Accuracy minimums for age checks could bring Big Social in line with Australian law

“Age checks fail.” That is, perhaps, a snappier headline than “social media platforms aren’t following the law” – and it’s how recent findings from KJR Labs are being framed in major news publications.

“Australia’s teen social media ban fails to clear first hurdle in age checks,” says a headline from Reuters.

The not-so-fine print is that the so-called ban is “ineffective” because platforms are not implementing the available technology in compliance with the law, instead relying on their own data profiling systems.

Testing by KJR Labs – which also ran tests for the 2025 Age Assurance Technology Trial – found that platforms “did not ask for age proof on any of the 50 accounts it opened after the law came into force and on which it declared the ⁠age as 16.” The story suggests that this “reveals a largely overlooked flaw: while ​the ⁠process has so far focused on the accuracy of photo-based age-assurance software, the initial vetting stage – which guesses a person’s age range based on their general online activity – does not appear to be picking up young users for further checks.”

Profiling not an effective ‘initial vetting stage’

The “initial vetting stage” referred to describes what the UK Information Commissioner’s Office (ICO) classifies as “profiling” –  using internally deployed AI to gather data, monitor user activity and guess at their age based on what the algorithm finds. Unsurprisingly, this has become the preferred option for social media firms, who pass it off as age inference: they get to use their nifty large language models (LLMs) to collect more data to feed on. And, conveniently, since the platforms control the algorithms, there is no guarantee they work as Meta and company say they do.

Andrew Hammond, director at KJR, says “you should be asked to demonstrate how old you are, and not once ⁠have we been asked to verify our age or use age-assurance measures.” Among the 10 platforms that are subject to the age restrictions, including Instagram, Facebook, Snapchat, TikTok and YouTube, “none ‌of the platforms let users sign up if they declared they were under 16. But just one, ‌Australia-based livestreaming platform Kick, refused to let users create an account without proof of age.”

That’s a clear demonstration that what social media companies are passing off as age assurance is not sufficient under Australia’s law.

Per the Reuters report, a Meta spokesperson said the trial appeared inconsistent with the regulator’s guidance of escalating “to formal age verification when behavioural indicators suggest they may be underage, or when an account is reported.”

A spokesperson for eSafety says the commissioner “remains confident that age-restricted platforms have the technology and resources they need to prevent Australian children under 16 from having accounts.”

One cannot circumvent something that isn’t there

So goes the debate. Platforms say their own systems are good enough, while fighting tooth and nail against laws requiring third-party age assurance. Regulators say platforms are fully capable of following the law.

The Age Verification Providers Association (AVPA) has already issued a response to KJR’s findings. “The right reading of this study is not that age assurance has failed,” it says. “It is that age assurance has barely been tried, and where it has been tried in the form of genuine document, biometric, voice or database checks rather than a self-declared tickbox, teenagers are not routinely defeating it with VPNs or other technical workarounds.”

The ask is for clear technical accuracy thresholds. “Until accuracy levels are actually measured and required, studies like this one will keep confirming the same thing: not that age assurance doesn’t work, but that it isn’t being used.”

Circumvention thus becomes “the go-to by young people,” says Colm Gannon, Australia CEO of the International Centre for Missing & Exploited Children (ICMEC), who advised on the Age Assurance Technology Trial.

Gannon says when circumvention was brought up during the AATT, “we kept on being ⁠told that that wasn’t part of the actual trial.”

Which it wasn’t. That trial was to assess whether or not privacy preserving age assurance in Australia was possible. It was a market survey, an evaluation of market status, and a test of select providers to validate claims about their technology.

It’s the platforms

The root of the problem is not in the legislation itself, nor in the technology. Technically, it is an enforcement issue: if nunchucking chickens is illegal (it is), one might expect anyone taking a swing at the local fowl to be charged. Yet regulators have yet to find a fine large enough to be of major consequence to the world’s wealthiest companies – although Australia is trying, having recently doubled its noncompliance penalties – and no one is showing up at Elon Musk’s house with a pair of handcuffs.

In the end, the problem is what could variously be defined as recalcitrance, rebellious disruptiveness, stubbornness, rascality, or simply flouting the law with a smirk, as the newswires tee up the next headline about how regulators just can’t get those dang online safety laws to work. The more incompetent regulators are made to look, and the more ineffective biometric age assurance tools are suggested to be, the happier the social media giants become.

Article Topics

age verification  |  Australia age verification  |  AVPA  |  biometrics  |  KJR Testing  |  social media