No comment on the implementation, but I wonder if there's some value in just allowing parents to be able to point to this and say "No, little Fred, you're not allowed to have an Instagram account until you're 16. It's the actual rule."

The government currently tendering for providers of different systems. See here [1] and here [2]:

Tender documents released on Monday show the technical trial is slated to begin “on or around 28 October”, with the provider also expected to assess the “effectiveness, maturity, and readiness” of technologies in Australia.

Biometric age estimation, email verification processes, account confirmation processes, device or operating-level interventions are among the technologies that will be assessed for social media (13-16 years age band).

In the context of age-restricted online content (18 years or over), the Communication department has asked that double-blind tokenised attribution exchange models, as per the age verification roadmap, and hard identifiers such as credit cards be considered.

[1] https://www.innovationaus.com/govt-readies-age-verification-...

[2] https://www.biometricupdate.com/202409/australia-launches-te...

Making it illegal could make it taboo, kids are less likely to talk about it in fear of "getting caught" and less talking means less usage.

This is not like porn which is a solitary activity: on social media you have to be social and let everyone know… at least for traditional actually-social media, not content-consuming apps like TikTok.

It's similar to alcohol usage: you can't stop it completely, but also you don't have 50% of kids bringing it to school.

A drop down list of birth dates/years "works" for most age restricted sites - I guess the logic is that if a user is lying about their age, it's not the sites problem.

Article states that sites must demonstrate they are taking reasonable measures to enforce this though - a lot will come down as to how courts interpret that. If they go to the extremes of the KYC laws in australia I imagine a significant fraction of adults will not want to verify their age.

    > extremes of the KYC laws in australia

There’s a near-zero chance of getting caught driving without a license. Despite not having a drivers license checking mechanism, people generally don’t drive without a license because of the mere fact that it’s illegal.

Societal signaling is pretty powerful.

RE ".....how can you implement such a law..."

Request the social media platform to implement the restriction. The large social media platform have billions $ cash , so if that "really want to implement it" it should not be a problem.

However, I expect social media companies to "drag out every reason , why they can ot implement it..." - since it does not benefit the social media company. ... and would reduce its user base ...

You don't!

That's exactly what they're aspiring to here, following on from a well-established pedigree of Australian lawmakers and their dysfunctional relationship with the Internet.

I don't think lawmakers should describe HOW things are done necessarily. Here it's enough to say that "unless you can be 100% sure your user is above age X, then you can't provide them service Y or feature Z".

It might not even be the desired outcome to have identification, the better outcome could be to have feature Z stripped for all users (for example video feeds based on past watching behavior).

It’s happening on porn sites in some states in the US right now. When you visit the site, they ask you to validate with your ID.

You don't necessarily need to actually attempt to globally enforce it. It's like speeding, right? Everybody knows the law, and a lot of people choose to break it. We can't check everybody's speed all the time, so instead we selectively enforce.

The real change though comes from parent's perceptions. Right now there's age limits of 14-years-old on most social media platforms, however most parents just see this as a ToS thing, and nobody cares about actually violating it. Once it becomes law, the parents are suddenly responsible (and liable) for ensuring their children are not breaking the law by accessing social media. It's not going to stop everybody, but it'll certainly move the needle on a lot of people who are currently apathetic to the ToS of social media platforms.

The government is being deliberately non-prescriptive about that, as they are about what qualifies as 'social media' (statement of fact - no comment on the approach itself). Ideally the legislation is accompanied by a government digital service that allows 3rd parties to verify age _without_ divulging full identity, but I don't see that side of things being discussed anywhere down here :(

Well, funny you should mention that - the AU government ID system (used to access govt services like medicare and tax), has very recently been rebranded from MyGovID to MyID. Most states have already got digital drivers' licences.

Same as alcohol. If you supply your kids with alcohol, or even have it at home and they get drunk without your knowledge, you'll be in trouble.

Law should not be excessively prescriptive, especially in the case of rapidly-evolving technologies (and business sectors) for all the obvious reasons.

What's far more useful is to propose effective incentives and disincentives, and let the participants work this out for themselves. There are some useful principles and examples which come to mind:

- Business is profit-oriented. Attack the basis of profits, in a readily-identifiable and enforceable way, and activity which pursues those markets will tend to dry up.

- Business is profoundly risk-averse. Raise the risks of an activity, or remove protections or limitations on threads (e.g., Section 230 of the CDA in the US), and incentives to participate in that activity will be greatly reduced. Penetrating corporate and third-party veils would be particularly useful, in this case, of service providers (aiding and abetting in a proscripted commerce) and advertisers (profiting by same). Lifting any limitations on harms which might occur (bullying, induced suicides, addiction, or others) would similarly be crippling.

As to how age might be ascertained:

- Self-reporting. Not terribly reliable, but a decent first cut.

- Profiling. There are exceedingly strong indicia of age which can be made, including based on a particular account's social graph, interests, online activity, location data (is the profile spending ~6h daily at an elementary school, and not lunching in the teacher's lounge?), etc. One strong distinction is between legislation and regulation, where the latter is imposed (usually with rulemaking process) through the executive branch (SCOTUS's Loper v. Raimondo being a phenomenally stupid rejection of that principle). Such regulation could then on a more flexible basis identify specific technical means to be imposed, reviewed, and updated on a regular schedule.

- Access providers. Most people now access the Internet through either fixed-location (home, work, institutional) providers, or their own mobile access provider. Such accounts could well carry age (and other attestation) flags which online service providers could be obliged to respect as regards regulation.

Jumping in before a few obvious objections: no, these mechanisms are not perfect but I'll assert they can be practically effective; and yes, there are risks for authoritarian regimes to abuse such measures, but then, those are already abusing present mechanisms. I'd include extensive AdTech-based surveillance in that, which is itself ripe for abuse and has demonstrated much of this already.

(That said, I'd welcome rational "what could possibly go wrong" discussion.)

Remember the Silicon Valley episode where they would have been fined $21 billion for not verifying the age of PiperChat users? Same way. All companies are one slippery slope away from being fined by Missouri for not protecting children enough. Or Australia.