Podcast: The under-16 check every adult has to pass
In this episode, Eric talks with Jillaine Heather, Chief Executive of the Free Speech Union, about the Government's plans for an under-16 social media ban and the universal age verification that may come with it. They examine why the Department of Internal Affairs appears to be building delivery machinery ahead of any legislation, what Australia and the UK reveal about compliance and scope creep, and why policy aimed at online harms could create serious risks for privacy and free speech.
To listen to our latest podcasts, please subscribe to The New Zealand Initiative podcast on iTunes, Spotify or The Podcast App.
Transcript
This transcript was automatically generated and may contain errors. For the most accurate version of the conversation, please listen to the audio.
Eric: Hello and welcome to The New Zealand Initiative podcast. I'm Dr Eric Crampton, chief economist with the Initiative. Today we've got Jillaine Heather from the Free Speech Union on to talk about social media age limits, legislation around it, the state of play in New Zealand and abroad, and where we might think things are going and where they should be going.
Welcome, Jillane.
Jillaine: Thank you, Eric. Nice to be here.
Eric: So just as a bit of a recap the Initiative podcast before has talked about the social media age limit bill that had come up as a member's bill and what's been going on in Australia. What's the current state of play with all of that?
Jillaine: Thank you for asking.
So we did have Catherine Wedd's private member's bill for the under-16 social media ban or regulation. Now, that got paused in mid-May, I believe, this year. We'd already heard that the government, both Luxon and Erica Stanford, were fans of this and really wanted to get behind it. They weren't shy at all about telling people and also saying that they wanted to convert it to a government bill.
While that was happening, it then went out to the Educational Workforce Committee. There was a select committee doing an investigation into the online harms on the back of that private member's bill, and they reported back, and I suppose at the moment we're just waiting for the government response to it.
However, the private member's bill has been paused at the moment and Erica Stanford announced that it had been paused in mid-May but said that the government was gonna come out with its own proposal, its own legislation or its own bill very soon. We were expecting that in May and now we're expecting it in June.
And I suppose we're waiting on that to come out. So even though the private member's bill has been paused we're still waiting on a much larger proposal that we don't know any details about but we're certain involves social media under-16 regulation and according to Erica Stanford on Q&A will also involve universal age verification.
Eric: Ooh, universal age verification. Fun. So during that select committee process, I remember having put in a submission where I was arguing about what I've viewed as a trilemma in online age verification, that it's impossible to get all three desirable characteristics of one of these systems.
One, that it's hard for kids to work around. Two, that it isn't a giant cumbersome pain for adults. And three, that it doesn't have severe problems for online privacy and the potential for online pseudonymity.
I had also encouraged that the government take up a couple of alternative approaches looking at getting better information to families about the tools that are already available through Google's Family Link, Microsoft's version, as well as what's going on in Apple.
And I'd seen some problems in how school accounts wind up providing circumvention tools for kids. So if the family has set up online controls, the kid can always just log into the school account and get around time limits. So it looked like there were some options there.
From what you're saying, it sounds like the government isn't really going ahead with any of that kind of thing, but is instead looking at universal online age verification.
Jillaine: Well, it was, that was the only detail that was dropped out of that Q&A session, and it was very alarming. When the select committee reported back on the online harms I thought they'd done a really poor job at defining what harm was, and then they seemed to say, "Yes, harms exist. Why don't we have a super regulator, online regulator?"
And then they went sort of several steps further and even suggesting that VPNs might be banned. So it didn't seem like a serious piece of work considering online harms for children. It seemed like, and I think one of ACT MPs characterized it like this, a predetermined outcome that they filled in the gaps and actually went further than in their recommendations.
So, who knows what's coming out of it apart from the fact that it appears, well, that DIA are building something, and we'll get to that and that, as Erica said, universal age verification will be a part of this.
Eric: Yeah.
Jillaine: It's frightening.
Eric: Yeah. I don't see any way of doing universal age verification without some pretty big problems.
It seems the kind of area where New Zealand is unlikely to be the first one to come up with something that is actually workable without terrible trade-offs. If someone else comes up with a version that works, we could watch to see how it works and adopt it if it does, if it's worth the cost.
I’m a little bit nervous about New Zealand trying to push ahead on this one 'cause I can see what's happened in the UK with Ofcom, and the UK's generalized “let's try and restrict online access to anything that could potentially be sensitive”. So, you wind up with people in the UK having to prove ID if they want to read Wikipedia articles on reproductive health.
