=][= AUSTRALIAN SOCIAL MEDIA AGE RESTRICTIONS =][=

[Brother Tyler]

On 10 December, 2025, the Australian government will implement regulations forcing "age-restricted social media platforms ... to take reasonable steps to prevent Australians under the age of 16 from creating or keeping an account." You can see information on this from Australia's eSafety Commission at https://www.esafety.gov.au/about-us/industry-regulation/social-media-age-restrictions. In our initial review of the regulation, there was some question about whether or not these restrictions applied to the Bolter and Chainsword since some platforms will be considered age-restricted while others will not (https://www.esafety.gov.au/about-us/industry-regulation/social-media-age-restrictions/which-platforms-are-age-restricted). When we inquired, we were informed that the Bolter and Chainsword would be considered age-restricted.

 

"Wait a minute! The Bolter and Chainsword is an American site (I am the site's owner and I live in the U.S. and the site's servers are also in the U.S.). Can this Australian regulation even be enforced on an American site?" Some of you may be wondering/asking. I'm not a legal expert, nor have I had the time to consult any legal experts (and our coffers can't afford that expense). For what it's worth, some of the major social media platforms that are explicitly identified as being subject to this law include Facebook, Instagram, Reddit, Snapchat, Twitch, X, YouTube (all of these are also American), and TikTok (Chinese). If the law can be enforced upon them, it can be enforced upon us. Ultimately, we meet all three of the basic conditions for Australia's age restriction:

• the sole purpose, or a significant purpose, of the service is to enable online social interaction between two or more end-users
• the service allows end-users to link to, or interact with, some or all of the other end-users
• the service allows end-users to post material on the service.

So yes, this regulation applies to us and can be enforced. One of the things that separates us from the other sites that I named is that we have very little capital whereas they are all large companies with lots of capital and paid resources (i.e., technical experts that can incorporate age-restriction measures quickly and at low cost to them). They can also afford to pay fines that Australia might impose upon them until they are able to comply whereas fines have the potential to shut us down.

 

Online safety measures in other countries/regions, notably the UK's Online Safety Act 2023 and the US's Kids Online Safety Act (2025) have been relatively easy to satisfy, largely due to the fact that our pre-existing family-friendly focus typically fulfilled the requirements of those laws and any necessary adjustments were minor. The upcoming Australian act, on the other hand, imposes some requirements that aren't easily implemented, and some of those may require capital. We're also going to have to look at the broad range of online safety laws (many are tracked here, but we'll have to expand the scope of our search to include other nations' laws).

 

We haven't imposed age restrictions for membership in the past, largely due to the fact that the Warhammer 40,000 hobby is meant for a variety of age ranges. The Warhammer 40,000 game, for example, is meant for ages 12 and up. The Warhammer Adventures series of books, meanwhile, is meant for ages 8-12. Since our site is intended to cover the entirety of the hobby, we avoided age restrictions that would restrict any aspects of the hobby. While some of the themes of the setting are decidedly mature, the content of the official material has generally been kept at a family-friendly level (mostly), and our site has mirrored that, with prohibitions on mature content and tools for reporting inappropriate content.

 

Australia's regulatory guidance, however, counters that. We are conducting a risk analysis and exploring our options for fulfilling Australia's regulatory guidance. Our goal is to continue providing service to as many hobbyists around the world as possible, including Australians [ages 16 and up]. This may require us to implement some additional measures, however. With the 10 December deadline fast approaching, we may be forced to implement some (hopefully temporary) measures to ensure that we don't violate the law.

 

Note that "reasonable steps" does not mean that we simply ask a question and allow [prospective] members to self-report. It's eminently easy to lie and failure to verify someone's claimed age would be dereliction on our part (i.e., not "reasonable"). Similarly, the uses of VPN are well-known and any method that doesn't account for the ability to "lie" about one's location through VPN would be derelict.

 

How will this impact you (whether or not you live in Australia)?

• In the likely event that we have to require proof of age in the account creation process, everyone will have to submit proof that includes both age and residency information. (Yes, all existing accounts will also be subject to this requirement.)
• Anyone residing in a country/region with age restrictions will only have their account approved (or preserved) if they meet those age restrictions.
• Anyone who is unable/unwilling to provide the age/residency proof, or who fails to meet the age restrictions for their country/region will not be approved for an account (i.e., new accounts won't be approved and existing accounts will be adjusted*).
• Until we are able to fully implement these measures, we may be forced to temporarily block access for users in Australia starting 10 December.

* We have several options here with regard to the existing accounts. One option is to simply delete the accounts, but that removes a lot of content and achievements. Another option is to place them in a holding status (some type of new group) where they are inaccessible until the member provides proof that they are of sufficient age. There may be other options after we conduct a more thorough analysis.

