Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

Australia Social Media Minimum Age

In force Australia · In force Dec 10, 2025 · no upcoming deadlines

Official text
Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics

Deadlines

EnforcementSep 12 · 45 days ago · Source
Strengthened enforcement amendments commenceThe Online Safety Amendment (Strengthening Enforcement for the Social Media Minimum Age) Act 2026 (No. 83, 2026) commences. The maximum civil penalty for platforms doubles from 30,000 to 60,000 penalty units, and eSafety gains new information-gathering powers.
Takes effectDec 10, 2025 · 11 months ago · Source
Social media minimum age obligation appliesAge-restricted platforms must take reasonable steps to prevent under-16s from holding accounts.

Summaries for reference, not legal advice. Check the official text.

What it does

Requires providers of age-restricted social media platforms to take reasonable steps to stop Australians under 16 from having accounts. Platforms may not rely only on government ID for age assurance, and must protect data collected for age checks and destroy it after use. eSafety has named platforms including Facebook, Instagram, Snapchat, TikTok, X, YouTube, Reddit, Threads, Twitch and Kick.

Who it applies to
Providers of 'age-restricted social media platforms' (services whose significant purpose is online social interaction, allowing users to link and post), subject to exclusions (e.g. messaging, gaming, education and health services).
Penalties
Up to 150,000 penalty units (AUD 49.5 million) for corporations failing to take reasonable steps. Separate penalties apply for misusing age-assurance data under the Privacy Act.
Enforced by
eSafety Commissioner (minimum age obligation); OAIC (privacy of age-assurance data)
Official name
Online Safety Amendment (Social Media Minimum Age) Act 2024
Citation
Act No. 127, 2024 (amending the Online Safety Act 2021)
Topics
Children, Online safety
Verified 2026-09-22 esafety.gov.au pm.gov.au
Research notes

On 28 June 2026 the Government announced legislation to double the maximum penalty for systemic breaches to AUD 99 million and give eSafety stronger information-gathering powers; it is not yet enacted as of verification. eSafety is investigating five platforms.

Related

In forceAustralia
Australia Cyber Security Act (ransomware reporting)Australia's first standalone cyber law: mandatory reporting of ransomware or cyber-extortion payments within 72 hours, security standards for consumer smart devices, 'limited use' protections for information shared with ASD and the National Cyber Security Coordinator, and a Cyber Incident Review Board. Ransomware payment reporting has applied since 30 May 2025.In effect since Nov 30, 2024
AmendedAustralia
Australia Online Safety ActSets up the eSafety Commissioner and removal schemes for cyber-bullying of children, adult cyber-abuse, non-consensual intimate images and abhorrent violent material. It also sets Basic Online Safety Expectations with reporting duties, and binding industry codes and standards. The Unlawful Material codes and standards cover class 1A and 1B material such as child sexual exploitation and pro-terror content. The Age-Restricted Material codes cover class 1C and class 2 material such as online pornography, and require age assurance and other measures to protect children.In effect since Jan 23, 2022
AmendedAustralia
Australia Privacy ActAustralia's federal privacy law (13 Australian Privacy Principles, Notifiable Data Breaches scheme). The 2024 amendment adds a statutory tort for serious invasions of privacy, tiered civil penalties and infringement notices, a mandate for a Children's Online Privacy Code, clearer security duties, and privacy-policy transparency for substantially automated decisions from 10 December 2026. It also adds criminal doxxing offences.Next: Dec 10 Children's Online Privacy Code must be registered · in 44 days
AmendedAustralia
Australia SOCI ActAustralia's critical infrastructure security law. Owners and operators of critical infrastructure assets must register ownership and operational information, and many must report cyber security incidents to the Australian Signals Directorate. Responsible entities for many asset classes must also keep a critical infrastructure risk management program. Systems of national significance face enhanced cyber security obligations, and the government has step-in and assistance powers.In effect since Jul 11, 2018
In forceChina
China AI Content Labeling MeasuresRequires generative AI service providers to add explicit (visible) labels to AI-generated text, images, audio, video and virtual scenes, and implicit labels (metadata) to generated files. Content distribution platforms must detect and label AI-generated content, and app stores must check labeling functions when apps are listed. A mandatory national standard (GB 45438-2025) takes effect on the same date.In effect since Sep 1, 2025
In forceChina
China Algorithmic Recommendation ProvisionsRegulates recommendation, ranking, personalization, generation and dispatch algorithms used in internet services in China. Users must be able to switch off personalized recommendations and manage tags, and providers may not use algorithms for price discrimination or to induce addiction. Providers with public opinion attributes or social mobilization capacity must file their algorithms with the CAC within 10 working days of launching a service.In effect since Mar 1, 2022
In forceChina
China Anthropomorphic AI MeasuresRegulates AI companion and emotional interaction services that simulate human personality. Providers must tell users they are talking to AI, remind users after every 2 hours of use, intervene in crises such as self-harm, offer easy exit, and may not offer virtual partner or relative services to minors. Users' interaction data may not be shared or used for training on sensitive data without consent, and services with 1 million registered or 100,000 monthly active users need a security assessment filed with the provincial CAC.In effect since Jul 15, 2026
In forceChina
China Deep Synthesis ProvisionsRegulates deepfakes and other deep synthesis services such as synthetic text, voice cloning, face swapping and immersive scenes. Providers must verify user identity, review content, add technical marks to generated content, and add prominent labels where content could confuse the public. Providers with public opinion attributes must file algorithms, and app stores must check filings and security assessments.In effect since Jan 10, 2023
Questions about Australia Social Media Minimum Age
What are the Australia Social Media Minimum Age compliance deadlines?
Dec 10, 2025: Social media minimum age obligation applies. Sep 12, 2026: Strengthened enforcement amendments commence.
When does Australia Social Media Minimum Age take effect?
Australia Social Media Minimum Age took effect on Dec 10, 2025.
Who does Australia Social Media Minimum Age apply to?
Providers of 'age-restricted social media platforms' (services whose significant purpose is online social interaction, allowing users to link and post), subject to exclusions (e.g. messaging, gaming, education and health services).
What are the penalties under Australia Social Media Minimum Age?
Up to 150,000 penalty units (AUD 49.5 million) for corporations failing to take reasonable steps. Separate penalties apply for misusing age-assurance data under the Privacy Act.