On 24 August 2026, the Government introduced the Online Safety (Minimum Age and Child Safety Risk Assessment) Bill to Parliament (the Bill). If enacted, it will ban children under 16 from certain online platforms, impose an annual child safety risk assessment on operators, and apply extraterritorially. Non-compliance can attract maximum pecuniary penalties of the greater of NZD40 million or 10% of the operator’s global turnover. You can read the Bill here. 

A new plan to improve children’s online safety

The Bill is the first phase of the Government’s two-step plan to improve children's online safety. It follows the Education and Workforce Committee’s March 2026 report on online harms experienced by young New Zealanders and the roles that government, industry and communities should play in addressing them. The Bill comes against a backdrop of increasing international regulatory focus on children’s online safety and platform accountability, with equivalent regimes emerging internationally.

The Bill is a Government Bill, but it does not have the support of coalition partners ACT or New Zealand First. Labour has indicated in-principle support and calls on the Government to send the Bill to Select Committee before the November General Election, signposting an appetite to pass the Bill into legislation, but signposting that changes will need to be made at the Select Committee stage.

Who does the Bill apply to?

The Bill applies extraterritorially to “operators” of certain age-restricted online platforms that are accessible in New Zealand. An “operator” is a person that directly or indirectly manages or controls the platform’s operations in New Zealand (whether by itself or together with other persons), with the Secretary of Internal Affairs being able to designate any person as an “operator”. In practical terms, businesses should consider whether their service enables users to interact with content or one another through engagement-driven features commonly associated with social media platforms.

Two categories of service are captured by the Bill:

• Internet services that allow users to exchange digital content and include one or more specified features, such as:
  • personalised recommendation systems (for example, “For You”, or “Explore” feeds);
  • infinite or continuous scrolling feeds;
  • engagement features such as likes, reactions or view counts; or
  • disappearing or time-limited content.
• AI companion services that are designed primarily to simulate a social, emotional, or personal relationship with a user.

The Bill adopts a feature-based approach rather than applying to a prescribed list of specific platforms. As a result, both existing platforms, and future new entrants may fall within scope if their services engage the relevant features.

The Bill also excludes a range of services that are considered lower risk from a child online safety perspective. These include services whose sole or primary purpose is to enable a user to: communicate by means of person-to-person messages, emails and calls (Facebook Messenger, WhatsApp, Discord), play online games with others (Roblox, Minecraft), listen to on-demand music and podcasts (Spotify), share reviews and product information, engage in professional networking (LinkedIn), support education or healthcare, and general-purpose AI chatbots. Regulations can add further exclusions to this list.

On the sole or primary purpose test, some services may sit close to the boundary. For example, despite being listed as an excluded service, platforms like Discord combine messaging functionality with large community spaces, which runs the risk of whether their sole or primary purpose is “person-to-person” messaging. Similarly, the distinction between a general-purpose AI chatbot and an AI companion may not always be straightforward.

Businesses operating services that combine social, content-sharing and AI-driven features will need to undertake a careful assessment of whether they fall within the Bill’s scope.

Two new duties for in scope operators

The Bill imposes two key duties on operators of age-restricted platforms.

1. Operators must take “reasonable steps” to prevent New Zealand persons under 16 years of age from having an account, whether new or existing.

The Bill does not prescribe what will amount to reasonable steps, but it does spell out what will not meet the threshold:

• manual entry of a user’s age or date of birth; and
• requiring an approved evidence of age document, using a digital identity service, or a combination of these two methods are not reasonable steps if these are the only steps that the operator takes in respect of the age verification duty.

The Bill makes clear that a platform will not be able to rely on formal identification or other digital identity services alone, and that it will be required to offer alternative methods. In practice, operators will need to have robust age assurance processes, such as age estimation (based on biological or behavioural characteristics such as facial scanning), or age inference (based on information already held by the platform, user activity patterns, device or account attributes, or interactions with the service). These can sit alongside formal age-verification processes to help operators meet their duty.

2. Operators must undertake a written child safety risk assessment, reviewed at least once annually.

This duty covers every user under 18 years old on their platform (with or without accounts) and has a wider scope than the first duty, as it extends to those under the age of 18 rather than 16.

This assessment covers three categories of risk:

• harmful digital content that children may encounter, including bullying, grooming, sexual extortion, self-harm, violence, sexually explicit content, false or misleading information, and AI content designed to make a person or thing appear to say or do something;
• risks presented by the platform’s design features, business model, algorithms, governance, and use of technology;
• risks presented by advertising, including its content, frequency, and the level of engagement children have with it; and
• any other matters specified by the regulator.

A senior manager must confirm the accuracy of each assessment, with a narrow criminal offence for knowingly confirming a false or misleading assessment. A change-related assessment is required before any significant change to the platform, and existing operators must provide their first assessment to the regulator within six months of commencement.

