Access Denied: Navigating Australia’s Age-Gating Rules for Online Gaming and Digital Content

In this insight, we set out a summary of the recent developments relating to the regulation of online content. It is important that online games providers and other content providers understand whether these requirements apply to their businesses and the associated penalties.

Social Media Ban

The Online Safety Amendment (Social Media Minimum Age) Act 2024 (Cth) received assent in December last year. This Act introduced a new part 4A to the Online Safety Act 2021 (Cth) (the OSA) which requires providers of certain kinds of social media platforms to take reasonable steps to prevent children who are under the age of 16 from opening an account with that platform. This, in effect, requires social media platforms to verify the ages of all customers. The requirement to conduct age verification is due come into effect in December 2025.

The OSA defines a “social media platform” as a service that satisfies all of the following conditions:

• the sole purpose, or a significant purpose, of the service is to enable online social interaction between 2 or more end-users;
• the service allows end-users to link to, or interact with, some or all of the other end-users;
• the service allows end-users to post material on the service; and
• the service satisfies any other conditions as set out in legislative rules.

This definition will capture services such as TikTok, Facebook, Snapchat, Reddit, Instagram and X. In other words, these services will be required to take reasonable steps to prevent people under the age of 16 from having an account with those services.

The Minister has indicated that legislative rules will be developed to exclude certain types of services. In the Second Reading Speech to the amending Act, the Minister indicated that services such as messaging services, online gaming services and services that significantly function to support the health and education of users will be carved out from the definition of a “social media platform” (and will therefore not be required to age-gate).

In relation to the carve out for online gaming services, the Minister noted that online games are currently regulated under the National Classification Scheme. This Scheme provides information as to the age suitability of certain games through the act of classification and the imposition of requirements for games providers to include mandatory consumer advice on packaging and in advertising materials. Online gaming services have therefore been excluded from the new social media ban to avoid unnecessary regulatory overlap.

The penalty for non-compliance with the social media ban is a civil penalty of up to 30,000 penalty units for an individual or five times that amount for a company (currently $9,900,000 and $49,500,000 respectively). In the event that non-compliance is identified by the eSafety Commissioner, the Commissioner may also prepare a statement to that effect and publish it on the eSafety website. Social media platforms are also prohibited from using any personal information collected via the age assurance process for any purpose other than for determining whether the user is age restricted.

The OSA does not prescribe the precise “reasonable steps” that social media platforms must take. At a minimum, platforms will be expected to implement some type of age assurance measures which estimate or verify the age of users. Whether an age assurance methodology is “reasonable” will depend on a variety of factors such as the efficacy of the methodology, the costs associated with its implementation and the data and privacy implications on users. The Australian Government is currently conducting an age assurance trial which is examining the effectiveness of a range of age assurance measures – it is expected that the results of this trial will provide social media platforms with more concrete guidance on the types of “reasonable steps” that they will be expected to take.

Interestingly, the new requirements preclude social media platforms from requiring Australian users to provide Australian government-issued identification documents as the only means of age assurance; in other words, social media platforms must not force users to use government identification documents (such as passports or drivers’ licences) for age assurance purposes.

Phase Two Online Safety Codes

As set out in our previous insight, the OSA applies to eight different categories of online service providers. The service provider is required to comply with the obligations that apply to the category that best describes their service.[1]

Industry codes and standards have been developed under the OSA via a two-phase process. If the eSafety Commissioner determines that an industry code should be registered, the requirements of that code becoming binding on the relevant service providers.

Phase 1 focused on the most extreme forms of “Class 2” material (ie. material that is or would be classified as R18+ or X18+); namely, child exploitation material, pro-terror material, extreme crime and violence material and drug-related material. Phase 1 industry codes for each of the different online service provider categories were registered by eSafety in 2024.

Phase 2 focuses on any remaining “Class 2” material. Final drafts of seven of the eight industry codes covering Phase 2 material were submitted to the eSafety Commissioner on 28 February 2025. The eSafety Commissioner is assessing whether these codes should be registered under the OSA. The final draft industry code, relating to app distribution services, was due to be submitted to eSafety on 28 March 2025.

