A Law Six Months Old, Already Getting a Bigger Stick
On 1 July 2026, the House of Representatives passed the Online Safety Amendment (Strengthening Enforcement for the Social Media Minimum Age) Bill 2026, introduced two days earlier. It doubles the maximum penalty for systemic non-compliance with Australia's under-16 social media ban from AUD 49.5 million to AUD 99 million, and extends the eSafety Commissioner's information-gathering powers beyond platforms to age-assurance vendors and app store operators (Prime Minister of Australia). The original Online Safety Amendment (Social Media Minimum Age) Act 2024 took effect on 10 December 2025, meaning the enforcement regime is being toughened before its first birthday.
The Case for Moving Fast
The strongest argument for acting now is that eSafety already has evidence the law is being gamed, not just under-enforced. Regulatory rules made in March 2026 imposed additional conditions on what counts as an age-restricted platform (Federal Register of Legislation, F2026L00370), and eSafety's compliance work since then found children who declared themselves under 16 were prompted to retake age checks until they scored over 16, alongside weak pathways for reporting underage accounts still live on Facebook, Instagram, Snapchat, TikTok and YouTube — all five now under investigation (Tech Policy Press, Early Lessons from Australia's Teen Social Media Ban). Survey data cited in that reporting found close to 70% of parents said their child still held an account on a major platform after the ban took effect, with roughly half retaining YouTube access. If platforms are actively engineering re-entry paths for children, giving the regulator the power to independently verify age-assurance vendors' claims — rather than taking a platform's word that its checks work — is a defensible response to a documented circumvention problem, not overreach for its own sake.
But the Escalation Outran the Evidence
The gap in that case is enforcement, and this bill barely touches it. More than 5 million under-16 accounts have been removed, deactivated or restricted since the ban began, according to the Prime Minister's own office (pm.gov.au) — a number the government cites as evidence of scale, not of the law's design. eSafety has not yet completed a single investigation into the five platforms it flagged, let alone assessed a fine under the existing AUD 49.5 million cap. Doubling a penalty that has never been imposed tells the public a company was punished harder, without establishing that the original ceiling was ever the binding constraint. If the AUD 49.5 million cap was insufficient, the evidence would be a platform judging that fine cheaper than compliance — something no enforcement action has yet tested.
The bill has run into exactly this timing objection inside Parliament, not just from outside critics. The Senate referred the enforcement package to a parliamentary inquiry, due to report by 25 August 2026, on concerns that six months was not enough time to know whether the existing framework works before intensifying it (Pinsent Masons, Out-Law). That a government-majority House still passed the bill before its own upper chamber finished asking whether it was premature is itself informative about how this cycle of regulation is being sequenced: penalty first, root-cause diagnosis second.
The Third-Party Powers Deserve More Scrutiny Than They're Getting
Extending eSafety's subpoena power to age-assurance providers and app store operators is being framed as closing a verification loophole, and there's a real version of that problem: platforms can point to a vendor's certification as a shield without the vendor ever being independently checked. But age-assurance vendors compete partly on how much personal data they can extract to prove a determination — facial estimation, ID uploads, behavioural signals — and Tech Policy Press's reporting already flags that facial age estimation deployed under this regime has known accuracy limits near the 16-year threshold. Regulatory pressure on those vendors to demonstrate certainty to a subpoena-empowered commissioner creates an incentive to over-collect, not to get the threshold call right. A privacy-proportionate version of this bill would pair the new information-gathering power with a data-minimisation floor for what age-assurance providers may retain — something absent from the reporting on the bill as passed.
What Proportionate Enforcement Would Look Like
None of this means Australia's law should have no teeth. But the sequencing here is backwards: legislate the fix for a diagnosed failure mode (re-attemptable age checks, weak underage-account reporting) before legislating a bigger number that nobody has yet had to pay. Parliament's own Senate committee process, reporting by 25 August, is the appropriate venue to establish whether AUD 99 million and third-party subpoena power are proportionate to a six-month-old law or a political response to bad headlines about non-compliance. Regulators building durable public trust — including in age-assurance technology broadly — need penalties that track evidence of what actually failed, not penalties sized to signal seriousness before the first case is decided.