Australia built the world’s most-watched child-safety mandate to move one number: the share of under-16s on social media. Eight months into enforcement, the regulator’s own data says that number has barely moved.
The Online Safety Amendment (Social Media Minimum Age) Act 2024 took effect on 10 December 2025, a year to the day after it received royal assent. It made Australia the first country to set a hard floor of 16 on holding a social-media account, and it put the duty on the platforms, not on parents or children. By late August 2026 the law had run more than eight months.
Then, in July, the eSafety Commissioner published the first hard read on whether it works. The answer is uncomfortable for a policy that other governments are already copying.
The number the ban was built to move
eSafety’s three-month follow-up study compared a baseline taken just before the December ban with data collected in March and April 2026. More than eight in ten children aged 10 to 15 were still using age-restricted platforms: 81.5%, down from 85.9% before the ban. Frequency of use barely shifted. About 58% still reported using social media daily or more often, against roughly 60% before.
Account ownership fell more, from about 52% to 42%, with statistically significant drops on YouTube, Snapchat and TikTok. But a falling account count is not the same as children leaving. Many kept using the apps without an account, or held on to the account they already had. Logged-out viewing does not show up as an account, and it is not what the ban was written to stop.
The study is not large. It drew on 803 children and their parents. But its direction is unambiguous, and it comes from the regulator that wrote the rules, not from an industry lobby trying to discredit them.
The gap is age assurance, not willpower
The revealing finding is why the number held. Among children who kept their accounts, more than half said the platform never checked their age. Another 18% said a platform’s age-estimation system wrongly judged them to be 16 or older. And 37% said they simply entered an older birth year and were waved through.
Read those three figures together and the design flaw is visible. The law required platforms to take “reasonable steps” to keep under-16s off, but it deliberately did not mandate a single verification method. Canberra chose flexibility over prescription, partly to avoid forcing an intrusive government-ID check on every Australian who opens an app. The platforms took the flexibility and, on this evidence, spent it lightly.
Age assurance is the load-bearing part of the whole scheme, and it is the part the state handed to the companies being regulated. A mandate that outsources its only enforcement mechanism to the firms it is trying to constrain is a mandate that runs on their goodwill. The March data is what that goodwill looks like in production.
None of this was unforeseen. The government ran a full age-assurance technology trial before the ban commenced, and its own conclusion was that no single method is both accurate and privacy-preserving at scale. That honesty in the trial became a gap in the law. “Reasonable steps” was never defined tightly, so a platform can point to a self-declared birth date and a lightly enforced estimation model and argue it has met the bar. Until eSafety contests that claim in a specific case, the definition of reasonable is whatever the platforms decide to ship. Eight months of silence on penalties has let them decide it downward.
What has actually been enforced
The penalties on paper are large. A platform that fails to take reasonable steps faces a civil penalty of up to 49.5 million Australian dollars, and eSafety’s list of age-restricted services now runs to ten, including Facebook, Instagram, Threads, Snapchat, TikTok, Twitch, X, YouTube, Kick and Reddit.
The penalties in practice are, so far, zero. Eight months in, no platform has been fined. eSafety has used its information-gathering powers to demand compliance data, and the government said in June that it would double the maximum penalty and strengthen the commissioner’s information-gathering powers after seeing the early results. Doubling a fine that has not been levied once is a statement of intent, not a change on the ground.
That is the honest status at the eight-month mark. A headline number that moved a few points. An enforcement mechanism that has issued notices but not consequences. A regulator escalating its powers while the platforms run out the clock on age checks.
The implication for everyone copying it
Australia is the template. Governments from Europe to the United States have cited the ban while drafting their own age limits. The lesson eSafety’s data hands them is specific and awkward: the hard part was never passing the law. It was building age assurance that works at population scale without either failing open, as it is failing now, or turning into a mandatory identity system that voters will not accept.
The ban has not failed outright. Account ownership did fall, some platforms did tighten, and an eight-month window is short for a behavioural shift among teenagers. But it has not yet delivered the one thing it was sold on, and the reason is not teenage defiance. It is that a law can order a platform to check age and still leave that platform holding the only tool that would make the order bite.
The next test is enforcement. If eSafety fines a major platform and forces working age checks, the March-to-April numbers will read like a starting line. If it does not, the ban becomes what every skeptic predicted: a rule everyone can see and almost no one under 16 has to obey.
Discussion
Sign in to join the discussion.
No comments yet. Be the first to share your thoughts.