From 27 December 2025, all ‘internet search engine services’ operating in Australia are required to comply with Schedule 3 – Internet Search Engine Services Online Safety Code (Class 1C and Class 2 Material) (Code) registered under the Online Safety Act 2021 (Cth) (eSafety Act).[1] The Code, registered by the eSafety Commissioner on 27 June 2025 pursuant to section 140 of the eSafety Act, mandates that search engine providers take reasonable steps to limit children’s exposure to harmful online content.[2]
As two (2) of the largest search engine providers globally, it is anticipated that Google and Microsoft will play a central role in shaping how the industry responds to these new requirements. This article explores what the Code demands in relation to age verification and examines how Google and Microsoft are likely to implement systems to meet these new obligations.
What is required by the Code?
The Code, enforced by eSafety Commissioner, requires internet search engine services to implement the following age assurance measures where technologically feasible and reasonably practicable:
- apply appropriate age assurance measures for account holders; and
- apply tools and/or settings — such as ‘Safe Search’ functionality — at the highest safety level by default for account holders who age assurance systems indicate are likely to be Australian children.[3]
At a minimum, these tools must filter out online pornography and high-impact violence material (Class 1C) detected in search results.[4]
What are Google and Microsoft’s mooted solutions?
While Google and Microsoft have yet to issue official statements as to how they will address the Australian Code, both companies have been actively exploring and trialling a range of age assurance technologies in global markets. These include:
- Zero-Knowledge Proof (ZKP) cryptography: open-source library of cryptography tools that allow people to prove that something about them, such as their age, is true without exchanging any other data.[5]
- Machine learning-based age estimation: using large language models (LLMs) to estimate an account holder’s age based on browsing behaviour.[6]
- Selfie verification & Government ID: requesting account holders submit a selfie or upload a government-issued ID if their activity suggests they may be under eighteen (18).[7]
- Google Wallet integration: exploring the use of digital ID cards stored in the Google Wallet to verify age.[8]
Concluding remarks about compliance with the Code
While neither company has committed to a specific solution for age verification in Australia, it is expected that they will leverage established global technologies and expertise to develop compliant, scalable systems that meet the requirements of the Code.
Links and further references
Industry codes
Schedule 3 – Internet Search Engine Services Online Safety Code (Class 1C and Class 2 Material)
Further information about eCommerce law
If your business need advice on ecommerce law, please contact us for a confidential and obligation-free discussion:
Malcolm Burrows B.Bus.,MBA.,LL.B.,LL.M.,MQLS.
Legal Practice Director
T: +61 7 3221 0013 (preferred)
M: +61 419 726 535
E: mburrows@dundaslawyers.com.au
Disclaimer
This article contains general commentary only. You should not rely on the commentary as legal advice. Specific legal advice should be obtained to ascertain how the law applies to your particular circumstances.
[1] Schedule 3 – Internet Search Engine Services Online Safety Code (Class 1C and Class 2 Material) (27 June 2025) eSafety Commissioner https://www.esafety.gov.au/sites/default/files/2025-06/Schedule-3-Internet-Search-Engine-Services-Online-Safety-Code-%28Class-1C-and-Class-2-Material%29.pdf.
[2] Schedule 3 – Internet Search Engine Services Online Safety Code (Class 1C and Class 2 Material) (27 June 2025) eSafety Commissioner https://www.esafety.gov.au/sites/default/files/2025-06/Schedule-3-Internet-Search-Engine-Services-Online-Safety-Code-%28Class-1C-and-Class-2-Material%29.pdf.
[3] Schedule 3 – Internet Search Engine Services Online Safety Code (Class 1C and Class 2 Material) at [7], p.5.
[4] Schedule 3 – Internet Search Engine Services Online Safety Code (Class 1C and Class 2 Material) at [7], p.5.
[5] Google (2025) Longfellow ZK https://github.com/google/longfellow-zk; Microsoft, ‘Advancing Privacy with Zero-Knowledge Proof Credentials’ (Blog Post, 22 July 2020) https://techcommunity.microsoft.com/blog/microsoft-security-blog/advancing-privacy-with-zero-knowledge-proof-credentials/1441554.
[6] Google, ‘New Digital Protections for Kids, Teens and Parents’ (Blog Post, 3 March 2025) https://blog.google/technology/families/google-new-built-in-protections-kids-teens/.
[7] Google, ‘Access Age-Restricted Content & Features’ (Web Page, 3 March 2025) https://support.google.com/accounts/answer/10071085?hl=en#zippy=; Microsoft, ‘Microsoft Entra Verified ID introduces Face Check in preview’ (Blog Post, 6 February 2024) https://www.microsoft.com/en-us/security/blog/2024/02/06/microsoft-entra-verified-id-introduces-face-check-in-preview/.
[8] Google, ‘Google Wallet launches new age and identity verification features’ (Web Page, 3 May 2025) https://blog.google/products/google-pay/google-wallet-age-identity-verifications/.
Related insights about technology and ecommerce law
-
A bet or a game? The Lottoland decision
The Supreme Court of New South Wales has ruled in favour of Lottoland Australia Pty Ltd, affirming that its disputed products fall under the exception of an Excluded Wagering Service as defined by the Interactive Gambling Act 2001 (Cth), clarifying the distinction between ‘bets’ and ‘games’.
-
Abhorrent violent content prohibited
Organizations hosting abhorrent violent material, such as terrorism, murder, torture, rape and kidnapping, now face hefty fines under the Criminal Code Amendment Act 2019 (Cth), up to 50,000 penalty units or 10% of annual turnover.
-
Domain name disputes – the case of eazyjet.com
Learn more about domain name disputes and the evidence required to establish confusion, rights, and bad faith. Internet Corporation for Assigned Names and Numbers (ICANN) and World Intellectual Property Organization (WIPO) provide legal elements and remedies, and the implications of failing to respond to a complaint.
-
EU General Data Protection Regulations (GDPR) – How to comply
The General Data Protection Regulation (GDPR) applies to Australian entities processing personal data of European Union (EU) citizens/residents. It outlines principles, notification obligations, penalties for non-compliance, and requirements for cross-border data transfers.
-
Legal challenges arising from data loss
Organisations must protect confidential data from external and internal threats. Learn steps to secure data, potential data breach implications, and how a data breach notification bill may require affected entities to notify consumers.
-
Data Breach Bill 2016 – key data security considerations
The Privacy Amendment (Notifiable Data Breaches) Bill 2016 has been passed, making notification of data breaches mandatory from 23 February 2018. Find out how this could affect you and what measures you can take to protect your data.
-
Legal risks in the in-app purchase model
Software developers and publishers are offering users the chance to make In-App Purchases within their software, but there are legal risks involved. Learn how to protect yourself and your business by understanding the requirements of distribution platforms and Australian consumer law.
-
Letting go of employees threatening to go to the media
When employees leak confidential information or threaten to go to the media, employers can face serious consequences. Find out what the Fair Work Commission says about this issue and what options employers have to protect themselves.
-
What exactly is an advertising sign-off?
Injunctions are Court orders that can restrain almost any conduct. Prohibitory, Mandatory, and Ex Parte injunctions can be sought if serious question to be tried, urgency, damages would not suffice, and the balance of convenience favours the applicant.
