As 10 December approaches the regulators are releasing guidances. Last month the e safety Commissioner issued its guidance. Last Friday the Privacy Commissioner issued a statement and guidance. As the Guidance makes clear, more is expected of entities in handling and, importantly, destroying data. Part 4A of the Online Safety Act 2021 sets out quite detailed obligations upon Social Media Platforms. For Social Media entities this will require a very thorough audit of data collection and use practices.
The Statement provides:
The Office of the Australian Information Commissioner (OAIC) has published regulatory guidance for age-restricted social media platforms and age assurance providers on compliance with the privacy provisions for the Social Media Minimum Age (SMMA) scheme, due to take effect on 10 December.
Privacy Commissioner Carly Kind said that the guidance reflects the stringent legal obligations on entities to ensure that age assurance is applied proportionately and through privacy-respecting approaches.
“Today we’re putting age-restricted social media platforms on notice,” Ms Kind said. “The OAIC is here to guard and uplift the privacy protections of all Australians by ensuring that the age assurance methods used by age-restricted social media platforms and age assurance providers are lawful.”
The OAIC co-regulates SMMA alongside eSafety. Last month, eSafety published their regulatory guidance – external site detailing what ‘reasonable steps’ age-restricted social media platforms must take to prevent age-restricted users from having accounts, including guiding principles for the implementation of age assurance to meet SMMA obligations.
The OAIC’s guidance published today provides information for age-restricted social media platforms and third-party age assurance providers on handling personal information for age assurance purposes in the SMMA context.
“The OAIC is committed to ensuring the successful rollout of the SMMA regime by robustly applying and regulating the privacy rules contained in the legislation, in order to reassure the Australian community that their privacy is protected,” said Privacy Commissioner Carly Kind.
“eSafety has provided the rules of the game with their ‘reasonable steps.’ Now the OAIC is setting out what is out-of-bounds when it comes to the handling of personal information for age assurance in the social media minimum age context.
“Together, eSafety and the OAIC’s regulatory guidance outlines the field of play for age-restricted social media platforms and third-party age assurance providers.
“SMMA is not a blank cheque to use personal or sensitive information in all circumstances; we’ll be actively monitoring platforms to ensure they stay within the bounds by deploying age assurance proportionately and lawfully.”
Key considerations detailed in the guidance call on entities to:
-
- note the additional privacy obligations in the SMMA scheme operate alongside the Privacy Act 1988 and the Australian Privacy Principles.
- choose age-assurance methods that are necessary and proportionate, and assess the privacy impacts associated with each method.
- minimise the inclusion of personal and sensitive information in age assurance processes.
- note pre-existing personal information later used for SMMA purposes does not need to be destroyed where the original purposes are ongoing.
- destroy personal information collected for SMMA purposes once purposes are met.
- make sure that any further use of personal information collected for SMMA purposes is strictly optional, has the user’s unambiguous consent and can be easily withdrawn.
- be transparent about the handling of personal information for SMMA purposes in privacy notices and at the moments it matters.
Together, these privacy safeguards impose stringent legal obligations on age-restricted social media platforms and age assurance providers. Failure to meet these obligations may constitute ‘an interference with the privacy of an individual’ and may trigger enforcement action.
Further OAIC resources will be released soon to help Australians understand what personal information may be handled through age assurance methods, as well as educational resources for children and families to help them navigate the changes and support conversations about children’s privacy online.
For more information and to view the guidance, visit: www.oaic.gov.au/privacy/privacy-legislation/related-legislation/social-media-minimum-age
Background
The OAIC co-regulates the Social Media Minimum Age Scheme with eSafety. Specifically, the OAIC oversees the compliance and enforcement of the privacy provisions set out in Section 63F of Part 4A of the Online Safety Act 2021, which operate in tandem with the Privacy Act 1988.
Key aspects of the guidance are:
- Purpose Limitation – section 63F(1) Entities that hold personal information collected for, or including, SMMA purposes must not use or disclose that information for any other purpose. There are limited Limited exceptions under APP 6.2(b)–(e) which permits use or disclosure, or where the individual gives voluntary, informed, current, specific and unambiguous consent under section 63F(2). This standard goes beyond the general APP 6 framework. The inclusion of “unambiguous” as an element of consent precludes the use of pre-selected settings or opt-outs when seeking consent. Also the reuse of information is prohibited unless clearly authorised or in the exceptional circumstances set out in APP 6.2(b) – (e).
- Information Destruction – section 63F(3) Once personal information collected for SMMA purposes which has been used or disclosed for those purposes that personal information must be destroyed. De-identification is not permitted. The destruction must happen as soon as all SMMA purposes are met. This obligation is stricter than APP 11.2, which permits de-identification or retention for ancillary business needs. Pre-existing data used to support age assurance remains governed by APP 11.2.
- Enforcement. The Privacy Commissioner has the power to investigate and take action for breaches as a breach of section 63F constitutes an “interference with the privacy of an individual” under the Privacy Act. Those actions include investigating, make determinations, and require remediation or compensation. Individuals may also lodge complaints directly with the Privacy Commissioner.
- Part 4A does not replace the APPs. It is an overlay of stricter duties in addition to the existing APPs. The APPs still apply in their entirety.
Under the Guidelines Platforms cannot retain information “just in case” it is useful later. The OAIC can investigate and enforce directly, even against entities not previously regulated, such as small technology providers or overseas processors.
The OAIC expects age assurance solutions to be privacy by design, backed by an early-stage Privacy Impact Assessment (PIA) that examines proportionality, necessity and data minimisation. That may be a new concept for some entities. In establishing the processes and procedures the least privacy-invasive method should be used. It should be teated through a PIA before deployment.
The OAIC recommends establishing a “ring-fenced SMMA environment” — a segregated technical and data structure where age assurance information is processed, stored and destroyed separately from other systems. Only minimal artefacts, such as a binary “16+ yes/no” result, method and timestamp, should persist. Inputs like ID scans or selfies must be deleted immediately after use.
The OAIC supports inference-based and AI-driven approaches but with clear restrictions: they must be transparent, demonstrably accurate, and not rely on continuous behavioural tracking or unnecessary sensitive data such as biometric or content analysis.
The process must be transparent. That includes:
- just-in-time notifications at the point of data collection,
- explaining what information is being collected, by whom, for how long, and why.
- having privacy policies which clearly describe SMMA-specific processing and destruction practices.
Legal, product and design teams need to collaborate. Poorly designed consent or information screens — even if legally accurate — can amount to non-compliance.
Part 4A sets a higher bar for consent to secondary uses of information collected for SMMA purposes than the standard APP test. It must be:
- voluntary,
- informed,
- current,
- specific and unambiguous and
- be able to be withdrawn.
The OAIC Guidance says that there should be:
- no:
- bundled or pre-ticked consents,
- reliance on general terms of use, and
- simple withdrawal mechanisms in dedicated privacy settings or contextually appropriate screens.
- purpose specific and time limited consent which is purpose-specific and time-limited.
Section 63F’s destruction requirement is specific and Read the rest of this entry »