Document and biometric age assurance built to support the "reasonable steps" standard eSafety expects, with a no-ID alternative built in, not bolted on.
Trusted by 250+ companies worldwide. Zero content retention. GDPR-grade privacy architecture.
- What Australian law requires
- The reasonable-steps waterfall
- Age assurance in the regulator's language
- Beyond the age gate: harms to detect
- Privacy that survives a subpoena
- Ship without a quarter of engineering
- The cost of getting it wrong
- Frequently asked questions
What Australian law actually requires right now
Two separate obligations are driving age verification demand in Australia, and it's worth being precise about which one applies to you.
The Social Media Minimum Age law
Took effect on 10 December 2025. Age-restricted social media platforms (eSafety names ten, including Facebook, Instagram, Snapchat, Threads, and YouTube) must take "reasonable steps" to prevent Australians under 16 from creating or keeping an account. eSafety released regulatory guidance on 16 September 2025 setting out what "reasonable steps" looks like in practice, and can seek penalties of up to $54.6 million for platforms that don't take them. There's no penalty for the young person or their parents. The obligation sits entirely with the platform.
The broader Online Safety Act 2021
Administered by the eSafety Commissioner, this sets out Basic Online Safety Expectations covering illegal content, cyberbullying, image-based abuse, and other harms, independent of the age-restriction rules. If your platform is likely to be accessed by minors at all, this framework applies whether or not you fall under the Minimum Age law specifically.
"Reasonable steps" means a waterfall, not a single gate
eSafety's guidance is explicit on how age assurance should be structured: platforms should use a successive validation ("waterfall") approach rather than one method for everyone, must not rely on self-declaration as the sole or primary check, and, critically, cannot require government ID as the only option. If you offer document verification, you must also offer a reasonable alternative that doesn't require a government-issued ID.
Waterfall layer
Tuteliq implementation
Requires government ID?
Biometric-only check
method: "biometric", age-bracket estimation from a selfie with our own model, no image sent to any language model
No
Document-based check
method: "document", DOB extracted via OCR, MRZ, and barcode decoding, with algorithmic document-number validation (Australian TFN check-digit validation included among 45 supported countries)
Yes
Combined / step-up check
method: "combined", document plus biometric cross-reference, flags age discrepancies over 10 years
Optional
Because the biometric-only method needs nothing but a selfie, it's a genuine no-ID alternative, not a document check with the ID field made optional in name only. You choose which layers to expose and in what order. Tuteliq doesn't dictate your waterfall; it gives you the components to build one that matches eSafety's guidance.
Age assurance, in the regulator's own language
eSafety's guidance consistently uses "age assurance" rather than "age verification": a deliberate choice, since assurance covers the full spectrum from a low-friction estimate to a high-assurance document check, not just hard identity verification. Tuteliq's three methods map onto that spectrum directly:
Low-friction age assurance
Biometric estimation alone, suited to the first rung of a waterfall.
Step-up age assurance
Combined document plus biometric, triggered when a lower-friction check is inconclusive or a user is close to the age threshold.
High-assurance verification
Full document validation with MRZ and barcode cross-referencing, for use cases (identity verification, moderator/admin checks) that need more than an age estimate.
Beyond the age gate: what the Online Safety Act asks you to detect
Age assurance gets a user in the door at the right age. The Basic Online Safety Expectations under the Online Safety Act 2021 also expect platforms to actively address harms once users are inside, and this is where a single age-check widget stops being enough. Tuteliq's detection endpoints cover:
Harm area (Online Safety Act scope)
Tuteliq endpoint(s)
Grooming and child sexual exploitation
/safety/grooming (multi-turn behavioural detection across a conversation, not single-message matching)
Cyberbullying and image-based abuse
/safety/bullying, /safety/image
Tech-facilitated gender-based violence
dedicated TFGBV classifier: doxing, outing, sexualised deepfakes, digital coercion
Financial exploitation and scams targeting minors
/fraud/social-engineering, /fraud/romance-scam, /fraud/mule-recruitment
Self-harm and eating disorder content
/safety/unsafe, always elevated to critical severity
Every endpoint accepts an age_group context field for age-calibrated severity, and results include a rationale string explaining why content was flagged. That's the kind of evidence trail eSafety's guidance and your own compliance team will want on file.