There's a wide range of topics that wind up being deemed to be sensitive, and then you have to show your ID if you want to look at them
Jillaine: This, and everything we are sort of seeing overseas, and I know we'll sort of dig into that in a bit more detail, it feels like, under the guise of ‘protect the children, save the children from everything’, the scope creep into just general online regulation and particularly worrying is the sort of gatekeeping or access to communication channels.
So it's actually, as you say, there's a lot of lawful legal content out there, and it appears that they want to put either infrastructures or systems in place where you have to verify before you can get access to communication, and that's got, that's actually got nothing to do with illegal content or potential harms for under 16s.
Eric: Now, what would you see as the risks if the government were able to maintain records on every website that you've ever checked linked to your real-world ID because they've checked your real-world ID?
Jillaine: I'm like, it's where do you start?
The honeypot of information. How often do we see data breaches? Almost every other day. 70 million here, two million there, right across the world. So I'd be really worried. What a great idea to store all of that crucial information about people, and particularly even young people, in one spot so that the hackers only have to choose one thing.
And then let alone can you imagine what the temptation that any government does - what would have happened during COVID if we could log what everyone was seeing, what they were looking at, who they were talking to, and the messages that they were expanding? The COVID report that came out that we did get, the second one, identified that the government's ministry of truth and tight control of communication was actually a source of distrust and a breakdown in social cohesion, achieving the exact opposite.
Building an infrastructure where they're tempted to help by top-down social cohesion is not a place where we want New Zealand or any country to go. Yeah.
Eric: The risks to free speech seem really obvious in any regime like this. So what do we know of what they're progressing?
So is DIA just kind of sitting around waiting for government to tell them what to be doing, or what's going on in the space?
Jillaine: It does seem to be a slightly backwards process that we have here. In April, DIA advertised for a director of program implementation for the government's new under-16 social media ban, and it was to roll out implementation.
It had a salary band. It had four to six direct reports, and it had a rollout date of July 2027. This is not a scoping job description that they put out there. This is not policy work that they're doing. We of course, we called it out after it was alerted to us. They pulled the job description very quickly and said it was put out in error, and then they resubmitted one within a day and a half with establishment language scoping, policy sort of direction.
Honestly, the dog ate my homework. I don't think anyone bought that at the time. We OIA'd them, and the results that we've got are, exactly as damning as you would imagine. We couldn't see any of the policy advice given to cabinet, but what we could see was that they had no legal analysis at all or advice about whether what they were trying to do was lawful whether it complied with BORA at all.
So no legal advice on the policy work. And the emails that we did have access to actually prove to me beyond a doubt that back in March, the GM of Digital Safety and Identity sort of sent emails to HR saying, "We have three approved implementation roles for the government's under 16 social media program."
HR replied, "Great news. We've got this will be under regulation delivery. These implementation roles will go live." Like, the HR emails, they classified these roles as regulation delivery in March. We haven't seen a proposal. There's no legislation out there but apparently now there's money.
Eric: Yeah, I found that at budget and subsequent to the budget.
So, I was at budget lockup, and thumbing through the list of new initiatives as you do, there was $30-$31 million sitting in there over four years for policy and legislative work in developing a potential legislative and regulatory responses to reduce online harm to children.
That seemed like an awful lot of money for just policy work, or at least I was imagining if somebody gave my shop a grant to spend, okay, spend $6 million in 2026, 2027, and then rising to eight and a half million for each of the last two years.
How would I spend that money just doing the kind of stuff that our shop does in developing legislative and regulatory options, policy options? It'd be like Brewster's Millions. I don't know if you remember the old movie Bre- Brewster's Millions.
Jillaine: I do.
Eric: The guy has to spend a million dollars and have nothing left at the end of it so that he'd get this big inheritance, and it's just terrible trying to do it.
I don't know how you spend that much money just on the legislative and policy design work. And then earlier this week when I was writing up my column for Newsroom on how crazy this sounded, I was digging through Vote Internal Affairs, where they give a little bit more detail, and they'd categorized the spend not under their policy development ministerial services kind of designation, but as regulatory services, which is a delivery.
It's an operational categorization, the same kind of categorisation that you'd found. So we have no clue what they're going to be doing, but their best guess is that whatever they're standing up is gonna cost eight and a half million dollars a year to run once it's stood up and running.
