The report by former CJ Robert French for the South Australian government on a Legal Examination of Proposed Age-Based Social Media Restrictions comments
The impact of social media is global. It evolves with new technologies and new applications of existing technology. It provides a variety of means by which people can interact with each other using electronic devices including computers, tablets and iPhones.
Social media can be beneficial, connecting people and their ideas and experiences, providing new and varied means of self-realisation, and providing opportunities for personal and creative self-expression. It can be educative and deliver community support services that may reduce some of the worst effects of social disadvantage including isolation and inequality. Social media is used for positive support and communication by many elements of the public, private and not-for-profit sectors. The Department of the Premier and Cabinet of South Australia states on its website that it ‘uses social media channels to distribute information to the community’. In so doing, it reserves the right to remove various species of incoming content including abusive, harassing or threatening comments, replies or direct messages. The Commonwealth Department of Social Services states on its website that it ‘uses a range of social media channels to inform, engage, communicate with and learn from stakeholders.’ These examples could be multiplied.
Social media can also be a channel for false and harmful content and a platform for bullying, exploitation and predation. It can be addictive. It can inflict harm on vulnerable members of society and particularly on children. While there are benefits to children learning how to navigate social media and how to use it to advantage there are significant risks. Harms identified by the Office of the eSafety Commissioner, established under the Online Safety Act, include: • Personal safety harms — e.g. direct and indirect threats or facilitation of violence; intimidation and harassment; viral challenges; • Health and wellbeing harms — self harm and suicide material — material promoting eating disorders and exposure to development mentally inappropriate conduct; • Harms to dignity — insulting and demeaning comments and trolling; • Privacy harms including doxing, sexual extortion and image-based abuse; • Harms involving discrimination, including hate speech, racism, misogyny, sexual harassment, homophobia and transphobia; • Harms involving perception and manipulation, including grooming of children.
In recognising these harms, it must also be recognised that across the age ranges to 14 years and from 14 to 16, there will be a variety of developmental stages and vulnerabilities — some of which will depend upon the particular circumstances of the individual child. Risk assessments across these age ranges necessarily involve broad generalisations.
The South Australian policy setting
The risks and benefits connected with the use of social media by children are best identified by reference to the investigations and findings of those with expertise and responsibilities in the field. Where a protective regulatory balance should be struck however, is a normative or policy judgment for government informed by evidence and advice.
The Government of the State of South Australia has taken the view that the most appropriate measure is to restrict access by children to social media generally. The Government has also taken the position that between the ages of 14 and 16, access should only be permitted with parental consent or its equivalent. It is against that background that the South Australian Government has commissioned this legal examination of mechanisms for giving effect to its policy setting.
The Terms of Reference state in very broad language the policy setting within which this legal examination is conducted. They refer to the harmful effects on the wellbeing and mental health of children of the use of social media and the shortcomings of existing safeguards which are said not to be in step with community expectations.
The Government acknowledges that the challenges associated with regulating social media services so as to protect children from harm are complex. This independent legal examination has been commissioned by the Premier into ‘how to ban children from having social media accounts’. A legislative pathway is proposed which would be within the legislative power of the South Australian Parliament. The Draft Bill is an indicative model of what legislation, to give effect to the Government’s policy, might look like. The Draft does not pretend to provide the definitive solution to the challenges of regulation and enforcement in this field — challenges which evolve with the dynamic landscape of social media and social media use.
Existing Commonwealth coverage
Specific online harmful content is the subject of regulatory powers relating to children conferred on the eSafety Commissioner under the Online Safety Act. It includes: • Cyber bullying of children; • Illegal and restricted online content, including child sexual exploitation material and pro-terror content and pornography; • Non-consensual sharing of intimate images; • Material promoting, inciting, instructing in, or depicting abhorrent violent conduct.
The regulatory system presently in place under the Commonwealth legislation does not preclude access to social media by children generally. However, it does have mechanisms in place to prevent access by children to particular classes of content.
The legislative powers of the State of South Australia
It is within the legislative competency of the South Australian Parliament to enact a law imposing State-specific age restrictions on access to social media services. A territorial link to the State is necessary. That requirement is satisfied by the application of the Act to social media services provided or accessible to users within the State and the imposition of the proposed restrictions upon access to children domiciled within the State. As to the relationship with the Commonwealth legislation, the Online Safety Act of the Commonwealth expressly allows for the possibility of concurrent State laws. The legislative competency of the State is discussed in a separate chapter of this Report.
