David Harvey
In most of the discussion about the proposed social media restrictions for under-16s, the question “do you support such restrictions?” received considerable support.
Understandably. Who would encourage access to harmful content online by children? Many parents also find it difficult to fulfil their parenting role by saying “no” to their kids and are therefore happy to defer that aspect of parenting to the State.
The problem is that in seeking the approval for the proposal, the next question that should be asked goes unasked and unanswered.
And that question is “how are you going to put in place a system that verifies that platform users or subscribers are over 16 years old?” That same system will produce an “access denied” result for users whose verified age is under 16.
But the verification system is the real issue and so far, it has gone unaddressed. The reason is that the implications are very serious in terms of data acquisition, retention and use.
Let’s pause for a moment and think about what is required. You want to access a social media platform. This involves what I describe as the privacy/verification tradeoff and it introduces a paradox – to prove you are allowed to use something freely, you must surrender freedoms you currently have.
The starting scenario
When you first approach a social media platform, your exposure is relatively limited. You choose a username, create a password and begin using the service. There is a degree of practical anonymity in this – you are, at least on the surface, whoever you choose to be. The platform knows little about you beyond the email address you may have used to register.
The reality beneath this surface is already more complicated. Your IP address travels with every request you make, quietly logging where you are in the world and which internet service provider connects you to it.
Your device leaves its own fingerprints – screen resolution, browser type, installed fonts, system language – a combination so specific it can identify you with surprising reliability, even without any formal identification process.
Your anonymity at this stage is real but fragile, protected more by practical inconvenience than by any robust technical barrier. A determined enquirer, armed with legal authority, can already connect your username to your front door.
How age verification changes the picture
Age verification changes this picture substantially and it does so by design. The moment a platform asks you to prove you are over 16, the informal and retrievable-only-with-effort connection between your online presence and your real-world identity becomes formal, deliberate and stored.
You are no longer incidentally identifiable – you are explicitly identified and that identification is recorded.
The first layer of verification data seems reasonable enough. Your real name and address confirm who you are in the world.
A phone number adds a further anchor, tying your account to a physical device registered in your name. Taken together, these details would satisfy many everyday identity checks. But they are not independently verifiable – anyone could type a name and address into a form – and so the system demands more.
The introduction of a passport or driving licence fundamentally changes the nature of what is being collected. These documents do not simply confirm your name and age. They carry your photograph – a biometric identifier that is uniquely and permanently yours.
Unlike a password, which can be changed, or an address, which you might move away from, your face follows you through life. Once it is stored in association with your account, the link between your physical self and your online activity is not merely administrative.
It is biological.
By this point, the verification system has assembled something that goes well beyond a simple age check. It holds your name, your address, your phone number, your date of birth, a copy of a government-issued document and an image of your face.
It knows which platform you wished to access and when you sought access. If the verification was handled by a third-party provider – which it common – that provider holds all this data independently of the platform itself, creating a second repository of your most sensitive personal information.
The implications of this accumulation extend in several directions simultaneously. Within the platform, your verified identity is now attached to everything you do – every post, every search, every connection you make, every piece of content you linger over.
The behavioural profile the platform builds about you is no longer associated with an anonymous username. It is associated with you specifically and verifiably.
Beyond the platform, the risks multiply further.
Verification providers who service multiple platforms can observe your activity across all of them, constructing a picture of your online life that no single platform could assemble alone.
Your phone number, used across services for two-factor authentication, becomes a common thread linking accounts you may have deliberately kept separate.
And all this data, concentrated in one place, becomes a target of considerable value – to advertisers, to data brokers, to hostile state actors and to ordinary criminals for whom a database linking real identities to online behaviour, facial images and contact details represents an exceptionally useful resource.
And conceivably that data can be available to the State and its various departments.
Impossible to retrieve
The legal protections that currently guard this information are real, but they are not permanent, and they are not uniform. Privacy law varies between jurisdictions, changes with governments and is subject to exceptions that expand in times of political pressure.
The data, once collected and stored, exists independently of the legal framework that currently protects it. If that framework weakens – or if the data is simply stolen – the protection disappears while the exposure remains.
What emerges from this process, then, is not simply an age verification system. It is a comprehensive identity infrastructure, built on the stated justification of keeping under-sixteens off social media, but with consequences that extend to every adult who passes through it.
The verification confirms your age in a moment. The data it generates persists indefinitely, attached to your identity, available to a widening circle of interested parties and impossible to retrieve once surrendered.
This is the trade-off. Access to a platform you are legally entitled to use in exchange for a level of personal exposure that would, in any other context, requires serious justification.
The above analysis exposes a truth that regulators are only beginning to grapple with: age verification as currently implemented is a surveillance infrastructure that happens to check ages, rather than an age-checking system that happens to be privacy-respecting.
This is a very basic and simplistic description, but it does provide a glimpse of an answer to the implications of the unasked and unanswered question.
Let’s take the issue a little further.
