Home · Regulations · Age checks · Australia

Age checks in Australia: what eSafety’s codes mean for adult sites

From 9 March 2026, Australia’s Age-Restricted Material Codes apply to designated internet services, which covers websites including porn sites. eSafety says an “I am 18 years or older” button is no longer good enough. Here’s what “appropriate age assurance” means in plain words, what a good gate looks like, and how to see what Australian visitors meet.

Summary of the official sources · checked 19 October 2026 · Not legal advice. · Sources at the end

Applies from9 March 2026 (designated internet services)

WhoPornography sites and other designated internet services reachable in Australia

RuleOnline Safety Act 2021 · Age-Restricted Material Codes · eSafety

Effort to fixFrom a few hours (gate) to 1–2 days (provider)

What does an Australian visitor meet on your site? Find out in about a minute.

Free · private · we never download your images or videos

In short

The codes are mandatory and enforceable. Industry drafted them; eSafety registered them under the Online Safety Act 2021.
For designated internet services (mainly websites, including porn sites) the relevant codes took effect from 9 March 2026.
eSafety says pornography sites should confirm age when people access age-restricted material, and that clicking “I am 18 years or older” is no longer good enough.
The codes say the method must meet “appropriate age assurance”: technically accurate, robust, reliable and fair. eSafety names photo-ID matching, facial age estimation, credit-card checks and digital identity wallets among possible methods.
Providers should offer more than one method and not rely on government ID alone, and take reasonable steps against workarounds such as VPNs.

Does this apply to your site?

If any of these is a yes, plan around the Age-Restricted Material Codes.

✓
People in Australia can open pornography or other age-restricted material on your siteeSafety treats pornography sites as high-risk services that must use appropriate age assurance.
✓
Your only gate is a button, tick box or date-of-birth fieldeSafety’s FAQ says clicking “I am 18 years or older” is no longer good enough.
✓
You rely on a single method, especially government ID aloneeSafety says fair age checks should offer more than one method and should not rely on government-issued ID as the sole method.
?
You are mainly a messaging, search or social product rather than a porn siteOther parts of the codes apply with different rules and start dates. This page focuses on pornography websites as designated internet services.

What regulators expect

Pick methods that can meet “appropriate age assurance”. eSafety names photo-ID matching, facial age estimation, credit-card checks, digital identity wallets, parent confirmation and certain AI-based estimation among possible approaches. Ask providers how they meet the four criteria: technically accurate, robust, reliable and fair.
Offer more than one way in. eSafety’s guidance says fair checks should give users a choice of methods, and should not make government-issued ID the only option.
Put the check before the content. Confirm age when people access age-restricted material. Don’t leave an “I am 18” button as the only barrier.
Let the server decide, and lock the files. The provider should tell your server the result. Pages, media URLs and public lists must not hand out age-restricted material around the gate.
Take reasonable steps against workarounds. eSafety expects providers to detect VPN use and other bypass patterns as part of appropriate age assurance.

Our scanner checks the visitor side from an Australian connection: what kind of check appears, what’s visible before it, and whether files open around it. Whether a specific product fully satisfies the codes is something only eSafety’s guidance and your lawyer can answer. Our Australian checks are in beta. They mark a self-declaration (button, tick box or self-entered date of birth) as a fail. When a provider runs the check, they leave the result open, because we can’t see which method it uses.

What a good Australian age gate looks like

Confirm you are 18+Adult content. Choose how you want to verify.

Front gate

Logo, a short explanation and a path to a real check. Nothing age-restricted loads yet.

📷 Quick face checkor verify with your card

A real check, with a choice

More than one method, for example a selfie estimate or a card check, not government ID alone.

18+ · Verify to continue

Neutral before the check

If anything is shown first, keep it non-explicit: logo, text, neutral art.

How No451 checks your site

We visit your site from an Australian connection like a first-time visitor, record what loads before the gate, and ask for the headers of a few media files. We never download images or videos and never try to break your check unless you’ve verified you own the site.

Should fixYour age check is only an “I am 18” button Example result

A first-time visitor from Australia sees a self-declaration button before the content. Anyone can click through. We found no age-assurance provider on the page.

The fix: switch to a method eSafety lists among possible approaches, offer more than one option where you can, and make the server decide who gets in.

Your age checkWhat kind of check a first-time visitor meets

Before the checkWhat’s visible behind the gate

Media filesWhether files open without passing

Age-check providerWhich provider runs the check, if we can see one

Common mistakes

Keeping an “I am 18” button as the only gate. eSafety’s FAQ says that is no longer good enough for pornography sites.
Only offering government ID. Guidance says fair checks should not rely on government-issued ID as the sole method.
Checking once, then a plain “over18=1” cookie. Anyone can set that cookie. Use a signed, short-lived proof.
Ignoring VPN and other workarounds. The codes expect reasonable steps to detect and limit bypass patterns.

Enforcement

eSafety enforces the Age-Restricted Material Codes under the Online Safety Act. It focuses on systemic failures by service providers. We don’t list penalty amounts on this page.

Questions operators ask

Is an “I am 18” button enough in Australia?

No. eSafety’s FAQ on the Age-Restricted Material Codes says pornography sites should confirm age when people access age-restricted material, and that clicking “I am 18 years or older” is no longer good enough.

When did this start for websites?

For designated internet services (a category that covers websites including porn sites), the relevant codes took effect starting on 9 March 2026. Some other service types and some age-check duties have different start dates.

Which methods count?

The codes say the method must meet “appropriate age assurance” in the codes’ head terms. eSafety names photo-ID matching, facial age estimation, credit-card checks and digital identity wallets among possible methods, and says providers should offer more than one method and not rely on government ID alone.

Do I have to fight VPNs?

As part of appropriate age assurance, the codes say providers must take reasonable steps to prevent workarounds. eSafety says that includes expecting providers to detect VPN use.

Sources

Not legal advice. This page summarises and links to primary sources; it does not tell you what the law requires of your specific site. Related: Australia overview · Glossary: highly effective age assurance · Fix guide: lock your media files

See what an Australian visitor sees. Then close the gaps.

One scan from an Australian connection shows your age check, what’s visible before it and whether your files open without it, with evidence and fixes.

No signup for the first result · built by people who run an adult site themselves