The age-old question of age verification – what you need to know

As online safety regulation and enforcement has evolved, age verification mechanisms and policy has emerged as one of the key areas of focus for governments and regulators around the world. 

As online service providers continue to come to grips with Australia’s evolving online safety regulation, recent developments in Australia’s regulation of online safety show that age verification has emerged as one of the tools of choice for regulators and legislators to protect children from online harm.

In this second instalment of our online safety series, we set out the current status of online age verification requirements in Australia and a snapshot of some of the key issues and the direction that regulation is heading towards.

What is age verification?

Age verification usually only involves confirmation that a person is over a certain age. This is to be contrasted against identity verification, which is a more onerous process that involves confirmation that a person is who they say they are. Unless identity verification is required by law, age verification typically does not require a person’s identity to be verified.

Age verification in an online context

The mechanisms currently available to verify the age of an end-user in an online context fall within a spectrum of intrusiveness from the perspective of an end-user, with some examples set out in the diagram below.

What is the current law in Australia?

The Restricted Access Systems Declaration (Declaration) is the most significant age verification regulation in the online safety context. It sets out a technology-agnostic access control system for material that depicts realistically simulated sexual activity between adults or high impact nudity, violence, drug use or language (Restricted Material). The Declaration applies primarily to:

• social media services;
• ‘relevant electronic services’, which includes messaging and multiplayer games; and
• ‘designated internet services’ which includes all websites.

The Declaration requires these services to:

• ensure end-users are required to apply for access to Restricted Material and are warned about the nature of the Restricted Material as part of the application; and
• take reasonable steps to confirm an applicant is at least 18 years old. Reasonable steps should be informed by the transaction type, as appropriate for the provider’s business practices.

In addition, the social media service Industry Code recently accepted for registration by the eSafety Commissioner requires social media services to:

• terminate or suspend the accounts of Australian children that are known to be using the service in breach of age restrictions; and
• take reasonable steps to prevent access by Australian child known to be under the minimum permitted age to access the service.

Age verification requirements are applicable in other online contexts, including:

• online gambling services, which are required under the AML/CTF Rules to verify the identity and age of every customer within 72 hours of opening a wagering account; and
• under state and territory rules for online liquor sales (e.g. for same day delivery of liquor under NSW liquor laws).

Latest developments in Australia

In 2021, in response to the findings of previous inquiries, the government directed the eSafety Commissioner to develop a roadmap for implementing a mandatory age verification system for online pornographic material (Roadmap). The Commissioner submitted the Roadmap to the government in March 2023 following consultations with various stakeholders.

The government has not yet published the Roadmap, so it is not clear at this stage how the Roadmap may impact the Declaration or the social media service Industry Code. The Minister for Communications, Michelle Rowland, has publicly stated that the government is considering the Roadmap and examining how it fits within other government initiatives, including in relation to digital identifiers and the Privacy Act Review.

What are the key issues with age verification technologies?

Privacy concerns

Stakeholders expressed concern during consultations on the Roadmap that:

• requirements to collect personal information to verify age can create data ‘honey pots’ which leave providers more vulnerable to data breaches and increase their security costs; and
• obtaining consent from children to collect and process age verification data is difficult under Australian law, and the requirements may differ in other jurisdictions.

The intrusiveness of any one technology from a privacy perspective can be impacted by its design. Feedback that has been received on the Roadmap referred to the need for mandatory standards relating to data minimisation to promote trust in age verification systems.

Effectiveness of age verification technologies

Some stakeholders also expressed concerns during consultations on the Roadmap that some age verification technologies can be easily circumvented (e.g. through the use of a virtual private network), highlighting the need for international harmonisation of age verification measures to ensure effectiveness.

What has been happening internationally?

In March 2023, legislation was passed in France’s National Assembly which required social media services to put in place technical solutions to verify the age of their users and to verify if users under the age of 15 have received parental consent. Several states in the US (including Louisiana, Utah and Arkansas) have also passed or introduced legislation that makes online service providers liable for distributing pornographic material to children, thereby requiring online ID verification to access pornographic material.

International standards on age verification systems are currently being developed by the International Organisation for Standardisation and the IEEE. Technical standards for age verification (PAS 1296) have already been developed by the British Standards Institute.

What next?

As we await the release of the Roadmap, online service providers should review any age verification systems they are required to have in place and brace for further regulation in this space. Although the Roadmap is focused on access to online pornography, there is the potential for stronger age verification systems to be required in future for other online contexts, including gaming.