Ani O’Brien in her weekly roundup A week is a long time: 23 May 2026 makes the following comment (the italics are mine):
The government has pulled an abrupt turn in its thinking around the proposed under 16s social media ban. I am hearing from multiple sources that officials and ministers have become increasingly nervous after watching the problems surrounding Australia’s approach, which has exposed just how technically difficult and politically risky these bans become once governments are forced to figure out how exactly you verify everyone’s age online.
Attention now appears to be shifting toward emerging European-style models built around much more centralised digital identity and age-verification systems which would create state-backed infrastructure for online identification rather than simply forcing platforms to “ban children”. That is a very different proposition politically and philosophically, because it moves the debate away from child safety alone and into questions about digital privacy, anonymity, surveillance and state control over internet access.
The issue came up during Erica Stanford’s appearance on Q+A last week, where she continued defending the government’s push for stronger restrictions despite struggling to provide detailed answers around implementation. The central problem to be resolved is that any system robust enough to genuinely prevent under 16s accessing social media inevitably requires some form of age or identity verification for everybody else as well.
It is likely National sees this kind of operation as a function for the Department of Internal Affairs and with Minister Brooke Van Velden retiring at the election, they’ll be wanting someone in that spot to champion the move.
This provides some further insight into the nuance of the unasked unanswered question.
I shall now consider the risks that flow from a European-style age verification model in the New Zealand context.
Unmitigated risks?
New Zealand is moving steadily toward a social media age verification regime and the infrastructure to deliver it is already being assembled.
The Social Media (Age-Restricted Users) Bill, introduced in May 2025, seeks to ban children under 16 from social media platforms and is modelled directly on Australia’s legislation.
While that bill has been shelved pending a more comprehensive approach, the Department of Internal Affairs (DIA) is already building the technical architecture a European-style model would require – a government digital wallet, a digital credential issuance platform and the Kiwi Access Card as the wallet’s first credential.
The pieces are in place. The question is whether the framework being built around them is adequate to mitigate the risks it creates.
Those risks deserve honest examination because they are substantial.
The central paradox
The fundamental tension in any age verification system has been identified plainly by Privacy Commissioner Michael Webster: to ensure that under-16s are not accessing social media, every adult must prove their age.
A law designed to protect children’s privacy requires every New Zealander to submit to identity verification simply to use the most common communication tools of modern life.
This is not a side effect that can be engineered away. It is structurally inherent to what the proposal requires.
The European Union’s model attempts to address this through zero-knowledge proof architecture – a cryptographic approach in which a user can prove he or she is over 16 without revealing who they are. The verification generates a yes-or-no signal rather than transmitting identity data to the platform.
But even this approach requires an initial trusted verification step in which someone, somewhere, establishes that the person is who they claim to be.
In the EU, that step is distributed across the national identity systems of 27 member states, each operating under the General Data Protection Regulation (GDPR) and supervised by independent data protection authorities. In New Zealand, it would flow through a single government department: the DIA.
That difference is not incidental. It is the central structural problem with New Zealand’s emerging model.
The concentration of power
The DIA is one of the most operationally powerful agencies in the New Zealand state. It issues passports, grants citizenship and already holds the biometric data of every passport holder in the country.
The unit now being handed responsibility for the social media age restriction program – Digital Safety and Identity Investigations – also houses the Digital Child Exploitation team, the Digital Violent Extremism team, the content classification function and the anti-spam enforcement operation.
It is, in other words, the government’s front line against online harm, broadly defined.
The convergence of these functions in a single agency – identity management, censorship enforcement and platform access regulation – is not the result of careful institutional design. It is an accumulation. And it creates a concentration of power that the EU’s model was specifically designed to avoid.
In Europe, age verification, identity infrastructure, data protection and content regulation are distributed across multiple independent bodies. New Zealand’s model places all these functions in a single government department, accountable to a single minister.
The EU’s privacy protections derive in significant part from that institutional separation. Reproducing the EU’s technical architecture without its institutional architecture would hollow out one of the model’s most important safeguards.
The trust framework and its limits
The Digital Identity Services Trust Framework Act 2023 provides the natural vehicle for delivering age verification in New Zealand.
It establishes an accreditation scheme for digital identity service providers, with stringent standards around privacy, security and data handling.
The government digital wallet, currently under development, is designed to carry credentials like the digital Kiwi Access Card. On the surface, the fit between the trust framework and the age verification proposal looks clean: accredited providers meet tested standards, the wallet carries verified credentials and platforms are required to accept them.
But the apparent fit conceals serious structural problems.
The trust framework was conceived as a voluntary quality mark – a way of giving users confidence that accredited providers handle identity data responsibly. The age verification proposal would transform participation in this ecosystem into a mandatory requirement for accessing social media.
That is a fundamental change of character.
A voluntary accreditation scheme designed to build consumer confidence is a different instrument from a mandatory regulatory regime governing access to online communication.
Repurposing the former as the latter, without explicit legislative authority calibrated to that purpose, risks undermining the legitimacy of both.
The regulator and the regulated, moreover, are the same body. The Trust Framework Authority is a statutory function within the DIA – formally distinct, but organisationally housed within the same department that issues passports, manages the wallet, operates the Digital Safety and Identity Investigations unit and is building the age verification infrastructure.
The separation is statutory in form but not in reality.