The necessary territorial link does pose a practical challenge in that a social media service provider seeking to comply with the restrictions would, as part of that compliance, have to determine which existing and prospective users were domiciled within the State of South Australia. That is a complication which arises from the State-based character of the proposed legislation.
Options for the establishment of a Regulator
As appears from examination of the functions of the Commonwealth eSafety Commissioner, the regulatory task in relation to social media is complex and burdensome. It requires financial and human resources and an accumulation of expertise and experience that cannot be created quickly from a standing start.
It is legally possible for South Australia to create its own bespoke regulator or to confer additional functions on an existing statutory officer such as the Children’s Commissioner or the Commissioner for Consumer Affairs. However, a timeline for getting a State Regulator fully functional and operating could be significant. It would be necessary to recruit people with the expertise and experience necessary to administer and enforce the legislation. There would inevitably be some duplication of resources with those provided to the Commonwealth regulator.
An alternative approach would be to secure the agreement of the Commonwealth to confer a new State-based regulatory function upon the Commonwealth eSafety Commissioner. There is precedent for that approach in national regulatory schemes. Examples are: Section 13A — Australian Energy Market Act 2004 Section 6AAA — Therapeutic Goods Act 1989
If the State law does not impose any ‘duty’ on the Commonwealth regulator the consent of the Commonwealth Parliament set out in a law of the Commonwealth would suffice. If the State law purports to confer a duty upon the Commonwealth regulator, that must be a duty which falls within a Commonwealth head of power and is supported by a law of the Commonwealth. The legislative powers of the Commonwealth supporting its Online Safety Act would appear to be sufficient to support a Commonwealth law giving effect to the conferral under State law of regulatory duties to the eSafety Commissioner in relation to the restriction of access to social media services by children in South Australia.
The choice of regulatory mechanism is a matter for the Government of South Australia and for the Commonwealth if it is decided to try to use the Commonwealth regulator.
Cooperative federal considerations
There is another important federal consideration in any design of a South Australian law. South Australia has taken the initiative in proposing a more protective approach to children’s access to social media than presently applies under Commonwealth law. That initiative could itself form the basis for the development of a more comprehensive child protective national scheme than presently exists. It is important that so far as possible South Australian legislation be compatible with the Commonwealth law and capable of providing a template or building block for a cooperative national scheme involving the Commonwealth and other States and Territories of Australia. To that end, the Draft Bill, so far as possible, uses terminology which is consistent with the Commonwealth scheme. A national scheme would remove the requirement for the proposed duty to be limited in its application to children domiciled in South Australia and the compliance and enforcement complications that go with that limitation.
Legislative models in other jurisdictions
Consideration has been given to online safety legislation in other jurisdictions. The European Union, Ireland, the United Kingdom, Canada, the United States and Singapore have been referred to. Consideration has also been given to legislative bans enacted in some States of the United States.
The concepts of: (1) Exemption of beneficial or very low risk social media services; and (2) The use of a reasonable steps criterion required for compliance with a duty to provide access, are derived from some of those examples.
Reflection upon State statutes in the United States has led to the conclusion that their definitions of terms equivalent to ‘social media services’ are unduly complex, particularly in their lists of statutory exemptions which are likely to give rise to litigious debate.
The model for South Australia
The legislative proposal for South Australia uses a generic definition of ‘social media service’ based on that which appears in the Online Safety Act, but which is broader in order to pick up search engines and App stores. The proposal allows for named social media services or classes of social media service to be exempted from age-based restrictions on access by regulation or ministerial determination. The proposal would impose a duty of care on non-exempt social media service providers to prevent access to their services by minors within the restricted age ranges. It would be a defence to a breach of the duty that the provider had taken reasonable steps to comply with it. A separate systemic duty of care would positively require providers to take reasonable steps to prevent access within the restricted age ranges. The operation of these duties of care is elaborated below.
Regulatory guidelines could set out minimum standards necessary for compliance with the ‘reasonable steps’ requirements in relation to the duties imposed on providers. The ultimate judgment of whether reasonable steps were being taken would be for a court on an enforcement action. There would, however, be ample room for collaboration between the Regulator, the industry, age assurance providers and other stakeholders to give a degree of certainty in this area which involves the use of age assurance mechanisms and determinations of domicile. Despite their novelty in the Australian context, the proposed restrictions do not introduce a regulatory approach which is completely unknown to providers. Many major providers already impose a 13-year old age related ban on access. The Commonwealth Act also imposes age-related bans on access to certain classes of material.
