Online Safety (Minimum Age and Child Safety Risk Assessment) Bill

Online Safety (Minimum Age and Child Safety Risk Assessment) Bill EXPLANATORY NOTE GENERAL POLICY STATEMENT This Bill creates a new stand-alone Act and delivers the first phase of the Government’s 2-step plan to improve children’s online safety. The Bill’s objective is to help protect children from the risk of online harm. It seeks to achieve this objective by creating an online safety framework that places a minimum age restriction of 16 years on certain platforms with features associated with a risk of harm to children (such as social media platforms and social artificial intelligence companions ( social AI companions )). It also requires operators of platforms to assess how their services impact all children under the age of 18 years through regular reporting on risks and to demonstrate how they are mitigating those risks. This Bill is focussed on creating positive systemic changes for children’s online safety, not enforcing individuals’ compliance with the legislation. The onus is on platforms for complying with the legislation. Shifting social norms and attitudes regarding children’s use of social media and other platforms will help improve children’s online experiences, generate awareness of the risks children face online, and support parents and caregivers in making evidence-based choices about their children’s online safety. Children are encountering harmful content and experiences online and New Zealanders are increasingly worried about what children are seeing and experiencing online, particularly in relation to impacts on their mental health. Online engagement offers positive opportunities for children; however, our regulatory settings have not kept pace with the risks they face online. New Zealand’s current regulatory framework does not adequately safeguard children online, and it overlooks the heightened developmental vulnerability of children aged under 16. While some protections exist, there is no overarching framework that regulates social media platforms or platforms with social AI companions to help protect children from the risk of online harm. In March 2026, the Education and Workforce Committee delivered its final report on an inquiry into the online harms experienced by young New Zealanders and the roles that government, industry, and communities should play in addressing them. The Committee’s report considered that harm to young New Zealanders from online platforms is severe and requires urgent responses. The report made 12 recommendations for the Government to improve online safety, including restricting social media access for children aged under 16 years. The Bill includes a definition of age-restricted platforms. The platforms within scope are defined as those that provide or facilitate the exchange of content between users and have features that are associated with an increased risk of harm to children. This includes— features that personalise and optimise user engagement with the service based on information obtained about the user ( recommender system ). This could include for you , explore , and discover feeds; and features that display content to a user with no endpoint that enable seamless and continuous consumption of content ( endless feed ); and features that enable a user to see interactions and engagement from other users on content they have posted ( feedback features ). This could include likes , upvotes , view counts, and reaction icons; and features that enable a user to view content only within a limited time after it has been posted ( time-limited features ). This could include viewing a friend’s story before it disappears or reading another user’s message in a chat before it expires; and any other features specified in regulations. Social AI companions are also within scope and are defined as artificial intelligence systems solely or primarily designed to simulate an emotional connection or personal relationship with the user. Evidence indicates that these platforms are becoming increasingly prevalent and pose a significant risk of harm to children that outweighs any potential benefits. Specified types of platforms have been directly excluded from needing to put minimum age restrictions in place or produce child safety risk assessments. Those types of platforms have been excluded as they are currently considered to predominantly provide beneficial experiences to children or are required to deliver necessary services. Excluded services have been defined as platforms that solely or primarily enables a user to do one of the following: communicate by means of messages, emails, voice calls, or video calls (such as Facebook Messenger, WhatsApp, and Discord): play online games with others (such as Roblox and Minecraft): listen to music or podcasts on demand (such as Spotify): share information about products or services (such as reviews, technical support, or advice websites): engage in professional networking or development (such as LinkedIn): support education (such as websites used for learning and school message boards): support health (such as telehealth and medical websites). This list of exempted types of platforms could be expanded through regulations. Platforms that use artificial intelligence are only intended to be in scope on that basis where the technology is solely or primarily designed to simulate an emotional connection or personal relationship with users, and not where artificial intelligence is solely or primarily used for other purposes such as internal business services, customer service, or research support. Regulations could also be made that stipulate a platform as being within scope of the legislation. An individual platform may be exempted from the Bill’s requirements through regulations if the Minister is satisfied that the benefits to children from an exemption outweigh the risk of harm. The Bill’s definition of a platform is broad to ensure it captures the wide range of different online services that present a risk of harm to children. A broad definition is necessary to be robust and enduring as the technology and platforms used by New Zealanders change over time. The Bill’s regulation-making powers enable reasonable limits to be placed on the definition to prevent unintentionally capturing platforms that predominantly provide positive experiences or are required to deliver necessary services. The Bill places a duty on operators of platforms within scope to take reasonable steps to prevent children aged under 16 years from holding an account on their services. Platform operators will be responsible for ensuring that a child aged under 16 years cannot hold an account. Children and their caregivers will not be subject to any penalties. As the Bill regulates the act of having an account, children will still be able to access publicly available content but will be less likely to be exposed to features that can increase the risk of exposure to online harm. The Bill does not state how platforms must comply with the minimum age restriction. Operators of platforms will be expected to determine whether a user is over or under the age of 16 years through various methods and technologies ( age assurance ). A platform will not be able to rely solely on age verification through formal identification or other digital identity services and will be required to offer alternative methods. This could include age estimation (determining age based on biological or behavioural characteristics such as facial scanning) or age inference (determining age based on information other than a user’s self‑declared date of birth, such as information already held by the platform, user activity patterns, device or account attributes, or interactions on the service), or both. As with other age-based regulatory regimes aimed at minimising exposure to known harms, such as restrictions on the sale of alcohol, New Zealand should anticipate that a proportion of individuals may circumvent the rules. The Bill assists in setting new social norms and reducing children’s exposure to online harm. The Bill includes strong protections for personal information used for age assurance, going beyond the Privacy Act 2020. Under these protections, platforms must not use or disclose personal information collected for age assurance for any other purpose and must destroy the information as soon as age assurance has been completed. The Bill places a duty on operators of age-restricted platforms to produce, at least annually, an up-to-date assessment of the risks of harm to all children under the age of 18 years on their platform (with or without accounts) and how they are mitigating those risks. A senior manager will be responsible for the accuracy of the information in the child safety risk assessment. A platform also needs to produce a child safety risk assessment before making a significant change to their services or if required by the regulator. The risks required to be considered in a child safety risk assessment are— content and behaviour that is illegal in New Zealand; and content and behaviour that is harmful or potentially harmful to children; and interactions between users that indicate an act by any person that is, or is potentially, illegal or harmful to children; and platform features that are harmful or potentially harmful to children, such as the platform’s business model, advertising, behavioural profiling, use of algorithms, governance, use of technology, and measures to promote the safe use of the service; and any other matter the regulator considers relevant. Content and behaviours that are harmful or potentially harmful to children include the following: bullying or harassment: suicide or self-harm: violence: grooming: extortion including sexual extortion: sexually explicit content: false or misleading information: any other activity that may constitute the commission of an offence in New Zealand. A child safety risk assessment must also include the number of New Zealand children that use the platform, grouped by age, and the methodology used by the platform to produce the assessment. The Secretary of Internal Affairs is the regulator of the Bill. The regulator’s functions under the legislation are as follows: monitoring and enforcing platforms’ compliance with requirements in the Act: publishing guidance on minimum age restrictions and child safety risk assessments: promoting education about, and awareness of, the Act and its requirements: publishing information about the regulator’s activities including monitoring, enforcement, and other compliance-related activities: co-operating and sharing information with domestic and international law enforcement