‘On the internet, nobody knows you’re a dog’ … but in Australia they will soon.

Introduction

While seemingly innocuous, the The Online Safety Amendment (Social Media Minimum Age) Act 2024 is among the most significant changes to the internet in Australia and is among similar legislative changes occurring throughout the Western world.

The legislation is framed as being for the purposes of child safety as an ‘age assurance’ scheme and would purportedly prevent children from accessing social media. This will impact other websites, including search engines and various online platforms.

It would be foolish to deny that the internet can be a dangerous place, especially for children. The harms of social media are well documented. The problem with this legislation is that in order to determine who is and is not a child, everyone will need to participate in age assurance on the internet. Secondly, internet age assurance has inconclusive evidence to support its intended use case and fails to justify its broad powers and dangerous precedent. The most recent studies suggest it is risky and there is strong potential for both false positives and false negatives.

While the term ‘age assurance’ is used in official publications, the most likely method to ‘assure’ your age will be to verify it with photos or identity documents, as is the case overseas. Functionally, this legislation is related to identity verification for the internet, for everyone.

The devil is in the details

It was confirmed that there will be no legally enforceable minimum standards for services deemed to be social media. Meaning, there is no strict requirement for tech companies to actually verify the age of every user, strictly speaking. Rather, they are required to make best effort attempts to prevent underage users. It makes the multi-million dollar initiative a little toothless as far as enforcement on big tech goes, but vague and opaque enough to raise an eyebrow.

GitHub was approached by the eSafety Commissioner for consultation, as they may fall under the definition of social media. Wikipedia has also expressed concern for similar reasons, regarding their moderation system. Any reasonable person can see that these are clearly not social media platforms. Social media isn’t simply any platform where two or more people can communicate with each other. Social media platforms are gamified to foster engagement, using algorithms to dictate a central feed, with an emphasis on content creation and consumption. They are not places designed to store software and information, like GitHub and Wikipedia.

This highlights a key problem - the scope is broad and vague, subject to interpretation and appeal rather than clear definition. You cannot make a strong argument that open source code repositories and free encyclopedias are social media platforms, yet alone harmful to children. Rolling up platforms like GitHub and Wikipedia under the social media umbrella might be an unintended byproduct of careless and lazy governance, rather than a deliberate attempt at censorship and suppression. However, it’s not an acceptable outcome. The idea of needing to verify your identity to access free information and software goes against the origins of the internet itself. The modern web and the fabric of our digital lives are built upon these kinds of resources in a way that most people do not comprehend.

In a predictably absurd twist, 4chan is unlikely to be subject to age verification. 4chan is a ‘message board’, not social media, according to eSafety Commissioner Julie Inman Grant. Yet, 4chan is a volatile platform that is categorically inappropriate for children and a place where unfathomable harms have brewed. While the implementation of age verification for 4chan is unfeasible due to the website’s anonymous design, it’s an odd idiosyncrasy and indicative of the platforms that will stay freely accessible to children. When mainstream, conventional social media is unavailable, deeper, darker corners of the internet are readily accessible. These platforms are poorly moderated (or unmoderated) and can expose children to far more harmful, radical content than mainstream alternatives.

As similar legislation is already in place in the UK, we can watch the cracks emerge from afar. A third party provider processing the identity verification for Discord has already been hacked, with personally identifiable information (PII) compromised. This is concerning - particularly in the case of Australia, where there is no clear framework or regulations for how the PII associated with age verification must be stored and managed. There are no penalties for failing to protect users and their data. The safety of Australian internet users is not even an afterthought. Encouraging the acquisition of PII without suitable guidelines demonstrates a complete lack of foresight.

This paves the way to lay blame. The Australian Government has made it clear that social media platforms are expected to attempt to prevent children from accessing their services, but are not required to meet any security benchmarks. When the platforms that try to comply inevitably get compromised, the Australian Government can simply deflect responsibility and dust their hands as compliance was never mandated - only encouraged. This approach is negligent and borderline reckless.

“If you have nothing to hide, you have nothing to worry about”

The worst counter-argument of all time. Let’s get this one out of the way.

This is a logical fallacy routinely used to paint privacy conscious people as deviant or wrongdoers. The problem with this statement is that age assurance measures are not aimed at people doing the wrong thing - they are aimed at everyone.