 

Does this suck? Absolutely. The stated goal ("protecting young [people] at a critical stage of their development") is perfectly understandable and supportable, so we're not here to gripe about the socio-political aspects of this (and any such commentary will be removed). At the very least, this requires some process where [prospective] members are required to submit sensitive personally identifiable information which we really don't want to collect. Part of our analysis, then, is to see if there's a way for the verification process to delete all such information after the account is approved.

 

Your thoughts on this are welcome. Note that we're not here to complain about the situation. It is what it is and complaints will be removed. At this point we're here to look for solutions.

[phandaal]

Any idea what sites like Facebook and YouTube are doing? It is hard to believe they will be requesting that everyone who creates an account provide proof of residency beforehand, or that all of their existing users do so.

[Brother Tyler]

That's something we're looking into.

 

Another option is to just apply the 16+ age requirement to everyone, which would then only require some form of age verification, which can also be performed via biometrics (facial recognition and age estimation). There are a variety of apps that perform this type of verification, so we would have to balance the regulatory requirements with collecting minimal (ideally no) personal data and cost.

[kabaakaba]

Doesn't most of services has formal verification like simple checkbox with text like "I confirm I'm older then 16"? 

[techsoldaten]

Seems like a massive overreach with long-tail consequences.

With regard to impact, I prefer my time spent talking about painted army men to be anonymous. I would probably not submit proof of age, thus I would no longer be able to post here.

Pretty sure this law is designed to curb online interaction, or at least to de-sensitize people to having interaction extremely curtailed. You might want to consider the direction this is headed and whether it's actually the best move for the site.


 

[Grotsmasha]

[Beaky Brigade]

I think automated age verification services would be a better option for the site than mods having to process ID documents manually as that's a whole can of worms to go though in terms of data protection, though at least if it leaks it just reveals the member is a big warhammer nerd, rather than anything more seedy! 

 

The site is heavily moderated and I'm not as free to post the type of content or say the type of things about the hobby I might on other platforms. 

 

As much as I want to show solidarity to my Australian brothers I don't think ID based age verification for all members is proportionate to the risks of under 16 aussie hobyists connecting via vpn. 

 

One thing I hope is a positive suggestion could be financial based verification for non Australian users. Could making a small donation to the B&C verify your local and age based on the requirements to have debit or credit cards? 

 

Overall it's somewhat unwelcome news and I'm not even directly affected! 

[Indy Techwisp]

8 hours ago, Brother Tyler said:

Similarly, the uses of VPN are well-known and any method that doesn't account for the ability to "lie" about one's location through VPN would be derelict.

 

While it is true that the use of a VPN to "lie" about one's location should be considered, I feel that the intended age bracket being excluded here should also be taken into consideration in regards to the restrictions applied to all users of the site.

The law is targeting people aged 15 and under, which is an age bracket that is unlikely to have access to a VPN with which to bypass the restriction.

 

It is also likely that applying the requirements for proof of age to all users regardless of location would do immense damage to the site's userbase as a whole, as I assume a lot of users would understandably prefer to not hand over personal identification to comply with a law that doesn't legally apply to them.

 

If it is possible to apply the proof of age requirements specifically to users from Australia, that should ideally be the course of action taken to limit the impact on the rest of the site.

[TheMawr]

8 hours ago, Brother Tyler said:

On 10 December, 2025, the Australian government will implement regulations forcing "age-restricted social media platforms ... to take reasonable steps to prevent Australians under the age of 16 from creating or keeping an account." You can see information on this from Australia's eSafety Commission at https://www.esafety.gov.au/about-us/industry-regulation/social-media-age-restrictions. In our initial review of the regulation, there was some question about whether or not these restrictions applied to the Bolter and Chainsword since some platforms will be considered age-restricted while others will not (https://www.esafety.gov.au/about-us/industry-regulation/social-media-age-restrictions/which-platforms-are-age-restricted). When we inquired, we were informed that the Bolter and Chainsword would be considered age-restricted.

 

 

Thats weird they saying that.. because when I see the lists of wich are and wich arent, forums like BnC have more in common with those that arent.

While I didnt read the full law or articles.. all the restricted ones in the list are Algoritmic social media, wich BnC isnt ( just as Whatsapp, Discord and Steamchat.. the closest thing to a forum in the list arent.)

 

I know in europe there is the discussion to ban or restrict Algoritmic Social Media because of its suspected addictive/mental straining nature for children, but its not about banning/restricting non-algoritmic social media like forums, as these do not have that addictive element to them.

 

[TheMawr]

to copy those lists

 

Services that eSafety considers will be age-restricted social media platforms

• Facebook
• Instagram
• Kick
• Reddit
• Snapchat
• Threads
• TikTok
• Twitch
• X (formerly Twitter)
• YouTube

Services that eSafety considers will not be age-restricted social media platforms

• Discord
• GitHub
• Google Classroom
• LEGO Play
• Messenger
• Pinterest
• Roblox
• Steam and Steam Chat
• WhatsApp
• YouTube Kids

 

And I really think BnC, or any forum for that matters, should be in the same category as the bottom list.

