New Zealand's under-16 bill makes age checks a statutory duty, and someone has to hold the scans

The load-bearing words are "reasonable steps" ^[2]. The bill offers four ways to satisfy them: existing account information, facial age estimation, digital ID services and formal identification ^[4]. Those are not four grades of the same control. Existing account information is a birthday field nobody checked. Facial age estimation and digital ID mean a platform, or a vendor acting for it, receives a face or a government credential and rules on it. A statute that lists both without saying which one clears the bar leaves the definition to be settled afterwards, by a regulator and by whatever enforcement record accumulates.

Operators resolve that kind of ambiguity upward, because the downside is lopsided. Picking the weakest permitted check and being told later it was not reasonable is the expensive outcome. Running facial age estimation on everyone is merely costly. So the predictable end state is that a large share of adult users on the named services get age-checked as well, because you cannot sort 15 year olds out of a population without inspecting the population.

Then comes the part that never gets legislated first. Neither published account of the bill describes what a platform must do with a face scan or an ID record once the check has passed ^[10]. An age-assurance record has no product use the moment it has done its job, and every month it stays on disk it is something that can be breached or subpoenaed. The duty to collect is being drafted now. The duty to destroy is in neither account.

The evidence base repays a close read too. The Government says one in three children aged 13 to 17 spends at least five hours a day on social media ^[11]. Five hours a day is 35 hours a week ^[17], which is a working week. But the cohort that produced the figure straddles the line the bill draws: 16 and 17 year olds are two of the five ages counted, and both would remain permitted users at a threshold of 16 ^[18]. The statistic supports intervention. It does not by itself support that number.

For anyone running a service with accounts, the durable part of this is not the ban. It is that age assurance stops being a product argument and becomes a documented obligation with an evidentiary trail attached. Whatever a platform does at signup is the exhibit it hands over when a regulator asks how a 15 year old got in, and the same record is the thing an attacker will eventually go looking for.