Australia finds age detection tech has many flaws but will work

Probe into how to implement social media ban finds privacy risks, developer overreach, infosec uncertainties

Australia’s trial of age assurance technology has found it’s up to the task of preventing children under 16 years of age from using social media, despite many problems.

Australia’s government ordered the trial after its November 2024 announcement of a policy to keep kids off social media. At the time, few nations had tried a similar scheme, so Canberra wanted to survey the field of relevant technologies and make sure they are up to the job.

We did not find a single ubiquitous solution that would suit all use cases

On Friday the team that ran those trials published its preliminary findings [PDF], the main one being “Age assurance can be done in Australia and can be private, robust and effective.”

“The preliminary findings indicate that there are no significant technological barriers preventing the deployment of effective age assurance systems in Australia. These solutions are technically feasible, can be integrated flexibly into existing services and can support the safety and rights of children online,” wrote Tony Allan, project director of the trial.

The findings do not, however, suggest that implementing age assurance will be easy.

Finding Three opens: “We found a plethora of approaches that fit different use cases in different ways, but we did not find a single ubiquitous solution that would suit all use cases, nor did we find solutions that were guaranteed to be effective in all deployments.”

In Finding Eight, the reviewers note they “found opportunities for technological improvement including improving ease of use for the average person and enhancing the management of risk in age assurance systems.”

Finding Ten noted that systems the review’s authors assessed were “generally secure and consistent with information security standards” and that developers who made them “actively addressed attack vectors including AI-generated spoofing and forgeries.”

The authors also found “the rapidly evolving threat environment means that these systems - while presently fairly robust - cannot be considered infallible and must be continuously monitored and improved. Privacy compliance must be similarly monitored.”

Some providers were building tools which could lead to increased risk of privacy breaches due to unnecessary and disproportionate collection and retention of data

Finding Eleven mentions “concerning evidence that in the absence of specific guidance, service providers were over-anticipating the eventual needs of regulators about providing personal information for future investigations.”

It gets worse: “Some providers were found to be building tools to enable regulators, law enforcement or Coroners to retrace the actions taken by individuals to verify their age, which could lead to increased risk of privacy breaches due to unnecessary and disproportionate collection and retention of data.”

The trialists also found that parental control systems are flawed and reportedly noted that age-checking tech is only accurate to within 18 months 85 percent of the time.

Australia’s government has promised to implement its social media ban on December 1st, so there’s not much time to address the issues mentioned in the preliminary findings. The initiative has broad public support. The Murdoch press, which can nearly always find a reason to criticize Australia’s center-left government, has campaigned in support of the policy using the slogan “Let Them Be Kids”.

Opponents of the policy point to social media’s central role in many aspects of modern life, and suggest that isolating kids from it until they turn 16 will leave them unprepared for the many perils found online. Others wonder why the scheme doesn’t apply to YouTube.

Justin Warren, the Founder and Principal Analyst of Australian firm PivotNine, is not impressed by the report.

"The preliminary results do not inspire confidence," he told The Register. "In fact, the preliminary results portray a level of confidence that is unsupported by evidence. It rather suggests that there is a pre-ordained outcome for which a justification must be manufactured. I hope I am mistaken in that assessment."

Warren took issues with the document's omission of data to support its findings. "We do not even have summary statistics about average or median accuracy rates, rates of false positives, how many systems were assessed as meeting particular technology readiness levels," he told us by email.

"Fundamental questions about how age assurance is expected to work in practice remain unanswered," he added. “It seems the government is determined to surprise everyone at the last possible moment and hope for the best. They are either incredibly brave, or incredibly foolish. Or possibly both."

Age assurance tech trial boss Allan’s remarks added the caveat the trial aimed to “assess whether the technology works and can be deployed - not to make policy decisions about whether or how it should be used.” ®