Australia eSafety Phase 2: The Broadest Age Verification Regime Yet
Six new Online Safety Codes took effect March 9, 2026, covering pornography websites, social media, app stores, device manufacturers, and AI chatbots. Penalties reach A$49.5 million per breach.
Phase 2 Is Live
On March 9, 2026, six additional Online Safety Codes took effect under Australia's Online Safety Act 2021, administered by the eSafety Commissioner. This is the broadest age verification regime any country has implemented to date.
What Phase 2 Covers
Phase 1 (December 27, 2025) covered search engines, hosting services, and internet carriers. Phase 2 expands to:
- Pornography websites
- Social media platforms
- App stores (Apple App Store, Google Play)
- Device manufacturers
- Gaming and messaging services
- AI-powered chatbots and companions (including services like ChatGPT that can generate explicit content)
The inclusion of AI chatbots makes this the first age verification law to explicitly address generative AI services.
Key Requirements
- Self-declaration of age is explicitly not sufficient for compliance
- Platforms must implement "meaningful steps" to verify users' ages
- Acceptable methods include: facial age estimation, digital IDs, and credit card checks managed under Australian privacy laws
- Data minimization requirements apply — verification data must be deleted promptly
Penalties
Up to A$49.5 million (approximately US$34.5 million) per breach. This is among the highest penalty caps for age verification non-compliance globally.
Early Impact
VPN usage in Australia has reportedly surged following the implementation, mirroring the pattern seen when US states implemented age verification laws and Pornhub chose to geo-block.
What Platforms With Australian Users Should Do
- Determine if you serve Australian users. IP geolocation data will tell you.
- Implement age verification that goes beyond self-declaration. A simple "Are you 18?" click-through will not satisfy the codes.
- Be aware of the AI chatbot scope. If your platform includes any AI chat features that could generate explicit content, you're in scope.
- Plan for data minimization. Unlike some other jurisdictions, Australia specifically requires prompt deletion of verification data.