Gaming services with communications functionality (ie. multiplayer computer games) are captured by the “Relevant Electronic Services Online Safety Code”. This code requires that providers of multiplayer gaming services that are, or would likely be, classified as R18+ must, where technically feasible and reasonably practicable, implement appropriate age assurance measures and access control measures before providing access to that computer game.

Other online video games that have been, or would be, classified as R18+ or lower, as well as other forms of media such as films, books, newspapers and magazines in digital or audio form, are considered “classified designated internet services” and fall within the “Designated Internet Services Online Safety Code”. Classified designated internet services must implement age assurance measures and access control measures before providing access to X18+ material or simulated gambling material.

The effect of the Phase 2 codes is that online video game providers must implement age assurance procedures where the video games:

• are multiplayer video games that are, or would be, classified as R18+, provided that it is technically feasible and reasonably practicable to do so;
• contain X18+ material; or
• contain simulated gambling material.

Simulated gambling is interactive activity within a game that resembles or functions like a real-world age restricted betting or gambling service and which does not provide rewards that can be redeemed for real world currency or traded to other players in-game for real world currency. This definition would capture video games which resemble, for example, casinos or slot machines (ie. social casino games).

As of 22 September 2024, any video games which contain simulated gambling are classified as R18+. The new classification requirement applies to video games which are classified after 22 September 2024 or which undergo a significant modification requiring reclassification after this date.

Age Assurance Trial

An age assurance trial commissioned by the Australian government is currently being conducted. The purpose of this trial is to examine options to implement age-gating technology and to evaluate their effectiveness, maturity and readiness for use in Australia.

Testing was due to be completed in April 2025 with a final report due to be handed down in June 2025 following stakeholder engagement. Importantly, the aim of the trial is not to endorse or procure a particular age assurance method, but rather to evaluate a variety of methods to ensure that further online content laws and regulations are fit for purpose.

The trial is looking at measures for both age estimation (ie. approximating a person’s age or age range through biometric data such as facial scans or behavioural patterns) as well as age verification (ie. using physical or digital government ID documents to verify a person’s age).

Review of the Online Safety Act

It would be an understatement to say that the age assurance rules – or proposed age assurance rules – in Australia are difficult to navigate.

For example, in relation to online gaming, the requirement to conduct age assurance must be viewed in the context of Australia’s National Classification Scheme. These laws, which are enforced at the state and territory level, generally make it an offence for a person to sell or deliver R18+ video games to minors. Further, under the OSA, online content providers are already subject to a requirement to limit the exposure of children to age-inappropriate content, including R18+ material. The OSA, for example, already empowers the eSafety Commissioner to direct providers of R18+ content to ensure that access to that content is subject to a “Restricted Access System” which limits access to such content to persons over the age of 18.[2]

Against this background, a review into the OSA was announced by the Minister for Communications in November 2023. The review examined, in essence, whether the OSA is fit for purpose and whether any changes were needed in order to strengthen the OSA. The report of this review was released in February 2025. The report noted that there was a need to simplify the OSA.

In relation to the overlap between the OSA and the National Classification Scheme, the report recommended that the regulatory remit of eSafety should be clarified and that content that is subject to the National Classification Scheme should fall outside eSafety’s remit (except for features that are uniquely social media enabled).

Where to next?

Concerns relating to the intrusiveness of age assurance technology, including privacy risks relating to the collection, storage, use and sharing of data collected as part of an age assurance process, have – unsurprisingly – also arisen. We expect that these concerns will be ventilated further during the stakeholder engagement process for the ongoing age assurance trial. The approach that the new Minister for Communications, the Hon Anika Wells MP, will take in relation to this area is also yet to be seen.

We will continue to monitor this space with interest. Please contact us if you have any questions about navigating this complex regime or if you would like to know if these requirements apply to your business.