The bill, question by question.

What does the bill actually do?

Two things. First, platforms with certain risky features must take “reasonable steps” to prevent New Zealanders under 16 from holding an account (clause 11). Second — the part most coverage missed — those platforms must produce a child safety risk assessment at least once a year, covering the risks their service poses to everyone under 18 (with or without an account), and file it with the regulator (clauses 14–19). The Government calls this the first phase of a two-step plan for children’s online safety.

Is this law now?

No. The bill was introduced to Parliament on 24 August 2026 but hasn’t had a first reading — and won’t before Parliament rises on 24 September for the 7 November election. Whether it proceeds depends on the next Parliament. If it does pass, it comes into force 6 months after Royal assent (clause 2), and must be formally reviewed within 2 years (clause 64).

Which apps would be banned for under-16s?

The bill doesn’t name a single platform. It defines an “age-restricted platform” by features (clause 5): a service where users exchange content and that has any of —

• a feed that recommends content based on what it knows about you (“For You”-style feeds);
• an endless, continuously updated stream of content;
• feedback features — likes, upvotes, view counts, reactions;
• disappearing content — stories or messages you can only view for a limited time.

In practice that captures the big social platforms — the Government has pointed to Instagram, TikTok, Snapchat and Facebook — but coverage follows the features, and regulations can add platforms or features later (clause 62). “Social AI companions” are covered separately, regardless of features.

Which services are not covered?

Services that solely or mainly let you do one of these are excluded (clause 5(2)), even if they have risky features:

• person-to-person messaging, email, voice or video calls;
• video gaming;
• listening to music or podcasts on demand;
• reviews, technical support or advice about products and services;
• professional networking or development;
• education services;
• healthcare services.

The Government’s explanatory note gives examples: Messenger, WhatsApp, Discord, Roblox, Minecraft, Spotify, LinkedIn. Ministers can also exempt an individual platform by Order in Council if satisfied the benefits to children outweigh the risks (clause 61).

What’s a “social AI companion”, and is ChatGPT covered?

An AI service is covered when it is solely or primarily designed to simulate a social, emotional or personal connection with the user (clause 5(1)(b)) — think AI “friend”, companion or romance apps. General-purpose AI tools used for work, study, customer service or research aren’t captured on that basis, so a tool like ChatGPT is out of scope unless it’s being offered as a companion service.

Would my under-16 lose the account they already have?

Yes — the duty applies to accounts created before, on, or after the law commences (Schedule 1, clause 2). Platforms would need to deal with existing under-16 account holders, not just block new sign-ups. In Australia, that meant millions of existing accounts being removed or restricted when its law took effect.

Could kids still watch or browse without an account?

Yes. The bill regulates holding an account, not viewing public content. The explanatory note is explicit that children will still be able to access publicly available content — the aim is to keep under-16s away from the account-based features (feeds, likes, DM-driven engagement) linked to harm.

Is a kid (or parent) punished for getting around it?

No. The bill places civil liability solely on platform operators. Children and their parents or caregivers face no offences and no penalties — the explanatory note states this directly. A teenager who slips through commits no offence.

Who exactly does the under-16 rule protect?

A “New Zealand person” — defined as an individual ordinarily resident in New Zealand — under the age of 16 (clause 11(5)). The wider risk-assessment duty covers “children”, defined as under-18s ordinarily resident in New Zealand (clause 4). The Act applies to platform operators wherever they are in the world, so long as the platform is accessible from New Zealand (clause 8).

How would platforms check age?

The bill deliberately doesn’t prescribe a method — but it rules some things out (clause 11):

• Simply asking users to type in their age or birthdate does not count as a reasonable step.
• Platforms can’t make formal ID or a digital identity service the only route — they must offer alternatives.

The expected alternatives are age estimation (judging age from characteristics like a face scan) and age inference (judging age from signals the platform already has — account history, activity patterns, device attributes). Regulations can also ban platforms from collecting specified classes of personal information for age checks.

Will adults have to prove their age too?

In practice, yes — a platform can’t tell who’s under 16 without checking ages across the board. As Privacy Commissioner Michael Webster put it in 2025: “To ensure under 16-year-olds are not accessing social media, all users over 16 will be required to verify their age.” Whether that trade-off is acceptable is the central contested question in this debate — supporters point to the bill’s data-destruction rules; critics say checks on every adult are the real cost of the policy.

It also moves the polling. Headline support is strong (57.8% in RNZ–Reid Research, 66% in a Curia poll) — but when a UK Ipsos poll spelled out that everyone would have to upload ID, support fell from 69% to 50%, and the Curia poll found nearly half of New Zealanders worry age checks become a de facto digital ID. No NZ pollster has published that follow-up here — which is exactly the gap our poll tries to fill.

What happens to my ID or face-scan data after the check?

