How Is the Social Media Minimum Age Act Working?

A 16-year-old examines the Social Media Minimum Age Act’s implementation, scrutinising platform verification methods, data privacy risks, and Australia’s outdated digital protections.

I recently wrote a piece about the Social Media Minimum Age Act, explaining my perspective on the new legislation as a 16-year-old.

My three main concerns were:

1. that children would still have access to social media, as the legislation only banned creating an account, and on many platforms, you can still access content without an account.

2. government overreach, specifically referring to a famous quote said by Abraham Lincoln:

“The legitimate object of government is to do for a community of people, whatever they need to have done, but can not do, at all, or can not, so well do, for themselves, in their separate, and individual capacities. In all that the people can individually do as well for themselves, government ought not to interfere.”

Yes, social media is certainly creating problems for the younger generation, but this is an issue that parents are best equipped to deal with. I believe it would be more effective if the government focused on issues they actually have significant control over, things like the increasing costs of living. I believe that if this were lowered, it would allow more time for families to spend together, and over time, this would improve relationships in families, among other benefits.

3. Finally, I referred to data leaks, explaining how uploading sensitive information to social media platforms and third-party verification software could potentially become an issue of national security.

Now, several months after the implementation of the new act, we have a better idea of how those verification and age checks are being performed, and also a better idea of the potential issues that may arise in the future. In this second article, I want to look deeper into these platforms and their reputations.

How platforms are enforcing the Social Media Minimum Age Act

The social media platforms covered by the Social Media Minimum Age Act are YouTube, TikTok, Instagram, Facebook, Snapchat, X (formerly Twitter), Threads, Twitch, Reddit, and Kick.

In this article, I will focus on the most popular platforms, namely YouTube, TikTok, Snapchat, Instagram, and Facebook. Looking at the verification methods they have in place, the third-party platforms they use, and their track records.

Meta

Meta, specifically Instagram and Facebook, is known to use an AI face verification tool called Yoti, which is affiliated with the World Economic Forum (WEF). In this case, Yoti works by scanning an image or video of users’ faces to estimate whether their age is above or below 16. This is called a biometric age check, using your facial features to estimate your age.

According to Yoti, the only time they have access to this information is when they do a verification or check. In July of 2023, Yoti proposed a facial estimation system to the US Federal Trade Commission (FTC) with the idea that Yoti, along with partners, would create a privacy‑protective facial age estimation method as a way to verify age under the Children’s Online Privacy Protection Act (COPPA).

In April 2024, the Federal Trade Commission (FTC) rejected the proposal due to concerns about privacy and biometric age verification. While this proposal was different from the age verifications Yoti performs with Instagram, they both include the collection of facial data, and the above case highlights concerns.

TikTok

As for TikTok, it also uses Yoti, and states the methods they will use for verifying age include Facial age estimation, credit card authorisation, and government-approved identification. TikTok itself stated:

“For more than a decade, many organisations and companies have tried to solve the complex challenge of online age assurance. Despite these efforts, and as recognised by eSafety, there is still no single method that can be used to effectively confirm a person’s age in a way that also preserves their privacy.”

Snapchat

Snapchat uses a third-party software called K-ID, a Singapore-based company. Some experts have pointed out that relying on an overseas company may pose an issue: uploading images or scanning IDs into foreign servers, in this case, Singapore-based servers, means that the data leaves Australia.

Even if the data is deleted, having it uploaded onto a different country’s server could make the protection of that information more complicated. Snapchat has also stated that it uses Connect-ID. This only works if the user has a bank account. By sending a yes or no to the social media platform, to verify whether the user is above the age of 16.

YouTube

YouTube’s verification methods depend mainly on its own systems and its parent company, Google. Consuming videos on YouTube doesn’t require an account, meaning that as long as you have a device and an internet connection, you have access to most of the content posted on YouTube.

An account does, however, allow you to have subscriptions, like and comment on videos, as well as create your own, making the opening of an account an incentive for many people.

