Australia’s Privacy Watchdog Sets Proportionality Bar for Age Assurance as Enforceable Codes Arrive

Australia’s Office of the Australian Information Commissioner has published guidance on age assurance technologies, setting out privacy expectations for entities deploying age checks under the country’s expanding online safety framework. Privacy Commissioner Carly Kind said the guidance clarifies requirements around necessity and proportionality, transparency, complaints mechanisms, and vendor due diligence.

Under the guidance, entities must justify why age checks are required before implementing them, adopt privacy-by-design principles, and select data-minimizing methods where possible. The OAIC expects organizations to ensure that vendors in the age assurance ecosystem maintain appropriate data security standards. Where age assurance involves collection of biometrics or other sensitive personal data, entities must obtain clear consent.

The guidance arrives alongside enforceable industry codes registered by the Office of the eSafety Commissioner, which recently brought age verification requirements into force for pornography websites, app stores, AI chatbots, and other platforms. Those codes require platforms to confirm users are 18 or older before granting access to high-impact content. The eSafety Commissioner’s codes are technology-neutral: acceptable methods range from parental confirmation and photo ID to facial age estimation, credit card checks, digital ID wallets, or third-party verification providers.

Australia’s age verification requirements stem from a broader legislative push. The Social Media Minimum Age Act banned users under 16 from major platforms including Facebook, Instagram, TikTok, X, and YouTube. Combined with the eSafety codes, the result is a multi-layered framework spanning both adult content and social media, with the OAIC now providing the privacy guardrails for how age checks must be implemented across both.

Kind said proportionality is central to the guidance: entities must be able to demonstrate that their chosen age assurance method is appropriate for the risk level of the relevant service, and should not collect more personal data than is necessary to complete the age check. The OAIC also expects transparent disclosure to users about how age assurance data will be used and retained.

The release of binding codes and privacy guidance together marks a shift from Australia’s earlier voluntary and trial-based approach. Regulators had previously registered industry codes for online safety as a framework, but enforcement authority now sits with both the eSafety Commissioner and the OAIC, giving Australia two regulatory levers over the age assurance market simultaneously.

Sources: Office of the Australian Information Commissioner

–

By the ID Tech Editorial Team