New Zealand links minimum-age rules with continuing child-safety duties
New Zealand’s Online Safety (Minimum Age and Child Safety Risk Assessment) Bill would require designated age-restricted platforms to prevent under-16s from holding accounts and require operators of services used by children to assess and reduce child-safety risks.
What it could improve
The bill combines an access restriction with continuing governance duties. Operators would need initial, periodic and change-related child-safety risk assessments, provide assessments to a regulator and identify a responsible person who confirms their accuracy. The enforcement framework includes warnings, undertakings, corrective notices, restriction orders, penalties and information-gathering powers.
What remains unresolved
A recurring risk-assessment duty is stronger than a one-off access rule, but the bill’s effectiveness will depend on designation decisions, assurance methods, regulatory capacity and whether children move to services beyond its practical reach.
- Platforms must take steps to prevent under-16 accounts, but the reliability, proportionality and privacy standards for those steps will determine whether the rule protects children without excessive data collection.
- A designated-platform model may leave gaps when children migrate to smaller, overseas, decentralised or newly emerging services.
- Operator-produced risk assessments require independent scrutiny, comparable standards and evidence based on children’s actual experiences.
- Account restrictions do not automatically protect signed-out use, shared accounts, web access or harmful services outside the designated category.
- The framework should distinguish younger children from older teenagers and support growing autonomy rather than relying on a single threshold alone.
- Risk reduction should preserve beneficial opportunities for communication, learning, creativity and participation.
The Child-Friendly Internet perspective
The bill’s continuing risk-assessment model supports Safe by Design because it expects operators to revisit risks as services change. A Child-Friendly Internet approach would add interoperable, privacy-preserving assurance and coordinated expectations across networks and services so protection does not end at the boundary of a designated platform.
- Use data-minimising assurance that communicates only the age or developmental fact needed for a service response.
- Align risk assessments with child-rights, digital-wellbeing and age-appropriate design outcomes.
- Create mechanisms for children’s participation and independent evaluation of real-world effects.
- Ensure positive, age-appropriate digital spaces remain available rather than treating exclusion as the complete solution.
The central question
Can continuing platform risk assessments become consistent protection across the wider Internet—not only compliance documents for designated services?