Rachel Lord, Public Policy Senior Manager of YouTube AUNZ, wrote an article updating users about this, writing,

“Most importantly, this law will not fulfil its promise to make kids safer online, and will, in fact, make Australian kids less safe on YouTube. We’ve heard from parents and educators who share these concerns.”

She added, “At YouTube, we believe in protecting kids in the digital world, not from the digital world”.

Clearly, some social media platforms do not agree with the Social Media Minimum Age Act; however, of course, these platforms benefit greatly from having users on their platforms, and none of these platforms is free from legal issues either.

For example in 2019 Google/YouTube agreed to pay the then record-setting fine of USD $170 million after the US federal trade commission, and the New York Attorney General concluded that YouTube collected personal data from children under the age of 13, then used that data for targeted advertising of children’s content, a violation of COPPA, and this was even before the use of AI features on YouTube.

When it comes to TikTok, the US Federal Trade Commission (FTC), working with the Department of Justice, launched a lawsuit against TikTok and its parent company, ByteDance, alleging that the company violated the COPPA. The key allegation included allowing millions of children under the age of 13 to remain on the platform even though there were restriction policies in place. However, more relevant to this piece, it collected and used the personal data of children and failed to delete the data when required, instead using it for tracking.

Australia’s Privacy Protections

So who can we really trust in this digital era? The above-mentioned are the same platforms and third-party software that will verify the identity of Australian citizens, and potentially collect the information gained from those verifications.

In theory, the Social Media Minimum Age Act seems justified as it appears to protect children, but what about the children who attempt to create accounts and still scan their face into the AI facial age estimators, or possibly use their parents’ ID – or people over the age of 16 who want to create accounts but now have to trust their information with these social media platforms and third-party softwares.

This legislation, in attempting to prevent children under the age of 16 from the dangers of social media, which undoubtedly causes prevalent issues, unfortunately fails to prevent children and adults from the risks of uploading sensitive information into untrustworthy platforms.

Unlike the United States, we don’t have a Childrens Online Privacy Protection Act. Instead, the Social Media Minimum Age Act relies greatly on pre-existing laws to protect people’s privacy, namely the 1988 Privacy Act. Which, in my view, when it comes to digital privacy and security, is outdated. Specifically, in creating adequate protection for the security issues that the Social Media Minimum Age Act (SMMA) creates, and I am not alone in thinking so.

Former Attorney‑General Mark Dreyfus himself described the Act as “woefully outdated and unfit for the digital age”, in an article detailing how the reform process was largely failing to modernise important principles of the 1988 Privacy Act. Additionally, there have been parliamentary submissions about the fact that it had not been meaningfully updated in nearly four decades.

The need for improved digital protection

It is clear to me that the 1988 Privacy Act should provide better protection than it does, and also mandate a system of regulation in order to adequately protect Australian online security and privacy.

Let us look at the USA’s Children’s Online Privacy Protection Act (COPPA). Specifically targeted at any digital software, platform, or company that collects children’s data, for children’s data to be legally collected, it must meet the requirements of COPPA, which are very specific and are then enforced by the Federal Trade Commission (FTC).

In this way, it is preventative. It not only creates penalties for companies that do not comply, but moreover does not allow the companies to legally access children’s data unless they meet the security standards set by COPPA, as seen in the case of the YOTI request, which was denied.

On the other hand, Australia’s Privacy Act is more reactive, meaning if it is violated, there will be repercussions. However, it is far less preventative, and the Privacy Act does not directly affect or regulate other laws that come into place.

It is my opinion that before rolling something out like the SMMA, there should have been clear legislation regulating and restricting what platforms and software are allowed to do with our private information, not just children’s, but all Australians. Then, for the SMMA to come into effect, it should have passed the safety standards set by this law.

Perhaps if the Australian government had not created legislation that specifically made Australians more vulnerable to the consequences that can arise when there is not enough digital protection this would be less of an issue, but the Australian government did.

