By Elena Yi-Ching Ho & Rys Farthing

The long awaited Enhancing Online Privacy Bill paves the way for an Australian privacy code, that addresses how all Australian’s data can be used on social media platforms (think TikTok), large online platforms (like Spotify) and by data brokers (such as Axiom). 

The Code addresses some aspects of children’s needs, stating that the Code must require Social media companies to:

• Take reasonable steps to verify the age of users 
• Ensure parental consent is obtained for users under 16 years old and
• Require that data is only used in ways that are in children’s best interests.

A lot has been made about the first two requirements, which on the surface appear radical.

It’s worth remembering that ‘reasonable steps’ to verify age and consent doesn’t mean kids having to scan birth certificates and send them to TikTok, as many terrified press commentators have suggested.

Reasonable steps might include, for example, asking young users to reconfirm their date of birth that they used to sign up or analysis of photos to flag those likely to be under 13. 

Although none of these are foolproof, they will add one iota of friction to a process that is currently -- deliberately -- "friction free".

It’s designed to encourage young people to join effortlessly. There are pros and cons to this friction, but at the end of the day it’s probably fair to ask social media companies to make reasonable attempts to ensure that very young children aren't on their risky platforms.

But neither requirement is likely to move the dial much. The root problems of social media for kids is not that parents are unaware that their kids are on it, nor that 12 year olds are sneaking on (although both are bad).

The core of the issue is that social media companies develop risky, exploitative platforms. From algorithms pushing harmful material, messaging systems exposing kids to unwanted contact and non-stop invasive data harvesting, social media platforms are just awful to kids.

The third requirement, for social media companies to only use children’s data in ways that are in their ‘best interests’, has the capacity to change this.

It means social media companies may have to change the way their platforms work for kids in the first instance.

But there’s a long way to go between this Bill, and the Code it paves the way for.

The Privacy Act stipulates that the Information Commissioner must draft this Code alongside industry, and that most likely industry will have the first opportunity to draft it.

Given what we know about this industry, this is worrying to say the least, and is a giant fly in the ointment.

As Frances Haugen pointed out two weeks ago in Canberra, Facebook is not to be trusted.

It would be a disaster if Facebook’s industry representatives -- Digi -- drafted the very code that is meant to protect kids from them. 

The Bill is currently open for consultations, and we’d encourage you to have your say.