Australia banned under-16 social media accounts and left reasonable steps undefined in the Act — the regulator's own tracking survey found use of the restricted services fell from 85.9 to 81.5 percent between December 2025 and April 2026, and as of 2026-07-07 no provider had been fined

What is happening?

The Online Safety Amendment (Social Media Minimum Age) Act 2024 passed the federal Parliament on 2024-11-29 and the prohibition commenced on 2025-12-10. It bars Australians under 16 from holding accounts on the services the eSafety Commissioner designates as age-restricted, and it places the duty on the provider rather than on the child or the parent. The duty is to take reasonable steps to prevent under-16 account holding. The Act does not say what those steps are.

What fills that space is regulatory guidance the eSafety Commissioner released on 2025-09-16, which legal analyses of the regime describe as principles-based and not legally binding. The guidance recommends a waterfall of successive age-assurance methods and advises providers against relying on self-declaration alone. It mandates no particular verification technology. The maximum civil penalty standing behind the obligation is 30,000 penalty units, about 49.5 million Australian dollars.

Designation is also narrower than the phrase social media ban implies. Services whose primary purpose is messaging, email, online gaming or education sit outside the rules, so the regime reaches some of the places children gather and not others.

The regulator has since measured the result twice and its own numbers point two ways. On 2026-03-31 the eSafety Commissioner published a compliance update reporting that five designated services allowed accounts already self-declared as under 16 to retry low-confidence age estimation, and that more than half of the children surveyed had never been asked to confirm their age. Then a tracking survey of 803 children aged 10 to 15 and their guardians, run in March and April 2026 against a December 2025 baseline and published 2026-07-31, found that use of age-restricted services had moved from 85.9 to 81.5 percent while account holding had moved from 52 to 42 percent. Account holding fell by the larger margin of the two. In the same survey 37 percent of the children said they had entered an age of 16 or over, and 18 percent said a verification system had placed them at 16 or over.

As of 2026-07-07 no provider had been fined. The regulator said that gathering sufficient evidence takes time. In early July 2026 the government introduced a bill to double the maximum penalty to 60,000 penalty units, about 99 million Australian dollars, and the bill was referred to a parliamentary inquiry with a report due 2026-08-25. Whether it passed is not confirmed in any source opened here.

Whose problem is this?

The body that measured the shortfall is the same body that would have to enforce against it, and the standard it would enforce was written by nobody in binding form. Parliament set a penalty ceiling and left the floor to guidance, so the one actor with the power to act is the one waiting for a definition it cannot issue.

Where does this problem end?

Three value questions sit immediately next to this document and none of them is decided in it. Whether a minimum age for social media is sound policy is the first, and it is the substantive issue in a challenge now before the High Court. Whether mandatory age assurance is an acceptable privacy cost for every adult user is the second. Whether the design of these services rather than the age of their users is the thing that ought to be regulated is the third. This document measures the distance between a duty and its definition, and takes no position on which of those three ought to decide the matter.

What is the state now, and what should it be?

Now

The record therefore contains a great deal of visible activity. A world-first law was passed and commenced on schedule, guidance was issued before commencement, millions of accounts were removed or restricted, the regulator checked compliance and published what it found, it measured the effect on children and published that too, and a bill to raise the penalty has been introduced and referred. The one thing none of that has produced is a determination that any provider did too little.

Needs a new measurementthe target state: no source opened here names a share of under-16 use the regime is meant to reach, a date by which a first enforcement action is meant to have been taken, or a set of age-assurance measures a provider must have in place to be treated as compliant. The Act names a duty and the guidance names methods it recommends, and neither carries a number or a date that a later year could be measured against. The only figure the regime has fixed is the maximum penalty, which describes what an enforcement action could cost rather than what the regime is trying to achieve. Nobody is failing to hit a figure here, because no figure has been set.

How big is it?

The population layer for this document records not-derivable, and the reason is a mismatch of age bands rather than a missing percentage.

What the regulator survey measured. Use of age-restricted services among children aged 10 to 15 stood at 85.9 percent at the December 2025 baseline and 81.5 percent when the same group was surveyed in March and April 2026. Account holding over the same window went from 52 to 42 percent, a larger movement than the change in reported use. Those two measures moving apart is itself the finding: children who no longer hold an account on a designated service still report using one. Both figures are shares within that survey and neither is presented here as a national rate.

Why there is no headcount. Converting a share into a count of children needs a denominator, and no opened source supplies one for this band. The only Australian population figure reached in this round covers ages 0 to 14, while the survey frame is ages 10 to 15, so the bands differ at both ends. The secondary aggregator carrying that figure returned HTTP 403 on re-check. Multiplying one by the other would produce a number with no source behind it, which is why this document does not.

