How are Google and Microsoft implementing age verification?

From 27 December 2025, all ‘internet search engine services’ operating in Australia are required to comply with Schedule 3 – Internet Search Engine Services Online Safety Code (Class 1C and Class 2 Material) (Code) registered under the Online Safety Act 2021 (Cth) (eSafety Act).^[1]   The Code, registered by the eSafety Commissioner on 27 June 2025 pursuant to section 140 of the eSafety Act, mandates that search engine providers take reasonable steps to limit children’s exposure to harmful online content.^[2]

As two (2) of the largest search engine providers globally, it is anticipated that Google and Microsoft will play a central role in shaping how the industry responds to these new requirements.  This article explores what the Code demands in relation to age verification and examines how Google and Microsoft are likely to implement systems to meet these new obligations.

What is required by the Code?

The Code, enforced by eSafety Commissioner, requires internet search engine services to implement the following age assurance measures where technologically feasible and reasonably practicable:

• apply appropriate age assurance measures for account holders; and
• apply tools and/or settings — such as ‘Safe Search’ functionality — at the highest safety level by default for account holders who age assurance systems indicate are likely to be Australian children.^[3]

At a minimum, these tools must filter out online pornography and high-impact violence material (Class 1C) detected in search results.^[4]

What are Google and Microsoft’s mooted solutions?

While Google and Microsoft have yet to issue official statements as to how they will address the Australian Code, both companies have been actively exploring and trialling a range of age assurance technologies in global markets.  These include:

• Zero-Knowledge Proof (ZKP) cryptography: open-source library of cryptography tools that allow people to prove that something about them, such as their age, is true without exchanging any other data.^[5]
• Machine learning-based age estimation: using large language models (LLMs) to estimate an account holder’s age based on browsing behaviour.^[6]
• Selfie verification & Government ID: requesting account holders submit a selfie or upload a government-issued ID if their activity suggests they may be under eighteen (18).^[7]
• Google Wallet integration: exploring the use of digital ID cards stored in the Google Wallet to verify age.^[8]

Concluding remarks about compliance with the Code

While neither company has committed to a specific solution for age verification in Australia, it is expected that they will leverage established global technologies and expertise to develop compliant, scalable systems that meet the requirements of the Code.

Links and further references

Industry codes

Schedule 3 – Internet Search Engine Services Online Safety Code (Class 1C and Class 2 Material)

Further information about eCommerce law

If your business need advice on ecommerce law, please contact us for a confidential and obligation-free discussion:

Disclaimer

This article contains general commentary only.  You should not rely on the commentary as legal advice.  Specific legal advice should be obtained to ascertain how the law applies to your particular circumstances.

[1]   Schedule 3 – Internet Search Engine Services Online Safety Code (Class 1C and Class 2 Material) (27 June 2025) eSafety Commissioner https://www.esafety.gov.au/sites/default/files/2025-06/Schedule-3-Internet-Search-Engine-Services-Online-Safety-Code-%28Class-1C-and-Class-2-Material%29.pdf.

[2]    Schedule 3 – Internet Search Engine Services Online Safety Code (Class 1C and Class 2 Material) (27 June 2025) eSafety Commissioner https://www.esafety.gov.au/sites/default/files/2025-06/Schedule-3-Internet-Search-Engine-Services-Online-Safety-Code-%28Class-1C-and-Class-2-Material%29.pdf.

[3]    Schedule 3 – Internet Search Engine Services Online Safety Code (Class 1C and Class 2 Material) at [7], p.5.

[4]    Schedule 3 – Internet Search Engine Services Online Safety Code (Class 1C and Class 2 Material) at [7], p.5.

[5]    Google (2025) Longfellow ZK https://github.com/google/longfellow-zk; Microsoft, ‘Advancing Privacy with Zero-Knowledge Proof Credentials’ (Blog Post, 22 July 2020) https://techcommunity.microsoft.com/blog/microsoft-security-blog/advancing-privacy-with-zero-knowledge-proof-credentials/1441554.

[6]   Google, ‘New Digital Protections for Kids, Teens and Parents’ (Blog Post, 3 March 2025) https://blog.google/technology/families/google-new-built-in-protections-kids-teens/.

[7]   Google, ‘Access Age-Restricted Content & Features’ (Web Page, 3 March 2025) https://support.google.com/accounts/answer/10071085?hl=en#zippy=; Microsoft, ‘Microsoft Entra Verified ID introduces Face Check in preview’ (Blog Post, 6 February 2024) https://www.microsoft.com/en-us/security/blog/2024/02/06/microsoft-entra-verified-id-introduces-face-check-in-preview/.

[8]   Google, ‘Google Wallet launches new age and identity verification features’ (Web Page, 3 May 2025) https://blog.google/products/google-pay/google-wallet-age-identity-verifications/.

---

Related insights about technology and ecommerce law