Ironically, the Australian Government’s own correspondence regarding this legislation is heavily redacted. As in, pages and pages of redacted text, meeting agendas or other details obscured. While I respect that some things need to be protected, such as contact information or specific sensitive details, I can’t help but see the irony in heavily redacted documents underpinning a bill that is detrimental to the privacy of Australian citizens. See for yourself.

• Screenshot from Order of 28 July 2025 (37) relating to social media minimum age - legislative instruments

Privacy should be the default state - it’s not something that need be justified. Let me illustrate the point further. If you have nothing to hide you will have no issue:

• Sending me you email account or social media logon details.
• Handing me your unlocked phone.
• Giving me access to your financial information, like bank accounts or investments.
• Letting me review your personal medical history.
• Allow me to read all messages you’ve sent in confidence to anyone.

See where this is going? Ask yourself the following questions:

• Do you lock your house when you go out?
• Do you close your curtains at night?

If you answered yes to either of these, why? Do you have something to hide? Or is it because you benefit from privacy?

Most people don’t place the same value on their digital privacy, but in modern life it’s more important than ever. Cyber security is just as important as physical security.

Finally, it’s okay to have things to hide. It’s abnormal for humans to have every facet of their life publicly available. Especially with the permanency of the internet - people have the right to decide how they handle their own information, what they share and with whom.

Arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say.

- Edward Snowden

Broader attacks on privacy

While there is no explicit ‘right to privacy’ and free speech on the internet has always been under threat, legislative measures have noticeably ramped up throughout the Western world this year. Throughout 2025, the United Kingdom, United States and European Union are enacting or discussing similar measures attacking privacy and encryption. We’ve seen:

• Privacy oriented mobile operating systems like GrapheneOS are scrutinised and viewed as suspicious by some law enforcement agencies.
• The Australian government openly expressing interest in the idea of backdooring popular messaging apps, like Signal.
• The European Union debating ‘Chat Control’, or the mass-scanning of private messages to detect CSAM. This Louis Rossman video discusses this in more detail. Great thumbnail, I know.

There will always be alternate communication methods and ways for motivated users to skirt around such impositions. I’m more concerned about the ordinary people who will take this as normal or acceptable. It moves the needle further to the right and any privacy-conscious person becomes even more of a weirdo: comply and use insecure platforms or be ostracised.

Unlike the law enforcement operations that have targeted criminals directly or the mass-surveillance programs that have occured in the murky shadows of our intelligence agencies, this is being done publicly in front of everyone, to everyone equally. While the idea of a ‘age assurance to protect the children’ seems harmless, it sets precedent for broader, public incursions into the digital lives of Australians.

While this legislation doesn’t go that far, eventually it seems inevitable that centralised digital identity will become the norm. Digital identities will firmly link an individuals digital footprint to their real life identity. For services that are legally obligated to follow know your customer requirements (such as utilities, financial services, government services, insurance, etc.) there are actually some benefits to correctly implemented digital identity systems, from a privacy and security standpoint. However, generic internet usage (such as web browsing, social media or streaming) cannot use this without creating glaring concerns for privacy and the freedom of speech.

Surveillance creep

Surveillance creep refers to the gradual expansion of surveillance measures. Policies and systems that were initially implemented for seemingly harmless or even beneficial purposes, later become used for different purposes - often more invasive and sinister.

Australia has a proven track record of surveillance creep. For example:

• Metadata retention laws introduced for prescribed security and law enforcement agencies have been accessed by the “RSPCA, Victorian Institute of Education, Taxi Services Commission and local councils”.
• Covid contract tracing apps that were introduced strictly as public health tools have been used by law enforcement for solving crimes.

Surveillance measures introduced for one purpose are commonly used later for new purposes. This is demonstrated fact in Australia. When we allow new surveillance measures, we are not accepting these things only for their original purposes - we’re deciding as a society if they’re acceptable to use indiscriminately across the board.

Won’t somebody please think of the children?

This whole situation has a tone of the classic ’think of the children’ moral panic.

However, much of the discourse doesn’t focus on what this will achieve for children. How is this expected to improve their lives and futures in general? What are the objectives and indicators of success? These questions remain unanswered. Parents already have the ability to block social media or other websites using their home router software. This functionality has existed for longer than many popular social media platforms. Admittedly, its easily bypassed by savvy kids much like this new system.

