TL;DR
Australia’s age gate law marks a major shift in youth online safety, but age limits alone won’t protect minors. Real impact depends on enforcement, robust age assurance, and ongoing content safety for the teens who will inevitably still access platforms.
1. Are We Finally Ready to Treat Youth Safety Like We Treat Real Harm?
Australia has introduced one of the strongest online safety laws to date, setting a minimum age of 16 for social media use. Platforms must verify users’ ages and remove underage accounts, a significant step at a time when digital risks to children and teenagers continue to intensify.
Young people today face a wide range of online threats. Exposure to harmful or extreme content, predatory contact, cyberbullying, sexual exploitation, body image pressure, and self-harm communities has become distressingly common. These risks have only expanded with the rise of AI-driven recommendation systems that can amplify harmful content at unprecedented speed and scale, sometimes pushing minors into darker corners of the internet before adults around them even notice.
This is the reality of modern communicative tech: the interactive systems where people, and especially young people, connect, create, and collaborate with each other. And when these spaces don’t feel safe, parents, regulators, and governments are right to explore stronger protections.
2. The Enforcement Gap: Why Most Safety Laws Fail and What Australia Might Change
When we ask whether this new Australian law will work, we are really asking a regulatory question, not just a technical one. With years of experience advising on digital regulation, I can say confidently that a regulation’s impact depends almost entirely on its enforcement.
Both the EU’s Digital Services Act and the UK’s Online Safety Act were introduced with high expectations, yet commentary from law firms and academic institutions in 2024 and 2025 often highlights the same point: enforcement has been cautious and slower than anticipated, especially around systemic risk and algorithmic harms. As a result, the practical change on platforms has been more limited than many hoped.
The GDPR, by contrast, shows what happens when enforcement is consistent and well-resourced. Its global impact demonstrates that strong regulatory action can reshape industry behavior far beyond the borders of the law itself.
A safety law does not become effective because it exists. It becomes effective when the regulator is hands-on, empowered and willing to act decisively.
3. Teens Will Still Get In. The Question Is What They Find When They Do
Alongside strong regulatory enforcement, we need to face something every parent of teenagers knows. Some teenagers will still find ways to bypass age restrictions. I write this not only as a lawyer working in safety and AI, but also as a mother of teenagers who are remarkably capable, technologically fluent and endlessly resourceful.
Whether by adjusting their stated age, using VPNs, borrowing someone else’s login or exploiting AI tools that help them mask identity signals, some under-16 users will remain on platforms. They may be fewer, but they will still be present. Age thresholds alone do not remove young users entirely.
4. Australia Raised the Age Bar. Now Comes the Hard Part
This leads to the real challenge. The age gate cannot be simplistic. It must be difficult to bypass and supported by real enforcement. If regulators expect meaningful outcomes, the requirements placed on platforms must include robust and layered age assurance mechanisms, not only basic age declarations or cosmetic friction.
A meaningful age gate requires technical sophistication, oversight, and continuous adaptation. Platforms must be required to build systems that make circumvention harder, not easier. Enforcement must ensure those systems are maintained and strengthened over time. Without this, the law risks becoming symbolic, even if intentions are strong.
5. A Multi-Layered Approach Is Needed
It is important to remember that this law applies only in Australia. Social media platforms operate globally and harmful content crosses borders effortlessly. Even if under 16 users in Australia face new access limitations, teens elsewhere and even Australian teens who circumvent the rules will continue to encounter the same content.
A realistic approach must combine several layers:
- Strong, sustained regulatory enforcement
- Technical friction that makes underage access meaningfully harder
- Ongoing reduction of harmful content through advanced detection, including AI safety tools
- Design choices that reduce exposure and risk for minors by default
Age restrictions may keep some users out, but in communicative tech ecosystems, it is content safety that ultimately determines what young people encounter once they are inside.
6. What Success Should Actually Look Like
The success of Australia’s age restrictions should not be measured only by how many accounts platforms remove or how many users complete an age check. Those figures show that a process exists, but not whether young people are materially safer.
A more useful assessment would track outcomes across three levels.
First, access outcomes: Are fewer under-16 users creating or retaining accounts, and are repeated attempts to bypass restrictions becoming harder over time?
Second, exposure outcomes: Among young people who still gain access, is there a measurable reduction in exposure to harmful content, predatory contact, self-harm material, sexual exploitation and other high-risk experiences?
Third, system outcomes: Are platforms identifying failures quickly, correcting them consistently and improving their safeguards as user behaviour and circumvention methods evolve?
These distinctions matter because a platform could report high verification volumes while leaving the underlying risks largely unchanged. It could also remove large numbers of accounts without understanding whether those users return through new identities, shared devices or alternative access routes.
Regulators should therefore look beyond compliance activity and require evidence of effectiveness. Useful indicators could include:
- The rate of confirmed underage accounts before and after implementation
- Repeat account creation following an age-based removal
- The proportion of disputed age decisions that are overturned
- Differences in error rates across user groups
- Changes in young users’ exposure to defined categories of harmful content
- The time taken to detect and address new circumvention methods
- The frequency with which platforms update controls in response to identified failures
No single metric will prove that the system works. But together, these measures would help distinguish meaningful safety improvements from procedural compliance.
Australia’s law will be most valuable if it creates a culture of evidence: platforms testing whether their controls work, regulators examining outcomes rather than promises, and safeguards evolving when the data shows they are falling short.
7. A Hopeful Note
Despite the complexities, there is room for optimism.
Australia’s law may serve as an important pilot for global thinking about youth online safety. And it is not alone: several countries are experimenting with age-based restrictions and age-assurance requirements for social media, reflecting a growing recognition that youth protections must evolve alongside digital behavior.
If regulators remain active, if platforms build genuine and increasingly robust barriers, and if content safety efforts continue to evolve alongside advances in AI, this could mark the beginning of meaningful change.
The hope is that this becomes not a standalone solution but the first step in a wider shift, one that acknowledges how deeply minors live within digital environments and treats their safety as a shared responsibility.
If this pilot succeeds, it may inspire other countries to raise the bar and help create online spaces where teenagers can connect, learn and participate without exposure to harmful content that can shape their lives for years.
Need help preparing for the next era of AI and internet safety regulation?
Learn moreWhat’s new from Alice
LIVE from Black Hat Las Vegas: AI, Nation-States, and the Battlefield That Keeps Changing
What if the biggest threat to your security team isn't the attacker, it's the model you're relying on to stop them? LIVE from Black Hat Las Vegas, Mo and Madi bring together two cybersecurity authors, Caroline Wong, Chief Strategy Officer at Axari and author of The AI Cybersecurity Handbook, and Allie Mellen, Principal Analyst at Forrester and author of Code War, who wrote very different books that turn out to be arguing the same point. One explains why nations attack the way they do. The other explains why AI just changed the cost, speed, and scale of everything. Tune in!
It Takes AI to Break AI: The Case for AI Red Teaming
As AI systems gain autonomy, organizations need security approaches built specifically for AI behavior. Learn why AI-driven red teaming is becoming a critical defense layer.
5 Ways Your Third-Party CX Agent Gets Broken
Third-party CX agents create hidden liability. Learn the 5 attack patterns vendors miss and how WonderSuite closes the gap.
