Cheap software able to fool age verification systems could render Australia’s groundbreaking social media laws “useless”, according to the company stress-testing enforcement of the forthcoming ban on under-16s having accounts.
Australia passed world-first legislation last month preventing anyone under the age of 16 from registering to join social media services including Instagram, X, Facebook and Snapchat. The new law, in effect from November 2025, will put the onus on tech companies to enforce the age limit or face potential fines of up to A$49.9mn (US$31.9mn) for systemic breaches.
The Australian government has commissioned a A$3.4mn trial to help determine how it will enforce the new law and the most effective methods tech companies can use to comply. The trial will be co-ordinated by British not-for-profit specialist company The Age Check Certification Scheme and will involve a live test of 1,200 people starting next year.
Tony Allen, founder and chief executive, told the Financial Times the trial would stress-test different methods of age verification by incorporating “attack vectors” that could be used to fool systems. They include the use of fake IDs, face-swapping, deepfake software and virtual private networks (VPNs) that mask a user’s location.
Allen said the biggest concerns were around easy-to-use, cheap and scalable methods — such as software that can make a person look 10 years older — that under-16s could use to undermine the law. “That would make age verification useless,” he said.
He was less concerned with the notion that tech-savvy children would easily dance around any verification tools by using expensive software and sophisticated methods. “Kids that could do that aren’t interested in signing up to Facebook or watching online porn. They’re more likely to try to break into the FBI,” he said.
Allen said there was “no silver bullet” for verifying ages, with methods ranging from the use of official documents to less precise techniques, such as age estimation based on facial or hand recognition technology.
The Australian government included stipulations in the law that no one should be compelled to provide government identification — such as a driver’s licence or a Medicare card — to register with social media companies, because of privacy concerns. That means social media companies will probably have to come up with a range of options for users to verify their age.
The Australian government has admitted it does not expect the social media ban to be completely foolproof.
Allen said the law meant social media companies would now be subject to the same sort of restrictions and responsibilities as online gambling companies, credit card providers and retailers selling alcohol in ensuring no children were using their services. Given that responsibility, verification should become more routine over time, he said.
The trial, set to report back in June, will be critical to defining how the enforcement of Australia’s ban should progress, but also for how other governments will tackle the issue of improving online safety for teenagers and children.
“The world is watching,” said Mimi Zou, a law professor at the University of New South Wales and an adviser to the UK Ministry of Justice.
The debate around how to implement the Australian law obscures a broader point, she added. “The most important thing is that a message has been sent to Big Tech [that] Australia is ready and prepared to do this even if it doesn’t work. Social media companies are being told to go much further to create safe spaces for children.”