The bill goes beyond the Privacy Act here (clauses 12–13): information collected for an age check must not be kept longer than needed, must not be used or disclosed for any other purpose, and a breach is treated as an interference with privacy under the Privacy Act and exposes the platform to the top penalty tier — the greater of $40 million or 10% of the platform’s global turnover.

Will VPNs be banned or blocked?

No — and the bill text is unusually clear on this. Nothing in it restricts VPN use, and the definition of an “access service” (the services a court can order to block a platform) explicitly excludes virtual private networks (clause 4). So even the bill’s strongest blocking powers can’t be pointed at VPNs. The Prime Minister has separately said there are no plans to ban them. As Australia’s experience shows, that also means a determined teenager with a VPN remains a real gap — a point critics make and the Government accepts as the cost of a proportionate design.

Who is the regulator?

The chief executive of the administering department — in practice the Secretary for Internal Affairs (Department of Internal Affairs). The regulator must act independently of the Minister when monitoring and enforcing (clause 20), and can require anyone to hand over information, including by live demonstrations or testing of a platform’s systems (clause 21). It can share information with NZ agencies — Police, Netsafe, the Classification Office, the Privacy Commissioner — and overseas counterparts like Australia’s eSafety Commissioner (clause 22).

What are the penalties, exactly?

Civil penalties come in three tiers, imposed by the High Court on the regulator’s application (clauses 44–47). “Global turnover” means revenue attributable to that platform worldwide, including related companies:

Before penalties, the regulator has softer tools: public warnings, enforceable undertakings and corrective notices. A platform has a defence if it took reasonable steps or the failure was outside its control (clause 44(3)).

Could a platform really be blocked in New Zealand?

Yes, as a last resort. If a platform keeps refusing to comply, the regulator can ask the High Court for a service restriction order — cutting off the platform’s advertising and payment services in relation to NZ (clause 35) — and, if that isn’t enough, an access restriction order requiring ISPs and app stores to block the platform for New Zealand users, and the platform itself to shut New Zealanders out (clause 38). The court must weigh proportionality and users’ rights (clause 41), orders must avoid affecting access to anything else, and the platform can appeal to the Court of Appeal. Critics call this a site-blocking power without precedent for lawful services in NZ; supporters call it the only language a non-compliant global platform understands.

Can anyone actually go to jail?

Only in narrow cases, and never a child or parent (clauses 57–60). The main one: the senior individual a platform must designate as responsible for its risk assessments commits an offence — up to 12 months’ imprisonment or a $500,000 fine — for knowingly confirming a false or misleading assessment. Companies that refuse the regulator’s information demands face fines up to $40 million. There are also offences for breaching information-sharing conditions and for regulator staff leaking information.

What’s in these “child safety risk assessments”?

Annually (and before any significant change to the service), a platform must assess and report the risk to under-18s from: illegal content; bullying, grooming, extortion and sexual extortion; content promoting self-harm, suicide, violence or sexually explicit activity; false or misleading information; AI-generated deepfakes; its own design — business model, algorithms, behavioural profiling; and its advertising (clause 14). It must count its NZ child users by age, name the measures it takes and how well they work, and file the lot with the regulator — first filing within 6 months of the law commencing. The inclusion of “false or misleading information” as a risk category is one of the provisions free-expression critics are watching most closely.

Will it pass?

Unknown. ACT and NZ First invoked the coalition’s “agree to disagree” provisions and will vote against; the Greens oppose it. That means it needs Labour’s votes — and Labour is uncommitted, with 79 written questions in to the Government. Since there’s no first reading before Parliament rises on 24 September, the bill’s fate genuinely rests on the 7 November election result and the next Parliament.

How does it compare with Australia’s ban?

Same age line (16), same platform-pays philosophy, different machinery. Australia’s law names categories of platform through its regulator and fines up to A$99m; NZ’s defines platforms by features and fines up to the greater of $40m or 10% of platform turnover. NZ adds the annual child-safety risk assessments — closer to the UK/EU duty-of-care model — and writes the VPN exclusion into the definition. Australia’s ban has been in force since December 2025 with heavily contested results: most under-16s who had accounts still get on, and Canberra has responded by doubling fines and starting court action.

How is it different from the 2025 member’s bill?

The member’s bill (the Social Media (Age-Restricted Users) Bill) was a short framework: “all reasonable steps” age checks and a $2m maximum penalty. The Government bill is a different animal — feature-based scope, social AI companions, the risk-assessment duty, a DIA regulator with information powers, tiered penalties up to 10% of platform turnover, blocking orders, and privacy rules for age-check data. The member’s bill remains on hold and has been superseded.

Can I have a say?

Formally: if the bill gets a first reading in the next Parliament, it would normally go to a select committee, where public submissions open at parliament.nz — that’s the official channel. Before then, the 7 November election is the say. Informally: our two-minute poll asks the enforcement questions most polls skip, and the parents’ guide covers what you can set up at home tonight regardless of what Parliament does.