Background

The Online Safety (Minimum Age and Child Safety Risk Assessment) Bill was recently introduced to Parliament on 24 August. As you may be aware, the aim is to ban people under 16 from accessing social media, ostensibly for their own safety.

This isn’t the first legislation of its kind. Quite a few jurisdictions are already planning to do this, including UK and Australia. In fact, Australia’s gone beyond merely ‘planning’ on introducing some kind of ban and have already made it the law across the ditch. Australia started the ban in December 2025 and 8 months on, it’s been long enough that New Zealand’s had the opportunity to study how it’s gone for them. Which makes it all the more confusing since not only have these law changes not worked in Australia at all, New Zealand hasn’t made any real changes to how we’re approaching it to try and fix any of their issues.

What the Bill Requires

Let’s take a step back for a moment though. What does the Bill actually want? It wants to force social media platforms to undertake “reasonable steps” to ensure no New Zealander under 16 can access their websites. The onus is entirely on the social media platform, meaning if a child uses Facebook the punishment falls squarely on Meta (Facebook’s parent company). The reason for introducing this ban is to limit the harm that a child might face while using social media.

That’s all well and good but there’s issues.

The Age Verification Problem

The first problem is with age verification. One of the common ways to verify someone’s age is to request that they submit photo ID. Children typically don’t hold valid forms of photo ID, so the way the ban has actually worked in other jurisdictions is that adults need to submit ID to prove they’re not under 16. This means that how the law actually works is that rather than social media sites keeping a look out to prevent children from using their services, it turns into adults needing to prove they’re adults to stay online. The other alternatives tend to be either letting the social media platform scan your face or giving your personal information to a digital identity service and having them verify your age with the platform.

And yet, New Zealand appears to be going beyond that.

Clause 11 of the Bill (available to read online here) states that a social media platform will be in breach if the “only” things they do is to demand photo ID and/or have the user use a digital identity service. This not only gives social media platforms the green light to be more aggressive in collecting personal information to meet the requirements of the Bill, it almost forces them too because doing anything less means risking breaching their requirements to ensure under 16 year olds aren’t using their services. They have to collect as much data on you as possible, then profile you and guess if they think you’re over 16 or not.

The Data Collection and Leaks Problem

But no one likes surrendering their personal information. No one likes the pop up that begs you to allow cookies to track your personal information that appears on every website. New Zealanders are demonstrably finding personal information and privacy concerns an issue. The Privacy Commissioner held an annual survey on privacy in May 2026 (available online here). Over half of people surveyed felt that “none of our information is private anymore”. The top three privacy concerns were about the privacy of children, government agencies and businesses using AI to make decisions about you based on your personal info, and your personal info being held by social media companies.

Which leads us to the second problem: personal information keeps getting collected and then leaked.

For example, you may have heard of the Tea app. It was a dating app that collected tens of thousands of photo IDs and selfies for verification services, stashed online in an easily accessible cloud storage space. Tea launched in 2023, had two major data leaks in July and August 2025, then was removed off the Apple app store in October 2025. Discord, a popular instant messaging app, had over 70,000 government IDs leaked after their verification service provider was hacked. Last week, at the start of this month, the FBI is investigating the leak of 153 million drivers licenses being leaked onto the dark web after an identity verification company was compromised. These driver licenses are now being bought and sold over the dark web, and one of the driver licenses includes U.S Defence Secretary Pete Hegseth. Other ID stolen includes 10 million ID cards, 3 million travel documents, and 579,000 medical information records and cards.

This highlights one of the risks of this sort of legislation. It demands that everyone puts all of their personal information into the same box, which just makes it all the more tempting for someone to steal it. Social media platforms must collect this data however, the Bill demands it. They are expected to delete this information after verification is complete but every social media platform is expected to do it, meaning your personal information is always being collected. And there really isn’t any guarantee that third party digital identity or verification service providers will delete their data or not do anything else with it. The fact that so much information gets leaked at once every time this happens implies they’re actually storing it, if anything.

The Enforcement Problem

This leads us to another problem. How are we enforcing this?

All of these social media platforms are foreign. They don’t have physical presences in New Zealand, there’s no branches or offices here. So how are we supposed to fine an American company, exactly? Really, the only thing New Zealand could do is demand our local ISPs (internet service providers) to block the platforms and prevent anyone in New Zealand from accessing them. It’d be like a forced national strike. But Facebook has about 2.11 billion daily users. Not total users, just how many people log on to Facebook once a day. Stats NZ puts New Zealand’s total population as 5,361,300 as of 31 March 2026. Which means that if every single person in New Zealand had a Facebook account, we would make up 0.25% of the amount of people who log in daily. New Zealand really doesn’t have any power to make these massive foreign companies conform to our laws. They might do it to avoid the fuss for now, but once something happens there’s no way they’re accepting any penalties under the Bill.

The end result is that New Zealanders would be forced to send their photo ID to social media platforms, allow them to scrape as much personal information from them as possible for verification purposes, and if they make a mistake there’s nothing we can do about it. If you refuse to comply, the social media platform will just stop you from being able to use their services and it’d be our laws that lets them do it.

Does the Ban Even Work?

So what’s the point?

“It’s to protect children”

Unfortunately, as they say, the road to hell is paved with good intentions. Australia has been doing this for a while now so we can check in and see how that’s been going for them. The Australian eSafety Commissioner did a 3-month evaluation and published the results on July 2026 (available online here). The results were that before Australia introduced the ban, 85.9% of families had under 16s that used social media. After the ban, 81.5% of families had under 16s that used social media.

It turns out that kids are more tech savvy than adults and social media companies just want to do the bare minimum to comply and outsource most of it. The result is kids find it laughably easy to circumvent the age verification (sending photos of video game characters is one of the most common methods for example) while adults are still sending in their passports and drivers licenses just to keep using social media.

The ban barely does anything except collect the personal information of adults, which creates all sorts of privacy issues. Consider free speech for example. Once your ID is tied to your online presence, will you still be as truthful about what you really think online?

Final Thoughts

Despite my misgivings about the Bill, I do think that something has to be done about protecting minors online. I just don’t think the Bill is the way to do it, it’s demonstrably hasn’t worked in Australia and there’s no reason why it’d be any different for us. My personal thoughts on the matter is that the zeitgeist of the internet and its approach to personal information has changed. Back when I was a child and using the internet online, back in the 90s and early 00s, there was a much larger focus on teaching children how to be safe online. And, honestly, a sort of paranoia that sharing even the smallest scrap of personal information would let hackers track you down and kidnap you and/or steal all your money. That attitude largely fell away as the internet became more ubiquitous and now it’s considered fairly normal to share everything about your daily life online to everyone. Maybe we need to bring that back.