and regulatory agencies to promote children’s online safety: advising the responsible Minister in relation to the making of regulations: performing any other function and exercising any other power conferred or imposed on the regulator by law. To effectively perform their functions, the regulator has access to information-gathering and information-sharing powers. Children and their caregivers are not subject to any offences and penalties under the Bill. The Bill places civil liability solely on operators of age-restricted platforms. The regulator will have access to a wide range of tools to uphold compliance with the Bill, enabling the regulator to respond to the risk of harm presented by the platform. Those tools include warnings, corrective notices, enforceable undertakings, and injunctions. The regulator may apply for a civil pecuniary penalty in instances of serious non-compliance. Individuals could be liable for a fixed amount for a fine, but companies could be liable for a fine based on a percentage of their global turnover. The maximum amounts for civil pecuniary penalties are separated into tiers, based on the severity of the platform’s non-compliance. This table is small in size and contains 3 columns. Column 1 contains Tier 1, 2, and 3. Column 2 is headed Individual. Column 3 is headed Any other case. Individual Any other case Tier 1 (most serious) $500,000 The greater of either $40 million or 10% of the relevant global turnover for each year in which the penalised act occurs Tier 2 (serious) $250,000 The greater of either $12 million or 3% of the relevant global turnover for each year in which the penalised act occurs Tier 3 (least serious) $100,000 The greater of either $4 million or 1% of the relevant global turnover for each year in which the penalised act occurs Large civil pecuniary penalties are necessary due to the risk of exposure to harm that can occur as a result of a platform not complying with the Bill. Due to the size and revenue of some platforms, basing those penalties on a percentage of the operator’s global turnover is also necessary if they are to be sufficiently dissuasive and punitive. If other compliance measures are inadequate to change a platform’s behaviour, the regulator can apply to the court for service restriction orders and access restriction orders as a last resort ( business disruption tools ). The regulator would need to show that the platform was not complying with the legislation and that other enforcement tools were failing to change behaviour. A service restriction order would prevent businesses that help monetise a platform from engaging with that platform. The regulator can also apply for an access restriction order if a service restriction order has not been, or is unlikely to be, effective at changing a platform’s behaviour. This would require internet service providers, app stores, and the platform itself to prevent all New Zealand users from accessing the platform. There are narrow instances where a person can be held criminally liable for non-compliance with the Bill. Those are when a person— fails to provide information when requested by the regulator, or knowingly provides false or misleading information to the regulator or in a child safety risk assessment: discloses, without authorisation, information acquired in the course of exercising information powers as, or for, the regulator: breaches conditions attached to information disclosed by the regulator to a law enforcement or regulatory agency, or to an overseas body. The Bill’s requirements on platforms will commence 6 months after Royal assent. The intention is to give effect to the minimum age and child safety risk assessment obligations as soon as practicable, balancing the need to act quickly to minimise the risks of harm to young New Zealanders, with realistic time frames for regulatory compliance. The types of platforms intended to be captured are already obliged to meet a range of online safety measures in other jurisdictions such as Australia, the United Kingdom, and the European Union. Those obligations can support their compliance with the obligations imposed by New Zealand. The social media landscape, and digital technology more broadly, is fast-moving and constantly evolving. To address this and reflect that the Bill is intended to deliver the first phase in the Government’s plan to improve children’s online safety, the Bill must be reviewed within 2 years after its commencement. REGULATORY ANALYSIS SUMMARY The Department of Internal Affairs prepared a regulatory analysis summary on 11 March 2026 to help inform the main policy decisions taken by the Government relating to the contents of this Bill. Copies of the regulatory analysis summary can be found at— https://www.dia.govt.nz/diawebsite.nsf/wpg_URL/Resource-material-Regulatory-Impact-Statements-Index?OpenDocument https://www.regulation.govt.nz/publications-and-resources/regulatory-analysis-summaries/ CONSISTENCY WITH PRINCIPLES OF RESPONSIBLE REGULATION The Department of Internal Affairs provided the following documents relating to its review of this Bill, and its process for developing it, for consistency with the principles of responsible regulation under the Regulatory Standards Act 2025: a consistency accountability statement on 6 July 2026: a summary of underpinning analysis on 6 July 2026. Copies of these documents can be found at— https://www.dia.govt.nz/diawebsite.nsf/wpg_URL/Resource-material-Regulatory-Impact-Statements-Consistency-Accountability-Statements-and-related-documents?OpenDocument The Department of Internal Affairs considers that a statement from the responsible Minister under section 11(b) of the Regulatory Standards Act 2025 is not required for this Bill. CLAUSE BY CLAUSE ANALYSIS Clause 1 is the Title clause. Clause 2 is the commencement clause. It provides that the Bill comes into force 6 months after Royal assent. PRELIMINARY PROVISIONS PURPOSE Clause 3 sets out the purpose of the Bill, which is to reduce the risk of harm to children when online by imposing duties on operators of certain internet services. INTERPRETATION Clause 4 defines terms used in the Bill. Some of the key definitions are set out in separate clauses ( see below). Clause 5 defines an age-restricted platform and clause 6 defines an operator. Those terms are key to the Bill because the duties set out in Part 2 apply to an operator of an age-restricted platform. An age-restricted platform under this Bill is any of the following: an internet service that— is accessible by a person who is in New Zealand; and enables the exchange of digital content between 2 or more users; and has 1 or more specified features (as defined in clause 5(2) ); and is not an excluded service (as defined in clause 5(2) ): an internet service that— is accessible by a person who is in New Zealand; and displays (or otherwise makes available) digital content; and uses artificial intelligence solely or primarily to simulate a social connection, an emotional connection, or any other form of personal connection with a user: an internet service that is specified as an age-restricted platform in regulations made under clause 62 . An operator under this Bill is a person who, directly or indirectly by any means, manages or controls an age-restricted platform’s operations in New Zealand (whether by itself or together with other persons). However, under clause 7 , the regulator has the power to designate a person as the operator of an age-restricted platform for the purposes of the Bill. If the regulator makes a designation under that clause, the designated person is the only operator of the age-restricted platform for the purposes of the Bill while the designation is in place. OTHER PRELIMINARY PROVISIONS Clause 8 provides that the Bill applies to an operator of an age-restricted platform regardless of whether the operator is in or outside New Zealand, but only to the extent that the platform is operated in a manner that enables a person who is in New Zealand to access the platform. Clause 9 gives effect to the transitional, savings, and related provisions set out in the Schedule . Clause 10 provides that the Bill binds the Crown. DUTIES ON OPERATORS OF AGE-RESTRICTED PLATFORMS Part 2 sets out the duties imposed on an operator of an age-restricted platform. The main duties are— the duty to take reasonable steps to prevent a New Zealand person under the age of 16 years from having an account with the platform ( clause 11 ); and the duty to undertake a child safety risk assessment ( clause 14 ). Clause 11(1) requires an operator of an age-restricted platform to take reasonable steps to prevent a New Zealand person under the age of 16 years from having an account with the platform. Clause 11(2) provides that requiring manual entry of age or date of birth is not a reasonable step for the purposes of clause 11(1) . Clause 11(3) provides that the duty in clause 11(1) cannot be satisfied by an operator— requiring provision of an approved evidence of age document (as defined in clause 11(5) ) and taking no further steps: using a digital identity service (as defined in clause 11(5) ) and taking no further steps: requiring provision of an approved evidence of age document and using a digital identity service (as those terms are defined in clause 11(5) ) but taking no further steps. Clause 11(4) provides that an operator must not, for the purpose of complying with the duty in clause 11(1) , collect personal information that is of a class specified in regulations as a class in respect of which personal information must not be collected for the purpose of complying with that duty. Clause 2 of Schedule 1 provides that clause 11 applies in respect of accounts that were created before, on, or after the date on which this Bill comes into force (the commencement date ), meaning an operator of an age-restricted platform will need to comply with the duty in respect of both existing and new accounts. Clause 12 imposes restrictions on the retention, use, and disclosure of personal information (as defined in section 7(1) of the Privacy Act 2020) collected for the purpose of an operator of an age-restricted platform’s compliance with the duty in clause 11(1) . The clause provides that— the personal information must not be kept for longer than is required for the purpose of complying with the duty and may be used or disclosed only for the purpose of complying with the duty; and information privacy principles 9, 10, and 11 (set out in section 22 of the Privacy Act 2020) do not apply in respect of the personal information. Clause 13 provides that a breach of those restrictions is treated as an interference with privacy under the Privacy Act 2020. It