Yesterday afternoon, the Government introduced the Online Safety (Minimum Age and Child Safety Risk Assessment) Bill to Parliament.
The Bill1 represents the Government’s response to mounting concerns about harm to young New Zealanders online and follows significant public and international momentum for action in this area.
If enacted, the Bill would effectively ban children under 16 from certain social media platforms (where they have certain specified features such as “endless feed” scrolling options) or certain artificial intelligence “companion” platforms. The consequences of breach are significant – including, in the worst cases, penalties of NZ$40 million or 10% of global revenue.
Background to the Bill
The Bill follows an inquiry by the Education and Workforce Committee into online harms experienced by young New Zealanders and the roles that government, industry, and communities should play in addressing them. The Committee’s report, issued in March 2026,2 found that harm to young New Zealanders from online platforms is severe and requires an urgent response, including consideration of restrictions on social media access for children aged under 16 years.
That aligns with well-publicised efforts internationally, including most notably Australia’s recent social media restrictions, and the regulatory regimes in the United Kingdom and European Union. Announcing the Bill yesterday, Education Minister Erica Stanford declared that “the Bill brings New Zealand into line with other countries around the world that are placing greater responsibility on technology companies to protect children online.”3
Who is caught by the Bill?
The Bill has extra-territorial application, applying to “operators” of age-restricted platforms regardless of whether that operator is in or outside New Zealand, but only to the extent that the platform is operated in a manner that enables a person in New Zealand to access the platform.
An “operator” is a person that, directly or indirectly, manages or controls the platform’s operations in New Zealand (whether by itself or together with other persons). The Secretary of Internal Affairs, as the regulator under the proposed regime, will also be able to designate any person as an operator.
“Age-restricted platform” is defined broadly as including two key categories of internet services accessible in New Zealand.4 The first is internet services that enable the exchange of digital content between two or more users including a “specified feature”. The specified features include:5
recommender systems that personalise and optimise user engagement (e.g. “explore” and “discover” pages);
endless feeds displaying content with no endpoint (such as “bottomless” scrolling formats);
feedback features enabling users to see interactions on their content (e.g. likes, reposts, view counts); and
time-limited features (e.g. disappearing “stories”, messages or photos).
Certain services are excluded, including platforms that solely or primarily enable users to communicate by person-to-person messages, play video games, listen to music, share reviews, engage in professional networking, or access education or healthcare services. The explanatory note to the Bill notes various services that have been excluded on this basis – including Discord, WhatsApp, Roblox, Spotify, LinkedIn, and AI chatbots such as ChatGPT.
The second key category is internet services that display digital content and use AI solely or primarily to simulate a social connection, an emotional connection, or any other form of personal connection with a user. The explanatory note describes these services as “social AI companions” and observes that “evidence indicates that these platforms are becoming increasingly prevalent and pose a significant risk of harm to children that outweighs any potential benefits.”
What are the key obligations under the Bill?
The Bill imposes two principal duties on operators of age-restricted platforms:
Minimum age restriction
Operators must take reasonable steps to prevent under-16s from having an account on their platform. This applies to both existing and new accounts. Importantly, the following are explicitly not reasonable steps:
requiring manual entry of age or date of birth;
relying solely on approved “evidence of age” documents (e.g. a passport or driver’s licence);
relying solely on a digital identity service; or
a combination of the above without further steps.
The Bill also notes that personal information collected for age assurance must not be used or disclosed for any other purpose and must be destroyed once age assurance is complete. Operators will need to consider these obligations alongside broader measures to comply with the Privacy Act 2020.
2. Child safety risk assessment
Operators must produce a written “child safety risk assessment” covering all children under 18 on their platform (with or without accounts). The assessment must address:
the risk of children encountering illegal, harmful, or potentially harmful digital content (including bullying, grooming, sexual extortion, self-harm, violence, sexually explicit content, and false/misleading information) and content that uses AI to make a person or thing appear to say or do something;
risks presented by platform design, features, functionality, and operation (including business model, governance, algorithms, and behavioural profiling); risks presented by advertisements on the platform (including the content, frequency, and engagement that children have with these);
and any other matters specified by the regulator.
The assessment must include the number of New Zealand children using the platform grouped by age, a description of measures to lower identified risk, and the methodology used. A senior manager must be designated as responsible for confirming the accuracy of each risk assessment.
Existing operators must provide the regulator with their first risk assessment within six months after commencement. Risk assessments must be reviewed at least annually, and a change-related risk assessment must be completed before making any significant change to the platform.
Breach of these obligations carries serious consequences for operators, including a tiered range of civil pecuniary penalties. For the most serious penalties, the maximum penalty for corporate entities is the greater of NZ$40 million or 10% of annual global turnover. Even at the least serious end, the penalty is still significant (NZ$4 million or 1% of annual global turnover). There is also a prospect of personal liability for senior managers who knowingly confirm a false or misleading risk assessment (up to 12 months’ imprisonment or a NZ$500,000 fine).
What are the implications for operators?
The prospects of the Bill, at least in its current form, are uncertain. The Bill does not have the support of National’s coalition partners ACT and New Zealand First, although earlier today Labour announced it would support the Bill (though said it expected “significant improvements” through the select committee process).
If the Bill proceeds, organisations that operate social media platforms, social AI companions, or other online services with specified features accessible to New Zealand users should begin considering their exposure to these obligations now and how they could implement the required age assurance processes and child safety risk assessment frameworks.
Importantly, there are a number of differences between the Bill and the equivalent Australian requirements, so operators will not necessarily be able to rely on the same processes already established in Australia. For example, the New Zealand Bill expressly brings social AI companions within scope as a distinct category of age-restricted platform, whereas the Australian legislation does not. The risk assessment obligation also has no equivalent under the Australian regime.
These differences mean that operators with existing Australian compliance programmes will need to assess and adapt their processes to meet the distinct requirements of the Bill. We therefore expect that operators, among other interested stakeholders, will be keen to engage actively in any consultation should the Bill proceed.
If you have any questions about the matters raised in this article, please get in touch with the contacts listed or your usual Bell Gully adviser.
1Online Safety (Minimum Age and Child Safety Risk Assessment) Bill
2Education and Workforce Committee Final Report
3See Government moves to ban U16s from social media
4Section 5(1). Regulations can also prescribe additional internet services as an age-restricted platform
5Section 5(2). Other features can be prescribed in regulations
Disclaimer: This publication is necessarily brief and general in nature. You should seek professional advice before taking any action in relation to the matters dealt with in this publication.
