eSafety forces proof-of-age checks for porn and AI chatbots, fines up to Aus$49.5m

The eSafety Commissioner has ordered online platforms to require proof that users are over 18 before they can access pornography, R-rated games, sexually explicit AI companion chatbots and other age-restricted material, a change that takes effect on 9 March 2026 and carries fines up to Aus$49.5 million per breach.

The new industry codes, developed under the commissioner’s direction, cover search engines, app stores, social media, gaming platforms, pornography websites and generative AI systems capable of producing sexual or other age-inappropriate content. The regulator says platforms must take "meaningful steps" to stop children being exposed to harmful material and that a simple self-declaration click is no longer acceptable. As the commissioner put it: "Clicking a button that says 'I am 18 years or older' is no longer sufficient. This is consistent with similar efforts being implemented internationally." She added a sharper enforcement warning: "Make no mistake, where we see failures or foot-dragging, we will hold companies to account."

The rules give businesses flexibility on technical approaches but make clear any method must meet the definition of "appropriate age assurance" and comply with Australian privacy law. Possible tools named by regulators and industry include photo identification and digital ID verification, facial age estimation or recognition, credit-card checks, digital identity wallets and AI-based age estimation from user data. Adults will retain access to legal content but may be required to verify their age before viewing.

Regulators point to research showing widespread exposure among children as the rationale for the change: eSafety statistics indicate one in three Australian children aged 10 to 17 has seen sexual images or videos online, and more than 70 percent of children have encountered content associated with harm, including high-impact violence, pornography and self-harm material. The government framed the move as a follow-up to earlier child-safety measures introduced late last year that limited children under 16 from joining social platforms.

Industry reaction has been mixed. Several adult sites operated by Aylo, the Canadian owner of RedTube, YouPorn and Tube8, blocked Australians from registering and accessing content in the days before the rules took effect. An Aylo spokesperson said the company will comply but "did not think the move would protect children and 'instead creates harms relating to data privacy and exposure to illegal content on non-compliant platforms'."

Privacy experts and cybersecurity researchers warn the rules face practical limits. Dr Rahat Masood, a cybersecurity academic, said the new laws will have limited impact, and other observers point to straightforward circumvention methods such as virtual private networks, shared adult accounts, and falsified credentials. The policy shifts liability and technical burden onto platforms and places privacy trade-offs at the center of implementation: verifying age at scale typically requires collecting or inferring sensitive personal data.

The immediate effects are clear: platforms must either deploy verifiable age-assurance systems or risk multi-million‑dollar penalties, and some international sites have already altered access for Australian users. The policy signals a retreat from lax online self-declaration toward enforced age assurance; its success will depend on how regulators balance enforcement with privacy safeguards and how well platforms prevent evasion while securing users’ data.