also results in the operator being liable for a pecuniary penalty or other court-imposed remedy ( see clause 34 ). Clause 14(1) requires an operator of an age-restricted platform to undertake a child safety risk assessment. A child safety risk assessment is an assessment of the matters set out in clause 14(2) . Those matters include— the level of risk of children who use the platform encountering certain kinds of digital content; and the level of risk of harm to children who use the platform presented by the design, features, functionality, and operation of the platform; and the level of risk of harm to children who use the platform presented by the advertisements on the platform. An operator’s child safety risk assessment must be in writing and include a description of the identified levels of risk and the reasons for those levels, amongst other things ( see clause 14(3) ). Clause 15 requires an operator to provide a copy of its child safety risk assessment to the regulator— within 12 months after the platform becomes an age-restricted platform; or by any earlier date specified by the regulator in a written notice (but see clause 15(2) , which places restrictions on the regulator’s ability to specify an earlier date). However, those time frames do not apply in respect of a person who is an operator of an age-restricted platform at the start of the commencement date. Instead, that person must provide the regulator with a copy of its child safety risk assessment within 6 months after the commencement date ( see clause 3 of Schedule 1 ). Clause 16 requires an operator to review its child safety risk assessment and specifies by when a review must be completed. Clause 16(2) provides— that the first review must be completed within 12 months after the date on which the child safety risk assessment was completed; and that subsequent reviews must be completed within 12 months after the date on which the last review was completed. However, clause 16(3) gives the regulator the power to require that a review be completed before the date on which it is due to be completed under clause 16(2) if the regulator is satisfied— that it is desirable for the review to be completed earlier because of a potential risk of harm to children who use the operator’s platform; and that it is practicable for the review to be completed earlier. An operator must provide the regulator with a copy of its child safety risk assessment on the completion of each review (whether or not changes are made to the risk assessment). Clause 17 requires an operator of an age-restricted platform, before making a significant change to the platform, to undertake an assessment of the matters set out in clause 14(2) in relation to the impacts of the proposed change (a change-related child safety risk assessment ). Significant change is defined in clause 17(4) . A change-related child safety risk assessment must include a description of the anticipated levels of risk identified by the assessment and the reasons for those anticipated levels (amongst other things) and a copy of it must be provided to the regulator as soon as practicable after being undertaken and before the proposed change is made. Clause 18 requires an operator to designate an individual as responsible for confirming the accuracy the operator's risk assessments. The operator can designate an individual as such if the individual has a significant role in ensuring or overseeing the undertaking of the operator’s risk assessments and the provision of them to the regulator. The individual must be designated by notice to the regulator and the notice must include the individual’s contact details. Clause 19 gives the regulator the power to direct an operator of an age-restricted platform to repeat its child safety risk assessment or a change-related child safety risk assessment if the regulator considers that the operator has not adequately assessed a matter set out in clause 14(2) or specified or described a matter set out in clause 14(3) or 17(2) (depending on the type of risk assessment). The regulator must notify the operator of the matter or matters that the regulator considers have not been adequately assessed, specified, or described and the date by which a copy of the repeated assessment must be provided. REGULATOR, ENFORCEMENT, AND OTHER MATTERS FUNCTIONS AND GENERAL POWERS OF REGULATOR Subpart 1 of Part 3 sets out the functions and general powers of the regulator (defined in clause 4 as the chief executive of the Ministry, being the department that, with the Prime Minister’s authority, is responsible for the administration of the Bill). Clause 20 sets out the functions of the regulator under the Bill, which (without limitation) include functions relating to compliance with, and enforcement of, the Bill. Clause 21 gives the regulator the power, by written notice, to require information from persons if that information is necessary or desirable for the purpose of performing or exercising the regulator’s functions, duties, or powers under the Bill. Clause 22 sets out the conditions for information-sharing between the regulator and specified New Zealand law enforcement and regulatory agencies, as well as overseas agencies that are the equivalent of the regulator. Information-sharing with those agencies may be subject to conditions imposed by the regulator and is limited to assisting those agencies in the performance or exercise of their functions, powers, or duties. Clause 23 prohibits the disclosure of information acquired in the course of exercising information-related powers under clause 21 or 22 , except in limited circumstances. REGULATOR-IMPOSED ENFORCEMENT MEASURES Subpart 2 of Part 3 sets out the various enforcement measures that may be imposed by the regulator in relation to contraventions of the Bill. Clauses 24 to 26 set out what the regulator must do when issuing warnings to operators of age-restricted platforms that have failed to comply with a provision of the Bill. In particular,— the regulator must publicly notify warnings issued under clause 24 ; and the regulator may require the operator issued with the warning to disclose a copy of the warning on the operator’s internet site ( clauses 25 and 26 ). Clauses 27 to 30 deal with enforceable undertakings that the regulator may accept from operators in relation to the enforcement of the Bill. Those provisions— provide for what undertakings can relate to ( clause 27 ): set out the notification requirements that the regulator must abide by when deciding on, and accepting, an undertaking ( clause 28 ): provide for when an undertaking becomes enforceable and that proceedings for specified liability acts relating to an accepted undertaking cannot be brought nor continued against the operator ( clause 29 ): provide for the orders that a court can make against an operator that breaches an undertaking ( clause 30 ). Clauses 31 to 33 provide for corrective notices that the regulator may issue against operators. Corrective notices will require operators to take specified steps to address the adverse effects of a specified liability act ( see clause 34(3) ) or to ensure they do not carry out future specified liability acts. In particular,— the regulator must take specified procedural steps before issuing a corrective notice ( clause 33 ); and non-compliance with a corrective notice is an act that may be penalised with a tier 3 pecuniary penalty ( see clauses 34(3)(i) and 47 ), a restriction order, and an injunction. COURT-IMPOSED REMEDIES Subpart 3 of Part 3 provides for court-imposed remedies in relation to contraventions of this Bill; namely, restriction orders, pecuniary penalties, and injunctions. Those remedies can be imposed against operators of age-restricted platforms that have carried out a specified liability act, which involves acts described in any of clause 34(3)(a) to (i) . Clauses 35 to 43 deal principally with 2 types of orders that the court may impose on operators and their age-restricted platforms: service restriction orders and access restriction orders. The regulator can apply for those orders to be made against an operator that is failing to comply with a requirement of the Bill on an ongoing basis, among other additional criteria. Service restriction orders impose restrictions on ancillary services (as defined in clause 4 ) in relation to the operator’s age-restricted platform, such as advertising servers and payment services. Those orders— would require an ancillary service provider to withdraw a specified service in relation to the platform and the operator to stop accepting that service ( clause 35(1) ): can only be granted by the court, on application by the regulator, if the court is satisfied that certain criteria have been met ( clause 35(2) ). Access restriction orders impose restrictions on New Zealand access to the operator’s age-restricted platform, including restrictions through access services (as defined in clause 4 ), such as app stores and internet service providers. Those orders— would require, in accordance with clause 38(1) ,— access service providers to withdraw their access services in relation to the platform; and the operator to prevent New Zealand users from accessing the platform; and both access service providers and the operator to notify persons who attempt to access the platform of the order and its effect on the platform: can only be granted by the court, on application by the regulator, if the court is satisfied that certain criteria have been met ( clause 38(2) ). Interim orders may also be made with substantively the same effect as service restriction orders and access restriction orders respectively ( clauses 36 and 39 ). An interim order can be imposed for no more than 180 days and has effect until the earlier of the following: the interim order’s expiry date: the date that the interim order is set aside on appeal: upon, and in accordance with, the court’s decision on an application for a corresponding restriction order to replace the interim order. Restriction orders, including interim orders, must specify certain details, including the steps that ancillary service providers, access service providers, and operators (as the case may be) must take, or arrangements that they must put in place, to give effect to an order ( clauses 37 and 40 ). Furthermore, in relation to restriction orders,— the court must consider the rights and obligations of certain specified persons under any legislation or rule of law when determining whether to make any restriction order ( clause 41 ): the regulator may apply to the court to renew a restriction order ( clause 42 ): an operator of an age-restricted platform subject to a restriction order may