Exempt Social media — sifting out the good from the bad and the ugly
The term ‘social media service’ defined broadly, as in the Draft Bill, has a very wide reach. It encompasses the ugly, the bad and the good. It is important that the child protective approach adopted by South Australia, not throw out the baby with the bathwater. It should allow access to existing and new social media services which are beneficial and very low risk, e.g. dedicated educational services and eHealth services. To that end, the Draft Bill, while precluding access by children to a widely defined class of social media services, introduces the concept of an ‘exempt social media service’. It is proposed that ‘exempt social media services’ should be listed by name or category determined by the Minister or the Regulator from time to time according to publicly available criteria. The purpose of leaving the question of what is an exempt social media service to be determined by ministerial or regulatory decision is to ensure flexibility in the face of a complex and rapidly changing technological landscape. It is important not to lock definitions into the legislation which would require amendment by Parliament from time to time to cover unanticipated developments. Some of the definitions in the United States State laws are quite elaborate in their lists of exceptions and are not recommended in the legislative model suggested in this Examination.
Duties of care to prevent access
The approach proposed in this Report seeks to give practical and workable effect to the policy of a ban on children’s access to social media. In so doing it does not seek to create a hard-edged prohibition supported by a civil penalty regime of first resort. Rather, it seeks to implement the policy by creating two statutory duties of care. The primary duty would be a duty on a social media service provider to prevent access to its social media service in South Australia by any child under the age of 14 and by any child between the ages of 14 and 16 without the consent of their parents or a person in place of their parents. The second duty would be a duty on a social media service provider to take all reasonable steps to prevent access to their social media service by any person under the age of 14 and by any person between the ages of 14 and 16 without parental consent. These are not just duties to protect children against unsafe online content. They are more comprehensive than the duties of care provided in some other jurisdictions. These are duties of care directed to prevent children from having access to non- exempt social media at all in the lower age range or without parental consent if within the higher age range. Branding them as’ duties of care’ rather than as a general prohibition emphasises the purpose of the legislation which is to give effect to a policy protective of children. The children to whom the duties would apply would be children domiciled or resident in South Australia. The verification of domicile would raise an additional challenge for social media service providers and for the Regulator under the South Australian law. It would be necessary to exclude the application of the duty to children from other States or countries visiting South Australia, e.g., for holiday purposes. A diagram showing a possible decision tree for a provider complying with the duty is attached to this chapter.
A reasonable steps requirement
The proposed duties are technologically agnostic. They do not specify the means which a provider must adopt in determining whether access to a user is to be permitted or denied. Plainly, compliance will require the use of age verification and estimation mechanisms. But the means currently available for verification and estimation are still in development. The hard fact is that there is no error free means of determination of the age of users of an account. There is also a complication in terms of compliance where, as in this case, the relevant duties apply only in relation to children living in South Australia. To know whether the duties apply to it, a social media service provider must know where the proposed user lives. Again that verification — as to address or a location within the State would have to be subject to a ‘reasonable steps’ standard.
In order to encourage providers into a cooperative rather than adversarial stance with the regulator, it should be open to them to demonstrate, on an allegation of a breach of the first duty, that they have taken all reasonable steps, having regard to available technology, to discharge that duty. The second duty, supportive of the first and directly imposing the reasonable steps requirement, provides the means for a proactive enforcement regime and the development of regulatory guidance as to what constitutes reasonable steps to comply with the restricted access duty. Ongoing consultation with providers and other stakeholders would be essential.
Modes of enforcement — individual complaints and regulatory inspection
The proposed Act would provide different ways in which the duties of care are to be enforced. The first way, relevant to the primary duty, would be likely, for the most part, to depend upon complaints made to the regulator. It would arise where a child under the age of 14 is given access to the provider’s social media service, or where a child between the ages of 14 and 16 is given such access without parental consent. There is a limitation to this enforcement mechanism. Complaints-based enforcement is ad hoc and reactive. It would depend in many cases upon a parent becoming aware of a child’s use of a non-exempt social media service and reporting that use to the regulator. The problem with such a complaint-based process, apart from its ad hoc and reactive character, is that it may involve the child in enforcement proceedings. On the other hand, it would be open to the State to treat a breach of the primary duty as a statutory tort, actionable in damages where a child has suffered significant mental or physical harm as a result of the breach. The action could be taken by the child through a legal representative or perhaps by the Regulator on behalf of the child.
