Security2 distinct publishers2 min readPublished
The Online Safety Bill names Instagram, TikTok, Snapchat and Facebook, permits facial age estimation and digital ID, and caps fines at 10 percent of global revenue. Nobody has said who keeps the face scans.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
The load-bearing words are "reasonable steps" [2]. The bill offers four ways to satisfy them: existing account information, facial age estimation, digital ID services and formal identification [4]. Those are not four grades of the same control. Existing account information is a birthday field nobody checked. Facial age estimation and digital ID mean a platform, or a vendor acting for it, receives a face or a government credential and rules on it. A statute that lists both without saying which one clears the bar leaves the definition to be settled afterwards, by a regulator and by whatever enforcement record accumulates.
Operators resolve that kind of ambiguity upward, because the downside is lopsided. Picking the weakest permitted check and being told later it was not reasonable is the expensive outcome. Running facial age estimation on everyone is merely costly. So the predictable end state is that a large share of adult users on the named services get age-checked as well, because you cannot sort 15 year olds out of a population without inspecting the population.
Then comes the part that never gets legislated first. Neither published account of the bill describes what a platform must do with a face scan or an ID record once the check has passed [7]. An age-assurance record has no product use the moment it has done its job, and every month it stays on disk it is something that can be breached or subpoenaed. The duty to collect is being drafted now. The duty to destroy is in neither account.
The evidence base repays a close read too. The Government says one in three children aged 13 to 17 spends at least five hours a day on social media [8]. Five hours a day is 35 hours a week [9], which is a working week. But the cohort that produced the figure straddles the line the bill draws: 16 and 17 year olds are two of the five ages counted, and both would remain permitted users at a threshold of 16 [10]. The statistic supports intervention. It does not by itself support that number.
For anyone running a service with accounts, the durable part of this is not the ban. It is that age assurance stops being a product argument and becomes a documented obligation with an evidentiary trail attached. Whatever a platform does at signup is the exhibit it hands over when a regulator asks how a 15 year old got in, and the same record is the thing an attacker will eventually go looking for.
Ranked by verification strength, evidence, and original report placement.
The New Zealand Government introduced the Online Safety (Minimum Age and Child Safety Risk Assessment) Bill to Parliament, beginning the legislative process for under-16 social media restrictions.
The proposed law would require high-risk social media platforms to take reasonable steps to prevent children under 16 from accessing their services, and to establish whether users are over 16.
High-risk platforms covered by the proposal include Instagram, TikTok, Snapchat and Facebook.
The Bill allows multiple age-checking methods: existing account information, facial age estimation, digital ID services and formal identification.
Companies that fail to meet their obligations could face fines of up to 10 percent of global revenue.
An online safety regulator within the Department of Internal Affairs would independently monitor compliance, investigate platforms and enforce the law.
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Two consistent secondary accounts, no bill text or independent analysis
Both publishers agree on the concrete terms: named platforms, four permitted age-check methods, the 10 percent global-revenue penalty ceiling and a regulator inside the Department of Internal Affairs. That agreement is strong for the mechanics but derives largely from government communications; no bill text, regulatory impact analysis, privacy assessment or platform response appears in the supplied material, and the one contested point (whether Australia's precedent is working) is asserted on each side without primary citation.
Pre-legislative: introduced, contested, no compliance observed
The Bill has only been introduced to Parliament, one publisher reports opposition and unclear prospects of passage, and no platform has been reported taking any age-assurance step in New Zealand. The only in-force comparator, Australia's under-16 ban, is described by independent studies as difficult to enforce with many young teens still on platforms, and France's approved under-15 law has not yet taken effect.
Firm-sounding duty ahead of enforceable reality
Coverage presents a hard statutory regime, a 10 percent global-revenue penalty, a regulator, behaviour already changing, while the Bill is only introduced, faces opposition with unclear odds of passage, and its closest precedent is documented as hard to enforce. The Government's supporting usage statistic covers ages 13 to 17, two of whose five age-years would remain permitted users, and the mechanism most likely to create new risk, custody of face scans and ID records, is unaddressed in both accounts. The overstatement is moderate rather than severe because the reported terms themselves are specific and consistently sourced.
Government-sourced framing dominant, one publisher adds counterweight
The substance of both accounts flows from the Prime Minister's statement, his office's press release and the Education Minister's quotes, including the unaudited 13-to-17 usage figure and the claim of Australian behaviour change; the ministers have an evident interest in the Bill being seen as effective and as burdening platforms rather than families. One publisher partially offsets this by reporting parliamentary opposition and independent enforcement studies. No platform, industry body, civil-liberties or privacy voice appears in either source, so the incentive mix on the record is one-sided.
Mechanics reliable, outcome and data-handling unknown
Confidence is solid on what has been proposed, because two independent publishers report the same terms, and low on what will happen, because passage is contested, enforcement precedent is weak, and the supplied sources say nothing about age-assurance data custody, penalty application in practice, or platform response.
product
Age assurance without a spec: France cuts verification, New Zealand promises 10 percent2 distinct publishers
security
The fluent cohort is the scammed cohort: 70% of 18-to-22s hit by an AI scam1 distinct publisher
product
Meta's under-13 data practices go to a jury: 29 AGs, COPPA, and a porous age gate1 distinct publisher
product
Cinemas, classrooms and ICE: smart glasses now need a venue-policy contingency1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 25, 2026
1 article · August 24, 2026