appeal on a question of law to the Court of Appeal on decisions of the High Court to make such an order ( clause 43 ). The High Court, on application by the regulator, can impose a pecuniary penalty on an operator if satisfied that the operator had carried out a specified liability act ( clause 44 ). Clauses 45 to 47 set out the following 3 tiers of pecuniary penalties, each of which apply to different specified liability acts: Tier 1 penalties, which comprise a maximum amount of $500,000 for an individual or, for any other operator, the greater of $40 million or 10% of the operator’s relevant global turnover for each financial year in which the act occurred ( clause 45 ): Tier 2 penalties, which comprise a maximum amount of $250,000 for an individual or, for any other operator, the greater of $12 million or 3% of the operator’s relevant global turnover for each financial year in which the act occurred ( clause 46 ): Tier 3 penalties, which comprise a maximum amount of $100,000 for an individual or, for any other operator, the greater of $4 million or 1% of the operator’s relevant global turnover for each financial year in which the act occurred ( clause 47 ). Relevant global turnover, for the purposes of determining the maximum amounts for pecuniary penalties, is defined in clause 4 and encapsulates an operator’s total gross revenues (including that of its interconnected bodies corporate) in relation to the age-restricted platform to which the penalty relates. Clause 48 details the kinds of matters that the court would have regard to when determining an appropriate pecuniary penalty against an operator. Clause 49 enables the High Court, on application by the regulator, to grant an injunction restraining a person from engaging, or requiring a person to engage, in activities that amount to a specified liability act. Those injunctions must not impose substantially the same restrictions and obligations as a restriction order. Clauses 50 and 51 provide the criteria that the court must be satisfied of before granting a restraining or performance injunction, or interim equivalents of those orders. Clause 52 provides that the court cannot require the regulator to give an undertaking as to damages when granting an interim injunction or interim restriction order under this subpart. Clauses 53 to 56 deal with miscellaneous matters relating to court-imposed remedies. In particular,— the usual rules of court and procedure in relation to civil proceedings apply in respect of court-imposed remedies ( clause 53 ): the court may grant a restriction order, pecuniary penalty, and injunction in respect of the same conduct, but only 1 pecuniary penalty can be imposed in respect of the same conduct ( clauses 54 and 55 ): a pecuniary penalty and criminal penalty cannot both be imposed in respect of the same conduct ( clause 56 ). OFFENCES Clause 57 provides for an offence if an individual designated under clause 18 confirms the accuracy of a child safety risk assessment or change-related child safety risk assessment knowing it to be false or misleading in a material particular and a copy of that risk assessment is provided to the regulator. Clause 58 provides for an offence if a person fails to comply with an requirement to provide information to the regulator under clause 21 . Clause 59 provides for an offence if a person breaches any condition attached to information that the regulator shares with a law enforcement or regulatory agency, or an overseas regulator, under clause 22(3) . Clause 60 provides for an offence if the regulator, or a person authorised by the regulator to exercise its information-related powers under clause 21 or 22 , discloses information obtained in the course of exercising those powers. The offence does not apply if the person disclosed the information in good faith in the course of that exercise. OTHER MATTERS Clause 61 provides for the making of an Order in Council exempting an operator of an age-restricted platform from any or all requirements under the Bill. An exemption may be subject to conditions. Before recommending that an Order in Council be made, the Minister must— consider the digital content, features, and users of the platform and any other factors that the Minister thinks relevant; and seek advice from, and consider any advice provided by, the regulator; and consult any person that the Minister thinks appropriate. However, the Minister must not recommend an Order in Council be made unless satisfied that the benefits of the proposed exemption outweigh the risk of children being exposed to harmful digital content and interactions when using the platform. Clause 62 provides for regulations to be made in relation to age-restricted platforms. Specifically, regulations may be made specifying— a certain kind of internet service as an age-restricted platform: a feature as a specified feature: an activity for the purposes of the definition of excluded service. Before making a recommendation that regulations be made under this clause, the Minister must— seek advice from, and consider any advice provided by, the regulator; and consult any person that the Minister thinks appropriate; and in relation to regulations that specify an internet service as an age-restricted platform or a feature as a specified feature, consider certain matters ( see clause 62(2)(a) and (3)(a) ). However, the Minister must not make a recommendation— in relation to regulations that specify an internet service as an age-restricted platform or a feature as a specified feature unless the Minister is satisfied that the regulations are necessary or desirable to achieve the purpose of this Bill: in relation to regulations that specify an activity for the purposes of the definition of excluded service unless the Minister is satisfied that the benefits of internet services that solely or primarily enable a user to do the activity outweigh the risk of children being exposed to harmful digital content and interactions when using those internet services. Clause 63 provides for regulations to be made for other purposes, including for the purpose of providing for anything this Bill says may or must be provided for by regulations under this section. Before making a recommendation that regulations be made under this clause, the Minister must seek advice from, and consider any advice provided by, the regulator and consult any person that the Minister thinks appropriate. Clause 64 requires the Minister to review the operation and effectiveness of this Bill, and prepare a report on the review, within 2 years after the commencement date. The report must be presented to the House of Representatives as soon as practicable after it has been completed. The Parliament of New Zealand enacts as follows: 1 Title This Act is the Online Safety (Minimum Age and Child Safety Risk Assessment) Act 2026 . 2 Commencement This Act comes into force 6 months after Royal assent. 3 Purpose The purpose of this Act is to reduce the risk of harm to children when online by imposing duties on operators of certain internet services. 4 Interpretation In this Act, unless the context otherwise requires,— access restriction order means an order under section 38 access service , in relation to an age-restricted platform,— a means— i a service that supplies internet access to a person in New Zealand through which the age-restricted platform is accessible; or ii a service or facility that enables a person in New Zealand to obtain software, or a licence for software, that provides access to the age-restricted platform for use on an electronic device; but b does not include a virtual private network Example An app store (from which a person can download a mobile or other application) is an example of an access service. account includes anything that may reasonably be regarded as the equivalent of an account age-restricted platform has the meaning set out in section 5 ancillary service , in relation to an age-restricted platform, includes a service that— a directly or indirectly promotes or displays information relating to the age-restricted platform: b directly or indirectly enables funds to be transferred in relation to the age-restricted platform: c makes content relating to the age-restricted platform available to users of the service (but is not otherwise an access service): d uses technology to facilitate the display of advertising on the age-restricted platform (for example, an ad server or an ad network) change-related child safety risk assessment has the meaning set out in section 17(1) child safety risk assessment has the meaning set out in section 14(1) children means individuals under the age of 18 years who are ordinarily resident in New Zealand court-imposed remedy has the meaning set out in section 34(1) digital content — a means any content in electronic form; and b includes any of the following in electronic form: i an image or a video: ii speech or any other sound: iii text: iv a combination of any of the things specified in subparagraphs (i) to (iii) : v a link to any of the things specified in subparagraphs (i) to (iv) excluded service has the meaning set out in section 5(2) interconnected and interconnected bodies corporate have the meanings set out in section 2(7) of the Commerce Act 1986 interim access restriction order means an order under section 39 interim service restriction order means an order under section 36 law enforcement or regulatory agency means any of the following: a the New Zealand Police: b the Approved Agency appointed under section 7 of the Harmful Digital Communications Act 2015: c the Classification Office established under section 76 of the Films, Videos, and Publications Classification Act 1993: d the office of the Privacy Commissioner continued by section 13 of the Privacy Act 2020: e any other body specified as a law enforcement or regulatory agency in regulations made under section 63 operator has the meaning set out in section 6 overseas regulator means a person in a country other than New Zealand that performs functions that correspond with, or are similar to, any of those conferred on the regulator under this Act personal information has the meaning set out in section 7(1) of the Privacy Act 2020 regulator means the chief executive of the Ministry relevant global turnover , in relation to an order requiring an operator to pay a pecuniary penalty under section 44 , means the operator’s total gross revenues (exclusive of any tax required to be collected) that are— a attributable to the platform to which the order relates (in New Zealand and overseas); and b received or receivable by the operator and all of its interconnected bodies corporate (if any) in a financial year restriction order means any of the following: a a service restriction order: b an interim service restriction order: c an access restriction order: d an interim access restriction order service restriction order means an order under section 35 specified feature has the meaning set out in section 5(2) specified liability act has the meaning set out in section 34(3) . 