Australia’s Under-16 Social Media Ban Is the Wedge for Universal Biometric IDs

What the government calls child protection is being used to force biometric identity verification across platforms, normalise Digital ID, and give surveillance capital its next growth market.

A Trojan Horse is a deceptive tactic, originating from Greek mythology, where soldiers hid in a giant wooden horse to infiltrate the city of Troy. In today’s definition, it’s any person or thing intended to undermine an enemy or organisation from the inside by appearing harmless or beneficial. It’s a metaphor for any trick or stratagem that causes a target to invite a foe into a securely protected place, much like the original ruse let enemies inside the seemingly impregnable city.

I write this as someone who believes governments claim legitimacy through the consent of the governed, and that those in power present themselves as public servants meant to act in the interests of the people, not to sell them to private data brokers. That claim of duty has been repeatedly violated.

Across multiple countries, citizens have openly resisted the introduction of Digital ID systems. In the United Kingdom, a mass public petition demanding dilution and reconsideration of Digital ID proposals drew extraordinary public support and forced parliamentary debate, yet the policy trajectory continued regardless. The pattern is clear. When citizens object to identity binding and biometric normalisation, governments acknowledge the noise, then proceed anyway.

I also write this with anger because what is unfolding in Australia is not a narrow child-protection experiment. The so-called under-16 ban is being operationalised across entire platforms, forcing age verification on everyone who seeks access, regardless of age. Adults are not exempt. They are compelled to submit identity documents and biometric data through third-party brokers as the price of participation. This is a structural shift toward binding online access itself to biometric identity, sold under the soft language of safety while the underlying mechanics lock in permanent, system-wide change.

My earlier piece, Lab Rats: Australia Once Again Becomes the Global Testbed, serves as the proving ground for sweeping social and regulatory controls.

As with the CV-19 policy experiments, Australia is again being used as a lab rat for a global rollout, with consequences now unfolding in real time.

The Law and the Screen

Australia’s Online Safety Act regime, and the new minimum-age rule already in place at the time of writing (effective December 10, 2025), demands platforms take “reasonable steps” to prevent under-16s from maintaining accounts. That sounds specific. The implementation is not. The tools platforms are deploying include birthdate prompts, age-prediction models, and document and biometric checks routed through third-party identity vendors. The result is a pervasive prompt that millions now see: verify your age by submitting government ID and a face scan, processed by an identity broker (Persona, see below). eSafety frames this as child protection. Platforms frame it as compliance. The screen says it all.

The screen says it all: Facebook wraps biometric identity verification in soft illustrations and calming blue tones to reduce resistance and signal safety. This is not neutral design. It is behavioural conditioning, using visual reassurance to normalise the surrender of identity and make a coercive process feel harmless, routine, and acceptable.

That prompt is a wedge designed to normalise something far larger. It tells users they must hand over passport or driver’s licence images, take a selfie, and consent to processing by a vendor such as Persona. It then adds a line most users will miss: the purpose is not only age assurance but also to “improve” the vendor’s platform. That means biometric templates, derived data, confidence scores, and model training enter a commercial loop. Subcontractors, logs, and fraud models are not promised deletion on the same terms. “Redacted” is not the same as destroyed.

A Short, Typical User Journey

An adult reader opens Instagram to read a link shared by a friend. A pop-up appears: verify your age to continue. The user uploads a driver’s licence photo. The app asks for a selfie to match the licence photo. A third-party vendor processes the images, flags a match, and grants access. The vendor’s policy records the transaction; derived features and confidence metrics feed fraud models. Months later the user receives an unrelated targeted commercial offer that leverages better identity resolution. The user complied to read one article. Their face is now a portable credential across services. That journey is hypothetical but maps to the real flows platforms describe and the vendors promote. Platforms are not merely making identity checks; they are creating a reusable identity fabric.