Australia's Social Media Minimum Age Law: Who Is Covered, Penalties and the High Court Challenges

Since 10 December 2025, platforms that meet the legal definition of an age-restricted social media platform must take reasonable steps under Part 4A of the Online Safety Act 2021 to prevent Australians under 16 from holding an account; the obligation falls on platforms, not on children or parents.

This article covers the social media minimum age scheme created by the Online Safety Amendment (Social Media Minimum Age) Act 2024, inserted as Part 4A of the Online Safety Act 2021: what platforms must do, which services and users are covered, the penalties, and the litigation testing the law's validity. It does not cover the wider Privacy Act framework, covered in the Australia data privacy laws hub, or the separate deepfake, image-based abuse and doxxing offences covered in deepfake and intimate image laws in Australia and doxxing laws in Australia.

What the Law Requires, and Does Not

Part 4A of the Online Safety Act 2021, inserted by the Online Safety Amendment (Social Media Minimum Age) Act 2024, has one central rule. Section 63D provides that a provider of an age-restricted social media platform must take reasonable steps to prevent age-restricted users, defined as an Australian child who has not reached 16 years, from having accounts with the platform. The stated object of Part 4A, in section 63B, is to reduce the risk of harm to age-restricted users from certain kinds of social media platform, not to remove every under-16 user from the internet.

The Office of the Australian Information Commissioner describes the scheme plainly: it puts the onus on age-restricted social media platforms, not parents or young people, to take reasonable steps to prevent under-16s from having accounts. Every civil penalty in Part 4A, sections 63D, 63DA, 63DB and 63H, applies to a provider or a person who fails to comply with a regulator notice about a provider's compliance. No provision in Part 4A creates an offence or penalty a child or a parent can commit; the law is structured entirely around platform conduct.

Reasonable steps is also not an absolute duty to prevent every under-16 account. eSafety and OAIC both frame the obligation as reasonable steps, weighed against what is available, effective and proportionate for a given provider, a standard that eSafety itself has described as genuinely fact-intensive to prove in court (see What Has Happened Since 10 December 2025, below).

When the Law Started

Part 4A itself commenced on 11 December 2024, the day after the Act received Royal Assent on 10 December 2024. But the core obligation in section 63D did not start on that day. Section 63E, the delayed-effect provision, let the Minister specify, by notifiable instrument, the day section 63D would take effect, provided that day was no later than 12 months after section 63E itself commenced.

Three independent sources confirm the Minister specified 10 December 2025 as that day: eSafety's own guidance states the law came into effect on 10 December 2025; the Office of the Australian Information Commissioner states that from 10 December 2025, age-restricted platforms have to take reasonable steps to prevent under-16 accounts; and the 12-month statutory backstop in section 63E independently narrows the window to a date at or before 11 December 2025. Section 63E(4) makes clear the obligation covers accounts that already existed before that date, not only accounts created afterward.

Which Services Are Covered, and the Exclusions

A service is an age-restricted social media platform under section 63C if it is an electronic service whose sole or a significant purpose is enabling online social interaction between two or more end-users, that lets end-users link to or interact with other end-users, and that lets end-users post material, unless it falls within an exclusion. Being funded by advertising does not help a platform avoid the definition; section 63C(3) expressly disregards the provision of advertising and the generation of ad revenue when assessing a service's purpose.

A March 2026 amendment to the Online Safety (Age-Restricted Social Media Platforms) Rules 2025 added a further condition on top of those three. To count as age-restricted, a service must also have a recommender feature, meaning it selects and displays material to a user based on information linked to that user's account, or a logged-in feature, meaning an endless feed, an engagement-metrics feature or a time-limited content feature that is only available to users with an account. A service that meets the three base conditions but has neither feature is not covered by this additional Rules test.

The Rules also set out eight classes of service excluded from the definition, each judged against a sole-or-primary-purpose test (the last two use a lower significant-purpose test):

A service that falls within one of these eight classes is excluded even if it also meets the three base conditions above.

