Background to the bill

The passing of the SMMA Bill marks a continuation of the government's intense pursuit of its online safety agenda, with the introduction of the SMMA Bill only announced in November. The SMMA Bill aims to address growing public concern about the harms of social media on children.

Introducing a minimum age for social media access is about protecting young people – not punishing or isolating them – and letting parents know that we are in their corner when it comes to supporting their children’s health and wellbeing.

– Michelle Rowland MP, Minister for Communications (Minister)

Currently, the minimum age to have an account is 13 on all major social media platforms. This policy position can be traced back to a 1998 decision by the US Congress in the Children’s Online Privacy Protection Act, which pre-dates the existence of social media. The decision to set the minimum age at 16 years in Australia was based on extensive consultations with experts, parents and young people. While details about the implementation and practical operation of the new legislation remain unclear, the government has committed to ongoing collaboration with stakeholders in the lead-up to its commencement. The legislation is not expected to come into force for at least 12 months, with the exact date to be determined by the Minister.

How the bill operates

The SMMA Bill introduces the concepts of age-restricted users and age-restricted social media platforms through amendments to the Online Safety Act 2021 (Cth) (Online Safety Act).

An age-restricted user is defined in the SMMA Bill as an Australian child who has not reached 16 years of age.

Under the SMMA Bill, an electronic service will be an age-restricted social media platform if:

• the sole or significant purpose of the service is to enable online social interaction between two or more end users;
• it allows end users to link or interact with other end users; and
• it allows end users to post material on the platform.

However, exemptions will be provided for:

• messaging apps;
• online gaming services;
• services with health or education as their primary purposes; and
• services deemed to be 'low risk' by the eSafety Commissioner (Commissioner).

The SMMA Bill also states that if none of the material on the service is accessible to, or delivered to, one or more end users in Australia (or specified in the legislative rules) it the service will not be an age-restricted social media platform.

Burden of compliance to sit with social media platform operators

The SMMA Bill imposes an obligation on social media platform operators to take reasonable steps to prevent Australian end users under 16 from having an account with an age-restricted social media platform. The Bill does not specify what constitutes reasonable steps, with further guidance expected to be released at a later date. However, the explanatory memorandum provides some insight, as follows:

• at a minimum, platforms should implement some form of age assurance methodology to determine whether an account holder is an Australian child under the age of 16;
• whether an age assurance methodology meets the reasonable steps test is to be determined objectively, having regard to the methods available, their relative efficacy, their associated costs, and data and privacy implications on end users; and
• the outcomes of the Government's age assurance trial are likely to be instructive for platform operators, and will form the basis of initial regulatory guidance issued by the Commissioner.

Adding to the complexity of complying with this legislation, last-minute amendments to the SMMA Bill prohibit platform operators from collecting government issued identification material (such as passports or driver’s licences) or using an accredited service for the purposes of ‘taking reasonable steps’ to prevent age-restricted users having accounts with the age-restricted social media platform. There is, however, an exception to this for providers that have provided reasonable alternative means of age assurance.

Age-restricted users will still be able to access platforms that do not require end users to be logged into accounts (for example, YouTube).

Privacy Act interaction

Social media platform operators will need to collect and use personal information to verify the age of potential end users. The SMMA Bill prohibits platforms from using information collected for the purpose of age verification for any other purpose, unless an individual has provided their consent. This consent must be voluntary, informed, current, specific and unambiguous – an elevated consent requirement that seeks to prevent platforms from obtaining consent through pre-selected settings or opt-outs.

Once end user information and data has been used for age verification (or any other agreed purpose) it must be destroyed.

Penalties

If a platform operator fails to meet their obligations, they could be subject to penalties of up to 150,000 penalty units (which currently equates to AUD$49.5 million).

The Explanatory Memorandum outlines that penalties under the SMMA Bill are intentionally large, to:

• reflect the significance of the harms the Bill is intended to safeguard against; and
• strongly signal the expectation that age-restricted social media platforms treat the minimum age obligation seriously.

Under the SMMA Bill there are no penalties imposed on age-restricted users who gain access to an age-restricted social media platform, nor on their parents, guardians or educators. The government has acknowledged that despite the new rules, young people may attempt to circumvent these restrictions using methods such as VPNs, false identification, false biometric information or by simply using another person's account who is over the age of 16.