Privacy that survives a subpoena question
Age assurance means processing government ID and biometric data, exactly the kind of data an Australian Privacy Act review or an eSafety inquiry will ask hard questions about.
No images or extracted PII retained after verification
Only the pass/fail result and age range are kept.
Fully stateless safety detection
No conversation cache, no session store. Nothing to breach, nothing to subpoena.
No training on your data
Ever. Nothing shared with third-party APIs beyond what's needed to return your result.
Built-in data-subject rights endpoints
Erasure, export, rectification, for GDPR-equivalent obligations, available on every tier including free.
Ship it without a quarter of engineering time
- SDKs for Node.js, Python, Swift, Kotlin, Flutter, React Native, .NET, and Unity, plus a CLI.
- MCP server for AI-assisted development. Wire Tuteliq into Claude Desktop, Cursor, or Claude Code and prototype your age-assurance waterfall with an AI assistant calling the real API, sandboxed and credit-free, before it touches production.
- 14-day free trial on any paid plan. Age verification from the Build tier ($99/mo).
The cost of getting this wrong
eSafety has been explicit that it won't hesitate to act on systemic breaches, with penalties of up to $54.6 million AUD. A Tuteliq Assure plan costs a fraction of a single enforcement action, and unlike a fine, it's a cost you control.
Does age verification in Australia require government ID?
What counts as "reasonable steps" under the Social Media Minimum Age law?
Is Tuteliq eSafety-certified or government-approved?
Which platforms are actually in scope of the Minimum Age law?
Are Australian users' biometric or document images stored?
What happens if a user refuses to verify their age?
See also: Compliance overview, Trust Center, UK Online Safety Act compliance.
How age verification is configured in Tuteliq
Every setting below is available in the Tuteliq dashboard under Verification › Age Verification. Compliance, product and engineering teams share one source of truth: the same rules that appear here are the ones your integration reads at runtime through the /v1/age-verify endpoint.
Verification Mode
Pick the default level of assurance for new sessions. Overrides per market are set further down.
Liveness check plus an official document (passport, national ID or driver licence). Highest assurance, recommended for hard legal thresholds like 18+, 21+ or Online Safety Act "highly effective" categories.
Selfie plus liveness with biometric age estimation. Lower friction, ideal as a first-pass age gate or where the applicable rule accepts age estimation as a reasonable step.
Market Overrides
Override the default verification mode per jurisdiction. Unset markets inherit from their region group, or from the global default above.
Market
Default
Complete
Liveness Only
EU (27 member states)
Inherit
Document + liveness
Selfie + liveness
United States
United Kingdom
Australia
Canada
Latin America
Asia-Pacific
Middle East & North Africa
Sub-Saharan Africa
Rest of the World
EU and US groups can be expanded to set country and state level overrides (e.g. force Complete in the UK while keeping Liveness Only across the rest of the EU).
Age Threshold & Overrides
Global minimum age for verification. Users below this age are flagged as minors and routed into the minor handling flow (block, parental consent, or age-appropriate experience, depending on your platform rules).
- Global default: 18 (configurable 13, 14, 15, 16, 17, 18, 21).
- EU: default 16 for data processing consent (GDPR Article 8), lowered to 13 in states that opted down.
- United States: 13 (COPPA) with per-state overrides for KOSA and state-level laws.
- United Kingdom: 18 for pornography and 'highly effective' categories, 13 for social features under OSA.
- Australia: 16 for social media accounts under the Online Safety Amendment.
- Any market can be pinned to a fixed age regardless of its region group.
Integrating the settings into your app
Dashboard settings are enforced automatically. Your integration only needs to open a verification session and read back the result.