What the provider action count does and does not say. About 4.7 million accounts had been removed or restricted by mid-January 2026, with more than 300,000 further actions reported by March 2026. That counts accounts rather than people. One child can hold accounts on several designated services, and the total also includes accounts of adults who did not complete age assurance. No opened source converts accounts into distinct persons.

A separate survey taken outside government. A survey of 1,050 Australians aged 12 to 15, commissioned by a United Kingdom child-safety charity and reported on 2026-04-25, found that more than 60 percent still reached at least one previously used platform and that two thirds said the service took no step to remove or re-verify the account. It was commissioned by an organisation that campaigns on online safety, so it is recorded here as a finding and not as a measure of what the regime ought to achieve.

Under what conditions does it arise?

1. The duty was written without a threshold. The Act requires reasonable steps and does not define them, and the content comes from guidance the regulator itself presents as principles-based rather than binding. A duty whose content sits in a document that binds nobody cannot be breached in a way a tribunal could measure. Every condition below rests on that one.

2. Age assurance is probabilistic, and the guidance treats it that way. A waterfall of successive methods is recommended rather than one mandatory technology. A method that returns a confidence rather than an answer can be run again, and the eSafety Commissioner compliance update of 2026-03-31 reported that five designated services allowed exactly that for accounts already self-declared as under 16.

3. The first gate is still what the user types. In the regulator tracking survey 37 percent of the children said they had simply entered an age of 16 or over, and more than half said they had never been asked to confirm an age at all. A gate that can be retried until it opens is a delay rather than a gate.

4. The designated set is narrower than the harm. Services whose primary purpose is messaging, email, online gaming or education are outside the rules. A child removed from a designated service can move to an undesignated one without leaving the internet, and no opened source measures how much of the remaining use is of that kind.

5. The penalty is large and has never been applied. The maximum stands at 30,000 penalty units and as of 2026-07-07 no provider had been fined. A ceiling that has never been tested tells a provider nothing about what compliance costs, and it leaves the regulator no precedent on which to build the next case.

What has been tried?

Two directions ran at once and a third now runs against both. The regime was written and commenced on schedule, and the regulator measured the result and published what it found. What has not been tried is the step that would convert a measurement into a consequence, and the instrument the government reached for instead was a larger ceiling for a penalty that has never been imposed.

What was found?

Why is it still unsolved?

Enforcement absent — the duty exists and carries a large maximum penalty, and the standard it would be enforced against was never written down in binding form.

The first reason is that non-compliance is not currently a determinable state. A provider can be penalised only for failing to take reasonable steps, and the Act does not say what reasonable steps are. The content comes from guidance that the regulator describes as principles-based and that binds nobody. So there is no threshold a regulator can hold up and no line a provider can be shown to have crossed, and a survey finding that most children still use the services is not by itself a finding that any provider fell short of a duty. That is the sense in which the reason the regulator gave, that gathering sufficient evidence takes time, is a description of the statute rather than of its own diligence.

The second reason is that the measurement and the instrument point at different things. The tracking survey measures what children do. The duty measures what providers do. A share of children who still use a designated service can fall because providers verified harder, or because children moved to services the rules exclude, or because a question was answered differently in the second round. Nothing in the regime links the first quantity to the second, so the figure the regulator publishes cannot tell anyone whether the duty is working. Account holding falling further than reported use is the clearest sign of that gap: the part of the regime that providers control moved, and the part it was meant to change moved less.

The third reason is that the gate is built to be retried. Age assurance arranged as a waterfall of successive probabilistic methods has no single point at which a wrong answer becomes final, and the eSafety Commissioner compliance update of 2026-03-31 reported that accounts already self-declared as under 16 could run the estimate again until it returned an older age. Against that, 37 percent of the surveyed children said they had entered an age of 16 or over and more than half said they had never been asked to confirm one. A design in which the cheapest method is tried first and failure is not terminal produces exactly the distribution the regulator measured.

The fourth reason, which is the one that keeps the pattern stable rather than merely slow, is that the response to an unenforced maximum was a larger maximum. The bill introduced in July 2026 would double the ceiling to about 99 million Australian dollars, and as of 2026-07-07 no provider had been fined under the existing one. Raising a number that has never been applied changes the headline without changing the standard, and the standard is the part that is missing. Every actor in the system can meanwhile point to real activity — a law passed, guidance issued, accounts removed in the millions, a compliance check completed, a survey published, a bill introduced — and none of it has produced a determination that any provider did too little. A gap that keeps producing visible motion produces no pressure, because from outside it looks like something is already happening.

What observation would mean it is solved?

Candidates — (a) the Act or another binding instrument defines what reasonable steps are, at a level a provider can be measured against (b) a first enforcement action runs to a determination, so that the duty acquires a meaning in practice (c) the share of children in the regulator tracking survey who still use age-restricted services falls, and keeps falling across several rounds.