This legislation would have been the perfect opportunity to add additional regulations and mandate a specific method or system for how social media and third-party platforms are allowed to handle our data, but the Australian government did not.

Instead, they created a law that potentially could create a whole new set of security and privacy issues for Australians. Perhaps this will keep children off social media platforms for the present; however, in my opinion, even that is doubtful.

Nevertheless, even if it did work perfectly and children under 16 no longer had access to social media, how would those same children be affected in 20 or 30 years? Who knows how much AI will have advanced by then, and where or what is being done with the private information that they once shared?

Image courtesy of Adobe.

We need your help. The continued existence of the Daily Declaration depends on the generosity of readers like you. Donate now. The Daily Declaration is committed to keeping our site free of advertising so we can stay independent and continue to stand for the truth.

Fake news and censorship make the work of the Canberra Declaration and our Christian news site the Daily Declaration more important than ever. Take a stand for family, faith, freedom, life, and truth. Support us as we shine a light in the darkness. Donate now.

---

ODM Daily Commentary

Let’s pause and acknowledge something remarkable: this article was written by a 16-year-old. And it’s more thoughtful, more nuanced, and more urgently necessary than 90 per cent of the political commentary published by adults.

The Social Media Minimum Age Act sounds great on paper. Protect the kids. Keep them off Instagram and TikTok until they’re 16. What monster could oppose that?

Well, the monster of unintended consequences. And the monster of government overreach. And the monster of handing your biometric data to World Economic Forum affiliates.

This young author nails the central contradiction: the law tries to protect children from social media by forcing them to hand over more sensitive data to the very platforms they’re supposedly being protected from.

Think about that for a minute.

To prove you’re not old enough for an account, you might have to scan your face into Yoti — an AI tool affiliated with the World Economic Forum. Or upload your parents’ ID. Or link a credit card. All of which creates a digital footprint that will outlast your childhood by decades.

And for what? The author points out the obvious: the law only bans creating an account. On YouTube, you don’t need an account to watch videos. On most platforms, you can lurk, consume, and be influenced without ever verifying a single thing.

So the kids who want to get around the law will find a way — they always do. And the kids who follow the rules get rewarded with… privacy risks and data harvesting.

The author’s Lincoln quote is a masterstroke. “Government ought not to interfere” in what parents can do for themselves. And here’s the uncomfortable truth the nanny state refuses to admit: parenting, not legislation, is the solution to screen addiction.

Yes, social media is toxic for young minds. Yes, something must be done. But has the government considered that the cost of living crisis means parents are working three jobs and don’t have time to monitor their children’s online activity? Has anyone connected the dots between economic policy and family breakdown?

No. Instead, we get a law that creates a false sense of security while opening new vectors for data exploitation.

The comparison to America’s COPPA is instructive. The US has a preventative framework — companies can’t touch children’s data unless they meet strict standards. Australia has a reactive framework — we punish violations after the fact, like shutting the gate after the horse has bolted.

And our privacy laws haven’t been meaningfully updated since 1988. That’s the year Die Hard came out. The same year we were still using floppy disks. The government is trying to regulate AI-powered social media with laws written before the World Wide Web existed.

The author asks the haunting question: even if the law works perfectly — even if no child under 16 ever creates an account — what happens to their data in 20 years? What happens when an AI trained on teenage faces becomes a surveillance tool for a future authoritarian government?

These aren’t conspiracy theories. These are the natural consequences of centralising biometric data in the hands of companies with track records of violating children’s privacy (see: YouTube’s $170 million fine, TikTok’s ongoing lawsuits).

So here’s a radical proposal: instead of age verification mandates, how about we fix the privacy laws first? How about we give parents the economic breathing room to actually parent? How about we treat the disease (family breakdown, economic stress) instead of the symptom (kids scrolling TikTok at 2am)?

The 16-year-old author of this piece understands something most politicians don’t: good intentions don’t equal good policy. And sometimes, the cure is worse than the disease.

Listen to the young people. They see the trap being set for them.

— ODM Daily