Age assurance in Australia: what the 2026 rules actually require

Published 1 July 2026 · General information, not legal advice

Two sets of Australian online-safety rules now require businesses to check ages online, and a tick-box that says “I am 18 or older” no longer cuts it. This guide explains, in plain English, who the rules apply to, what they require, what regulators accept as an age check, and where facial age estimation fits. It is general information to help you scope the problem. For advice on your specific obligations, talk to a lawyer.

The two regimes at a glance

• Social media minimum age (SMMA). Since 10 December 2025, age-restricted social media platforms must take “reasonable steps” to prevent Australians under 16 from creating or keeping accounts. Platforms named by the government include Facebook, Instagram, Snapchat, Threads, TikTok, Twitch, X, YouTube, Kick and Reddit. Courts can impose civil penalties of up to 150,000 penalty units, currently around A$49.5 million.
• Age-restricted material codes. Nine industry codes registered by the eSafety Commissioner require age assurance before users can access online pornography and other material rated class 1C or class 2. The first three codes (search engines, hosting and internet carriage services) took effect on 27 December 2025; the remaining six (app stores, social media features, messaging, equipment providers and other internet services) took effect on 9 March 2026.

Who is actually affected

Directly: social media platforms, adult-content services, search engines, app distribution platforms and the other service categories the codes name. If you run one of those, the obligations apply to you now.

Indirectly: the net is wider than it first looks. Any service with social or messaging features, user-generated content, or age-restricted material may fall within a code category, and businesses selling age-restricted goods online (alcohol, vapes, gambling) face their own obligations under separate state and federal laws. Regulators are clearly moving in the same direction: prove the age, don’t just ask for it.

What counts as an age check

The rules are technology-neutral: services can choose the method that is proportionate for their risk, or use a third-party provider. eSafety’s examples of appropriate measures include:

• Facial age estimation: a live selfie is analysed to estimate the person’s age; no identity document involved.
• Photo ID matching: the user submits a government ID and a selfie is matched against it.
• Credit card checks: possession of a card implies the holder is an adult.

What is explicitly not sufficient any more, for services covered by the codes, is self-declaration, the “I am 18 years or older” button.

Age estimation vs age verification

Age verification establishes a person’s actual age or date of birth from an authoritative source, such as a passport or driver’s licence. It is precise, but it requires users to hand over identity documents, with the privacy risk, drop-off and handling obligations that come with them.

Age estimation analyses a live image of a face and returns an estimated age range. It is not exact, and honest providers don’t claim it is. But for a threshold question (“is this person clearly over 18?” or “clearly under 16?”) an estimate with a sensible buffer answers most cases in seconds, without collecting a single document.

In practice the two work best layered: estimation handles the clear cases instantly, and only borderline results step up to a document check. Most users never touch an ID.

Where facial age estimation fits

eaglecheck provides facial age estimation as an API: you send a live photo, it returns an estimated age range in seconds. A liveness check can confirm the photo is of a real, present person rather than a screen or printout, and face matching can compare a live face to an ID portrait when you do need to step up. Images are processed in AWS’s Sydney region and are not retained: the API returns the result and discards the image, which keeps your data-minimisation story clean under the Australian Privacy Principles.

A typical age-gate flow looks like this:

• User reaches the age-restricted point (sign-up, checkout, content gate).
• A live selfie is captured and sent for estimation.
• Clearly above the threshold (with your chosen buffer): proceed.
• Borderline or below: step up to an ID check, or decline.

A practical starting checklist

• Work out which regime touches you. Platform or service category named in the codes? Age-restricted goods under state law? Both?
• Map where age matters in your user journey: account creation, checkout, content access.
• Pick a proportionate method. The rules don’t mandate one; they require it to be effective and reasonable for your risk.
• Mind the privacy obligations. Whatever you collect for an age check is personal information under the Privacy Act. Collect the minimum and don’t keep what you don’t need.
• Document your reasoning. “Reasonable steps” is a judgement. A written record of why your approach is proportionate is your best evidence.

Sources

• eSafety Commissioner: Social media age restrictions
• Department of Infrastructure: Social media minimum age
• eSafety Commissioner: Industry codes