The EU’s equivalent functions are distributed across the European Commission, national data protection authorities and independent supervisory bodies. New Zealand’s are converging in one place.
The current accredited services under the trust framework are also narrow: high-assurance identity verification tied to New Zealand passports and driver licences held by persons born in New Zealand.
Neither document is universally held and neither provides a workable pathway for identifying the population the system most needs to reach –15-year-olds who, by definition, cannot hold a driver’s licence and whose passport coverage is incomplete.
The framework that works for adult identity verification does not extend cleanly to the problem it is being asked to solve.
The risk of function creep
History consistently demonstrates that capabilities built for one purpose are subsequently used for others.
A system designed to verify that someone is over 16 to access Instagram can, with modest technical adjustment, verify who is accessing any online service, when and from where.
The technical infrastructure, once built, persists beyond the political intentions that created it. Laws can be changed. Databases remain.
The EU addresses this risk through the GDPR, independent supervisory authorities, and constitutional privacy protections enforceable in national and European courts. New Zealand has no single constitutional right to privacy.
Section 21 of the New Zealand Bill of Rights Act protects against unreasonable search or seizure and the Privacy Act 2020 provides further protections, but these instruments were not designed for a system of mandatory, universal identity verification as a condition of online access.
New Zealand’s Biometric Processing Privacy Code 2025 sets rules for biometric data, but a code of practice is not the same as architectural separation. Rules about how data must be handled do not eliminate the risk that arises from the data existing in concentrated form in the first place.
A future government, with different priorities and different attitudes to surveillance, would inherit infrastructure capable of tracking who accesses what online services, when, and from where — and would do so with fewer structural constraints than exist in jurisdictions that built equivalent systems with institutional safeguards designed from the outset.
The breach risk
The EU’s zero-knowledge proof architecture is designed so that no central repository of verified identities linked to platform access exists. If faithfully replicated, there is relatively little of value for a hostile actor to steal.
But if New Zealand delivers age verification through the DIA – an agency already holding the biometric data of every passport holder – the critical question is whether the age verification function will be technically isolated from those existing databases or whether, in practice, they will become interlinked.
A breach of a centralised government identity system holding verified age credentials linked to online platform access would be extraordinarily valuable to criminal and state actors alike. It would expose not merely who New Zealanders are, but what platforms they use, when they use them and potentially what they do on them.
The aggregation risk is not hypothetical. It is the predictable consequence of concentrating these functions in a single system without the architectural separation that makes comparable European systems more resilient.
The equity problem
The EU model functions because it sits atop a mature, near-universal digital identity infrastructure. Most EU citizens hold national identity documents loadable into a wallet.
New Zealand’s infrastructure is less comprehensive and the communities most likely to be disadvantaged by a government-administered age verification system include those with limited digital literacy, limited smartphone access or complicated relationships with government documentation – recent migrants, people in rural or low-income communities and, in New Zealand’s specific context, Māori and Pasifika communities who have historically had grounds for wariness about government data collection.
A system that works smoothly for a digitally connected urban professional may create serious barriers for people whose relationship with government identity infrastructure is more fraught.
The deeper problem
What emerges from this analysis is a fundamental mismatch between the architecture New Zealand is building and the institutional safeguards that make equivalent systems elsewhere legitimate and safe.
The trust framework built infrastructure for voluntary digital identity services. The age verification proposal intends to make that infrastructure the mandatory gateway to platforms that most New Zealanders use daily.
The repurposing is being managed by the same body that built the infrastructure, without the independent oversight that would make that repurposing safe.
The EU model’s privacy protections are not solely technical. They rest on institutional architecture – independent regulators, constitutional privacy guarantees, a political culture shaped by twentieth-century experiences of authoritarian surveillance and a legal framework with real enforcement teeth.
New Zealand’s 2026 privacy survey found that 67% of New Zealanders are concerned about government agencies using personal data for automated decision-making, and 65% worry about social media platforms’ handling of personal information.
That public concern is real. But concern is not the same as institutional protection, and the gap between what New Zealand’s architecture currently provides and what a system of this kind requires to operate safely is the central unresolved risk in this proposal.
Conclusion: an assessment
New Zealand faces a genuine and legitimate problem – the same one that has driven Australia, the UK and the EU to act. Seventy-one percent of New Zealanders worry about how social media affects children and that concern is not without foundation.
The European model represents the most technically sophisticated and privacy-conscious attempt yet made to address it.
But transplanting that model into New Zealand through the DIA would mean adopting the architecture without the protections that make it relatively safe in its original context.
The risks are not theoretical. They follow directly from concentrating identity verification, content regulation and online access control in a single powerful government agency, in a jurisdiction with limited constitutional privacy protections, against a background of developing rather than mature digital infrastructure.
The question New Zealand needs to answer before proceeding is not whether the technology works. It is whether the institutional framework surrounding it is strong enough to prevent the tool designed to protect children from becoming an instrument of comprehensive surveillance of everyone else.
As matters stand, the DIA should have nothing to do with the age verification proposals.
David Harvey
David Harvey is a retired District Court Judge and a member of The Law Association’s Public & Administrative Law Committee
0 Comments