When federal parliament passed legislation last week which will ban under 16s from social media, Prime Minister Anthony Albanese celebrated. Posting on X, he said : "We're doing everything we can to keep our kids safe".
Author
- Toby Murray
Associate Professor of Cybersecurity, School of Computing and Information Systems, The University of Melbourne
Part of that commitment involves launching a trial of age assurance technologies to determine the best way of enforcing the social media ban for under 16s and preventing young people under 18 from accessing online pornography sites.
The trial will be run by a consortium led by a British company called the Age Check Certification Scheme. It has previously tested software for Australian troops in Afghanistan.
The trial, which the government says is a "key plank" of its online safety agenda, will kick off next year. According to the project plan , it will explore "how different methods perform in verifying a user's age without compromising their personal data". In turn, this will help Australia "establish best practices and potential regulatory frameworks for age assurance".
The trial will involve about 1,100 Australians of varying ages and cultural backgrounds. According to the project plan , it will test three main technology options.
So what exactly are these options - and what does the evidence say about their effectiveness?
Age assurance technologies
The trial will assess the following three technology options.
Age verification - using a person's identity credentials, such as a digital ID or an uploaded driver's license or passport. With this information, it is able to verify a person's stated date of birth - and therefore, whether they are over or under an age threshold.
Age estimation - analysing a person's biological or behavioural features known to change with age, such as examining a photo of their face or recordings of their voice. According to the project plan , these systems sometimes "employ machine learning and artificial intelligence and may be subject to configuration settings or age buffers to avoid false positives based on inherent performance errors".
Age inference - which involves using known details of a person's life circumstances to infer they are an adult, for example, because they are married, have a credit card or mortgage or because they have a government (.gov.au) email address.
Reliability concerns
These three technologies differ in terms of their reliability, how they can go wrong, and their potential unintended consequences when widely deployed.
Age verification based on identity credentials (whether a digital ID or an uploaded driver's license or other physical documents) is likely to be most reliable - as long as the person supplying the credential actually owns it. What protections will prevent a 14-year-old from uploading their parent's birth certificate remain unclear.
One option could involve requiring people to take a live photo of their face in real time and to upload that photo alongside verified photo ID. Facial recognition technology might then verify that the same person supplying the credential is pictured in it, by checking whether the face in the real-time photo matches the one in the ID.
However, as anyone who knows how easy it is to fake a live Snapchat picture will tell you, it can be difficult to prove whether a photo was taken live. Therefore, this kind of checking needs to be very carefully implemented to be effective against savvy and motivated teenagers.
Age estimation technology is also likely to include estimating somebody's age based on (purportedly) real-time photo or video of their face. Even ignoring the difficulties of determining whether a photo or video was taken live, this kind of technology is known to be imperfect.
Previous evaluation has shown that on average it is accurate within only 3.7 years of somebody's true age. More concerning, it performs worse on tweens and teens than it does on adults over 20. So age estimation may fail precisely when it is most needed.
We should expect similar challenges with age inference. However, it is also likely to exclude many people including young adults who still live with their parents and therefore don't have evidence such as rental agreements or credit cards.
Privacy concerns
The age assurance trial includes evaluating the privacy implications of each technology option. However, it's unclear how well Australians understand these risks.
This is something that will be much harder for the trial to evaluate. Polling from 2024 suggests most people are in favour of age assurance to prevent children and teens accessing social media or pornography online.
However, attitudes may shift next year when platforms deploy these technologies to enforce the impending ban.
Ultimately, no matter which technology is deployed, it remains to be seen how many Australians will be happy to identify themselves (whether with a digital or traditional ID, a photo of their face, or by their bank records) to access social media or adult content online.
Toby Murray has previously received research funding from Facebook and Google. He is Director of the Defence Science Institute, which receives State and Commonwealth government funding.
