OAIC publishes new guidance for under-16s social media ban

On 10 October 2025, the Office of the Australian Information Commissioner (OAIC), led by Privacy Commissioner, Ms Carly Kind, released a twenty-nine (29) page Privacy Guidance on Part 4A (Social Media Minimum Age) of the Online Safety Act 2021 (New Guidance).  This New Guidance details the privacy obligations for Age-Restricted Social Media Platforms (Restricted Platforms) and third-party age assurance providers.  The Privacy Commissioner put these entities “on notice“, stressing the need to ensure that age assurance methods are implemented lawfully.

Context of New Guidance

This New Guidance precedes the Social Media Minimum Age (SMMA) scheme taking effect on 10 December 2025.  The SMMA regime, which aims to prevent Australians under sixteen (16) from holding accounts on Restricted Platforms, is jointly regulated by the OAIC and the eSafety Commissioner, Ms Julie Inman Grant.

While the eSafety Commissioner published guidance on “reasonable steps“ Restricted Platforms must take to prevent underage users, the OAIC’s New Guidance focuses on the handling of personal information and ensuring compliance with existing legislation such as the Privacy Act 1988 (Cth) (Privacy Act). 

The Privacy Commissioner emphasised that the SMMA legislation is “not a blank cheque to use personal or sensitive information in all circumstances” and affirmed that the OAIC will be actively monitoring Restricted Platforms to ensure they deploy age assurance “proportionately and lawfully“.

The New Guidance is comprised of the following seven (7) chapters:

• Key considerations;
• Overview of Part 4A;
• Adopting a privacy by design approach when choosing an age assurance method;
• Privacy guidance – collection;
• Privacy guidance – destruction;
• Privacy guidance – secondary use or disclosure of personal information collected for SMMA compliance purposes; and
• Privacy guidance – frequency of checks.

Overview of New Guidance

Part 4A of the Online Safety Act 2021 (Cth)

Part 4A of the Online Safety Act 2021 (Cth) (Online Safety Act) requires providers of Restricted Platforms to take reasonable steps to prevent children under the age of sixteen (16) years (Age-Restricted Users), from having an account on their social media platform.

The onus is on Restricted Platforms to introduce demonstrable systems that ensure that Age-Restricted Users cannot create or continue holding a social media account.

Part 4A does not prescribe what ‘reasonable steps’ platforms must take.  However, it has been made clear by the OAIC and the eSafety Commissioner that Restricted Platforms will be required to implement age assurance technology at a minimum.

Part 4A operates alongside the Privacy Act and the Australian Privacy Principles (APPs), and introduces additional, more stringent obligations on Restricted Platforms.

Section 63F(1) states that where Restricted Platforms hold personal information about an individual that was collected for SMMA compliance purposes, they must not use or disclose that information for any other purpose, except where:

• disclosure is required by Australian statute, a Court order, law enforcement or health-related reasons; or
• with the voluntary, informed, current, specific and unambiguous consent of the individual.

New Guidance on SMMA data collection obligations

“New collection” for age verification

Restricted Platforms may collect limited personal information, such as selfies or copies of Government-issued identification, to verify if a user is at least sixteen (16) years old.  It is preferable to collect binary information, such as whether someone is or is not an Age-Restricted User, rather than more personal details like date of birth.  Restricted Platforms are encouraged to use on-device or temporary processing, to avoid storing selfies or documents, and to offer clear options and alternatives, such as facial age check or digital ID token.

Using existing information for age verification

If Restricted Platforms already hold user information such as date of birth, this can be used to confirm age without triggering new privacy obligations. However, where new data is created, such as a “16+” flag attached to an account, the obligations would be triggered.  Restricted Platforms should also avoid unnecessary use of sensitive information like biometrics, which carries greater privacy obligations, when non-sensitive personal information suffices.

Age verification by inference

Restricted Platforms can infer age using metadata, behaviour, or account history, however these inference results, such as “likely 16+”, are considered new personal data.  This process is less accurate than other methods and may be disproportionately invasive, hence this process should start with low-risk age signals like IP address and account age and avoid profiling or sensitive data unless necessary.

For more information on age verification technology, see our article on the Federal Government’s Final Report on the Age Assurance Technology Trial.

New Guidance on SMMA data destruction obligations

Section 63F(3) of Part 4A of the Online Safety Act also requires Restricted Platforms to destroy SMMA information after using or disclosing it.  This rule is stricter than APP 11.2, which allows retention if reasonably necessary for ancillary business needs.  Deidentification of personal information is not sufficient in lieu of destruction.

Inputted data like selfies, documents, and biometrics are higher risk and must be destroyed immediately after use, while outputted tokens, inferences, and methods of collection can be kept briefly in a separate ring-fenced SMMA cyber environment away from other systems.

It is recommended that prior to destruction, personal information is kept in read-only Application Programming Interfaces (APIs) that allow retrieval but explicitly prevent the modification or creation of data.  Minimal retention is acceptable in certain cases including for:

• audit logging, where a record with minimal personal information may be kept as evidence that an age check occurred;
• troubleshooting or fraud, where information may be retained only for case-specific investigations; and
• complaints and reviews, where information may be stored temporarily in a redacted form before destruction.

Each of these purposes must have defined time limits for retaining information, strict access controls and automated deletion processes in place.  Vague or padded purposes, such as “future research”, cannot be used to justify longer retention, and an objective, platform-wide retention matrix is recommended to manage and limit how long data is kept.  A failure to comply is considered an interference with the privacy of the individual pursuant to section 13 of the Privacy Act.

New Guidance on ongoing SMMA data obligations

SMMA compliance measures must be proactive and adaptive, requiring regular monitoring of platform changes and user behaviours to identify emerging risks and attempted circumvention by Age Restricted Users.

Ongoing compliance, such as through recurring checks or triggers, should be proportionate and necessary.  Any reuse that relies on existing personal information should have consent or another clear legal basis, as per APP 6.  Restricted Platforms should build and maintain their age assurance practices so that quality is maintained in compliance with APP 10, and security and retention limitations required by APP 11 are enforced by design.

Takeaways for Restricted Platforms

Key takeaways are as follows:

• collect only what is needed for SMMA purposes;
• destroy data promptly after SMMA purposes are met as de-identification is not sufficient;
• do not store raw inputs unless strictly necessary and time-limited;
• secondary use and disclosure is prohibited without clear, unambiguous consent or a valid legal exception;
• maintain clear retention schedules, with automatic deletion mechanisms;
• build ring-fenced systems to support compliance and accountability; and
• do not bundle consent with general terms, instead provide separate and opt-in conditions.

Links and further references

Legislation

Privacy Act 1988 (Cth)

Online Safety Act 2021 (Cth)

Further information about SMMA scheme obligations

If you need advice on the impending SMMA scheme obligations for your online business or platform, contact us for a confidential and obligation free discussion:

Disclaimer

This article contains general commentary only.  You should not rely on the commentary as legal advice.  Specific legal advice should be obtained to ascertain how the law applies to your particular circumstances.

Related insights about privacy compliance