Jillaine: It's such a backwards way, I would've thought, to do anything by, especially in an area where we are watching all of these experiments happening overseas and failing spectacularly in many different ways and having lots of unintended consequences. They're a democratic parliament, but we haven't seen anything.
We haven't been able to comment on it, and we don't know what they're building, but they are clearly building something and their direction of travel seems scary and not set in stone, but it's not preliminary.
Eric: Yeah, so just in terms of things failing I'm sure that you would've caught, and I'm not sure that if our listeners would have, there was a fun paper from out of Australia looking at the effects of their social media ban.
One of the authors on it was Cass Sunstein. I can't remember the names of all of the other ones. So they did a big survey of Australian teens looking at compliance, and just about nobody is complying with the legislation among youths. They've all found workarounds. Sometimes their parents help them work around, like I would've helped my kid work around it if it were in place.
Others are getting friends to help them work around it. And critically important for compliance on this kind of thing, surveyed teens said that their classmates who comply with the legislation tend to be, like, the least popular kids, and the most popular ones are the ones who ignore it.
So if kids see this as kind of a loser thing to do, complying with the legislation is what losers do, well, you're not gonna get much compliance, right?
None of this is working well there. Everybody sees it as, "Well, this is just a stupid rule, and we're gonna ignore it." Following their framework doesn't seem like a great idea. Some of the approaches in the UK are very worrying, and I worry also that, like New Zealand is a small place.
Europe is already seeing cases where deployment of new tech is just a lot slower there than elsewhere because they've hamstrung tech companies who are seeing just risks in deployment there. So they say, "Okay. Well, fine, you can't have the new stuff now." We're much smaller than the UK. Things that we might come up with, if they have high compliance cost, will either be a reason for them to pull from the New Zealand market or just to ignore.
I don't know if you've been following Preston Byrne at all in his responses to Ofcom.
Jillaine: Mm-hmm. Yep. I've come across him, plus the, I think it's the UK Free Speech Bill that he's proposed as well.
Eric: Yeah, so just on that one, Ofcom in the UK get really mad at American websites that have no UK presence, no obvious UK revenues, but are not complying with Ofcom's view on what's required to keep kids in the UK from viewing things online that Ofcom wouldn't like them seeing.
Under the First Amendment in the US and just standard jurisdictional stuff there is no reason for these platforms to comply with whatever the UK wants, right? The internet is open. It's fun watching him in cases where there is no UK presence, so he can take a fairly aggressive approach in replying.
So 4chan is one of his clients there. They're famously one of the more free-for-all kinds of online discussion forums and one where… you would probably prefer that your kids stayed on Instagram rather than going and hanging out on 4chan.
So in response to Ofcom demand letters, he sends them pictures of giant hamsters and warns them that he will send a picture of a giant marmot instead next time if they continue to pursue his clients.
It's just great fun. But the, there is no reason for them to comply. There is nothing that Ofcom can do that will hurt 4chan. 4chan can just tell them to piss off. I don't know why we think it'd be different.
Jillaine: No, exactly. And a couple of points there. One, I think New Zealand does understand that they're so small that they can't come up with anything sort of completely independently of it.
So I get that they want to, hitch their wagon to one of the other bigger players, otherwise they'll have no market sort of ability. But again, it's about hitching it to a failed experiment that's happening in Australia or the UK.
It's so interesting. The Ofcom one was the Online Safety Act. It came in 2023, and this one piece of legislation gave what was a broadcast regulator access to over 100,000 platforms and somehow convinced itself that it had the ability for extrajudicial, sort of rulings on people based in the States with nothing to do with the UK.
And, the US response is interesting in terms of pushing back on Europe with some of the either saying that the tech companies will either suffer in the US if they comply with some of the European regulations.
Were tariffs threatened recently perhaps in this game of the US response to free speech? It seems like its own arms race that's going nowhere.
Eric: It's a pretty big mess. There are a few things that are going on in the US at state level though that are I find a little bit concerning.
In California, there have been pushes to try and get what I would view as a form of device binding, that when you install an operating system, you would effectively have to do bank Know-Your-Customer type verification to prove who you are when you install Windows or Linux or your Apple OS.