(a) alone is weaker than it looks. A definition can be written at a level of generality that changes nothing, or carry a defence of having taken reasonable steps that reproduces the present question one layer down. The bill introduced in July 2026 raises a penalty without defining the duty, which is the shape this candidate is most likely to arrive in.

(b) alone can be satisfied by one small case. A single determination against a single provider would establish that the duty is capable of being breached, which is more than exists now, and it would still leave the standard to be assembled case by case over years. It is also the candidate most exposed to the pending constitutional challenge, an outcome that could remove the duty rather than define it.

(c) alone measures children rather than providers. The share can fall because verification improved or because use moved to services the rules exclude, and the regime collects nothing that would separate those two. Account holding in the survey already fell further than reported use, which is the evidence that the two move apart. The three have to be read together, and (a) is the one without which the other two cannot be interpreted.

What is it connected to?

Fills with researchage assurance and privacy regulation, including what a provider may retain from an identity or biometric check; the separate Australian codes covering age-restricted content; minimum-age and age-verification laws in other jurisdictions and how their enforcement provisions compare; the implied freedom of political communication as a limit on federal online-safety legislation; and service design duties, which are a different instrument aimed at the same harm. Relation type and evidence grade were not confirmed in this round.

What these sources do not say

• Whether the bill to raise the maximum penalty passed. The parliamentary inquiry report was due 2026-08-25 and no source opened here covers any date after early August 2026. Nothing above should be read as saying that the bill did pass or that it did not, and the same blind spot covers whether the compliance examination of the five designated services was ever closed.
• What sample the tracking figures rest on. Two opened sources describe the same regulator survey differently, one as 803 children aged 10 to 15 and their guardians in a longitudinal stage and one as a sample of more than 4,000. The survey report did not open, so which figure belongs to which stage is unresolved here. That is why the shares of 85.9 and 81.5 percent are reported above as shares within the survey rather than as a national rate.
• How many Australians are aged 10 to 15. The only population figure reached in this round covers ages 0 to 14 and came from a secondary aggregator that returned HTTP 403 on re-check. Because the bands differ at both ends, the survey shares cannot be converted into a count of children, and that is the reason the population layer of this document records not-derivable.
• Which provisions of the Act carry the duty and the penalty. Automated retrieval of the Act text on the Federal Register of Legislation returned only a table of contents and binary content, so no section is cited by number anywhere above.
• What the regulator found in its own words. The compliance update of 2026-03-31 and the tracking survey report did not open. Both reach this document through press and trade accounts of them, and the findings graded medium above are the ones that depend on that.
• How much of the remaining use is of services the rules exclude. The regime leaves out services whose primary purpose is messaging, email, online gaming or education. No opened source separates continued use of a designated service from movement to an excluded one, and that split is the difference between a regime being evaded and a regime aimed at the wrong set.
• How large the circumvention channels are. Several opened sources describe virtual private networks and borrowed adult credentials as routes around age assurance. None of them quantifies what share of continued use runs through any route.
• Whether any provider has been told what would be enough. No source opened here carries a statement from the regulator or from government describing a set of measures that would be treated as sufficient, and none reports a provider asking for one.
• What the designated providers say. No source opened here carries an on-the-record response from any designated provider to the compliance findings of 2026-03-31 or to the tracking survey. The one provider position recorded in this round is the constitutional challenge filed on 2025-12-12, and that goes to the validity of the law rather than to the adequacy of any compliance measure.

See the evidence

One government primary document was read directly. The media release of 2024-11-29 opened and supplies the passage date and the shape of the obligation, including that the Act requires reasonable steps without naming a verification technology. Nothing else primary opened. The Act text, the compliance update of 2026-03-31, the tracking survey report, the regulator regime page and the departmental fact sheet all failed automated retrieval, so seven rows above are blank with the reason recorded rather than filled with a substitute link, and no provision of the Act is cited by number anywhere in this document. Where sources overlap they agree: the survey figures of 85.9 and 81.5 percent and of 52 and 42 percent appear identically in three opened sources, and the characterisation of the guidance as principles-based and not binding appears in two. Where they disagree the disagreement is left visible rather than resolved — two opened sources describe the same survey with different samples, one as 803 children and guardians and one as more than 4,000, and neither acknowledges the other. Figures resting on a single opened source are graded medium or low above rather than presented as settled, and the survey taken outside government is attributed to the kind of body that commissioned it. No source opened here covers any date after early August 2026, so the passage of the penalty bill and the closure of the compliance examination are both outside what this document can say. This is a Path A output, so observation_refs is empty and provenance_mode: press-derived.

People affected

Estimated range Not derivable

The reason and what is missing are listed under “What is missing” below