The Platforms eSafety Says Are Covered

eSafety, the regulator responsible for specifying what reasonable steps look like and for publishing guidance on the scheme, maintains its own working list of platforms it considers age-restricted. As of 21 November 2025, the list named ten services: Facebook, Instagram, Kick, Reddit, Snapchat, Threads, TikTok, Twitch, X (formerly Twitter) and YouTube. eSafety reconsidered the list after the March 2026 Rules amendment introduced the recommender and logged-in-feature test above, and confirmed its assessment of those ten platforms had not changed.

A separate group of platforms have told eSafety, unprompted, that they consider themselves covered. Examples eSafety has published include BlueSky, which lowered its minimum age to 16 and notified eSafety on 12 November 2025, and several Match Group services, including Tinder, Hinge and OkCupid, which told eSafety they meet the legal conditions but said they will keep enforcing an 18-plus minimum rather than 16.

eSafety is explicit that this list is not a legally authoritative statement. In its own words, eSafety does not have a formal role in declaring which services are age-restricted social media platforms, and in the absence of a Ministerial rule naming a specific service, any determination that a service is or is not covered is a matter for the court. eSafety also says it will not consider every service, and instead focuses on those with the greatest number of Australian users under 16, so the list is deliberately not exhaustive.

How Age Is Checked: No ID-Only Rule and the Privacy Duty

Section 63DB stops a platform from making government identification the only way to check a user's age. A provider must not collect government-issued identification material, or use an accredited service under the Digital ID Act 2024, for the purpose of complying with section 63D, unless the provider also offers a genuinely reasonable alternative that does not involve ID or an accredited Digital ID service. In practice, a platform may still offer identity-document checking as one option, but it cannot make that the only path to proving a user is not under 16.

Section 63DA separately bans collecting information of a kind the legislative rules specify, for the purpose of complying with section 63D, and if the rules make it impossible for a provider to comply with section 63D at all, section 63DA(3) means the provider is not liable for that failure.

Information collected for age checking carries its own destruction duty under section 63F. If an entity holds personal information collected for the purpose of taking reasonable steps under section 63D and uses or discloses it outside a narrow set of permitted purposes, that is deemed an interference with privacy under the Privacy Act 1988. The entity must then destroy the information after using it for the purpose it was collected for; failing to destroy it is likewise deemed an interference with privacy. The Office of the Australian Information Commissioner describes this in its own guidance as a duty to ringfence and destroy the information.

This creates two separate enforcement tracks that should not be conflated. A failure to take reasonable steps under section 63D, or a breach of the ID-only rule under section 63DB, is enforced as an Online Safety Act civil penalty. A failure to handle or destroy age-checking data properly under section 63F is enforced instead through the ordinary Privacy Act complaint process to the Office of the Australian Information Commissioner, under section 36 of the Privacy Act 1988, not through the Online Safety Act's penalty regime. See how to make a privacy complaint in Australia for that process.

Penalties: 30,000 Penalty Units for the Core Duty, Up to 150,000 for a Corporation

Section 63D sets the civil penalty for the core obligation at 30,000 penalty units. Sections 63DA and 63DB, the information-collection and ID-only rules above, each carry the same 30,000-unit maximum. A separate and much smaller penalty, 500 penalty units under section 63H, applies only to ignoring an eSafety information-gathering notice about a provider's compliance, a process power rather than the headline penalty.

eSafety's own guidance states that a court can order penalties of up to 150,000 penalty units for corporations, currently equivalent to about 54.6 million Australian dollars. That figure uses the penalty unit value of 364 dollars that applies from 1 July 2026: 150,000 units multiplied by 364 dollars equals 54.6 million dollars. An older, still commonly quoted figure of 49.5 million dollars is not a mistake or a different penalty; it is the same 150,000-unit corporate maximum calculated at the previous 330 dollar penalty unit rate, before the most recent indexation. The Act's own text states the base figure as 30,000 penalty units; the higher 150,000-unit corporate figure reflects the multiplier that applies to a body corporate under the Commonwealth's general civil penalty framework, a mechanism eSafety states as an outcome without naming the specific enabling provision.