To prove who you are in there, and then that could be the basis for later gates, right? So you could imagine systems where your computer knows exactly who you are, your phone knows exactly who you are, and then it would anonymously verify to sites like Twitter or whoever else that while the user is over 18, the user is under 18.
But you could also imagine that turning into pretty awful things, 'cause your operating system provider could be subpoenaed for your information if the government thought that you were the one who was behind some anonymous online account that were saying rude things about the prime minister or the president.
Jillaine: And like it goes to the heart of being able to criticize your state governments, your legislature, the, whoever's in power, right?
To have the ability to say the criticism, criticize in power, error-correct by continually pushing back on, whatever are the popular policies of the day. Again, we only have to look at COVID to think about what if they had these sort of device-level controls in there.
And I believe actually the platform companies are trying to push it. They're just trying to push the responsibility anywhere else. The States is interesting because they've also got some internal state level laws that they're putting in perhaps to, to regulate under 16.
Yet at the national level, they're really pushing back on regulation of tech - the First Amendment. So, so it's a fascinating area to look at. And then the UK, or the EU seems to be focused on rolling out a mandatory digital wallet by the end of this year.
There has to be a mandatory digital ID wallet. You don't have to use it for anything. But then if nation states put in an under-16 ban, and there are a number of countries that are doing it, then they will likely default to the age verification digital wallet to use it. I believe when it rolled out in April, I think it took one person two minutes to hack into it.
It's crazy to think we can keep this sort of information safe.
Eric: Yeah. I don't think any of that's gonna work out well, and I can see all kinds of paths for it to be doing a fair bit of harm. There are bits that government could do to make things suck a little bit less though, right?
So I had suggested getting better information to parents on how Family Link works. I know that in our family, I would put time limits on the kids' devices of, like, the total amount of time that they could spend on them. App-level control. I’d blocked them from using LinkedIn 'cause I don't think kids should be on LinkedIn. It's not a very nice place. You get all these people preening about how nice they are. Eh, they don't need to see that.
Okay, that was just silly. But like, daughter uses Instagram for circus arts, and she keeps in touch with people around the country who do circus arts, and they share the routines that they've come up with doing stuff on silks and whatnot.
So yeah, she gets some time on Instagram. But time-limited, right? I can do all of those things pretty easily. There are equivalents on Apple, and you can also set controls in Microsoft: here's your time limit, and here's your bedtime. You can set bedtimes in all of these. It isn't hard
Jillaine: Yep. Look, I think there's a lot to do. So when the government, when even the child commissioners or the agencies come out and say, "There's harm out there. The government needs to do something," there are so many things that we can already do. Yeah.
A lot of the things that people don't like are already illegal: sending intimate material to an under-16, grooming, sexual conduct, all of that. It's already illegal in the Crimes Act.
We could resource those departments that look at it and fund them properly. We could put real obligations with teeth on the platforms to report CSAM, in a much faster way and to sort of help with the child abuse the child sexual abuse material that's on there.
We could also there are lots of, you've talked about the parental information and devices that are out there or, or applications.
There are digital and media literacy information and programs that have a long history. In Finland and in Taiwan, two states that are very much bombarded with disinformation by their neighbors and misinformation, they run literacy programs media literacy and digital literacy programs from the age of seven in Finland, and they have some of the highest - they've got a track record of the people being able to spot manipulation techniques, what is fake, what is not.
They learn how to evaluate the news out there. UNESCO, in all of their surveys, consistently say high distrust in government initiatives, government top-down initiatives, high community distrust, that the initiatives that work are the community and civil initiatives that, that empower the people with skills.
Taiwan does a lot of community fact-checking. They've got sort of humour apps out there and memes and, a lot of ways, because they also get bombarded by disinformation. So if we were really wanting to go after the harm, I think we could define it, and we could target it. We could measure what we're doing, adjust it, and instead of this blunt ban that all we can see doesn't work, creates scope creep, and potentially just builds surveillance infrastructure on access to communication, which is not healthy.
Eric: Yeah. So bit of that in the schools. Better information to parents through the schools on how to actually use Family Link if they haven't figured that out - and some of them might not have. I would also love to see better resource going to the schools explaining to them how to not undermine families' controls that they've already put on, right?
So if a kid has hit their time limits on their Google account on their phone or on their Microsoft account that the parents have set up, well, the kid just logs into the school's account, and there aren't time limits there, and there might not be the app control limits, right?