It seems like most of our legislators are so old, crusty and out of touch that they’ve forgotten what it was like to be a teenager. As someone on the other side of the median age from those calling the shots, I’m well aware that young people will find ways to do what they want, even when told not to by those in positions of authority. Especially when told not to. They are smart, sneaky and creative. In the UK, we’re already seeing children bypass identity verification requirements completely using low cost VPNs, alternative DNS services, images of other people, or even images of animated characters.

If we can’t ban our way out of this ‘youth social media crisis’, shouldn’t we be considering harm reduction techniques? Or methods to equip young Australians with the resilience and knowledge to better understand the risks of both social media and the internet in general?

As someone who’s actually thought of the children, we should consider:

• Ensuring children have relationships with safe, trusted adults (parents/guardians, teachers, etc.), who they can reach out to for help in a judgement-free way if they see something online that is inappropriate, or makes them feel uncomfortable.
• Teaching children critical thinking and ensuring they understand that what they see online is not necessarily factually correct. Harmful content can be deliberately deceptive, or simply fake (AI-generated). They need to be skeptical of and critically assess information that’s presented to them and find reliable sources.
• Encouraging respectful dialogue, welcoming different perspectives and having evidence-based discussions, even with people they don’t agree with.
• Targeting specific types of harmful content with education on the core issues. Educate young people in an age-appropriate way on challenging topics that appear online, such as:
  • Racism
  • Political extremism and radicalisation
  • Misogyny
  • Sexual content, such as pornography
  • Healthy relationships and topics related to consent and coercive control
  • Bullying
  • Mental health
  • Misinformation and disinformation

These require nuance, respect and maturity to discuss. As polarising and sometimes uncomfortable topics, they require treating children like adults. Throughout the age assurance identity verification discourse, there’s been zero emphasis what we are actually trying to achieve for young people long term. Preaching abstinence and opting for prohibition comes at the opportunity cost of teaching the ability to handle adversity and face challenges.

Beyond present day, what challenges are today’s youth going to be living with later in life? At a high level:

• Declining literacy rates and academic performance related to maths and science
• Civic education being at all time lows
• Fewer entry level jobs due to changing workforce demands
• Australia having some of the least affordable housing
• Australia having the highest income-debt ratio of any similar nation
• The fallout of a warming climate and more frequent, more intense natural disasters

Generation Z, Alpha and Beta will struggle to read, write, understand maths and science, make an informed vote, get a job and buy a house. They will be poorer than their parents, with more debt. They will live in a more climatically hostile environment with more frequent, more intense natural disasters. At least we saved them from Instagram, TikTok and Snapchat!

They won’t even get the joy of doomscrolling while their future hangs in limbo.

What can you do about it?

Unfortunately, it’s too late to reverse this. However, it’s important to not give up on privacy completely. Yes, the view that ’they probably already have it all already anyways’ probably has some truth to it. However, it’s no reason to idly watch things get worse.

If this concerns you, consider doing the following:

• Write to your local member. Better yet - call them.
• Write to the eSafety Commissioner.
• Talk to your friends, family and colleagues.
• Remember this at the next election and support parties/candidates with pro-privacy policies.
• Start decreasing your reliance on big tech. Be prepared to walk away from invasive services. There are fully fledged, affordable/free, privacy-friendly alternatives out there for almost everything. As consumers, we have the power to make choices and simply not participate in the circus if we don’t want to.
• Go outside and touch grass.

Conclusion

The long term consequences of leaning into age assurance and identity verification for the internet are profound. The ability to have private correspondence disappears. Users will be surveilled, scrutinised and ultimately will self-police and self-censor. Internet activity will be directly tied to your real identity - every click, every search, every comment, every message. The idea of using something anonymously is not feasible for the average user. ‘Alt accounts’ are no long alternate. This reduces and controls the flow of information, removing the ability to curate your own experience using the internet, threatening net neutrality and digital rights.

Lawmakers claim we are ahead of the curve. The question is, ahead of the cure of what exactly? Surveillance capitalism? Techno authoritarianism?

If you’ve ever thought about it, now is the time to begin the journey of migrating your digital life to privacy-friendly alternatives. Don’t let perfect be the enemy of good - privacy is a process, not an end state.

Age assurance for the internet is unlikely to create meaningful improvements for youth and sets dangerous precedent for future expansions of surveillance power. This creates issues for privacy, freedom of expression and censorship, impacting the free flow of information that originally made the internet the catalytic public resource it is today. Online experiences are becoming increasingly dictated by those in positions of power. More than just a privacy battle, this is about protecting intellectual freedom for generations to come.