[Felix Antipodes]

While I wouldn’t want my non-Aussie fraters to have to jump through hoops because of this legislation, I fear it will be only a matter of time before this becomes a wider problem.  Singapore (and I think Malaysia) has already announced they are planning their own law(s) to follow the Australian initiative, and there are several more closely following how this shakes out (including the EU).

 

It’s been a while since I joined, but didn’t we have to provide a birth date?  Or are we working on the principle that everything previously supplied is suspect unless re-verified?  What about we dinosaurs who have accrued 15+ years on the site and have the badges to prove it?  Do I have to prove it’s still me and not junior - or grand-junior in my case?

 

[Grotsmasha]

1 hour ago, Felix Antipodes said:

It’s been a while since I joined, but didn’t we have to provide a birth date?  Or are we working on the principle that everything previously supplied is suspect unless re-verified?  What about we dinosaurs who have accrued 15+ years on the site and have the badges to prove it?  Do I have to prove it’s still me and not junior - or grand-junior in my case?

 

 

DOB was previously optional information, but was recently removed as unnecessary. Account History is one of the metrics allowed by the Law.

[Indy Techwisp]

8 hours ago, TheMawr said:

 

Thats weird they saying that.. because when I see the lists of wich are and wich arent, forums like BnC have more in common with those that arent.

While I didnt read the full law or articles.. all the restricted ones in the list are Algoritmic social media, wich BnC isnt ( just as Whatsapp, Discord and Steamchat.. the closest thing to a forum in the list arent.)

 

I would definitely suggest seeking a second opinion on the application of this law to BnC, as it wouldn't be outside the realm of possibility that you've been told it applies "to be on the safe side".

 

We certainly to have more in common with the latter list of sites which aren't affected by the law, so is it possible that there is one or two site features that are pushing us over the edge which it would be easier and cheaper to remove (I.e. is it possible that something like "Reactions give you points which level up your account" is what makes us count for this law and would be cheaper to modify than bringing in age verification?)

 

Regardless of who this applies to or whether BnC is applicable for it at all, the age verification method used should ideally minimise personal data collected.

 

I feel it is also worth noting that we've seen plenty of ways users have bypassed age verification restrictions (using the guy from Death Stranding for Face Verification or an ID picture from Google images to verify via ID) that are far more likely than use of a VPN, but aren't anything BnC could reasonably do something about. It would be reasonable to assume that people, especially under 16s, wouldn't use the VPN method to bypass any restrictions when just gaming the verification itself is an option that doesn't mean they need to purchase a VPN and set it up on a probably shared family PC.

[Brother Anderson]

Might be worth noting that steam is explicitly excluded and it has extensive forums that act very much like the B&C but with significantly worse moderation 

Edited 10 hours ago by Brother Anderson

[Grotsmasha]

The Law defines Social Media as anything that's Primary Function is user interaction and sharing.

By that definition, we fit, even if the problema they're trying to prevent (realistically) don't exist here , mostly due to us not being monitised, and being thoroughly moderated.

Edited 9 hours ago by Grotsmasha

[Evil Eye]

Egads. Hoping a solution can be found. Just for the record, if submission of ID becomes mandatory to use this site I will have to stop using it; I like this place but I'm not willing to put my real personal information out there.

[Mendi Warrior]

For Belgium, the easiest would be to require an electronic copy of the "Certificate of Main Residence". This is an official document which is electronically signed by the Federal Public Service Interior. It contains both the date of birth and the adress.

 

Other countries might or might not provide similar documents.

 

The financial based verification mentioned by brother Beaky Brigade is something that might be interesting to check. Costs for such a service need to be assessed. The financial based verification does not automatically mean that your credit card is charged an amount X. Usually, the verification consists of reserving X units of the local currency (with X often equal to 0.00 or 0.01). Typically, the reserved amount remains blocked for about 2 weeks.

 

For my other hobby, I often register to bid at auctions, either through auction platforms like Invaluable or LiveAuctioneers (among others) or directly through inividual auction houses. It is quite typical for them to require proof of residence and/or a valid credit card. For proof of residence, a copy of ID card or passport is often required combined with a utility bill. The credit card is usually required as collateral. Note: in my case, providing a copy of the "Certificate of Main Residence" beats providing a copy of my ID card or passport and a utility bill. Less risks of identity theft for me, less risks of getting an AI-generated fake ID or utility bill for the auction house.

 

Another type of verification, which is used for official competitions in the EU or for registrations into remote learning programs, is to go through a biometric-based identification system that will have a picture of you taken and then compared to your photographic ID. This to ensure the person taking the test or exam is actually the person who enrolled. Again, there are costs for using such verification systems.

