A teenager in Sydney opens Instagram. An adult in Manchester navigates to a pornography site. A gambler in Auckland loads an online casino. All three hit the same obstacle: a gate.
The technology behind that gate – age assurance – has become, without any formal design, the shared infrastructure of three distinct regulatory regimes operating across different sectors, different legal architectures, and different political motivations.
Australia uses it to keep under-16s off social media. The UK uses it to keep children away from pornography. And New Zealand uses it to bring a grey gambling market under domestic oversight.
On the surface it seems coordinated, but it happened because three separate political pressures – protect children online; protect children from pornography; capture a market that had been wholly unregulated – each resolved toward the same limited toolkit.
The question now is whether that convergence is an asset or an accident that could produce three incompatible compliance regimes in parallel.
Three problems, one instrument
Each regime reached age assurance by a different route.
Australia’s Online Safety Amendment (Social Media Minimum Age) Act 2024 requires platforms to take “reasonable steps” to prevent under-16s holding accounts on nine designated services. Penalties run to A$49.5 million. The law is technology-neutral – no specific method is mandated, and government-issued ID is explicitly prohibited as a sole option. The Australian Privacy Commissioner has made clear that verification data must be deleted after use and that age assurance is not a licence for expanded data collection.
The UK’s approach arrives via the Online Safety Act 2023. From July 2025, platforms hosting user-generated pornography have been required to deploy highly effective age assurance (HEAA) – a standard set by Ofcom that goes well beyond self-declaration or opt-in age gates. Acceptable methods include photo ID matching, biometric estimation, and credit-card-based verification. Fines reach £18 million or 10% of global turnover.
New Zealand came at the problem from gambling regulation. Under the Gambling Act 2003, it was illegal to offer online casino games domestically, but entirely legal to play at offshore platforms based in Malta, Curaçao, and Gibraltar – platforms that owed New Zealand players nothing and paid no tax. The new licensing regime created by the Online Casino Gambling Act 2026 ends that arrangement. From 1 December 2026, up to 15 licensed operators may serve New Zealanders, each required to verify all users are over 18. An advertising ban on unlicensed offshore operators commenced 1 May.
Surface similarities are clear: all three involve technology-mediated age checks, and all three attach significant penalties for non-compliance. Beneath that, the differences in standard, scope, and what the regulator can actually see are considerable.
What the compliance data is already showing
Australia is the furthest along, and the most transparent about what is not working.
The government’s A$6.5 million age assurance technology trial tested more than 60 solutions from 48 vendors before the law commenced. Its conclusion – that no substantial technical barriers exist, provided platforms use layered approaches – was the foundation for the legislative architecture. The first compliance data has since complicated that picture.
The eSafety Commissioner’s March 2026 review identified four specific failure modes across the major platforms: messaging that encouraged underage users to retry failed checks; no limit on the number of re-attempts; parental reporting tools that were functionally inaccessible; and accounts held by under-16s that had not been deactivated. Five platforms – Facebook, Instagram, Snapchat, TikTok, and YouTube – are under active compliance examination.
Approximately 4.7 million accounts were deactivated in the first two months, with more than 300,000 additional accounts removed by early March. The commissioner’s own finding: ‘poor practices’ across four areas.
The scale of initial action was real: approximately 4.7 million accounts were deactivated in the first two months, with more than 300,000 additional accounts removed by early March. But the commissioner’s own finding – “poor practices” across four areas – signals that early platform responses have been uneven and, in some cases, designed to satisfy the letter of the obligation rather than its purpose. The letter. Not the purpose.
The privacy trade-off
Effective age verification needs data. The more reliable the verification, the more data is collected, processed, or retained. Every age assurance regime is implicitly making a choice about where on that spectrum to sit.
The core technical problem runs across all three jurisdictions. Facial age estimation is reasonably reliable at the boundaries of adulthood but struggles near the 16-year threshold, where Australia’s regulatory standard applies. It also shows demographic bias – accuracy varies by skin tone and gender – which creates unequal compliance outcomes across different user populations.
Ofcom’s own accepted HEAA methods share a version of the same limitation: facial estimation is permitted, but Ofcom acknowledges that virtual private network (VPN) circumvention is a known failure mode and prohibits platforms from hosting content that encourages it.
No age assurance technology currently meets a high-confidence standard at the specific age thresholds regulators are targeting – 16 in Australia, 18 in the UK and New Zealand – without either raising privacy costs that may exceed the harm-reduction gain, or producing error rates that undermine the policy rationale. Regulators in all three places have, in effect, legislated for a technology that doesn’t yet fully exist at the required standard.
No age assurance technology currently meets a high-confidence standard at the specific age thresholds regulators are targeting – without either raising privacy costs that may exceed the harm-reduction gain, or producing error rates that undermine the policy rationale.