- 1. Install the SDK bun add @tuteliq/sdk # or: npm install @tuteliq/sdk
- 2. Store your API key Set TUTELIQ_API_KEY as a server-side secret. Never expose the key in browser code.
Set TUTELIQ_API_KEY as a server-side secret. Never expose the key in browser code.
- 3. Create a verification session (server side) import { Tuteliq, VerificationMode } from "@tuteliq/sdk"; const tuteliq = new Tuteliq(process.env.TUTELIQ_API_KEY!); const session = await tuteliq.createVerificationSession({ mode: VerificationMode.AGE, redirect_url: "https://yourapp.com/verified", }); return { url: session.url, sessionId: session.session_id }; Redirect the user (or open a new tab) to session.url. Tuteliq applies the verification mode and age threshold you configured for the user's market.
Redirect the user (or open a new tab) to session.url. Tuteliq applies the verification mode and age threshold you configured for the user's market.
- 4. Read the outcome const result = await tuteliq.getVerificationSession(sessionId); // result.status: "pending" | "verified" | "failed" // result.result.age: estimated or extracted age // result.result.is_minor: boolean flag against configured threshold
- 5. Optional: webhooks Register a webhook to receive instant session updates instead of polling. Persist the verified status in your database so users do not re-verify on every visit.
Register a webhook to receive instant session updates instead of polling. Persist the verified status in your database so users do not re-verify on every visit.
All configuration is versioned and audit-logged. Changes to verification mode, market overrides or age thresholds are timestamped against the acting admin, so compliance teams can produce evidence of controls on demand.
Settings reference
Every knob compliance and engineering teams can turn, with the values accepted by the dashboard and the API. Each rule links to the statute or regulator guidance it derives from, so you can cite the primary source in your own DPIA or audit pack.
Verification modes
Set globally or per market override. API field: mode.
Mode
API value
Signals used
Assurance
Typical use & sources
complete
Document (OCR + MRZ + barcode) + selfie + liveness
High
18+ / 21+ hard gates, OSA highly effective, adult content Ofcom highly effective age assurance guidance (opens in a new tab) UK Online Safety Act 2023 (opens in a new tab)
liveness
Selfie + liveness + biometric age estimation
Medium
First-pass age gate, waterfall entry point, no-ID alternative Ofcom highly effective age assurance guidance (opens in a new tab)
Document Only
document
Document OCR + MRZ + barcode (no selfie)
Medium-High
Server-side batch verification, KYC top-up UK Online Safety Act 2023 (opens in a new tab)
Estimation Only
estimation
Facial age estimation, no document
Low-Medium
Low-risk features, waterfall low-friction rung Ofcom highly effective age assurance guidance (opens in a new tab)
Age thresholds
Minimum age users must meet to pass a verification. API field: min_age. Users below are flagged as minors and routed into your minor-handling flow.
Threshold
Legal basis & sources
Examples
13
COPPA (US), GDPR Art. 8 floor COPPA (15 U.S.C. §6501) (opens in a new tab) GDPR Art. 8 (opens in a new tab)
US default, general social features
14
GDPR Art. 8 opt-down state GDPR Art. 8(1) national opt-down (opens in a new tab) Italy D.Lgs. 101/2018 (opens in a new tab) Spain LOPDGDD Art. 7 (opens in a new tab)
Italy, Austria, Spain data-processing consent
15
GDPR Art. 8 opt-down state GDPR Art. 8(1) national opt-down (opens in a new tab) France Loi 2024-449 (SREN) (opens in a new tab)
France, Czechia, Greece
16
GDPR Art. 8 default, AU Minimum Age Act GDPR Art. 8 (opens in a new tab) AU Online Safety Amendment (Social Media Minimum Age) Act 2024 (opens in a new tab)
EU default consent, AU social media accounts
17
Platform policy
Adult-adjacent content, R-rated marketplaces
18
OSA primary priority, general adult UK Online Safety Act 2023 (opens in a new tab) Ofcom highly effective age assurance guidance (opens in a new tab)
UK pornography and highly effective categories
21
Regional alcohol / gambling law
US alcohol, some gambling jurisdictions
Any market can be pinned to a fixed threshold that overrides its region group. Thresholds are evaluated against the extracted or estimated age at verification time.
