Australia is fining tech firms $99m for kids who slip past its under-16 ban — and the kids are still slipping past

Information Technology 4 min 64 sources

Australia doubled the maximum penalty on platforms that fail to keep under-16s off social media, even as new research finds more than four in five teens are still online six months in. The fight has become less about banning kids and more about who has to prove they're gone — and what counts as proof.

Key takeaways

Australia doubled the maximum fine on social media platforms — to A$99m (US$68m) — for failing to keep under-16s off their services.
New research found more than 80% of under-16s were still using social media three months after the ban, mostly by lying about their age or fooling a selfie check.
The law punishes platforms, not kids, for an age it can't reliably verify — so the fight is now about proving you tried, not whether the kids actually left.

Australia said on Saturday it will double the maximum fine for tech companies that fail to keep under-16s off social media — from A$49.5m to A$99m, about US$68m [17][12]. The increase brings the penalty in line with what the country charges for breaking competition and consumer law [12]. The internet regulator, the eSafety Commissioner, is already investigating five platforms for possible non-compliance: Meta’s Instagram and Facebook, Google’s YouTube, Snap’s Snapchat, and TikTok [17].

Prime Minister Anthony Albanese framed it as enforcement, not retreat. “It’s clear big tech are not doing enough to comply with the law — there are still too many children on social media,” he said [12]. Communications Minister Anika Wells was blunter: platforms are “doing the bare minimum to get by” [17].

What the law actually does — and to whom

Australia became the first country to legislate a minimum age for social media, banning under-16s from 10 December [12]. The crucial design choice: the law doesn’t punish the children or their parents. It punishes the platforms for letting them in. The companies have to verify age and keep the under-16s out — and now face a doubled fine when they fail.

The trouble is that nobody has a reliable way to check a stranger’s age online. Platforms have used “age assurance” — a polite term for guesses, mostly a selfie a system judges to be over or under 16, or a user simply typing in a birth year [17]. Both are easy to beat. The government says more than 5 million under-16 accounts have been removed, deactivated, or restricted since the ban began [12][17]. That sounds decisive until you read the research.

The numbers don’t agree with the press release

A study published in the British Medical Journal this month followed 408 adolescents [17][12]. Three months after the ban took effect, more than 80% of under-16s were still using social media — 85% of 12-to-15-year-olds, by CNBC’s reading of the same study [12][17]. Two-thirds of underage users stayed on simply by declaring an age over 16 or posting a selfie the platform accepted as adult [17].

The verification barely touched the youngest. Only 5% of 12-to-13-year-olds reported being asked to prove their age at all [12]. Researchers at the University of Newcastle concluded the law produced “limited implementation, incomplete compliance, and substantial circumvention,” and found “insufficient evidence” of any early effect on how much under-16s use social media [12].

So the doubled fine is a response to a measurement gap. The government can count deactivated accounts; it can’t count the kids who opened a new one with a different birthday. The new reforms try to close that gap a different way: the eSafety Commissioner would gain power to compel platforms — and third parties like age-assurance vendors and app stores — to hand over documents showing exactly what they did to keep under-16s out [12][17]. The fight is shifting from “are the kids gone?” to “can you prove you tried?”

The disagreement underneath

The two sides are arguing about different things. The government says the technology works and platforms are dodging it. An industry body said in April the opposite — that the tools exist but are weak, and the failure is the limits of the tech, not the will to use it [17]. Both can hold: a selfie-based age check can be genuinely available and genuinely easy to fool. The doubled penalty is Australia betting that more financial pain will move the needle the research says hasn’t moved.

Reddit is fighting on a different front entirely. The platform is challenging the ban in Australia’s highest court on free-speech grounds, arguing the government can’t wall off a public square by age [17]. Australia says it will defend the suit [17].

Why this matters beyond Australia

Australia is the test case the world is copying. France has passed a ban for under-15s with a parental-consent carve-out [12]. The UK plans an “Australia-plus” version from 2027 that also covers gaming and live-streaming [17][12]. Slovenia, Poland, Spain, Denmark, and Malaysia are all weighing similar laws [12]. Every one of them will inherit the same unsolved problem: you can write a law about an outcome you can’t directly observe, but the moment you do, enforcement lands on whoever’s easiest to fine — and the gap between the rule and the result becomes someone’s full-time job to paper over.

If you work anywhere near identity, age verification, or compliance, this is the number to watch: not the fine, but the BMJ figure. A penalty that doubles while real-world use stays flat tells you the lever and the outcome aren’t connected yet.

02 · Lesson · why it matters

When you can't measure the thing you want, you punish the thing you can see

A rule aimed at an outcome it can't observe ends up enforced on whoever is easiest to charge — and the gap between the rule and the result becomes the real story.

