Under age Snapchat users are verifying their accounts by scanning the faces of people who are decades older and of a different gender, exposing a major loophole in the Albanese government’s signature policy.
From December 10, social media platforms in Australia have been required to prove to eSafety that they have made reasonable steps to prevent under-16s from holding accounts, including through facial age estimation scans.
But privacy safeguards between Snapchat and its scanning software provider, k-ID, mean the tool is not checking whether the face scanned matches the gender or age details provided for the account on the app that is popular with children.
Just six weeks on from Australia’s under-16s social media ban coming into effect – and as the United Kingdom considers replicating the legislation – the issues with Snapchat’s process show how the law is at risk of becoming a purely symbolic gesture.
While Snapchat’s policy asks readers to note “that approval from a parent or guardian is not an option for age verification in Australia”, in practice, one father said his 12-year-old daughter successfully passed the app’s age-assurance by pointing the camera at his face. Her account information claimed she was a 30-year-old woman, rather than a man in his late 40s.
k-ID chief corporate affairs officer Luc Delany said Snapchat used the company’s software to provide an “age-signal” only.
“As part of this process, k-ID does not receive a user’s ‘declared age’ or ‘declared gender’,” Delany said. “This is an intentional design choice grounded in data protection and data minimisation principles.”
Snapchat is by far the most widely used platform among 13- to 15-year-olds in Australia, with 440,000 of its 8.3 million monthly active users falling into that age group in February.
ESafety commissioner Julie Inman Grant confirmed all 10 age-restricted platforms were in compliance with the legislation on January 16, and Prime Minister Anthony Albanese said more than 4.7 million accounts had been removed across all age-restricted platforms.
But it’s common among the estimated 2.3 million eight- to 15-year-old Australian social media users to have logins for several social media sites, and more than one account on any platform, and many have created fresh accounts.
This masthead created several trial accounts on Snapchat with various temporary email addresses, a recently purchased phone number and a genuine number. The platform did not attempt to verify any of the accounts.
But where the platform does ask a user to prove their age via a facial scan, users are exploiting the major loophole.
Snapchat’s age verification policy states that it does not receive personal information, such as ID documents or facial scans, supplied to k-ID during the age verification process. For facial age estimation, Snapchat receives a “yes” or “no” from k-ID regarding if the face presented appears 16 or above.
Static images of over-16s are not expected to successfully bypass k-ID’s system, which checks that the image is of a live person rather than a photo.
A spokeswoman for Snapchat said the platform expressed this “technical challenge” throughout the debate of how the government and companies could effectively prevent under-16s from accessing age-restricted platforms.
“We continue to believe there are better solutions to age verification that can be implemented at the primary points of entry, such as the operating system, device, or app store levels,” the spokeswoman said.
“In the meantime, parents may report an account if their child is not 16 and we will suspend it.”
Implementing reporting systems to allow users to flag accounts they suspect belong to under-16s is recommended by eSafety, but Snapchat has been accused of stonewalling parents who have tried to report their under-age children’s active profiles.
A key element to the Online Safety Act is that the onus is on age-restricted platforms, not parents or under-age users, to comply with the law that is backed by fines of up to $49.5 million.
The Snapchat spokeswoman said it is working to stop under-16s from accessing the platform, which will “continue to use our inferred age signals to detect and remove under-age users.”
A government spokesperson noted age-restricted platforms must have robust and effective systems in place to meet their legal responsibilities, adding, “we don’t expect implementation to be perfect, but we expect progress and continuous improvement, and we will hold social media companies accountable”.
Guidelines issued by the eSafety Commission state that age-restricted platforms must not solely rely on a user’s declared date of birth, or government-issued IDs.
A spokesman said Safety was aware of reports some under-16s continue to access social media accounts and was actively engaging with platforms and their age assurance providers – including Snap and k-ID – to probe any weaknesses in their implementation and settings.
The Business Briefing newsletter delivers major stories, exclusive coverage and expert opinion. Sign up here.
Bronte Gossling is a reporter for The Sydney Morning Herald, The Age, WAtoday and Brisbane Times.Connect via email.