Market overrides
Overrides resolve in priority order: country / state override, region group, then global default. API field: market (ISO 3166-1 or sub-region code).
Suggested mode
Suggested threshold
Rationale & sources
18 / 13
OSA highly effective for PPC; 13 for social features UK Online Safety Act 2023 (opens in a new tab) Ofcom highly effective age assurance guidance (opens in a new tab)
Ireland
18 / 16
OSA-adjacent Coimisiún na Meán rules, GDPR Art. 8 default Coimisiún na Meán Online Safety Code (opens in a new tab) GDPR Art. 8 (opens in a new tab)
EU (default)
GDPR Art. 8 default consent age GDPR Art. 8 (opens in a new tab)
France
GDPR Art. 8 opt-down GDPR Art. 8(1) national opt-down (opens in a new tab) France Loi 2024-449 (SREN) (opens in a new tab)
Germany
JMStV youth media protection JMStV (Jugendmedienschutz-Staatsvertrag) (opens in a new tab) GDPR Art. 8 (opens in a new tab)
Italy / Spain
GDPR Art. 8 opt-down GDPR Art. 8(1) national opt-down (opens in a new tab) Italy D.Lgs. 101/2018 (opens in a new tab) Spain LOPDGDD Art. 7 (opens in a new tab)
Social Media Minimum Age Act 2024 AU Online Safety Amendment (Social Media Minimum Age) Act 2024 (opens in a new tab) eSafety Commissioner age assurance guidance (opens in a new tab)
United States (default)
COPPA floor COPPA (15 U.S.C. §6501) (opens in a new tab)
US: California
CCPA / Age-Appropriate Design Code CCPA / CPRA (opens in a new tab) California Age-Appropriate Design Code (AB 2273) (opens in a new tab)
US: Texas / Utah / Louisiana
State adult-content age verification laws Texas HB 1181 (opens in a new tab) Utah SB 287 (opens in a new tab) Louisiana Act 440 (opens in a new tab)
PIPEDA guidance PIPEDA guidance for minors (OPC) (opens in a new tab)
Conservative default; override per market as needed
Suggestions reflect common configurations, not legal advice. Confirm applicable thresholds with counsel before publishing. Links open the official statute or regulator guidance in a new tab.
Choose the plan for your Australian rollout
Every plan covers 'reasonable steps' age assurance with biometric and document paths. Business adds a Trust Center and eSafety-ready reporting.
Build
From $99/mo
For small platforms starting compliance work.
- Age verification API and SDK
- CSAM and grooming detection
- Dashboard with market overrides
- Email support
Assure
From $499/mo
For platforms with UK, EU or AU users in scope.
- Everything in Build
- Public Trust Center on your subdomain
- Audit logs and compliance exports
- SLA and priority support
Enterprise
Custom
For regulated platforms and large deployments.
- Custom retention and residency
- SSO, RBAC and DPA
- Named compliance partner
- Regulator-ready reporting
Request a security & compliance review for the Australian rollout
Our security and compliance leads map your architecture and user flows against eSafety's 'reasonable steps' guidance and the Social Media Minimum Age law. You get a written gap analysis, a documented waterfall design, and a remediation plan.
- Data-flow and retention review
- Written jurisdictional gap analysis
- Prioritised remediation plan
Response within one business day.
Book a security & compliance review
Tell us about your platform. Our security and compliance leads will confirm a 60-minute slot within one business day.
By submitting, you agree to be contacted by Tuteliq about this request. We do not share your details with third parties.
Get ready for Australia's age assurance deadline
Request a compliance assessment mapped to the Online Safety Amendment and eSafety guidance.