> ## Content Index > Fetch the complete content index at: https://www.theaidirectory.com.au/llms.txt > Use this file to discover other available public pages before exploring further. # Australia's app-store age checks are now law. Most of it already happened. - URL: https://www.theaidirectory.com.au/news-esafety-app-store-age-checks-australia-2026/ - Published: 2026-09-09T23:00:00.000Z - Updated: 2026-10-08T05:25:35.000Z - Description: The deadline fell on 9 September. Apple switched it on in February — and the half that reaches AI tools has been live since March. - Author: Adam - Tags: News, Regulation, eSafety, AI Policy, #news **Posted:** 10 September 2026 · **Category:** Legal, Compliance & HR --- > **TL;DR:** From 9 September 2026, app stores serving Australians must run age checks before letting anyone download an app rated R18+. Apple has been doing it here since February. The part worth your attention is quieter: generative AI services sit inside the same set of codes, and that obligation has been live since March. ## What changed A staged deadline under eSafety's Age-Restricted Material Codes fell due on **9 September 2026**. Age checks "for users seeking to download apps rated R18+ from app distribution services" had to be in place before that date. App stores must also rate apps correctly in the first place. The money at stake has gone up. eSafety now puts civil penalties for ongoing non-compliance at up to **$54.6 million per breach**. That is above the $49.5 million quoted when the codes were registered. Commonwealth penalty units rose on 1 July 2026. The codes themselves are not new. Six were registered on 9 September 2025 and took effect on 9 March 2026\. September's date was the enforcement line, not the change line. Both companies that matter moved early. Apple began blocking 18+ downloads for Australian users on **24 February 2026**, and says the App Store performs that confirmation automatically. Google said in July that its Play Age Signals API would reach Australian users by mid-August. So if you were expecting a new pop-up that morning, you probably didn't get one. ## Why it matters for Australians The half that reaches AI tools got almost no coverage. Under the same codes, "designated internet services" is a category that — in eSafety's own words — "**also covers generative AI services and AI model distribution platforms**." So an AI chatbot that can generate sexually explicit, self-harm or high-impact violence material has to confirm the user is 18 or older first. The check can sit at log-in, or at the point the material is accessed or generated. Read that precisely. The gate is on the material, not on the whole service. A service with companion-chatbot features carries a broader duty. It must assess the risk of children generating that material and address it — "either through age-checks or strong safety guardrails, depending on what is appropriate." That has applied since 9 March 2026, and it has already reshaped what Australians can reach. eSafety served transparency notices on four companion services in October 2025\. Its March 2026 report records that Character.AI introduced age assurance for Australian users in early 2026 and removed chat for under-18s. Chai announced a move to the Apple and Google age APIs the same month. This is the first Australian rule that changes how you *get* an AI tool rather than how it behaves once you have it. So what are you handing over? Usually less than you'd fear. Apple's Declared Age Range API returns an age *range* the user has provided, behind a permission prompt. Google's returns an age *band* rather than a birthdate, and says age ranges "are never shared by default." But the code's own list of acceptable methods is wider than that. Photo-ID matching, facial age estimation, credit card checks and digital ID wallets all qualify. eSafety says providers should offer more than one method, and should not lean on government ID alone. There is a quieter cost nobody advertised. Providers must take reasonable steps to prevent workarounds, and eSafety expects them to detect VPN use. The methods it names include device telemetry, behavioural signals, persistent identifiers and IP-intelligence services. Switching on a VPN to dodge an age gate is now something the service is expected to notice. The soft spot is real too. "Appropriate" age assurance is largely the provider's call, and a self-declared age range is a weak gate. A determined 15-year-old will walk through it. eSafety's March 2026 report found none of the four companion services it served notices on had robust age verification before it forced the issue. Treat these checks as a floor, not a guarantee. ## What you actually do differently now **If you're a parent.