5 Meaning of age-restricted platform In this Act, age-restricted platform means any of the following: a an internet service that— i is accessible by a person who is in New Zealand; and ii enables the exchange of digital content between 2 or more users; and iii has 1 or more specified features; and iv is not an excluded service: b an internet service that— i is accessible by a person who is in New Zealand; and ii displays (or otherwise makes available) digital content; and iii uses artificial intelligence solely or primarily to simulate a social connection, an emotional connection, or any other form of personal connection with a user: c an internet service that is specified as an age-restricted platform in regulations made under section 62 . In this section,— excluded service means an internet service that solely or primarily enables a user to do any of the following (regardless of whether it meets the criteria in subsection (1)(a)(ii) and (iii) ): a communicate by means of person-to-person messages, email, voice calls, or video calls: b engage in video gaming: c access and listen to music or a podcast on demand: d access or share reviews, technical support, or advice about products or services: e engage in professional networking or development: f access or engage in education services: g access or engage in healthcare services: h do any other activity specified in regulations made under section 62 specified feature , in relation to an internet service, means a feature that— a displays (or otherwise makes available) or recommends digital content to a user based on information about the user or the user’s use of the service: b displays (or otherwise makes available) or generates a continuously updated stream of digital content as a user navigates or uses the service: c displays information to a user about how others have viewed or engaged with the user’s digital content or account: d enables a user to view or engage with digital content for a limited period of time: e is specified as a specified feature in regulations made under section 62 . 6 Meaning of operator In this Act, operator , in respect of an age-restricted platform, means a person that, directly or indirectly by any means, manages or controls the platform’s operations in New Zealand (whether by itself or together with other persons). However, if the regulator has designated a person as the operator of the age-restricted platform under section 7 , the operator is the only operator of the age-restricted platform for the purposes of this Act while the designation is in place. 7 Regulator’s power to designate operators The regulator may, if satisfied that doing so will promote the purpose of this Act, designate either of the following persons as the operator of an age-restricted platform for the purposes of this Act: a a person that is an operator of the age-restricted platform under section 6(1) : b an interconnected body corporate of an operator of the age-restricted platform under section 6(1) . Without limiting subsection (1) , designating a person as an operator will promote the purpose of this Act if the designation is necessary or desirable to— a provide certainty about who is and is not an operator for the purposes of this Act; or b ensure that this Act can be effectively enforced in respect of an age-restricted platform. The regulator must maintain a list of the regulator’s designations under this section (if any) on a publicly accessible internet site that is maintained by, or on behalf of, the regulator. 8 Territorial application This Act applies to an operator of an age-restricted platform— a regardless of whether the operator is in or outside New Zealand; but b only to the extent that the platform is operated in a manner that enables a person who is in New Zealand to access the platform. 9 Transitional, savings, and related provisions The transitional, savings, and related provisions set out in Schedule 1 have effect according to their terms. 10 Act binds the Crown This Act binds the Crown. 11 Operators must take steps to prevent persons under 16 years from having accounts An operator of an age-restricted platform must take reasonable steps to prevent a New Zealand person under the age of 16 years from having an account with the platform. Requiring manual entry of age or date of birth is not a reasonable step for the purposes of subsection (1) . An operator does not satisfy the duty in subsection (1) if the only step it takes in respect of the duty— a is to require provision of an approved evidence of age document; or b is to use a digital identity service; or c is to do both of those things. An operator must not collect personal information for the purpose of complying with the duty in subsection (1) if it is of a class that is specified in regulations made under section 63 as a class in respect of which personal information must not be collected for the purpose of complying with that duty. In this section,— approved evidence of age document — a has the meaning set out in section 5(1) of the Sale and Supply of Alcohol Act 2012; and b includes a document that would fall within that meaning if it were current digital identity service has the meaning set out in section 10 of the Digital Identity Services Trust Framework Act 2023 New Zealand person means an individual who is ordinarily resident in New Zealand. 12 Personal information collected for the purpose of complying with duty An operator of an age-restricted platform— a must not keep personal information collected for the purpose of complying with the duty in section 11(1) for longer than is required for that purpose: b may use or disclose personal information collected for the purpose of complying with the duty in section 11(1) only for that purpose. Information privacy principles 9, 10, and 11 set out in section 22 of the Privacy Act 2020 do not apply in respect of that personal information. 13 Breach of restrictions relating to personal information A contravention of section 12(1)(a) or (b) by a person who holds, for or on behalf of an operator of an age-restricted platform, personal information collected for the purpose of the operator’s compliance with the duty in section 11(1) is treated as a contravention by the operator. If an operator of an age-restricted platform contravenes section 12(1)(a) or (b) , the contravention must be treated as being an interference with the privacy of an individual for the purposes of Parts 5 and 6 of the Privacy Act 2020. The regulator must notify the Privacy Commissioner before applying to the High Court for a court-imposed remedy in respect of a contravention of section 12(1)(a) or (b) . 14 Operators must undertake child safety risk assessment An operator of an age-restricted platform must undertake an assessment of the matters specified in subsection (2) (a child safety risk assessment ). The matters are as follows: a the level of risk of children who use the platform encountering the following kinds of digital content: i digital content that is illegal: ii digital content that is used, or is likely to be used, to— A bully or harass a person: B groom a person: C extort, including sexually extort, a person: D carry out other activity that may constitute the commission of an offence in New Zealand: iii digital content that portrays or promotes— A self-harm or suicide: B violence: C sexually explicit activity: D false or misleading information: E other activity that may constitute the commission of an offence in New Zealand: iv digital content that uses artificial intelligence to make a person or thing appear to say or do something (regardless of whether that person or thing has said or done that thing): v other digital content that may be harmful to children: b the level of risk of harm to children who use the platform presented by the design, features, functionality, and operation of the platform, including— i the business model of the platform; and ii any governance of the platform; and iii how the platform uses any behaviour profiling processes, algorithms, and proactive technology; and iv any measures in place that promote safe use of the platform: c the level of risk of harm to children who use the platform presented by the advertisements on the platform, including— i the content of those advertisements; and ii how often those advertisements appear; and iii the extent to which children who use the platform engage with those advertisements: d any matter specified by the regulator in a written notice to the operator. A child safety risk assessment must be in writing and include— a the number of children who use the platform (whether with or without an account), broken down by age; and b a description of— i the identified levels of risk and the reasons for those levels; and ii any matter specified in accordance with subsection (2)(d) ; and c a description of— i the measures in place to lower the identified levels of risk; and ii how effective those measures are; and iii how the operator monitors the efficacy of those measures; and d a description of— i the method used to assess the matters specified in subsection (2) ; and ii the method by which the child safety risk assessment will be reviewed in accordance with section 16 . 15 Provision of child safety risk assessment to regulator An operator of an age-restricted platform must provide the regulator with a copy of its child safety risk assessment— a within 12 months after the date on which the platform meets the definition of age-restricted platform; or b by any earlier date specified by the regulator in a written notice to the operator. However, the regulator may specify an earlier date in accordance with subsection (1)(b) only if the regulator is satisfied that— a it is desirable for the operator to provide its child safety risk assessment by that date because of a potential risk of children being exposed to harmful digital content and interactions when using the platform; and b it is practicable for the operator to provide its child safety risk assessment by that date. 16 Review of child safety risk assessment An operator of an age-restricted platform must review its child safety risk assessment to ensure that the risk assessment is kept up to date. A review must be completed— a within 12 months after the date on which the child safety risk assessment was completed; and b within every 12-month period after the date on which the last review was completed. However, the regulator may specify that a review be completed by an earlier date if the regulator is satisfied that— a it is desirable for the operator to review its child safety risk assessment by that date because of a potential risk of children being exposed to harmful digital content and interactions when using the platform; and b it is practicable for the operator to review its child safety risk assessment by that date. An earlier date must be specified by written notice to the operator. On completion of a review, the operator must provide the regulator with a copy of its child safety risk assessment (regardless of whether changes have been made to the risk assessment as a result of the review). 