The fine went up; the kids stayed online

Australia wants under-16s off social media. It can’t watch every teenager, so it wrote a law about the one party it can reach: the platforms. Keep the kids out, or pay. On Saturday the maximum fine doubled to about US$68 million.

Then the research came back. More than four in five under-16s were still scrolling three months in. Most of them just typed a fake birth year or held up a selfie the system waved through. The fine is now twice as large, aimed at a result that hasn’t budged.

This is not a story about a bad law or lazy companies. It’s a story about a move governments and managers make constantly, often without noticing: when you can’t measure the thing you actually care about, you measure something nearby instead — and then you start governing the nearby thing as if it were the real one.

The thing you want versus the thing you can count

Australia cares about whether children are spending their afternoons on Instagram. That’s almost impossible to see from the outside. What it can see is a number platforms will report: accounts deactivated. More than five million of them, the government says.

So the law quietly swapped its target. The goal is “kids off social media.” The measure is “accounts the platform closed.” The two look like the same thing. They are not. A child whose account gets deleted on Monday can open a new one on Tuesday with a different age. The five million is real. It’s also not the answer to the question anyone was actually asking.

This swap has a name worth carrying: the proxy. A proxy is a thing you can count standing in for a thing you can’t. Closed accounts for absent children. Test scores for learning. Hours logged for work done. The proxy is never the goal — it’s the part of the goal that happens to be visible. And the moment you reward or punish the proxy, people optimize the proxy, not the goal. Platforms close accounts. Kids open new ones. The number moves; the afternoon doesn’t.

The cost lands where the leverage is, not where the cause is

Here’s the part that poses as natural. Why fine the companies and not the families? Because the families aren’t reachable and the companies are. A government can’t audit ten million households. It can audit five named platforms with offices and lawyers and a balance sheet. So the law puts the whole weight of an unverifiable rule on the one node that has something to seize.

That’s a choice, not a law of physics — and it’s the choice almost every rule like this makes. The cost of enforcement flows to whoever is easiest to charge, which is rarely the person actually doing the thing. The teenager faking a birthday pays nothing. The parent pays nothing. The engineer who built a selfie-checker everyone knew could be fooled is now the reason a $99 million fine is on the table. The leverage sits with the platform, so the liability does too.

You can see why it’s built this way, and it can still misfire. Concentrating the penalty on the reachable party is efficient. It’s also how you end up punishing the people least able to close the gap, while the gap stays open.

The work moves to the seam

When the rule and the result don’t connect, a strange new job appears: papering over the distance between them. Australia’s next reform isn’t a better way to keep kids offline. It’s the power to compel platforms — and the age-check vendors, and the app stores — to prove what they tried. The question shifts from “are the children gone?” to “can you show me you made an effort?”

That’s the tell that a proxy has taken over. Nobody at the table can measure the real outcome anymore, so everyone starts producing evidence of compliance instead. A whole industry of age-assurance vendors now exists to sell platforms a defensible answer to a regulator’s demand — not to actually verify anyone’s age, which still can’t be done reliably, but to generate a paper trail that says they cared. The seam between the rule and the world becomes the place where the money and the effort pool.

You are the next thing to be verified

It’s tempting to read this as a fight between Canberra and Silicon Valley, with the rest of us watching. We’re not watching. We’re inside it.

There is only one way a platform can confidently keep a 15-year-old out: check everyone hard enough that the 15-year-old can’t get through. Which means the proof eventually gets demanded from you. France has a ban now. The UK has one coming in 2027 that reaches into gaming and live-streaming. Spain, Poland, Denmark, Slovenia, Malaysia are all drafting their own. As the fines climb, the cheap, foolable selfie gives way to the hard check — an ID upload, a face scan, a credit-card-on-file. The cost of a rule that can’t see children is paid, in the end, by every adult who now has to prove they aren’t one.

That’s the shape of it, and almost no single seat can see the whole thing. The regulator sees deactivated accounts and calls it progress. The platform sees a fine and builds a wall. The parent sees a law and assumes the problem is handled. The teenager sees a birthday field and types 2008. Each of them is acting sensibly inside their own view, and the sum is a doubled penalty chasing a number that won’t move — and an ID checkpoint quietly going up in front of all of us. The humbling part isn’t that someone is wrong. It’s that everyone is reading a proxy, no one can see the whole, and the rule keeps getting heavier while the thing it was for slips out the side.

03 · Lab · your turn

Run the Under-16 Ban

Pull the regulator's levers and watch the number you can count race ahead of the goal you actually wanted — while the cost of an unverifiable rule lands on everyone.

04 · Hope · carry this

The gap between the rule and the result is uncomfortable, but it is being measured in the open rather than hidden — and a dozen countries are now watching Australia learn, in public, what actually keeps children safe. We rarely get a hard thing right on the first law; we get it right by counting honestly and trying again.