** The gate sits at the store, and only on apps rated R18+. Most AI chat apps are not rated R18+, so nothing at the store will stop a 14-year-old installing one. If your child can still reach age-restricted material, tell the platform first. That is usually fastest. Then complain to eSafety, which uses those reports to find systemic non-compliance. The obligation sits on industry. There is no penalty for a child who gets through. **If you run a service.** Does your product have an AI companion or chatbot feature that can produce sexually explicit, self-harm or high-impact violence material? Then you are inside these codes, not near them. eSafety has named exactly that as its first enforcement priority for 2026\. Decide whether you need age checks or whether strong guardrails are appropriate, and write down why. Whatever you choose must comply with the Privacy Act, and the privacy impact has to be proportionate to the safety gain. **If you just use AI at work.** Nothing changes today. One date to keep: the Children's Online Privacy Code is expected by **10 December 2026**, and it will sit over the same services. ## Does this change our recommendation? No score moves. ChatGPT, Claude, Gemini and Microsoft Copilot are not rated 18+ and are untouched. The reviews this reaches are the companion apps — [Character.AI](https://www.theaidirectory.com.au/review-character-ai-australia-2026/), [Chai](https://www.theaidirectory.com.au/review-chai-australia-2026/) and [Replika](https://www.theaidirectory.com.au/review-replika-australia-2026/) — and each already carries the Australian regulatory context. It does add a question we now put to every mobile-first AI app we score. What does the store make you prove before you install it, and who holds that proof? For parents, the honest read is narrower than the headlines. The gate exists. It beats nothing. It is not a substitute for knowing what is on the phone. *This is general information, not legal advice. If you run a service that may fall inside these codes, get advice on your own obligations from a qualified practitioner.* ## Frequently asked questions ### What changed on 9 September 2026? Under eSafety's Age-Restricted Material Codes, app stores serving Australia had to have age checks in place before 9 September 2026 for anyone downloading an app rated R18+. They must also ensure apps are rated appropriately. eSafety states that ongoing failure to comply can carry civil penalties of up to $54.6 million per breach. ### Does this affect the AI tools I use? Not the mainstream assistants. ChatGPT, Claude, Gemini and Copilot are not rated 18+ and are unaffected. But the same codes treat generative AI services and AI model distribution platforms as "designated internet services". An AI chatbot that can generate sexually explicit, self-harm or high-impact violence material must confirm the user is 18 or older first. That obligation has applied since 9 March 2026. ### Do I have to upload my ID to download apps now? Not as standard. Apple's Declared Age Range API shares an age range the user provides, behind a permission prompt. Google's Play Age Signals API shares an age band rather than a birthdate, and never by default. The codes do allow stronger methods, including photo-ID matching, facial age estimation and credit card checks. eSafety says providers should offer more than one method, and should not rely on government-issued ID alone. ### What do I do if my child can still reach age-restricted material? Tell the platform or service first, and say how your child got to it — for example, that it appeared without an age check. That is usually the fastest fix. You can also complain to eSafety, which uses those reports to identify systemic non-compliance. The obligation to comply sits on industry, and there is no penalty for a child who accesses age-restricted material. --- ## Read next The AI apps this reaches, reviewed for Australians: - [Character.AI review](https://www.theaidirectory.com.au/review-character-ai-australia-2026/) - [Chai review](https://www.theaidirectory.com.au/review-chai-australia-2026/) - [Replika review](https://www.theaidirectory.com.au/review-replika-australia-2026/) - The assistants it doesn't reach: [ChatGPT](https://www.theaidirectory.com.au/chatgpt-review-australia/) · [Claude](https://www.theaidirectory.com.au/claude-ai-review-australia/) - How we score Australian fit: [Methodology](https://www.theaidirectory.com.au/methodology/) **Update history:** Drafted 10 September 2026\. Re-verified at primary source and approved 20 September 2026\. The penalty figure was corrected from $49.5 million to the $54.6 million per breach eSafety now publishes. The AI chatbot obligation was tightened to what the code actually says. The gate sits on the material, and companion features may use strong guardrails instead of age checks. The VPN-detection expectation, the complaint path and the 10 December 2026 Children's Online Privacy Code date were added. Google's mid-August rollout is now stated as the commitment Google made, not a confirmed ship. ## Sources - **Primary —** eSafety Commissioner, *FAQs: How will the codes impact access to online porn and adult content?