17 Change-related child safety risk assessments Before making a significant change to an age-restricted platform, the operator of the platform must undertake an assessment of the matters specified in section 14(2) in relation to the anticipated impacts of that proposed change (a change-related child safety risk assessment ). A change-related child safety risk assessment must be in writing and include— a a description of— i the anticipated levels of risk identified and the reasons for those anticipated levels; and ii any matter specified in accordance with section 14(2)(d) ; and b a description of— i the measures currently in place to lower the levels of risk identified by the operator’s child safety risk assessment; and ii how effective those measures are expected to be at lowering the anticipated levels of risk; and iii any additional measures that would be required to lower the anticipated levels of risk and how effective those measures are expected to be; and c a description of the method used to assess the matters specified in section 14(2) in relation to the anticipated impacts of the proposed change. An operator of an age-restricted platform must provide the regulator with a copy of any change-related child safety risk assessment— a as soon as practicable after undertaking the assessment; but b before making the proposed significant change to which the assessment relates. In this section, significant change , in relation to an age-restricted platform, includes a significant change to— a the design, features, or functionality of the platform: b the terms of use of the platform. 18 Individual responsible for confirming accuracy of risk assessments An operator of an age-restricted platform must, by notice to the regulator, designate an individual as responsible for confirming the accuracy of the operator’s child safety risk assessment and any change-related child safety risk assessment. An individual may be designated under subsection (1) only if the individual has a significant role in ensuring or overseeing the undertaking of the operator’s risk assessments and the provision of them to the regulator. A notice under subsection (1) must specify the designated individual’s contact details. 19 Regulator’s power to direct operator to repeat risk assessment The regulator may, by written notice, direct an operator of an age-restricted platform to repeat its child safety risk assessment or a change-related child safety risk assessment. However, the regulator may do so only if the regulator considers,— a in respect of a child safety risk assessment,— i that the operator has not undertaken an adequate assessment of any matter specified in section 14(2) ; or ii that the risk assessment does not adequately specify or describe any matter specified in section 14(3) : b in respect of a change-related child safety risk assessment,— i that the operator has not, in relation to the anticipated impacts of the proposed significant change, undertaken an adequate assessment of any matter specified in section 14(2) ; or ii that the risk assessment does not adequately describe any matter specified in section 17(2) . A notice under subsection (1) must specify— a the matter or matters that the regulator considers have not been adequately assessed, specified, or described; and b the date by which the operator must provide the regulator with a copy of the repeated risk assessment. 20 Regulator’s functions The functions of the regulator are to— a monitor and enforce compliance with this Act and any secondary legislation made under it: b co-operate and share information with law enforcement or regulatory agencies and overseas regulators (in accordance with section 22 ): c promote education about, and awareness of, this Act and operators’ duties under this Act: d publish guidance relating to this Act and information about the regulator’s regulatory activities, including monitoring, enforcement, and other compliance-related activities: e advise the Minister in relation to the making of regulations under subpart 5 of this Part : f perform any other function conferred or imposed on the regulator by legislation. In performing or exercising their functions, duties, and powers under subsection (1)(a) and (b) , the regulator must act independently of the Minister. 21 Regulator’s power to require information The regulator may, by written notice, require a person to provide the regulator with information in the person’s possession or control. However, the regulator may do so only if the regulator considers that the information is necessary or desirable for the purpose of performing or exercising the regulator’s functions, duties, or powers under this Act. A written notice under subsection (1) must specify— a the information that must be provided: b the date by which the information must be provided: c if applicable, that the regulator anticipates that they may disclose the information to a law enforcement or regulatory agency or an overseas regulator under section 22 . The written notice may— a specify that the information is to be provided— i by the testing, by, or on behalf of, an operator of an age-restricted platform, of any feature, functionality, system, process, or other part of the platform and providing the regulator with the results: ii by a live demonstration, by, or on behalf of, an operator of an age-restricted platform, of the operation of any feature, functionality, system, process, or other part of the platform: iii orally in an interview with the regulator: iv in any other manner or form; and b require the information to be provided regularly, at specified intervals, or in respect of specified periods. A person who is given a written notice must comply with it within the time specified in the notice. 22 Sharing information with law enforcement or regulatory agencies and overseas regulators The regulator may provide to a law enforcement or regulatory agency or an overseas regulator any information that the regulator— a holds in relation to the performance or exercise of the regulator’s functions, duties, or powers under this Act; and b considers may assist— i the law enforcement or regulatory agency in the performance or exercise of the law enforcement or regulatory agency’s functions, powers, or duties under any legislation; or ii the overseas regulator in the performance or exercise of its functions, duties, or powers under foreign law. However, the regulator may provide information under this section only if the regulator is satisfied that appropriate protections are or will be in place for the purpose of maintaining the confidentiality of information provided (in particular, personal information). The regulator may impose any conditions in relation to information provided to a law enforcement or regulatory agency or an overseas regulator, including conditions relating to— a maintaining the confidentiality of information provided (in particular, personal information): b storing, using, or accessing information provided: c copying, returning, or disposing of copies of information provided. In considering what conditions (if any) to impose, the regulator must have regard to whether conditions are necessary or desirable in order to protect the privacy of any individual. The regulator must not impose conditions that prevent the law enforcement or regulatory agency, or overseas regulator, from performing or exercising any of their statutory functions, duties, or powers. The regulator may use any information provided to the regulator by a law enforcement or regulatory agency under any legislation, or by an overseas regulator, in the performance or exercise of the regulator’s functions, duties, or powers under this Act. 23 Restriction on disclosure of information acquired under sections 21 and 22 This section applies to the following persons ( authorised persons ): a the regulator: b a person authorised by the regulator to exercise the regulator’s powers under section 21 or 22 (for example, by way of delegation under clause 2 of Schedule 6 of the Public Service Act 2020). An authorised person must not publish or disclose any information acquired in the course of exercising the powers under section 21 or 22 except— a for the purposes of, or in connection with, the performance of the regulator’s functions and powers under this Act; or b with the consent of the person to whom the information relates (if applicable); or c to the extent that the information is already in the public domain; or d if required or permitted to do so by another provision of this Act or under any other legislation (for example, the Official Information Act 1982 or the Privacy Act 2020). 24 Regulator must issue warnings in certain manner If the regulator issues a warning to an operator of an age-restricted platform in relation to a potential non-compliance with a provision of this Act, the warning must— a state the reason for the warning; and b be in writing and in a form approved by the regulator. The regulator must, as soon as is reasonably practicable after issuing a warning, give public notice of the warning. The regulator must ensure that any personal information and commercially sensitive information is withheld from the publicly notified warning, unless the regulator considers that publicly notifying the information is necessary or desirable to achieve the purpose of this Act. 25 Regulator may require operator to disclose warning This section applies if the regulator issues a warning to an operator of an age-restricted platform under section 24 . The regulator may, by written notice given to the operator, require the operator to prominently disclose a copy of the warning on 1 or more internet sites maintained by or on behalf of the operator. However, the regulator may do so only if the regulator— a considers that doing so is necessary or desirable to achieve the purpose of this Act; and b has given the operator at least 5 working days’ written notice of the following matters: i that the regulator is considering exercising the power; and ii the reasons why the regulator is considering exercising that power; and c has given the operator or the operator’s representative an opportunity to make written submissions and to be heard on the matter within that notice period. If the regulator has redacted information from their publicly notified warning in accordance with section 24(3) , the regulator must require the operator to withhold that information from the copy of the warning disclosed by the operator. The regulator may require disclosure on any other terms and conditions that the regulator thinks fit (if any). 