No provision anywhere in Part 4A creates a penalty for the under-16 user or a parent. The obligation and every civil penalty in the scheme attach only to the platform.

What Has Happened Since 10 December 2025

eSafety reported that by mid-December 2025, platforms had removed 4.7 million under-16 accounts across Australia. In March 2026, following compulsory information-gathering notices sent to the ten platforms it had publicly identified, eSafety published its first compliance update and flagged five platforms with ongoing compliance concerns; eSafety's July 2026 summary of that update does not repeat which five platforms were flagged, and this article has not opened the March 2026 update itself.

eSafety's first outcome data from a two-year evaluation, run with Stanford University's Social Media Lab and an independent academic advisory group and released 31 July 2026, found under-16 account-holding fell from 52.4 percent before the law to 42.1 percent at the three-month follow-up in March 2026, a decline eSafety itself describes as modest but statistically significant. Under-16 use of social media, with or without an account, fell only from 85.9 percent to 81.5 percent over the same period, meaning most under-16s who used social media before the law were still using it three months later, often through another person's account. eSafety's own release states that most under-16s who had accounts before the law started were able to keep them or create new ones by the three-month mark, and names platforms' failure to implement effective age assurance as the main reason.

No civil penalty proceeding under section 63D had been filed as of that same 31 July 2026 release. eSafety's explanation is that proving a reasonable-steps failure in court requires establishing what steps were available to a given provider, their effectiveness, cost and other impacts, and which steps the provider actually took, a fact-intensive test eSafety describes as still under investigation rather than as a decision not to enforce. eSafety said a second compliance update was expected in the weeks after 31 July 2026.

The High Court Challenges

Two matters before the High Court of Australia test the scheme's constitutional validity, and both remain active and undecided. Digital Freedom Project Incorporated and others v The Commonwealth of Australia and others, case S163 of 2025, was filed 27 November 2025 by a youth-advocacy association with under-16 members. Reddit, Inc v Commonwealth of Australia and another, case S166 of 2025, was filed 12 December 2025 by the platform itself. Both argue that Part 4A of the Online Safety Act 2021 is invalid, wholly or in part, because it impermissibly burdens the implied freedom of political communication; the Digital Freedom Project matter also raises a separate dispute over whether the plaintiff association has standing to bring the claim.

The two matters are running as a single joint special case before the Full Court, referred there on 29 July 2026, with the special case filed jointly on 22 July and 14 August 2026. As of this article's verification date, the plaintiffs' written submissions were due 28 August 2026, the Commonwealth's submissions were due 25 September 2026, and a reply was due 16 October 2026, with no hearing date yet published on the Court's own docket. Neither matter has produced a judgment; a decision striking down or upholding Part 4A, if and when it comes, would be the most significant development this scheme could see.

What Parents, Teens and Platforms Can Expect

Nothing in the law entitles a parent or a teenager to a guaranteed outcome. The obligation on platforms is to take reasonable steps, not to guarantee that no under-16 ever holds or accesses an account, and eSafety's own evaluation data shows a real compliance gap: most under-16s who had accounts before 10 December 2025 kept them or opened new ones within three months. A parent whose under-16 child still has an account is not evidence a platform has broken the law; a court, not eSafety, ultimately decides whether a platform's steps were reasonable.

The scheme sits alongside, not instead of, the wider Privacy Act framework covered in the Australia data privacy laws hub and the broader reforms tracked in Australia's Privacy Act reforms 2024-2025.

The law itself is due for an independent review. Section 239B requires the Minister to commission an independent review of Part 4A within two years of section 63D taking effect, covering the adequacy of the scheme's privacy protections among other matters, with a written report tabled in Parliament within 15 sitting days of being given to the Minister. Since section 63D took effect 10 December 2025, that review is due by around December 2027.