On 10 December 2025, Australia became the first country to enforce a national minimum age for social media. Under the Online Safety Amendment (Social Media Minimum Age) Act 2024, age-restricted platforms must take “reasonable steps” to prevent Australians under 16 from creating or keeping an account. Within the first week, eSafety reported that platforms had removed access to roughly 4.7 million under-16 accounts.
This is not a guidance document or a future obligation. It is live law with teeth: in late March 2026, the communications minister confirmed investigations into Facebook, Instagram, Snapchat, TikTok and YouTube for potential breaches, each carrying penalties of up to AUD 49.5 million per systemic failure.
For platform operators, the hard part isn’t the headline. It’s a structural constraint buried in the regime that breaks most off-the-shelf verification flows: you must prove a user is over 16, but you cannot compel them to hand over a government ID to do it. That single requirement is what separates a compliant architecture from a checkbox that fails an audit.
What the Law Actually Requires
The Act applies to platforms eSafety considers “age-restricted social media services.” Its stated view captures the obvious names — Facebook, Instagram, Snapchat, Threads, TikTok, Twitch, X, YouTube, Kick and Reddit — and the test is functional, not a fixed list. If your service has social interaction as a significant purpose and the addictive or harmful design features the regime targets, you are likely in scope regardless of how you describe yourself.
The obligation is to take “reasonable steps” to keep under-16s off the platform. eSafety’s Regulatory Guidance is explicit about what does not count as reasonable. Measures fail the standard if they rely entirely on self-declaration, if they let an under-16 hold an account for an unreasonable period before detection, if they allow a deactivated user to immediately re-register, or if they sweep up substantial numbers of adults who aren’t subject to the ban at all.
That last point is the one operators underestimate. Over-blocking is a compliance failure, not a safe default. A crude age gate that locks out legitimate adult users is as much a breach as one that lets children through. The standard demands accuracy in both directions.
The Constraint That Breaks Standard Flows
Here is the requirement that reshapes the entire architecture: the legislation prohibits platforms from compelling Australians to use government-issued identification to prove their age. A platform may offer government ID as one option within a layered approach, but it must always provide a reasonable alternative that does not require collecting government identity materials.
If your verification flow is “upload your driver’s licence or you don’t get in,” it is non-compliant in Australia — full stop. This inverts the model most platforms imported from US adult-content statutes, where a government ID check is the gold standard. In Australia, ID can only ever be one lane in a wider road.
This is a deliberate design choice by the regulator, informed by the Australian Government’s Age Assurance Technology Trial, which independently assessed age verification, age estimation, age inference, successive validation, parental controls and parental consent. The trial’s conclusion shaped the guidance: no single method is sufficient or appropriate for every user, so the regime expects platforms to combine methods intelligently rather than fall back on one heavy-handed check.
The Waterfall Model eSafety Expects
eSafety’s guidance points operators toward a “successive validation” or “waterfall” approach. Instead of a single gate, you run a sequence of age-assurance methods, escalating only when the previous step is inconclusive. The principle is proportionality: use the lightest effective method first, and reach for more intrusive options — biometric estimation, document checks — only when uncertainty remains.
A practical waterfall for the Australian regime looks like this:
Stage 1 — Signals and inference. Start with low-friction signals already available: account age, declared birthdate history, behavioural and device signals, and existing trusted attributes. This resolves the clear-cut cases — long-tenured adult accounts with consistent histories — without asking the user for anything new. It must never be the sole basis for a decision, but it is a legitimate first filter.
Stage 2 — Facial age estimation. For users not cleared by signals, on-device or server-side facial age estimation provides a privacy-respecting check that returns an age range, not an identity. The Age Assurance Technology Trial found estimation viable for the bulk of users, particularly when a buffer zone is applied around the 16 threshold. Someone estimated at 25 ± 3 clears comfortably; someone at 15 ± 2 does not. Estimation handles the long tail of users who shouldn’t have to prove who they are just to prove how old they are.
Stage 3 — Document or credential verification. Only for users in the uncertain band around the threshold, or those who fail estimation and contest the result, do you escalate to higher-assurance methods: a verifiable digital credential, an NFC-read identity document, or — strictly as one option among several — a government ID check. Because this stage only fires for a small slice of users, the privacy and friction cost is contained rather than imposed on everyone.