26 Operator must comply with notice to disclose warning An operator who is given a notice under section 25 must comply with the notice within the time frame, and in the manner, specified in the notice. 27 Enforceable undertakings The regulator may accept a written undertaking given by an operator of an age-restricted platform in connection with any matter relating to the enforcement of this Act. An undertaking may include— a an undertaking to take action to avoid, remedy, or mitigate— i a failure to comply with a requirement under this Act, including any actual or likely adverse effects arising from the failure; or ii an act or omission that the regulator reasonably believes may result, or may have resulted, in a failure to comply with a requirement under this Act; or b an undertaking to pay the regulator all or part of the regulator’s costs incurred in investigating, or bringing proceedings in relation to, a failure, or an alleged failure, to comply with a requirement under this Act. An undertaking may include an admission of liability by the operator giving it in relation to the matter to which the undertaking relates, but otherwise does not constitute an admission of liability. The operator may withdraw or vary the undertaking with the written agreement of the regulator. However, the undertaking may not be varied to relate to a different matter. 28 Notification requirements for undertakings The regulator must give the operator seeking to make an undertaking written notice of— a the regulator’s decision to accept or reject the undertaking; and b the reasons for the decision. If the regulator accepts an undertaking, the regulator must, as soon as is reasonably practicable, publicly notify the following: a the undertaking: b a brief description of the circumstances and nature of the matter to which the undertaking relates: c the regulator’s reasons for accepting the undertaking: d any withdrawal or variation of the undertaking. The regulator must ensure that any personal information and commercially sensitive information is withheld from a public notice under subsection (2) , unless the regulator considers that publicly notifying the information is necessary or desirable to achieve the purpose of this Act. 29 When undertaking becomes enforceable An undertaking takes effect and becomes enforceable— a on the date the regulator gives notice of acceptance of the undertaking; or b at any later date specified by the regulator. An operator must not breach an undertaking given by that operator that is in force. If the undertaking relates to a specified liability act, no proceedings may be brought against an operator for that act if— a the undertaking is in force and the operator is not in breach of the undertaking; or b the operator has completely discharged the undertaking. The regulator may accept an undertaking in relation to a specified liability act or an alleged specified liability act before proceedings in relation to that act have been completed. If the regulator accepts an undertaking in relation to a specified liability act or an alleged specified liability act while proceedings are under way but before they are completed, the regulator must take reasonable steps to have the proceedings discontinued as soon as is reasonably practicable to the extent that the proceedings relate to that specified liability act or alleged specified liability act. 30 Breach of undertaking If the regulator considers that an operator has breached an undertaking, the regulator may apply to the High Court for an order under subsection (2) . If the court is satisfied that the operator who made the undertaking has breached it, the court may make 1 of the following orders: a an order directing the operator to comply with the undertaking: b an order discharging the undertaking. The court may also make any other order that the court considers appropriate in the circumstances, including orders directing the person to pay to the regulator— a the costs of the proceedings; and b the reasonable costs of the regulator for ongoing monitoring of compliance with the undertaking. 31 Corrective notices This section applies if the regulator is satisfied that an operator of an age-restricted platform— a has carried out a specified liability act; or b is likely to carry out a specified liability act. The regulator may, by written notice given to the operator, require the operator to take any steps specified in the notice to— a avoid, remedy, or mitigate any actual or likely adverse effects arising from a specified liability act or a possible specified liability act; or b ensure that a specified liability act is not continued or repeated; or c ensure that a specified liability act does not occur. The notice must specify a reasonable period within which the required steps must be taken. If the regulator is satisfied that, by engaging in any conduct, the operator is carrying out, or is likely to carry out, a specified liability act, the regulator may act under subsection (2) — a whether or not the operator has previously carried out that specified liability act; and b whether or not the specified liability act, if carried out, would increase the risk of children’s exposure to harmful content, features, or interactions online. 32 Operator must comply with corrective notice An operator who is given a notice under section 31 must comply with the notice within the time frame, and in the manner, specified in the notice. 33 Procedural matters relating to corrective notice The regulator may exercise a power under section 31 only if the regulator— a considers that doing so is necessary or desirable to achieve the purpose of this Act; and b has given the operator at least 10 working days’ written notice of the following matters: i that the regulator is considering exercising the power; and ii the reasons why they are considering exercising that power; and c has given the operator or the operator’s representative an opportunity to make written submissions and to be heard on the matter within that notice period. 34 Court-imposed remedies available under this subpart The following remedies ( court-imposed remedies ) are available under this subpart: a a pecuniary penalty order (with 3 tiers of penalties): b a restriction order: c an injunction. Those remedies are available for a specified liability act. A specified liability act occurs if— a an operator of an age-restricted platform fails to take reasonable steps to prevent a New Zealand person under the age of 16 years from having an account with the platform in accordance with section 11 ; or b an operator of an age-restricted platform keeps personal information collected for the purpose of complying with the duty in section 11(1) in contravention of section 12(1)(a) ; or c an operator of an age-restricted platform uses or discloses personal information collected for the purpose of complying with the duty in section 11(1) in contravention of section 12(1)(b) ; or d in relation to its child safety risk assessment or change-related child safety risk assessment that an operator of an age-restricted platform is directed to repeat under section 19 , the operator fails to adequately assess, specify, or describe a matter specified in a notice issued under that section; or e an operator of an age-restricted platform fails to comply with the regulator’s direction to repeat its child safety risk assessment or a change-related child safety risk assessment under section 19 ; or f an operator fails to provide the regulator with a copy of its child safety risk assessment or a change-related child safety risk assessment in accordance with section 15(1), 16(5), 17(3), or 19(3)(b) ; or g an operator fails to designate a responsible individual in accordance with section 18 ; or h an operator of an age-restricted platform fails to comply with a notice to disclose a warning in accordance with section 26 ; or i an operator of an age-restricted platform fails to comply with a corrective notice in accordance with section 32 . 35 Service restriction orders On an application by the regulator, the High Court may make an order requiring— a 1 or more persons who provide an ancillary service in relation to an age-restricted platform (an ancillary service provider ) to stop providing that service in relation to that platform; and b the operator of the platform to stop accepting that service in relation to the platform. The court may make the order if satisfied that— a the operator has carried out a specified liability act; and b the act is ongoing; and c either— i the operator has— A failed to comply with a requirement to disclose a warning in relation to the act ( see section 26 ); or B breached an undertaking that was accepted by the regulator in relation to the act ( see section 29(2) ); or C failed to comply with a corrective notice issued in relation to the act ( see section 32 ); or D failed to comply with a pecuniary penalty order made in relation to the act under section 44 ; or ii the circumstances of the act are such, or the risk of children’s exposure to harmful content, features, or interactions online posed by the act is such, that the order is appropriate; and d the ancillary service provider provides the ancillary service to which the application relates in relation to the age-restricted platform; and e the order is appropriate for the purpose of preventing children’s exposure to harmful content, features, or interactions online and the restrictions imposed by the order are proportionate to that purpose. 