 9 September 2025, covering app distribution services, equipment providers, social media services (core features), social media services (messaging features), relevant electronic services and designated internet services.

When Did the Rules Take Effect?

The Codes commenced in two tranches, and several specific obligations inside them then had their own later start dates.

Within those already effective codes, two staged sub-obligations have their own commencement dates, and both have now passed. Age checks for a logged in user of a search engine service had to be in place before 27 June 2026. Age checks for a user downloading an R18+ app from an app distribution service had to be in place before 9 September 2026. As of today, both are live, current obligations, not future requirements.

What Search Engines and Apps Must Do

The search engine code requires that search results containing pornography and high impact violence be blurred by default unless the user is logged in to an account and confirmed as 18 or older. A logged in adult can opt in to keep that material blurred even after confirming their age. eSafety states that you can still use a search engine without logging in; logging in only affects whether age restricted material in the results is blurred.

App distribution services carry a parallel obligation: an age check before a user can download an R18+ app, in place since 9 September 2026.

Preventing Workarounds: VPN Detection

A provider covered by the Codes must take reasonable steps to prevent workarounds to its age assurance measures. eSafety's own guidance states this expectation explicitly includes detecting VPN use, a specific expectation rather than generic language about preventing circumvention. The detailed standard for what counts as appropriate age assurance sits in the Head Terms of the Codes, referenced from eSafety's register of online industry codes and standards.

How Is This Different from the Under Sixteen Social Media Ban?

These are two separate schemes and should not be conflated. Australia's social media minimum age law bans account holding for a person under sixteen on covered social media platforms, a distinct legislative mechanism with its own commencement timeline. See Social Media Minimum Age Laws in Australia for that scheme.

The Age-Restricted Material Codes instead require an age check before viewing certain content, apply to a user of any age, and cover services well beyond social media, including search engines, internet carriage services, hosting services and app stores. A reader could easily assume that Australia banning under sixteens from social media is the same rule that now applies to searching Google; it is not.

The Separate OAIC Children's Online Privacy Code

A third, separate instrument sits nearby and is worth distinguishing clearly. The Office of the Australian Information Commissioner is developing its own Children's Online Privacy Code, expected by 10 December 2026, made under the Privacy Act rather than the Online Safety Act 2021, and administered by a different regulator, the OAIC rather than eSafety. As of this article's verification date the Children's Online Privacy Code is still in development and is not yet in force; do not describe it as an existing requirement.

How Are the Codes Enforced?

eSafety's enforcement toolkit for a breach of a code or standard includes directions to comply, formal warnings, infringement notices, enforceable undertakings, and court ordered civil penalties or injunctions through the Federal Court. eSafety states that ongoing failure to comply with the codes may result in civil penalties of up to $54.6 million per breach, and that there are no penalties for children who access age restricted material.

eSafety has already enforced the Age-Restricted Material Codes themselves: on 19 May 2026 and 16 June 2026 it issued directions to comply under the Designated Internet Services code each to a provider whose name it withheld on public safety grounds, for failing the code's age assurance requirements for online pornography and for generative AI material.

eSafety has also used its tools against major platforms under its broader Online Safety Act powers, including an enforceable undertaking from Roblox Corporation dated 19 August 2026 over contact-with-children and private-by-default settings for under sixteens, and alleged non-compliance action against Telegram dated 29 July 2026 that was before the court as of eSafety's last update. Both of those examples arose under the Relevant Electronic Services Standard 2024, part of the separate first-phase Unlawful Material Codes and Standards, not under the Age-Restricted Material Codes.

Frequently Asked Questions

What are Australia's age verification laws called?

The Age-Restricted Material Codes, made under the Online Safety Act 2021. eSafety describes them as the second phase of the online safety codes; the first phase is the separate Unlawful Material Codes and Standards.

When did Australia's age verification rules start?

In two tranches: 27 December 2025 for search engines, internet carriage services and hosting services, and 9 March 2026 for designated internet services, relevant electronic services, social media services, app distribution services and equipment providers. Specific obligations within those codes, such as search engine logged in age checks, had their own later start dates.

Do I have to log in to use a search engine in Australia now?

No. You can still use a search engine without logging in. Logged in age checks only affect whether pornography and high impact violence are blurred in your results.

Can I get around age verification with a VPN?

Providers covered by the Age-Restricted Material Codes are required to take reasonable steps to prevent workarounds, which eSafety states explicitly includes detecting VPN use.

Is this the same as Australia's ban on under sixteens using social media?

No. That is a separate scheme that bans account holding for under sixteens on social media platforms. The Age-Restricted Material Codes instead require age checks before viewing adult content, apply to users of any age, and cover services well beyond social media, including search engines, internet providers and app stores.

What happens if a company does not comply with the Codes?

eSafety can issue directions to comply, formal warnings and infringement notices, accept enforceable undertakings, or seek civil penalties or injunctions from the Federal Court.