New Zealand’s proposed under-16 social media restrictions have acquired something governments generally prefer legislation not to have, which is having lawyers asking awkward questions about how they will actually work.
The Government’s Online Safety (Minimum Age and Child Safety Risk Assessment) Bill would require operators of designated social media platforms to take reasonable steps to prevent New Zealanders under 16 from holding accounts, while imposing wider child-safety obligations on affected platforms.
But the key question remains, being How does a platform establish that somebody is under 16 without checking everybody else?
Former District Court judge and technology law specialist David Harvey has already taken aim at the proposal. Writing in LawNews Harvey questions both the description of the measure as a straightforward “ban” and the practical effectiveness of age-assurance measures.
Protecting children from social media may require social media companies to obtain more information about the age or identity of millions of adults.
Age restrictions are only useful if determined 15-year-olds cannot stroll around them technologically.
The proposed regime provides for potentially severe penalties and introduces child-safety risk-assessment and age-assurance obligations that technology businesses operating in New Zealand will need to understand.
Bell Gully partners Richard Massey and Cushla Hemingway have examined what the Bill actually requires, which platforms may be caught and what operators should be considering now.
Their analysis is below –
The Bill1 represents the Government’s response to mounting concerns about harm to young New Zealanders online and follows significant public and international momentum for action in this area.
If enacted, the Bill would effectively ban children under 16 from certain social media platforms (where they have certain specified features such as “endless feed” scrolling options) or certain artificial intelligence “companion” platforms. The consequences of breach are significant – including, in the worst cases, penalties of NZ$40 million or 10% of global revenue.
Background to the Bill
The Bill follows an inquiry by the Education and Workforce Committee into online harms experienced by young New Zealanders and the roles that government, industry, and communities should play in addressing them. The Committee’s report, issued in March 2026,2 found that harm to young New Zealanders from online platforms is severe and requires an urgent response, including consideration of restrictions on social media access for children aged under 16 years.
That aligns with well-publicised efforts internationally, including most notably Australia’s recent social media restrictions, and the regulatory regimes in the United Kingdom and European Union. Announcing the Bill yesterday, Education Minister Erica Stanford declared that “the Bill brings New Zealand into line with other countries around the world that are placing greater responsibility on technology companies to protect children online.”3
Who is caught by the Bill?
The Bill has extra-territorial application, applying to “operators” of age-restricted platforms regardless of whether that operator is in or outside New Zealand, but only to the extent that the platform is operated in a manner that enables a person in New Zealand to access the platform.
An “operator” is a person that, directly or indirectly, manages or controls the platform’s operations in New Zealand (whether by itself or together with other persons). The Secretary of Internal Affairs, as the regulator under the proposed regime, will also be able to designate any person as an operator.
“Age-restricted platform” is defined broadly as including two key categories of internet services accessible in New Zealand.4 The first is internet services that enable the exchange of digital content between two or more users including a “specified feature”. The specified features include:5
- recommender systems that personalise and optimise user engagement (e.g. “explore” and “discover” pages);
- endless feeds displaying content with no endpoint (such as “bottomless” scrolling formats);
- feedback features enabling users to see interactions on their content (e.g. likes, reposts, view counts); and
- time-limited features (e.g. disappearing “stories”, messages or photos).
Certain services are excluded, including platforms that solely or primarily enable users to communicate by person-to-person messages, play video games, listen to music, share reviews, engage in professional networking, or access education or healthcare services. The explanatory note to the Bill notes various services that have been excluded on this basis – including Discord, WhatsApp, Roblox, Spotify, LinkedIn, and AI chatbots such as ChatGPT.
The second key category is internet services that display digital content and use AI solely or primarily to simulate a social connection, an emotional connection, or any other form of personal connection with a user. The explanatory note describes these services as “social AI companions” and observes that “evidence indicates that these platforms are becoming increasingly prevalent and pose a significant risk of harm to children that outweighs any potential benefits.”
What are the key obligations under the Bill?
The Bill imposes two principal duties on operators of age-restricted platforms:
- Minimum age restriction
Operators must take reasonable steps to prevent under-16s from having an account on their platform. This applies to both existing and new accounts. Importantly, the following are explicitly not reasonable steps:
- requiring manual entry of age or date of birth;
- relying solely on approved “evidence of age” documents (e.g. a passport or driver’s licence);
- relying solely on a digital identity service; or
- a combination of the above without further steps.
The Bill also notes that personal information collected for age assurance must not be used or disclosed for any other purpose and must be destroyed once age assurance is complete. Operators will need to consider these obligations alongside broader measures to comply with the Privacy Act 2020.
2. Child safety risk assessment
Operators must produce a written “child safety risk assessment” covering all children under 18 on their platform (with or without accounts). The assessment must address:
- the risk of children encountering illegal, harmful, or potentially harmful digital content (including bullying, grooming, sexual extortion, self-harm, violence, sexually explicit content, and false/misleading information) and content that uses AI to make a person or thing appear to say or do something;
- risks presented by platform design, features, functionality, and operation (including business model, governance, algorithms, and behavioural profiling); risks presented by advertisements on the platform (including the content, frequency, and engagement that children have with these);
- and any other matters specified by the regulator.
The assessment must include the number of New Zealand children using the platform grouped by age, a description of measures to lower identified risk, and the methodology used. A senior manager must be designated as responsible for confirming the accuracy of each risk assessment.
Existing operators must provide the regulator with their first risk assessment within six months after commencement. Risk assessments must be reviewed at least annually, and a change-related risk assessment must be completed before making any significant change to the platform.
Breach of these obligations carries serious consequences for operators, including a tiered range of civil pecuniary penalties. For the most serious penalties, the maximum penalty for corporate entities is the greater of NZ$40 million or 10% of annual global turnover. Even at the least serious end, the penalty is still significant (NZ$4 million or 1% of annual global turnover). There is also a prospect of personal liability for senior managers who knowingly confirm a false or misleading risk assessment (up to 12 months’ imprisonment or a NZ$500,000 fine).
What are the implications for operators?
The prospects of the Bill, at least in its current form, are uncertain. The Bill does not have the support of National’s coalition partners ACT and New Zealand First, although earlier today Labour announced it would support the Bill (though said it expected “significant improvements” through the select committee process).
If the Bill proceeds, organisations that operate social media platforms, social AI companions, or other online services with specified features accessible to New Zealand users should begin considering their exposure to these obligations now and how they could implement the required age assurance processes and child safety risk assessment frameworks.
Importantly, there are a number of differences between the Bill and the equivalent Australian requirements, so operators will not necessarily be able to rely on the same processes already established in Australia. For example, the New Zealand Bill expressly brings social AI companions within scope as a distinct category of age-restricted platform, whereas the Australian legislation does not. The risk assessment obligation also has no equivalent under the Australian regime.
These differences mean that operators with existing Australian compliance programmes will need to assess and adapt their processes to meet the distinct requirements of the Bill. We therefore expect that operators, among other interested stakeholders, will be keen to engage actively in any consultation should the Bill proceed.
If you have any questions about the matters raised in this article, please get in touch with the contacts listed or your usual Bell Gully adviser.
1Online Safety (Minimum Age and Child Safety Risk Assessment) Bill
2Education and Workforce Committee Final Report
3See Government moves to ban U16s from social media
4Section 5(1). Regulations can also prescribe additional internet services as an age-restricted platform
5Section 5(2). Other features can be prescribed in regulations
