On 24 August 2026, the Government introduced the Online Safety (Minimum Age and Child Safety Risk Assessment) Bill (Bill) to Parliament. In short: under-16s would be banned from holding accounts on certain social media platforms, and the Department of Internal Affairs (DIA) could impose penalties of up to $40 million or 10% of global turnover on platforms that fail to comply.

The Bill forms part of the Government's broader online safety programme aimed at reducing children's exposure to harmful content and other online risks. The Government first signalled its intention to restrict children’s access to social media following Australia’s world-first ban in late 2024, but the road to legislation has been protracted. An earlier member’s bill was deprioritised, a select committee inquiry was launched into online harms, and extended policy development (amid coalition party disagreements) has delayed progress for over 18 months.

Which platforms are affected?

A platform is in scope if it lets users exchange content and has at least one “high-risk” feature, including:

• recommendation algorithms and personalised feeds;

• endless scrolling or continuously updated content feeds;

• likes, reactions and engagement metrics; and

• disappearing content and similar time-limited features.

This is expected to capture most social media platforms that are widely in use in New Zealand.

Messaging services (eg WhatsApp), online gaming (eg Roblox), educational, healthcare, music streaming (eg Spotify) and professional networking platforms (eg LinkedIn) are expressly excluded.

General-purpose AI tools used primarily for information, productivity or assistance (such as ChatGPT, Gemini and Copilot) are not intended to be captured. However so-called “social AI companions”, being AI systems solely or primarily designed to simulate a personal, social or emotional relationship with the user, are in scope.

The Bill also allows regulations to designate specific platforms as in scope, or to exempt platforms where the Minister is satisfied the benefits to children outweigh the risks.

What does the Bill require?

Platform operators would need to take “reasonable steps” to verify that users are 16 or older. The Bill is technology-neutral - it does not prescribe a single method - but expects a combination of:

• age-estimation technologies, where age is determined based on biological or behavioural characteristics (such as face scanning); and

• age-inference systems, where age is determined based on information other than a user’s self-declared date of birth (such as user activity on the platform and existing account information).

Simply asking users to enter a date of birth would not be sufficient, and platforms could not rely solely on formal identification documents or digital identity services.

Strong privacy safeguards apply. Information collected for age checks must not be used for any other purpose and must be destroyed once the check is complete, with protections going beyond those in the Privacy Act 2020.

The obligation applies to both new and existing accounts. Platforms cannot simply “grandfather” underage users who already hold accounts.

Child safety risk assessments

The Bill would also place a duty on operators of age-restricted platforms to produce an annual risk assessment of harms to all children under the age of 18 years on their platforms and how they are mitigating those risks. Those platforms would also need to produce a child-safety risk assessment before making significant changes to their services or if required by the regulator.

What are the penalties for non-compliance?

The DIA would act as regulator, with powers to investigate, issue warnings and corrective notices, seek court orders and pursue financial penalties. For the most serious breaches, fines could reach the greater of $40 million or 10% of global turnover.

How does this compare to the previous bill?

 The earlier Social Media (Age-Restricted Users) Bill (Former Bill) was deprioritised earlier this year. While the Former Bill similarly sought to require social media platforms to take reasonable steps to prevent users under 16 from holding accounts, the requirement would have applied only to specific social media platforms designated by regulation. The Former Bill carried a maximum penalty of $2 million for non-compliance.

The Bill extends to a wider range of online services and requires platforms to undertake and report on their child safety risk assessments. For the affected platform operators, this represents a shift from a relatively narrow age-verification obligation to a broader compliance regime with greater proposed penalties.

How does this compare to Australia?

The Bill closely follows Australia's Online Safety Amendment (Social Media Minimum Age) Act 2024 (AU Act), which last year introduced a minimum age of 16 for certain social media services.

Both regimes require “reasonable steps” to keep under-16s off platforms, prohibit reliance on government ID alone, and exclude lower-risk services. A key difference is that the Bill adds mandatory, ongoing child safety risk assessments, which is absent from the AU Act.

Where does the Bill stand?

While the Bill has been introduced to Parliament, NZ First and ACT have invoked their coalition “agree to disagree” provisions to oppose the Bill, but Labour has indicated it may provide the votes needed to pass the Bill through its first reading. Labour’s support means the Bill could proceed to select committee before the election, though as the select committee process needs to be completed, and the Bill will need to go through a second and third reading, its ultimate fate will depend on the election outcome and the next Government’s priorities.

What should affected businesses do now?

If enacted, the Bill's requirements would take effect six months after Royal Assent. While the Bill’s passage remains uncertain, operators of platforms likely to be captured should begin considering their readiness. Key areas to assess include age-assurance capabilities, privacy safeguards for age-verification data, and governance structures for ongoing child safety risk reporting. Platforms already subject to comparable regimes in Australia, the United Kingdom, or the European Union may be able to leverage existing compliance frameworks to meet the proposed New Zealand obligations.

Australia’s experience implementing its social media ban has highlighted practical challenges around selecting reliable age-assurance technologies and balancing verification accuracy against user friction and privacy concerns. Operators preparing for the New Zealand regime should monitor those developments closely, as the lessons from Australia’s rollout are likely to inform regulatory expectations here.

Get in touch

If you would like to discuss the Bill’s potential impact on your business or the evolving regulatory landscape for online safety in New Zealand, please contact one of our experts.

Special thanks to Julia Wynands for her assistance in writing this article.