When Australia's Parliament passed the Online Safety Amendment (Social Media Minimum Age) Act 2024, ministers framed it as a narrow intervention: keep under-16s off TikTok, Instagram, Snapchat, and X until they are old enough to handle algorithmic feeds. Eighteen months later, with the Act taking effect in December 2025 and the eSafety Commissioner now drafting implementation guidance, the law's scope is expanding into territory that even its drafters did not clearly anticipate. The latest flashpoint: in-app commerce.
In early 2026, the eSafety Commissioner issued draft regulatory guidance clarifying that TikTok Shop and equivalent in-app commerce features fall within the Act's scope. Platforms must either demonstrate that commerce functionality is architecturally separated from age-restricted social feeds, or enforce age assurance across the entire integrated experience. The choice — separate or age-gate everything — sounds clean on a regulator's whiteboard. In product reality, it is neither.
What the guidance actually does
TikTok Shop is not a discrete app. It is a set of features — live shopping streams, product tags in videos, a discovery tab — woven into the same recommendation engine that powers the For You feed. The same is true of Instagram Shopping, Snapchat's AR try-on commerce, and emerging shoppable features on X. Treating these surfaces as severable from the social product misunderstands how modern platforms are built.
The draft guidance gives platforms two choices, both costly:
- Architectural separation: Spin commerce features into a sibling product with its own data flows, its own recommendation system, and its own onboarding. Effectively, build a second app.
- Universal age assurance: Verify the age of every Australian user — including adults buying laundry detergent through a live stream — to the same standard required for social feeds.
Neither option is proportionate to the harm the Act was sold to address. The legislative debate, as recorded in the Parliament of Australia's Bills database, focused on adolescent mental health and algorithmic amplification. It did not focus on whether a 14-year-old should be able to buy a phone case.
Age assurance is the unsolved problem
The Albanese government's own age-assurance technology trial, run by the Department of Infrastructure and reported throughout 2025, concluded that no current method is simultaneously accurate, privacy-preserving, and inclusive. Facial estimation systems return higher error rates for darker skin tones. Document-based verification excludes Australians without government ID. Hashed-token systems require a central authority — and central authorities are honeypots.
Extending these systems from social feeds to commerce surfaces compounds every concern. A user who buys something through TikTok Shop now generates a verified-identity trail tied to purchase history, payment information, and shipping address. That is not a child-protection regime; it is an adult-surveillance regime with a child-protection label.
The Electronic Frontier Foundation's recent analysis, "The Science is Not Settled," documents how the evidence base for under-16 social media bans remains contested. The American Psychological Association, the U.S. Surgeon General's office, and peer-reviewed meta-analyses have all qualified their conclusions. Australia legislated through that uncertainty. Now the regulator is extending the legislation through further uncertainty — into a domain (commerce) the original evidence base never touched.
The competition cost is real
Architectural separation favours incumbents. Meta and ByteDance can afford to fork their stacks, run parallel infrastructure, and absorb the conversion-rate hit of breaking the discovery-to-purchase pipeline. Australian retailers who depend on these platforms cannot.
The Australian Retailers Association estimates that social commerce already accounts for a growing share of small-business digital sales, and live shopping has been one of the few channels where independent local sellers can compete with marketplace giants. If commerce surfaces get bifurcated or buried behind age walls, the channel narrows — and the platforms most likely to survive are the ones with the resources to build the second app.
A proportionate path exists
None of this is an argument that platforms should ignore child safety. The Act's underlying concern — that algorithmic feeds optimised for engagement can harm developing users — deserves serious response. But the response should be targeted at the harm, not at every adjacent feature that shares a codebase.
A more proportionate framework would:
- Limit age-gating to features whose harm profile is actually established — algorithmic recommendation, direct messaging with strangers, public follower counts for minors.
- Permit commerce features to operate under the existing consumer-protection regime administered by the ACCC, which already covers misleading conduct, minors and contracts, and product safety.
- Require transparency and researcher access — provisions of Australia's Basic Online Safety Expectations already point this direction — rather than architectural mandates that lock in current platform designs.
The eSafety Commissioner's consultation window is the moment to recalibrate. December 2025 has already arrived; the Act is live. But guidance is where ambiguous statutes meet operational reality, and the choices made in the next few months will set precedent for every jurisdiction watching Australia as a regulatory laboratory. The UK's Ofcom, the EU's Commission services administering the DSA, and U.S. state attorneys-general are all reading the same draft.
The right lesson to export is not that commerce is social media. It is that proportionate, evidence-based regulation beats categorical bans — and that the open internet's commercial layer is too valuable, to small businesses and consumers alike, to be collateral damage in a debate that was supposed to be about teenagers and TikTok feeds.