As to the second duty, the question whether a provider has taken reasonable steps to prevent access or access without parental consent could be explored by a process of information gathering from the provider by the Regulator, supported by coercive request powers. Such requests could require the provision of information by a provider relating to its system for verification of domicile, age verification and verification of parental consent where applicable. The Regulator could issue guidance from time to time, of what would constitute reasonable steps. Alternatively, minimum measures necessary to meet the reasonable steps requirement could be specified in a legislative instrument without thereby pre-empting a determination whether they are sufficient in a particular case to meet that requirement.
Sanctions
Sanctions for non-compliance with either duty of care, could include the following:
(1) The issue of a remedial notice to the provider to institute a process for age, domicile and parental consent verification that meets the threshold of reasonable steps.
(2) An enforceable undertaking.
(3) An infringement notice imposing a specified compensation payment to be made which is capable of challenge in the court. The compensation payment would be applied to a special fund of the kind referred to below.
(4) The institution of proceedings in court for the imposition of all or any of the following remedies: (i) a declaratory order; (ii) injunctive relief and/or corrective orders; (iii) a compensation order; (iv) a civil penalty. A compensation order would not have the character of a civil penalty. Its proceeds could be paid into a fund to promote research into and education about the effects of social media on children and the means of developing beneficial social media services for children. It could also provide for the discretionary payment of compensation, upon application, for the benefit of a child shown to have suffered harm as a result of exposure to a non-exempt social media service.
(5) It would be appropriate to seek a civil penalty where there has been wilful or reckless or repeated breaches of one of the duties, non-compliance with a statutory requirement for the provision of information or breach of an enforceable undertaking or an injunction. The amount of the civil penalty could be fixed by regulation.
(6) A breach of the first duty of care could also constitute a statutory tort where mental harm has resulted. Proceedings for damages for breach of the statutory duty in such a case could be taken by a legal representative of the child harmed or by the Regulator on behalf of the child.
Ongoing policy development
A point of importance was made by the Chief Psychiatrist of South Australia about the need for ongoing proactive development of a knowledge base and policies to respond to the harms of social media services and to encourage the development of beneficial social media services or protected uses of existing social media services. An example of a protected use was given by Department for Education officers who spoke of teachers in South Australian schools using Facebook with their students where the Facebook account was controlled by the teacher and was not an account accessible by the students.
The US Surgeon-General in an Advisory Statement about Social Media and Youth Mental Health, which was issued in 2023, observed that researchers would play a critical role in helping to gain a better understanding of the full impact of social media on mental health and wellbeing and informing policy, best practices and effective interventions. A means by which research could contribute included: • rigorous evaluation of social media’s impact; • the role of age, developmental stage, cohort processes and the in-person environment; • benefits and risks associated with specific social media designs, features and content; • long term effects on adults with social media use during childhood and adolescence; • the development and establishment of standardised definitions and measures for social media and mental health outcomes; • the development and establishment of standardised definitions and measures for social media and mental health outcomes; • evaluation of best practices for healthy social media use; • enhancement of research coordination and collaboration.
A statutory mechanism already in place in South Australia which might be able to take on the oversight of research, policy development and collaboration incidental to the statutory regime, is the Child Development Council, established under s 46 of the Children and Young People (Oversight and Advocacy Bodies) Act 2016 (SA). Although its primary function under s 55 of that Act is to prepare and maintain the Outcomes Framework for Children and Young People, it has additional functions which include advising and reporting to government on the effectiveness of the Outcomes Framework for Children and Young People for which the Act provides. It may also carry out: such other functions as may be assigned to the Council under this or any other Act or by the Minister.
This would enable the Council to be given what would amount to policy development functions for the purposes of the further development of policy in relation to restriction of access to social media services and the development of exempt social media services. The Council already has a duty under s 55(3) in performing its functions to seek to work collaboratively with: (a) State authorities and Commonwealth agencies that have functions that are relevant to those of the Council; and (b) Relevant industry, professional and community groups and organisations.
This could include engagement with providers in what might be a more flexible, high-level way than would be prudent for the regulator to undertake. Alternatively, some other body or authority may be established for that purpose.
Conclusion — not a counsel of perfection
Whatever regime is established by the South Australian Government, it will not be perfect. Effecting compliance across the industry will be challenging. Compliance will require age assurance measures, location measures and, where applicable, verification of parental consent. Enforcement measures may be complicated by the fact that many providers are companies which are located outside Australia. The legislation would apply to existing as well as prospective users of social media services. There will undoubtedly be workarounds by knowledgeable child users. However, the perfect should not be the enemy of the good. One non-legal beneficial effect of the law may be to arm parents with the proposition that it is the law not them that restricts access to social media for children in South Australia.