 

One of the major drawback of starting to collect information such as ID cards, passports, credit card numbers, ... is that it comes with the need to protect that information from getting hacked or stolen. And that has other legal ramifications (e.g. EU RGPD and obligation to inform customers/users in case of a data breach, also subject to fines if not done properly).

 

If possible, I would suggest having a dialogue with Australian authorities to determine if B&C can be reclassified in the non age-restricted category (based on comparables), and, if not, to determine which actions are needed to be compliant with this law.

 

Best of luck!

[techsoldaten]

Something that occurred to me: it might not be possible for B&C to comply with the law.

Read this page very carefully:

https://www.esafety.gov.au/about-us/industry-regulation/social-media-age-restrictions/consultation

A manual verification process might not comply with that provision. It's specifying technological approaches, which are going to cost money. Notice they do not specify the age assurance technology, or the frequency with which it should be applied.

Currently, the cost to spoof an identity is negligible / zero. It takes maybe 5 minutes to create a realistic image of an identity card for any country using Stable Diffusion, there are models tuned specifically for this purpose which include all nations. As stated before, VPNs can disguise the country of origin for any user. Possible to go much further than that with automated OPSEC and INFOSEC tools that interact with identity providers to track down real world names, addresses, etc. It's not safe to assume a verification system based on identity cards is reliable.

There are multiple platforms for providing age assurances. Uniformly, they tie an otherwise anonymous online identity to a real world person, and most of them check every online interaction. Most of them are multiparty tenants, meaning they don't just check the identity of the user, they check who the identity of the person the user is interacting with. Some of them also monitor the nature of the interaction, using NLP for sentiment analysis.

You can find a detailed explanation of the nature of these platforms and the methods of verification currently being used here:

https://www.newamerica.org/oti/reports/age-verification-the-complicated-effort-to-protect-youth-online/age-assurance-and-age-verification/

Don't consider that link comprehensive. It leaves out / obfuscates some of the most important features (active monitoring is referred to as social graph age estimation, for example.) Any time the frequency is not mentioned, consider it to be constant and not a gateway through which verification is passed. It does not discuss behavioral, contextual inference models, steganographic age verification methods which are also being considered, which would be used to address account hand offs and would require constant monitoring. 

In all likelihood, complying with this law means subjecting all users to some form of de-anonymization and ongoing monitoring. If not today, in the near future. I have not seen model legislation that puts the costs anywhere but on the website operator. Identomat, Sumsub, Veriff, Yoti, AgeCheck, and some of the custom AWS / Azure / Google Cloud solutions I've seen are all metered services. These are just the ones that come to mind, there are others that are popular in India / Pacific nations that are more encompassing (will alert authorities when content triggers are passed.) 

Just things to consider. 

[Cleon]

While I share the dismay at the legislation, I agree it's best left to those with more resources to fight it.

 

Where I will chime in is the need to be VERY careful (as compliance with it is part of my other life) of the UK and EU General Data Protection Regulation (GDPR), as any attempt to put in a stop gap around the Australian legislation which collects identity and residence information would very easily fall in to the scope of that legislation unless any storage and transfer was fully compliant.

[phandaal]

3 hours ago, Evil Eye said:

Egads. Hoping a solution can be found. Just for the record, if submission of ID becomes mandatory to use this site I will have to stop using it; I like this place but I'm not willing to put my real personal information out there.

 

Yeah. Unfortunate, but there are multiple reasons why that is going to be a non-starter. Although I am still skeptical that this website would ever fall under the kind of attention that would even warrant something like this.

Edited 5 hours ago by phandaal

[Matcap86]

 

6 hours ago, Cleon said:

While I share the dismay at the legislation, I agree it's best left to those with more resources to fight it.

 

Where I will chime in is the need to be VERY careful (as compliance with it is part of my other life) of the UK and EU General Data Protection Regulation (GDPR), as any attempt to put in a stop gap around the Australian legislation which collects identity and residence information would very easily fall in to the scope of that legislation unless any storage and transfer was fully compliant.

 

Agreed, another veteran of the GDPR wars here and recording those types of data can really quickly escalate into a big old headache.

 

I'll also voice my concern that if I'd need to send in verifiable ID documentation, I'll probably stop using the site. Much to my dismay as it's (usually) a haven compared to the rage driven social media sites. 

Edited 42 minutes ago by Matcap86

[Marshal Mittens]

3rd opinion that GDPR would make the plan in the first post a headache. 

 

There are 3rd party identity verification services that can validate information without B&C having to collect PII and store PII,  which exposes you to more regulations. 

 

Ultimately this is going to be a bit of a boondoggle. 

Edited 13 minutes ago by Marshal Mittens