Stage 4 — Reasonable alternatives, always. At every escalation, the user must have a path that does not require surrendering government identity materials. Reusable age credentials, vouching, and trusted third-party attestations all qualify. This is not optional polish — it is the legal requirement that makes the whole flow compliant.
The waterfall does two things at once: it keeps friction low for the majority while concentrating high-assurance checks where they matter, and it gives you a defensible, documented decision trail for each account — exactly what an eSafety investigation will ask to see.
De-activation Is Harder Than Onboarding
Most coverage focuses on new sign-ups. The operationally harder problem is the existing user base. The guidance requires platforms to deactivate or remove under-16 accounts already on the service and to prevent those users from immediately re-creating an account.
That means age assurance can’t live only at the registration gate. It has to run retroactively across an existing population of millions, identify likely under-16s without locking out adults, and persist a signal that survives logout, device changes, and re-registration attempts. The 4.7 million accounts removed in the first week were existing accounts, not blocked sign-ups — which tells you where the real engineering load sits.
This is where a reusable, platform-managed age signal earns its keep. If age status is bound to a durable credential rather than re-evaluated from scratch on every session, re-registration after deactivation becomes detectable instead of trivial. Without that persistence, a removed under-16 account simply comes back under a new email an hour later, and you have failed the “unreasonable period before detection” and “immediate re-registration” tests simultaneously.
What Operators Should Build Now
If you operate a service that could fall within scope and serves Australian users, the practical priorities are:
Stop treating government ID as the primary gate. Re-architect so that ID is one optional lane, with a genuine no-ID alternative available at every step. If your current flow can’t grant access to an adult who declines to upload a licence, it doesn’t meet the Australian standard.
Implement estimation before escalation. Facial age estimation with a threshold buffer resolves most users without identity collection. Tune the buffer to your risk tolerance: wider buffers reduce false clears of minors at the cost of escalating more borderline adults to Stage 3.
Instrument the over-blocking rate. Track how many adults your flow rejects or escalates, not just how many minors it catches. eSafety treats mass false rejection as a breach. You need this metric in front of you, not buried.
Persist age status across sessions and re-registration. A durable, privacy-preserving age credential is what makes deactivation enforceable and re-registration detectable. Re-running verification from zero on every login is both expensive and non-compliant.
Document the decision trail. For each account, retain which methods ran, what they returned, and why the final age decision was made — without retaining the underlying sensitive data longer than necessary. This is your evidence in an investigation.
How Xident Fits the Australian Regime
Xident was built around the layered, privacy-first model the Australian guidance now effectively mandates. Rather than a single ID gate, Xident runs a configurable waterfall: client-side age estimation first, document and NFC chip verification as escalation, and reusable age tokens that let a verified user prove they’re over 16 again without repeating the check or re-exposing their identity.
Critically, no step in a Xident flow compels government ID. Age estimation returns a threshold classification (over/under 16) rather than an identity, satisfying the “reasonable alternative” requirement by default. When higher assurance is genuinely needed, document and chip verification are offered as options alongside non-ID paths, and the result is reduced to the minimal signal — an age band — rather than a stored copy of someone’s licence.
For the deactivation problem, Xident’s token model binds age status to a durable, privacy-preserving credential. A deactivated under-16 account attempting to re-register surfaces the prior signal instead of starting clean, which directly addresses the “immediate re-registration” failure mode the guidance singles out. And because every decision is classified rather than identity-bound, the over-blocking rate stays measurable and low — adults clear on estimation alone, and the flow doesn’t punish users for declining to upload an ID.
The result is a single integration that produces the documented, proportionate, no-compelled-ID decision trail eSafety expects — while keeping friction low enough that legitimate users don’t abandon the flow.
Australia has done something the rest of the regulatory world is watching closely: it mandated effective age assurance while explicitly forbidding the lazy version of it. You can’t just demand everyone’s ID, and you can’t just trust a self-declared birthday. The only architecture that satisfies both constraints is a layered one — light methods first, heavy methods only where needed, and a no-ID path available throughout.
That design isn’t unique to Australia. The UK’s Online Safety Act, the EU’s age-verification work, and the expanding US state patchwork are all converging on the same shape. Australia is simply the first jurisdiction enforcing it at national scale, with fines large enough to make the architecture decision urgent. Building the waterfall now means you’re not just compliant in Sydney — you’re ready for the regime that’s coming everywhere else.
