Australia’s Largest Christian News Site

A 16-year-old examines the Social Media Minimum Age Act’s implementation, scrutinising platform verification methods, data privacy risks, and Australia’s outdated digital protections.

I recently wrote a piece about the Social Media Minimum Age Act, explaining my perspective on the new legislation as a 16-year-old.

My three main concerns were:

1) that children would still have access to social media, as the legislation only banned creating an account, and on many platforms, you can still access content without an account.

2) government overreach, specifically referring to a famous quote said by Abraham Lincoln:

“The legitimate object of government is to do for a community of people, whatever they need to have done, but can not do, at all, or can not, so well do, for themselves, in their separate, and individual capacities. In all that the people can individually do as well for themselves, government ought not to interfere.” 

Yes, social media is certainly creating problems for the younger generation, but this is an issue that parents are best equipped to deal with. I believe it would be more effective if the government focused on issues they actually have significant control over, things like the increasing costs of living. I believe that if this were lowered, it would allow more time for families to spend together, and over time, this would improve relationships in families, among other benefits.

3) Finally, I referred to data leaks, explaining how uploading sensitive information to social media platforms and third-party verification software could potentially become an issue of national security.

Now, several months after the implementation of the new act, we have a better idea of how those verification and age checks are being performed, and also a better idea of the potential issues that may arise in the future. In this second article, I want to look deeper into these platforms and their reputations.

How platforms are enforcing the Social Media Minimum Age Act

The social media platforms covered by the Social Media Minimum Age Act are YouTube, TikTok, Instagram, Facebook, Snapchat, X (formerly Twitter), Threads, Twitch, Reddit, and Kick.

In this article, I will focus on the most popular platforms, namely YouTube, TikTok, Snapchat, Instagram, and Facebook. Looking at the verification methods they have in place, the third-party platforms they use, and their track records.

Meta

Meta, specifically Instagram and Facebook, is known to use an AI face verification tool called Yoti, which is affiliated with the World Economic Forum (WEF). In this case, Yoti works by scanning an image or video of users’ faces to estimate whether their age is above or below 16. This is called a biometric age check, using your facial features to estimate your age.

According to Yoti, the only time they have access to this information is when they do a verification or check. In July of 2023, Yoti proposed a facial estimation system to the US Federal Trade Commission (FTC) with the idea that Yoti, along with partners, would create a privacy‑protective facial age estimation method as a way to verify age under the Children’s Online Privacy Protection Act (COPPA).

In April 2024, the Federal Trade Commission (FTC) rejected the proposal due to concerns about privacy and biometric age verification. While this proposal was different from the age verifications Yoti performs with Instagram, they both include the collection of facial data, and the above case highlights concerns.

TikTok

As for TikTok, it also uses Yoti, and states the methods they will use for verifying age include Facial age estimation, credit card authorisation, and government-approved identification. TikTok itself stated:

“For more than a decade, many organisations and companies have tried to solve the complex challenge of online age assurance. Despite these efforts, and as recognised by eSafety, there is still no single method that can be used to effectively confirm a person’s age in a way that also preserves their privacy.”

Snapchat

Snapchat uses a third-party software called K-ID, a Singapore-based company. Some experts have pointed out that relying on an overseas company may pose an issue: uploading images or scanning IDs into foreign servers, in this case, Singapore-based servers, means that the data leaves Australia.

Even if the data is deleted, having it uploaded onto a different country’s server could make the protection of that information more complicated. Snapchat has also stated that it uses Connect-ID. This only works if the user has a bank account. By sending a yes or no to the social media platform, to verify whether the user is above the age of 16.

YouTube

YouTube’s verification methods depend mainly on its own systems and its parent company, Google. Consuming videos on YouTube doesn’t require an account, meaning that as long as you have a device and an internet connection, you have access to most of the content posted on YouTube.

An account does, however, allow you to have subscriptions, like and comment on videos, as well as create your own, making the opening of an account an incentive for many people.

Rachel Lord, Public Policy Senior Manager of YouTube AUNZ, wrote an article updating users about this, writing,

“Most importantly, this law will not fulfil its promise to make kids safer online, and will, in fact, make Australian kids less safe on YouTube. We’ve heard from parents and educators who share these concerns.”