It's a bit frustrating when the state gets really mad saying it must do something about these horrible tech platforms that are making it too easy for kids to get stuff, and at the same time it's the state that's providing the mechanism for undermining parents' own attempts to set these controls, right?
Jillaine: Which makes you just think it's a slogan without anyone really understanding what are the implications of what they're doing and how are they rolling it out. And I don't disagree that the platforms could do a lot better in their transparency of the algorithms and, sort of how they respond to stuff.
And I think we can still do that without appointing an e-safety czar to control everything that we're looking at in all types of communication. Because as we've seen with Australia, that doesn't help the under 16s. It doesn't address the problems, and doesn't give them the tools to cope once they turn 17 if they were one of the kids, which is very unlikely, that abided by the social media ban.
Eric: Potentially, but I would be a little nervous about putting in any any regs on that didn't just mirror what's already being done in a larger country.
'Cause New Zealand is very small, and if it's costly for one of these platforms to comply with a small market's idiosyncratic preferences, it's not gonna turn out well for anybody.
Jillaine: No, I agree. It'll be working likely with the platforms and developing more of these controls, and working, as you say, with the larger players. Otherwise, New Zealand's whistling in the wind.
If Signal will pull their accounts from the UK, Signal won't hesitate at pulling its application from New Zealand if we overstepped in a certain way.
Eric: So I guess we all should be keeping an eye on what the heck is imminently going to be released from Minister Stanford.
I've got a few bottom lines of things that I really wouldn't wanna see in there. Those would include device binding or requirements to show ID and basically know your customer verification in installing an operating system.
I wouldn't want to see Ofcom-style ‘you must show ID to access anything that's considered sensitive’, and I really wouldn't wanna see the versions of online age limits that have been done in Australia. Are there other things that we should be watching for?
Jillaine: For me, I mean, you've covered a number of them, but for us very much it's no super-regulator, and especially no government super-regulator who holds all this information, who controls it, who decides what's legal and what's not.
For us is our biggest red flag, which is why we're so concerned about DIA. We can address this in a lot more efficient manner by actually identifying the harms and going after that. When the government's looking at wanting to economize or rather, streamline the government ministries and everything that it's doing, let's not build a whole another department and resource it.
Eric: Well they're getting rid of the Broadcast Standards Authority 'cause they saw it as overstepping and trying to regulate the internet, and well, maybe DIA's gonna be the new internet regulator, right?
Jillaine: I think DIA, it looks like DIA is shaping up for that role, and I think that's the absolute worst place it could be.
And talk about the scope creep and the surveillance infrastructure, built into a government mainframe. Anything that is done, if you do it for under-16s, it shouldn't affect adults' ability to access communication, and it can't take away from parental rights as well, which you've touched on a number of times.
Government shouldn't step in instead of the parents. It should be aiding information and resources and applications that can help parents make the choices.
Eric: That's another good bottom line, that whatever the heck they're doing, parents should be able to opt out of it and to authorize things for their kids that they think make sense.
Jillaine: Completely. The government, if anything, should be there to help facilitate getting the information out there, and especially in the education space on digital and media literacy for everyone. Not doing the job itself and in a manner that we can't see.
Eric: Great stuff. I understand that you're gonna be doing an ongoing podcast series over at the Free Speech Union touching on a lot of these issues.
When is that gonna be coming out so we can be paying attention and watching out for it?
Jillaine: The first one should be coming out in the next couple of weeks, probably two to three weeks from now. And we really just wanted to run right across the whole arc, delving into privacy, delving into what digital ID and the government, actually looks like, how it is good for convenience, but how we don't want it to morph over into surveillance, and just sort of touching on things that are out there that parents can do.
What are the platforms doing? It just unpacking this and trying to have a more of a nuanced, informed discussion, especially 'cause we don't know what the government's doing, so we're trying to get information out there.
Eric: Sounds great, Jillaine. I'll be watching out for it, and I hope that our listeners will be as well.
Jillaine: Great, Eric. Look, thank you for having me on today. It's watch this space. We're gonna hear something from the government in June. I hope I'll be pleasantly surprised, but I'm not betting on it.
Eric: Yeah. I wish that we were legally allowed to bet on it, but DIA considers that gambling.
So, yeah, I got some issues with DIA. Thank you, Jillaine. It's been wonderful, and I'm sure we'll chat again.
Jillaine: Perfect. Thanks, Eric.