On 10 September 2026, according to the Senate committee's bill page, Australia's Parliament passed the Online Safety Amendment (Strengthening Enforcement for the Social Media Minimum Age) Bill 2026. It doubles the maximum civil penalty for systematic breaches of the under-16 social media minimum age from A$49.5 million to A$99 million. It also gives the eSafety Commissioner stronger tools to compel evidence from platforms and from third parties such as age-assurance vendors and app stores.
The bill was introduced on 29 June and passed the House on 1 July. The Senate then referred it to the Environment and Communications Legislation Committee, which was due to report by 25 August, so final passage came about ten weeks after the House vote.
The strongest case for the bill
The government's argument deserves a fair hearing. A rule that large platforms can ignore at modest cost is not a rule. The Prime Minister's announcement said more than 5 million under-16 accounts had been removed, deactivated or restricted since the law took effect in December 2025. It also said the eSafety Commissioner is investigating Facebook, Instagram, Snapchat, TikTok and YouTube.
The Commissioner's March 2026 compliance update, as summarised by Pinsent Masons, flagged two specific weaknesses:
- Users who had self-declared as under 16 could revise their age through low-confidence methods such as facial age estimation.
- Platforms allowed repeated attempts with the same age-assurance method instead of escalating to a more robust one.
If a regulator cannot see how a platform's checks work, it cannot judge compliance. Compelling documents from age-assurance providers and app stores is a reasonable answer to that gap. It lets the Commissioner test a platform's claims independently instead of taking them on trust.
Where proportionality starts to strain
The information powers are the least objectionable part of the bill. Regulators investigating a novel regime need evidence, and the bill's own scope is limited to compliance with the minimum age rule. Those powers should still be watched, because third-party notices reach vendors and individuals who are not the regulated party. The new examination powers, which can require individuals to answer questions in compliance investigations, are a heavier instrument than a document request. Parliament should expect eSafety to publish how often and against whom they are used.
The penalty doubling is harder to defend on evidence. The A$99 million figure, 60,000 penalty units according to Pinsent Masons, is a ceiling for systematic breaches, not a price per failed check. A higher ceiling does little to resolve the technical problem the compliance update identified. Age estimation is probabilistic. Any threshold will let some under-16s through and wrongly block some adults and older teens. A fine does not change that error rate, and it pushes platforms toward whichever approach looks safest to a regulator.
The predictable result is over-compliance. Platforms may demand government ID or biometric scans from everyone to avoid being the next test case. That is a real cost to adult users' privacy and to lawful speech, and it falls on people the law never meant to touch. A law aimed at keeping children off social media can end up forcing every Australian to prove their age to use it.
A second cost is less visible. A regime where the penalty is large and the standard is vague rewards the largest incumbents. Meta, Google and TikTok can afford layered age-assurance stacks and legal teams that negotiate with the Commissioner. A smaller or newer service facing a A$99 million ceiling and an open-ended standard may simply geo-block Australia. That outcome reduces competition and choice for Australian users.
What would make this proportionate
The amendment is not the end of the story. The practical test is how eSafety uses the powers. Three things would show whether enforcement is proportionate:
- A published standard. The Commissioner should say what accuracy and escalation behaviour counts as reasonable steps. Platforms and vendors then know the target before they are penalised for missing it.
- Privacy-preserving options. Enforcement should reward methods that verify age without retaining identity documents or biometrics, and should not treat the most intrusive method as the safe default.
- Outcome reporting. The government has cited more than 5 million accounts affected. The public still lacks figures on false positives, on adults wrongly restricted, and on how many teens simply moved to unregulated services or workarounds such as VPNs.
The five open investigations will be the first real test. If they end in negotiated improvements to age-assurance design, the new powers will have done their job. If they end in headline fines for imperfect estimation tools, Australia will have shown other governments how to make an under-16 ban expensive without making it effective.
The amendment gives eSafety more leverage. What remains to be shown is whether that leverage produces better age assurance or only more intrusive and more cautious age assurance. That is an empirical question, and the government should publish the data that would answer it.