On 31 March 2026, Australia's eSafety Commissioner, Julie Inman Grant, opened formal investigations into Facebook, Instagram, Snapchat, TikTok and YouTube for suspected breaches of the country's world-first ban on social media accounts for under-16s. Communications Minister Anika Wells went further, accusing the platforms of "choosing to do the absolute bare minimum because they want these laws to fail." The investigations are the first real enforcement test of the Online Safety Amendment (Social Media Minimum Age) Act 2024, which took effect on 10 December 2025 and carries corporate penalties of up to 150,000 penalty units — about A$49.5 million (eSafety).
The case for the ban is real
It would be dishonest to treat this as regulators inventing a problem. The harms eSafety is responding to are well documented: in 2026 Australian courts found Meta and Google liable for addictive design features, and the evidence linking compulsive social-media use to adolescent mental-health decline is substantial enough that a dozen governments are now watching Australia's experiment closely. The ban is also democratically grounded — it passed Parliament on 29 November 2024 with rare cross-party support and broad public backing. A regulator that did nothing while platforms profited from minors would be failing its statutory remit. The strongest version of eSafety's position is that platforms removed 4.7 million under-16 accounts by mid-December 2025 yet kept the friction low enough that re-registration stayed trivial — doing the letter of the law while gutting its purpose (eSafety media release).
What eSafety is actually demanding
The problem is not the goal but the compliance test. eSafety's guidance says a platform fails the "reasonable steps" standard if it relies on self-declaration, lets users hold accounts "for unreasonable periods before detection," fails to block reactivation, or allows repeated attempts to pass an age check. Read together, these criteria do not describe lighter-touch options — they describe a system that can only be satisfied by persistent, identity-level age assurance: facial-age estimation, document checks, or behavioural inference applied to the entire user base, not just suspected minors (Euronews).
That is the quiet cost of the March findings. To prove a user is over 16, a platform must in practice verify the age of everyone — because you cannot identify the children without screening the adults. A law framed as protecting kids becomes, operationally, a mandate that every Australian adult submit to age verification to keep using mainstream social media. The Electronic Frontier Foundation has warned that age-gating regimes of this kind are "a dangerous new system of control" that normalises identity checks as the price of speech (EFF).
Proportionality is the missing word
Good regulation is proportionate: it weighs the harm prevented against the rights and costs imposed, and prefers the least intrusive means that works. The eSafety enforcement posture inverts this. By treating any failure to catch a determined minor as a compliance breach, it effectively demands perfect exclusion — a standard no identity system meets without sweeping collateral surveillance. Age-estimation tools misclassify adults near the threshold, forcing document uploads; data-protection regulators worldwide have flagged that mass collection of facial scans and IDs creates exactly the honeypot that breach after breach has taught us to avoid.
The effectiveness case is also weaker than the rhetoric. eSafety's own compliance update concedes that the 4.7 million figure "does not equal the number of social media users" still on the platforms, and acknowledges genuine uncertainty about how many under-16s remain (The Conversation). Determined teenagers migrate to VPNs, smaller services outside the ten named platforms, or open-web alternatives the law does not touch. A measure that imposes universal verification costs while delivering uncertain exclusion of the targeted group is the textbook definition of disproportionate.
A better path exists
None of this requires abandoning child safety. The Conversation's analysis makes the constructive point: an account ban addresses access, not "the actual harms posed by content, algorithms and other platform features." A duty-of-care model — already contemplated in Australia's wider Online Safety Act review — targets the addictive design the courts have now found unlawful, without conscripting every adult into an identity check. Default privacy settings for minors, algorithmic transparency, and friction on engagement-maximising features attack the harm directly and survive a proportionality test.
The risk in the current trajectory is that Australia exports a template. Wells is right that other jurisdictions are watching; that is precisely why the enforcement standard matters. If "reasonable steps" hardens into "verify everyone, perfectly," the global precedent will not be safer children — it will be an internet where anonymous, friction-free participation is quietly abolished. eSafety can pursue the genuinely bad actors among these five platforms without writing universal age-gating into the definition of compliance. Whether it chooses the proportionate path, or the maximal one, is the decision that will actually be tested when it announces by mid-2026 whether to litigate.