The three jurisdictions have made different choices about where on that spectrum to sit.
Australia’s design is the most privacy-protective. Government ID is prohibited as a sole option; verification data must be destroyed after use; behavioural inference – deducing age from usage patterns rather than identity documents – is permitted as a method. The result is a regime that minimises surveillance risk but is more vulnerable to circumvention. The compliance data confirms the latter.
The UK’s HEAA standard accepts methods with higher privacy costs: photo ID matching, credit card checks, and biometric face scans from known-age databases. These are more reliable but build more persistent infrastructure around the verification moment. The Information Commissioner’s Office (ICO)’s statutory code on AI and automated decision-making – now under active preparation following the statutory duty that came into force on 12 May – will apply directly to age assurance systems, which are themselves automated tools making consequential inferences about users. How the ICO resolves explainability and bias-testing requirements for these systems will have direct implications for which HEAA methods remain compliant beyond 2026.
New Zealand has not yet published the technical standards for its “acceptable age verification systems.” Those will be set in secondary regulation by the Department of Internal Affairs (DIA) – meaning the privacy architecture of the New Zealand regime is still being designed. That is either a window to align with the more mature Australian and UK standards, or a missed opportunity, depending on how the DIA uses the time available.
No jurisdiction has publicly articulated a principled framework for where the privacy-accuracy trade-off should sit. The default position in all three is a legislative standard plus technology-neutral flexibility – which delegates the trade-off to platform operators and their vendors.
Three standards, or one?
On paper, the standards are different: Australia’s “reasonable steps,” the UK’s HEAA, New Zealand’s “acceptable age verification systems.” These are not interoperable definitions. A platform could theoretically satisfy one without satisfying the others.
In practice, convergence is being driven from the technology supply side rather than the regulatory side. The same small ecosystem of vendors – Yoti, Age Check Certification Scheme (ACCS), which ran the Australian government’s own trial, Veriff, Onfido, and others – is deploying across all three markets simultaneously. Platform operators building a single global age assurance system will tend to calibrate toward the most demanding standard, which is currently Ofcom’s HEAA regime – driven by commercial logic rather than regulatory coordination.
Whether that is sufficient is the open question. Accidental vendor-led standardisation means the floor is set by commercial feasibility and the most demanding regulator’s requirements, not by a principled assessment of what standard best balances harm prevention with privacy protection across all three contexts. It also means the floor can shift whenever Ofcom revises HEAA requirements, regardless of what Australian and New Zealand regulators have told their own regulated populations.
The Five Eyes relationship, Trans-Tasman coordination mechanisms, and UK-Australia digital trade frameworks all provide potential vehicles for formalising alignment. None has been used for this purpose.
What each regulator can learn from the others
Compliance transparency is the most replicable asset in the system, and Australia has it. The eSafety Commissioner’s public documentation of specific failure modes – retry messaging, re-attempt limits, and inaccessible parental tools – gives regulators in the UK and New Zealand an early map of implementation friction before they face it at scale. Ofcom is further along on technical standards but has produced less public compliance data. The DIA is just beginning.
The UK’s HEAA framework is the most technically developed and the closest thing to an international reference standard that currently exists. Its vendor assessment process and performance expectations have been tested against a large, active market. Platforms deploying HEAA-compliant systems in the UK are, by default, deploying the most demanding age assurance infrastructure in any of the three jurisdictions.
New Zealand’s deferred technical standards process – still open as licensing begins – is a genuine opportunity. The DIA can look at what Australian and UK regulators have learned about failure modes, privacy costs, and vendor capabilities, and build those lessons into its secondary regulation before the first licence is issued in December. That window is short and narrowing.
All three regimes are running real-time experiments that generate compliance data the others can use. The eSafety Commissioner’s public reporting model – regular compliance checks, named failure modes, public escalation pathway – is worth examining for any regulator standing up a new age assurance obligation. The data it produces is the most granular early-implementation evidence available anywhere.
Accidental convergence
Three independent legislative decisions, shaped by three different political pressures, arrived at the same technological chokepoint. The technology at that chokepoint does not yet fully meet the standards regulators have set for it. The privacy trade-offs are unresolved. And the convergence that has emerged – vendor-led, commercially driven – is producing a de facto floor rather than a principled standard.
That gap – between what the legislation promises and what the technology delivers – will close only through enforcement action, through judicial interpretation of “reasonable steps” and “highly effective,” through ICO rulings on what AI-mediated age inference must be able to explain, and through regulators choosing, eventually, to compare notes. While the data needed to accomplish that exists, the mechanisms to share it are largely absent.
The eSafety Commissioner’s compliance review data is updated monthly. Ofcom’s register of HEAA-compliant services is maintained at the Ofcom website. New Zealand’s Department of Internal Affairs is expected to publish technical standards for age verification ahead of the December 2026 licensing round.