She added, “At YouTube, we believe in protecting kids in the digital world, not from the digital world”.

Clearly, some social media platforms do not agree with the Social Media Minimum Age Act; however, of course, these platforms benefit greatly from having users on their platforms, and none of these platforms is free from legal issues either.

For example in 2019 Google/YouTube agreed to pay the then record-setting fine of USD $170 million after the US federal trade commission, and the New York Attorney General concluded that that YouTube collected personal data from children under the age of 13, then used that data for targeted advertising of children’s content, a violation of COPPA, and this was even before the use of AI features on YouTube.

When it comes to TikTok, the US Federal Trade Commission (FTC), working with the Department of Justice, launched a lawsuit against TikTok and its parent company, ByteDance, alleging that the company violated the COPPA. The key allegation included allowing millions of children under the age of 13 to remain on the platform even though there were restriction policies in place. However, more relevant to this piece, it collected and used the personal data of children and failed to delete the data when required, instead using it for tracking.

Australia’s Privacy Protections 

So who can we really trust in this digital era? The above-mentioned are the same platforms and third-party software that will verify the identity of Australian citizens, and potentially collect the information gained from those verifications.

In theory, the Social Media Minimun Age Act seems justified as it appears to protect children, but what about the children who attempet to create accounts and still scan their face into the AI facial age estimators, or possibly use their parents’ ID – or people over the age of 16 who want to create accounts but now have to trust their information with these social media platforms and thirdy-party softwares.

This legislation, in attempting to prevent children under the age of 16 from the dangers of social media, which undoubtedly causes prevalent issues, unfortunately fails to prevent children and adults from the risks of uploading sensitive information into untrustworthy platforms.

Unlike the United States, we don’t have a Childrens Onlne Privacy Protection Act. Instead, the Social Media Minimum Age Act relies greatly on pre-existing laws to protect people’s privacy, namely the 1988 Privacy Act. Which, in my view, when it comes to digital privacy and security, is outdated. Specifically, in creating adequate protection for the security issues that the Social Media Minimum Age Act (SMMA) creates, and I am not alone in thinking so.

Former Attorney‑General Mark Dreyfus himself described the Act as “woefully outdated and unfit for the digital age”, in an article detailing how the reform process was largely failing to modernise important principles of the 1988 Privacy Act. Additionally, there have been parliamentary submissions about the fact that it had not been meaningfully updated in nearly four decades.

The need for improved digital protection 

It is clear to me that the 1988 Privacy Act should provide better protection than it does, and also mandate a system of regulation in order to adequately protect Australian online security and privacy.

Let us look at the USA’s Children’s Online Privacy Protection Act (COPPA). Specifically targeted at any digital software, platform, or company that collects children’s data, for children’s data to be legally collected, it must meet the requirements of COPPA, which are very specific and are then enforced by the Federal Trade Commission (FTC).

In this way, it is preventative. It not only creates penalties for companies that do not comply, but moreover does not allow the companies to legally access children’s data unless they meet the security standards set by COPPA, as seen in the case of the YOTI request, which was denied.

On the other hand, Australia’s Privacy Act is more reactive, meaning if it is violated, there will be repercussions. However, it is far less preventative, and the Privacy Act does not directly affect or regulate other laws that come into place.

It is my opinion that before rolling something out like the SMMA, there should have been clear legislation regulating and restricting what platforms and software are allowed to do with our private information, not just children’s, but all Australians. Then, for the SMMA to come into effect, it should have passed the safety standards set by this law.

Perhaps if the Australian government had not created legislation that specifically made Australians more vulnerable to the consequences that can arise when there is not enough digital proetction this would be less of an issue, but the Australian government did.

This legislation would have been the perfect opportunity to add additional regulations and mandate a specific method or system for how social media and third-party platforms are allowed to handle our data, but the Australian government did not.

Instead, they created a law that potentially could create a whole new set of security and privacy issues for Australians. Perhaps this will keep children off social media platforms for the present; however, in my opinion, even that is doubtful.

Nevertheless, even if it did work perfectly and children under 16 no longer had access to social media, how would those same children be affected in 20 or 30 years? Who knows how much AI will have advanced by then, and where or what is being done with the private information that they once shared?

___

Image courtesy of Adobe.