What the UK Must Learn from Australia’s Social Media Restrictions

The regulatory framework surrounding online child safety is shifting. Following recent policy proposals from Prime Minister Keir Starmer regarding mobile device content filtering, the UK government is evaluating a potential ban on social media for children under the age of 16. As regulators look to replicate international frameworks, technology companies face an immediate challenge: verifying age accurately without causing severe problems for users during onboarding.

The Breakdown of the Australian Model

The operational reality of enforcing strict age boundaries is highlighted by the rollout of social media restrictions in Australia. According to a research briefing published by the Molly Rose Foundation, legislative prohibitions present a complex picture.

The study, which surveyed 1,050 Australians aged 12 to 15, highlights significant gaps in compliance:

• Three-fifths (61%) of teenagers who previously held accounts on restricted platforms still maintain access to one or more active accounts.
• More than half of previous users remain active on dominant platforms, including TikTok (53%) and YouTube (53%).
• A striking 70% of children still accessing these services reported that it was easy to circumvent the restrictions, largely because platforms failed to deactivate pre-existing accounts.

At the same time, the findings demonstrate meaningful benefits for many young people.

• Half (50%) of children who used restricted platforms prior to the ban reported that they now spend less time online.
• Amongst teenagers who completely lost access to their accounts, 45% reported positive outcomes for both their academic performance and their overall mental health and wellbeing.
• However, half of respondents (51%) reported that the restrictions had made no difference to their online safety, whilst 14% stated they felt less safe.

The lesson is not that age restrictions are ineffective. Rather, it is that enforcement presents significant operational challenges. Policymakers may establish age thresholds, but platforms still require practical mechanisms to verify age, minimise circumvention and maintain a workable user experience.

Restrictions Alone Do Not Prevent Circumvention

The Australian experience highlights another challenge facing policymakers: technical restrictions are only as effective as the mechanisms used to enforce them.

As the Molly Rose Foundation research demonstrates, many children were able to retain access to restricted platforms despite the introduction of the ban. The most commonly reported reason was that platforms failed to remove or deactivate existing accounts, allowing users to continue accessing services without undergoing any new verification process.

Alongside account retention, regulators must also consider the growing availability of VPN services, which can obscure a user’s location and create the appearance of accessing services from another jurisdiction. Whilst VPNs have legitimate privacy and security uses, they demonstrate why geographic restrictions alone are unlikely to provide a complete solution to online age assurance.

For this reason, regulators are increasingly focusing on user-level age verification rather than relying solely on location-based controls or platform access restrictions.

The Missing Piece: Identity and Device Confidence

One of the most overlooked challenges in age assurance is that age verification and device verification are often treated as separate problems.

A platform may successfully verify that a set of personal details belongs to an adult, but that does not automatically confirm that the person completing the registration process is genuinely associated with those details. Equally, possession of a device alone does not establish a user’s age.

This distinction becomes increasingly important as governments look to strengthen age assurance requirements. If a platform only verifies age, questions remain around whether the person presenting those credentials is genuinely connected to them. If a platform only verifies device possession, it still lacks confidence in the user’s age or identity.

A more robust approach combines both forms of assurance. Identity verification establishes confidence in the information being presented, whilst device authentication provides confidence that the device currently in session is associated with the identity being assessed.

Together, these controls create a stronger framework for age assurance and help reduce opportunities for circumvention.

A Global Shift Towards Stronger Age Assurance

Australia is not alone in pursuing stricter protections for children online. Governments across multiple jurisdictions are examining age assurance requirements and restrictions for minors accessing social media and adult content.

In the United Kingdom, policymakers continue to evaluate measures aimed at strengthening online child safety and limiting access to age-inappropriate content. Similar debates are taking place across Europe, whilst several US states have introduced legislation requiring age verification for specific online services.

Although regulatory approaches differ, the direction of travel is clear. Platforms are increasingly being asked to demonstrate that they can identify underage users, apply appropriate safeguards and prevent circumvention without creating unnecessary barriers for legitimate users.

Resolving Friction Through Waterfall Verification Flows

To replicate the positive outcomes seen in Australia whilst addressing the compliance gaps, platforms need a structured approach known as a waterfall verification flow.

Rather than forcing every user through intrusive biometric scanning or physical identity document uploads as a first step, platforms should begin with cost-effective, low-friction checks and only escalate users where additional assurance is required.

By utilising mobile identity intelligence as the first layer of the waterfall, platforms can silently assess users during onboarding. TMT ID’s Verify product enables organisations to query authoritative mobile network operator data during onboarding and KYC processes.

Through a single background query, platforms can assess whether key subscriber attributes, including first name, surname, date of birth and address, correspond with the information supplied during registration. Additional age assurance signals can also be assessed, including:

• Date of birth verification
• 18+ match confirmation
• Carrier-level sensitive content filter status

Where the network signals provide sufficient confidence, users can proceed without additional verification. Where the response is ambiguous, incomplete, or indicative of a thin-file profile, platforms can seamlessly escalate users to higher-assurance methods such as facial age estimation or physical identity document checks.

This approach reduces unnecessary friction for legitimate users whilst ensuring that more intrusive verification methods are reserved for cases where they are genuinely required.

The model can be strengthened further by incorporating device authentication. Whilst Verify establishes confidence in the identity and age attributes associated with a mobile subscription, Authenticate can confirm that the device currently in session is associated with that same subscription. Together, they provide stronger assurance that the individual completing the verification process is genuinely connected to the identity and age signals being assessed.

Building Trust Into Age Assurance

The Australian experience demonstrates both the potential benefits and the practical limitations of social media restrictions for minors. The challenge facing platforms is not simply verifying age. It is verifying age in a way that is effective, scalable and resistant to circumvention.

As governments continue to strengthen online child safety requirements, organisations will need approaches that balance regulatory compliance with user experience. Waterfall verification flows provide a practical framework for achieving that balance, combining low-friction mobile identity checks with higher-assurance methods only when necessary.

The future of age assurance is unlikely to depend on a single verification method. Instead, it will rely on layered trust models that combine identity verification, age assurance and device confidence to deliver stronger outcomes for platforms, regulators and users alike.