SYDNEY, July 7 - A recent study by a team that helped advise Australia’s social media age-check rollout has identified a critical shortcoming in the early-stage vetting used by platforms to enforce the country’s ban on accounts held by those under 16.
The law, effective since December, requires major online platforms such as Instagram, Snapchat and YouTube to prevent accounts for people under 16. Operators must take "reasonable steps" to comply, and the government has urged platforms to apply a series of increasingly robust checks to determine a user's age. In practice, however, the first line of scrutiny - automated age inference that evaluates a user’s likely age range from general online behaviour - appears not to be flagging younger users for further checks, the team told Reuters.
The testers, who ran a trial of age-assurance technology on more than 1,000 Australians last year, conducted a shadow follow-up after the law came into effect. They created 50 accounts across nine of the 10 platforms covered by the restrictions and declared the age on each as 16. According to the research team, not one of those accounts was asked to provide proof of age at sign-up.
Andrew Hammond, director at testing firm KJR, which led the original 2025 trial, said the absence of any request for age verification exposed a largely overlooked failure point in the process. "You should be asked to demonstrate how old you are, and not once have we been asked to verify our age or use age-assurance measures," Hammond said.
All 50 test accounts remain active, the researchers reported. They distributed those accounts across platforms that include Meta’s Instagram, Snap’s Snapchat, TikTok and Alphabet’s YouTube. Some of the dummy accounts were served advertisements for youth banking products, which the team interpreted as evidence that the platforms had registered the users’ age range in some form. In one instance, an account created on X and declared as 16 was shown pornographic material.
Hammond noted that while platforms did block sign-ups where the user declared an age below 16, the study found only one platform - Australian live-streaming site Kick - required proof of age before allowing account creation. The follow-up study therefore suggests that the initial behavioural screening stage is not escalating suspect accounts to formal age verification as intended.
When approached for comment, Snap and TikTok declined to provide one. Google and X did not respond to requests for comment. A Meta spokesperson said the shadow trial’s approach appeared inconsistent with the regulator’s guidance, which advises escalating to formal age verification when behavioural indicators point to an account holder being underage or when accounts are reported. Meta added that the test accounts had been declared as older than the minimum required age and that it was unclear whether those accounts had behaved in the way an actual under-16 user would.
A Kick spokesperson told the researchers that relying on age inference was not feasible for their service because it is new and lacks sufficient historical data to produce reliable age estimates.
The eSafety commissioner’s office said it remains confident that age-restricted platforms have the technology and resources needed to stop Australians under 16 from creating accounts. The regulator reiterated that the recommended approach - applying progressively stronger checks when earlier steps suggest a user may be underage - ensures there is no single point of failure if implemented correctly.
Context and earlier concerns
The rollout of the 2025 law has faced intense scrutiny and criticism since its introduction. Initial government statements that the ban had removed roughly 4.7 million suspected underage accounts within a month were followed by persistent reports of non-compliance. By March, authorities warned of possible enforcement action against five platforms, and the government last month increased the maximum penalty, saying some firms had effectively set the ban up to fail.
Platforms maintaining compliance have pointed to the regulator’s guidance that prioritises low-friction checks as a first step, and note that operators are not allowed to rely solely on government-issued identification because of privacy concerns.
Advisers involved in the original trial said they had repeatedly raised the issue that the test failed to examine how systems would perform against real-world circumvention. That kind of circumvention can include under-16s entering false birthdates at sign-up. Colm Gannon, Australia CEO of the International Centre for Missing & Exploited Children, who advised the project, said: "We did want to talk about circumvention, but we kept on being told that that wasn’t part of the actual trial." He added that circumvention has now become the default tactic used by young people.
Amanda Third, a youth digital rights academic who advised the trial and who is now part of a two-year regulator study on the ban’s effects, said platforms were expected to start by singling out accounts that self-declared as underage, and then escalate to age-inference measures by mid-year. "The next round of data that’s collected after this point, we may be able to see some more impressive statistics," she said, indicating that further monitoring may reveal changes in enforcement outcomes.
What the study highlights
- The central shortcoming identified by the testers is that early-stage, behaviour-based age inference does not appear to identify likely under-16 users for additional checks.
- Platforms varied in their enforcement: most allowed accounts declared as 16 to be created without immediate verification, while only one platform required proof of age at sign-up.
- Regulator and platform responses differ on whether the shadow trial reflects how escalation to formal checks is intended to work under official guidance.
The study’s findings underline a technical and procedural challenge at the heart of Australia’s pioneering attempt to restrict under-16s from social media accounts: the multi-step compliance model depends on early detection to trigger more robust verification, and that trigger does not appear to be reliably activating in real-world testing conducted by those who helped design the rollout.