It is impossible for governments to completely prohibit young people from accessing harmful products or content. Australia should be prepared for the reality that some people will break the rules, or slip through the cracks.

- Explanatory Memorandum to the SMMA Bill

Likewise, social media platforms will not be penalised for instances where young people circumvent any reasonably appropriate measures put in place by the platform, provided that there hasn't been a systemic failure by the platform to take action in limiting circumventions.

Regulatory oversight and flexibility

The Commissioner and the Minister will play key roles in ensuring platform compliance and adapting to future changes.

The Commissioner's Information Gathering powers

The SMMA Bill gives the Commissioner broad powers to require electronic service providers to disclose information regarding whether:

• the electronic service is an age-restricted social media platform; and
• whether the provider has taken reasonable steps to meet its obligations.

If the Commissioner is satisfied the provider is an age-restricted social media platform that has contravened its obligations, the Commissioner may publish a public statement, effectively 'naming and shaming' the provider.

Minister for Communications’ role

Under the SMMA Bill, the Minister has the authority to make legislative rules to refine the definition of age-restricted social media platforms. In exercising this rule-making power, the Minister must have regard to advice from the Commissioner, and may also seek advice from other relevant Commonwealth agencies.

The intention for this framework is to provide the Government with greater agility and responsiveness to changes in the social media ecosystem as they occur.

Swift timeline for passage

The Senate Committee passed the Bill on 28 November, the last sitting day of the year, with the House of Representatives passing the Bill on 29 November.

The Government has moved quickly to ensure the passing of the SMMA Bill this year. Immediately after its introduction on 21 November, the Bill was referred to the Environment and Communications Legislation Committee, allowing a one-day window for public submissions. However, various stakeholders and members of Parliament raised concerns, particularly about privacy, enforcement, and effectiveness.

…the widespread privacy implications of a social media ban have me concerned.

Australian Privacy Commissioner Carly Kind

Seems like a backdoor way to control access to the internet by all Australians.

– Owner of X (formerly Twitter) Elon Musk

The government's deal with [Opposition Leader Peter] Dutton to ram through a social media age ban in under a week is rushed, reckless and goes against the evidence.

– Greens communications spokesperson Sarah Hanson-Young

Following Elon Musk's entry into the debate, the public inquiry received approximately 15,000 submissions within 24 hours.

Looking Ahead

Deferred commencement

The minimum age obligation will come into effect in approximately 12 months. The Government has said this delay is to allow sufficient time for businesses to develop and implement appropriate systems. A delayed commencement will also allow for the Government's age assurance trial to inform industry on what age assurance technologies would be considered 'reasonable'.

Independent review

The SMMA Bill also requires an independent review to be conducted within two years of the minimum age obligation taking effect. As part of this review the Government has said they will reassess the social media landscape and consider the extent of impacts of the Bill. It will also consider if changes to scope or the minimum age are required.

Key takeaways for organisations

Social media organisations should seek advice as soon as possible to ensure compliance before the SMMA Bill comes into force. Some key things to consider include the following:

Age assurance technology

Organisations will need to implement age assurance technology to meet their obligations under the new legislation. The Government is currently conducting a comprehensive, three-phase trial of these technologies, and these results should inform the technologies that organisations choose to adopt.

In the meantime, organisations should prepare for operational adjustments and associated costs to comply with these obligations. Organisations should also consider how to prevent circumvention of age-assurance technologies through VPNs or false IDs, and identify (and deactivate) existing accounts held by age-restricted users.

Increased enforcement risk

This Bill also significant civil penalties for contraventions, and comes into force at the same time as the Privacy Act changes. It is more crucial than ever for organisations to comply with their privacy obligations, maintain comprehensive record-keeping in relation to their compliance actions, and conduct regular audits to identify and address potential compliance gaps.

MinterEllison offers full-service IT, legal and consultancy services with expertise in technology, privacy and data protection. Our team has extensive experience in navigating complex regulations and can provide tailored advice to you. Please contact us if you would like assistance with your organisation's practices.