* (the 9 September 2026 staged deadline, the 9 March 2026 commencement, generative AI services and AI model distribution platforms as designated internet services, the AI chatbot and companion-chatbot requirements, the acceptable age-assurance methods, the VPN-detection expectation, the $54.6 million per-breach penalty, the 2026 enforcement priorities, the complaint path, and the Children's Online Privacy Code expected by 10 December 2026). Page last updated 6 August 2026; read in full 10 September 2026 and re-read 20 September 2026, unchanged. https://www.esafety.gov.au/industry/codes/faq-access-to-online-porn-and-other-adult-content · Wayback: no same-day capture — see the note below - **Primary —** eSafety Commissioner, *Background to the Age-Restricted Codes* (registration dates: three codes 27 June 2025, six codes 9 September 2025). Re-read 20 September 2026\. https://www.esafety.gov.au/industry/codes/background-to-the-age-restricted-codes · Wayback: no same-day capture — see the note below - **Primary —** eSafety Commissioner, media release, 9 September 2025 (the services covered, including generative AI services and AI companion chatbots; the privacy-proportionality requirement; the $49.5 million figure quoted at registration, since superseded). Re-read 20 September 2026\. https://www.esafety.gov.au/newsroom/media-releases/new-industry-codes-seek-to-take-on-ai-chatbots-that-encourage-suicide-and-engage-in-sexually-explicit-conversations-with-aussie-kids · Wayback: no same-day capture — see the note below - **Primary —** eSafety Commissioner, *eSafety report shows AI companions are putting children at risk* (the October 2025 transparency notices on four companion services; Character.AI's age assurance for Australian users in early 2026; none of the four had robust age verification). https://www.esafety.gov.au/newsroom/media-releases/esafety-report-shows-ai-companions-are-putting-children-at-risk · [Wayback 28 June 2026](http://web.archive.org/web/20260628110732/https://www.esafety.gov.au/newsroom/media-releases/esafety-report-shows-ai-companions-are-putting-children-at-risk) - **Primary —** Apple Developer, *Age requirements for apps distributed in Brazil, Australia, Singapore, Utah, and Louisiana*, 24 February 2026 (blocking of 18+ downloads for Australian users from that date, performed automatically by the App Store; the Declared Age Range API). Re-read 20 September 2026\. https://developer.apple.com/news/?id=f5zj08ey · Wayback: no same-day capture — see the note below - **Primary —** Android Developers Blog, *Delivering safer, age-appropriate experiences on Google Play*, 29 July 2026 (the commitment to expand the Play Age Signals API to Australian users by mid-August; age ranges never shared by default). Re-read 20 September 2026\. https://android-developers.googleblog.com/2026/07/google-play-age-signals-api-safer-experiences.html · Wayback: no same-day capture — see the note below - **Primary —** Chai AI, announcement of the upcoming rollout of Apple and Google age verification APIs, March 2026\. https://www.prnewswire.com/news-releases/chai-ai-announces-upcoming-rollout-of-apple-and-google-age-verification-apis-to-enhance-platform-safety-302708688.html · [Wayback 11 April 2026](https://web.archive.org/web/20260411151730/https://www.prnewswire.com/news-releases/chai-ai-announces-upcoming-rollout-of-apple-and-google-age-verification-apis-to-enhance-platform-safety-302708688.html) **Wayback note (20 September 2026):** archive.org's Save Page Now would not accept new captures from this machine today, so no same-day snapshot exists for the five sources marked above. Each was instead fetched and read in full at primary source on 20 September 2026\. The eSafety FAQ still carries its 6 August 2026 "last updated" stamp. The captures are queued and will be taken when Save Page Now recovers. --- *The AI Directory Australia is independent. We review and score AI tools for Australian users — AUD pricing, AU availability, data residency, GST. We don't write ads; affiliate links are disclosed and sponsored content is labelled. Edited by Adam.*