In practice, operators will need a repeatable governance model to support this, this should include: a risk assessment template that maps to the areas described above, a senior manager sign-off process, and a change-management process to identify when a change-related assessment is triggered. Because “significant change” is not defined in the Bill, operators will need to set their own internal thresholds for what counts.

A step up from the Member’s Bill 

The Bill is a substantial step up from the earlier Social Media (Age-Restricted Users) Bill, a Member's Bill introduced by Catherine Wedd MP in 2025. Most notably, maximum pecuniary penalties have been lifted from a flat NZD2 million to the greater of NZD40 million or 10% of an operator's global turnover for the most serious contraventions. Enforcement has also moved from ad-hoc court applications by the departmental chief executive to a standing regulator with enforcement powers.

While these penalties are notably higher, the ability to enforce extra-territorially where the platform has no New Zealand legal personality or presence is a live question. Some age-restricted platforms will fall into this category. By contrast, operators with a New Zealand presence will be exposed to the Bill’s full force. That, in turn, raises the prospect of inconsistent regulatory application and effect.

The fundamental challenge is one of asymmetry: the regulator must identify, investigate, and pursue entities that may have no physical presence in the jurisdiction, no obligation to respond to domestic process, and no assets against which a regulatory judgment can be executed. That dynamic risks creating a regime that operates effectively against smaller or locally present operators, while the largest platforms - which potentially pose the greatest systemic risk - remain practically beyond reach unless they choose to cooperate or are compelled through indirect mechanisms such as the service and access restriction orders discussed below.

The Bill aims to address this enforcement risk through two types of court order. Service restriction orders can require ancillary providers (such as payment services and ad networks) to stop dealing with the platform. Access restriction orders can require internet service providers, app stores, and the operator itself to prevent New Zealanders from accessing the platform. Whether these orders will prove effective in practice remains to be seen.

Can this Bill gain more traction than Australia? 

Australia’s Online Safety Amendment (Social Media Minimum Age) Act 2024 (the Australian Act) was enacted in December 2024 with a similar objective to the Bill (see here for our earlier guidance on the Australian Act).

That Act requires providers of “age-restricted social media platforms” to take reasonable steps to prevent under-16s from having accounts, supported by maximum penalties up to AUD49.5 million for systemic breaches. Early evidence suggests that the Australian Act has not achieved its objectives. In Australia, use of popular social media platforms like TikTok, Instagram and Snapchat among Australian 13–15 year olds have risen close to pre-ban levels, with news reporting suggesting that few Australian teenagers have stopped using social media because of the ban. VPN use remains a key reason cited.

The Bill takes a different approach to Australia in three ways, which may make it more effective:

• Scope: The Bill’s test differs from Australia’s with wider application. Australia is targeted at social media platforms, the Bill is triggered by specified features and also captures AI companions as their own category.
• Ongoing accountability: The Australian Act is essentially an age verification regime. The Bill layers an additional annual child safety risk assessment on top, with a senior manager accountable for its accuracy.
• Enforcement: The Bill has heightened penalties (up to 10% of global revenue) which are designed to have a deterrent effect even for the largest operators, and are backed by service and access restriction orders that can reach a non-compliant platform through its commercial dependencies.

Despite these features, there is still a risk that the Bill faces the same shortcomings as the Australian Act. VPN use, age obfuscation, and migration to services falling outside of the scope, or not yet deemed within scope by the Secretary of Internal Affairs, are all potential issues.

Further, as a practical consideration, operators with existing Australian compliance workstreams will not be able to import them wholesale into New Zealand due to the different requirements. The AI companion category and the risk assessment obligation are entirely new, and the specific age-assurance requirements will need to be assessed against the New Zealand drafting. It will be interesting to see the level of engagement from operators, and other interested stakeholders, in the Select Committee process.

Practical implications 

While it is still early in the legislative process (and there is a General Election looming) there is currently a level of major party consensus that child online safety is an important issue where current settings are inadequate to protect the health and wellbeing of young New Zealanders who engage with social media platforms. Operators who value public trust and confidence will want to begin assessing what age assurance technology they will be required to implement, establish clear governance frameworks for the child safety risk assessment, and consider whether they would like to engage in the Select Committee process.

Regardless of the Bill’s ultimate form, operators that take a considered and transparent approach to child safety now will be better positioned, both legally and commercially, when the inevitable regulatory change in this space commences. Those that wait risk being caught between regulatory deadlines and public expectations that have already moved ahead.

How we can help

MinterEllisonRuddWatts advises platform operators, technology providers, and advertisers on the full spectrum of online safety, privacy and consumer regulation. If you have any questions about the matters raised in this update, please contact one of our experts.

This article was co-authored by Zach Kirby, a Solicitor in our Corporate and Commercial team.