36 Interim service restriction orders On an application by the regulator, the High Court may make an order requiring— a 1 or more persons who provide an ancillary service in relation to an age-restricted platform (an ancillary service provider ) to stop providing that service in relation to that platform; and b the operator of the platform to stop accepting that service in relation to the platform. The court may make an interim service restriction order if— a it has reason to believe that the operator has carried out a specified liability act; and b satisfied that the ancillary service provider provides the ancillary service to which the application relates in relation to the age-restricted platform; and c satisfied that there are prima facie grounds to suggest that an application for a service restriction order would be successful ( see the grounds for making a service restriction order under section 35(2) ); and d satisfied that the risk of children’s exposure to harmful content, features, or interactions online posed by the act is such that it would not be appropriate to wait to establish the act before making the order. The court must specify in the interim service restriction order the date on which that order expires, which must not be more than 180 days after the making of the order. An interim service restriction order has effect until the earlier of the following: a the expiry date specified in the interim order ( see subsection (3) ): b if the regulator applies for a service restriction order in relation to the same matter (or substantially the same matter) to which the interim order relates,— i the date on which the court makes the service restriction order; or ii the date on which the court dismisses the application; or iii another date specified by the court: c the date on which the interim order is set aside on appeal. 37 Content of service restriction orders or interim service restriction orders A service restriction order or an interim service restriction order must specify— a the age-restricted platform in respect of which an ancillary service must stop being provided and accepted: b the operator of that platform: c the ancillary service that must stop being provided and accepted: d the person or persons who are required to stop providing the ancillary service (the ancillary service provider ): e the steps that the ancillary service provider and operator must take, or arrangements that they must put in place, that have the effect of— i withdrawing the ancillary service to the extent that it relates to the platform: ii preventing the ancillary service from promoting or displaying content that relates to the platform: f the date by which the ancillary service provider must stop providing, and by which the operator must stop accepting, the service: g the date on which the order expires. For the purposes of subsection (1)(e) , steps that the ancillary service provider and operator must take, or arrangements that they must put in place,— a may include steps or arrangements that require the termination of, or prohibition on the performance of, an agreement (whether or not it was entered into before this Act came into force); but b are limited, as far as possible, to steps or arrangements relating to the age-restricted platform as it affects New Zealand users of the platform. 38 Access restriction orders On an application by the regulator, the High Court may make an order requiring— a 1 or more persons who provide an access service in relation to an age-restricted platform (an access service provider ) to— i stop providing that service in relation to that platform; and ii notify persons in New Zealand who attempt to access the platform via that service of the order and its effect; and b the operator of the platform to— i prevent persons in New Zealand from accessing the platform; and ii notify persons in New Zealand who attempt to access the relevant platform of the order and its effect. The court may make the order if it is satisfied— a that the operator has carried out a specified liability act; and b that the act is ongoing; and c either— i that a service restriction order or an interim service restriction order has been made in relation to the act and the order or interim order is not sufficient to avoid, remedy, or mitigate the risk of children’s exposure to harmful content, features, or interactions online as a result of the act; or ii that— A the grounds for applying for a service restriction order or an interim service restriction order in relation to the act are met; but B the likely consequences of the act are such that if a service restriction order or an interim service restriction order were to be made, it would be unlikely to be sufficient to avoid, remedy, or mitigate the risk of children’s exposure to harmful content, features, or interactions online as result of the act; and d that the access service provider provides the access service to which the application relates in relation to the age-restricted platform; and e that the order is appropriate for the purpose of preventing children’s exposure to harmful content, features, or interactions online and the restrictions imposed by the order are proportionate to that purpose. 39 Interim access restriction orders On an application by the regulator, the High Court may make an order requiring— a 1 or more persons who provide an access service in relation to the age-restricted platform (an access service provider ) to— i stop providing that service in relation to that platform; and ii notify persons in New Zealand who attempt to access the relevant platform via that service of the order and its effect; and b the operator of the age-restricted platform to— i prevent New Zealand users from accessing the platform; and ii notify persons in New Zealand who attempt to access the relevant platform of the order and its effect. The court may make an interim access restriction order if— a it has reason to believe that the operator has carried out a specified liability act; and b satisfied that the access service provider provides the access service to which the application relates in relation to the age-restricted platform; and c satisfied that there are prima facie grounds to suggest that an application for an access restriction order would be successful ( see the grounds for making an access restriction order under section 38(2) ); and d satisfied that the risk of children’s exposure to harmful content, features, or interactions online posed by the act is such that it would not be appropriate to wait to establish the act before making the order. The court must specify in the interim access restriction order the date on which that order expires, which must not be more than 180 days after the making of the order. An interim access restriction order has effect until the earlier of the following: a the expiry date specified in the interim order ( see subsection (3) ): b if the regulator applies for an access restriction order in relation to the same matter (or substantially the same matter) to which the interim order relates,— i the date on which the court makes the access restriction order; or ii the date on which the court dismisses the application; or iii another date specified by the court: c the date on which the interim order is set aside on appeal. 40 Content of access restriction orders or interim access restriction orders An access restriction order or an interim access restriction order must specify— a the age-restricted platform that is the subject of the order: b the operator of that platform: c the access service that must stop being provided in relation to that platform: d the person or persons who are required to stop providing the access service (the access service provider ): e the steps that the access service provider must take, or arrangements that they must put in place, that have the effect of withdrawing, adapting, or manipulating the access service in order to impede users’ access to the platform via that service: f the steps that the operator must take, or arrangements that they must put in place, that have the effect of preventing access to the platform by New Zealand users: g the manner in which, and date by which, the access service provider and operator must notify persons of the order and its effect: h the date by which the access service provider must stop providing the access service: i the date by which the operator must prevent access to the platform: j the date on which the order expires. For the purposes of subsection (1)(e) and (f) , steps that the access service provider and operator must take, or arrangements that they must put in place,— a may include steps or arrangements that require the termination of, or prohibition on the performance of, an agreement (whether or not it was entered into before this Act came into force); but b are limited, as far as possible, to steps or arrangements— i relating to the age-restricted platform as it affects New Zealand users of the platform; and ii that do not affect the ability of New Zealand users to access anything other than the platform. 41 Additional requirements relating to making of restriction orders In determining whether or not to make a restriction order, the court must consider the rights and obligations of the following persons under this Act or any other legislation or rule of law: a the operator of the age-restricted platform to which the order relates: b the person or persons providing the ancillary service or access service to which the order relates (as the case may be): c users of the age-restricted platform to which the order relates. The regulator must inform the Minister as soon as reasonably practicable after a restriction order is made. 42 Application for renewal of restriction orders If the court makes a restriction order, the regulator may, at any time before the order expires, apply to the court for a renewal of the order. After considering an application under this section, the court may renew the order as it thinks fit. 43 Appeal to Court of Appeal on question of law An operator of an age-restricted platform in relation to whom a restriction order has been made may appeal to the Court of Appeal against the decision of the High Court to make the order on a question of law. The procedure in respect of an appeal under this section must be in accordance with the rules of court. The decision of the Court of Appeal on an appeal under this section is final. 44 Pecuniary penalty order The regulator may apply to the High Court for an order that an operator pay a pecuniary penalty to the Crown in relation to a specified liability act. The court may make the order if it is satisfied that the operator has carried out a specified liability act. The court must not make the order if the operator satisfies the court that— a the conduct constituting the specified liability act occurred due to— i the act or omission of another person that was beyond the operator’s control; or ii the operator’s reasonable reliance on information supplied by another person (other than a director, employee, or agent of the operator); or b the operator took steps that were reasonable in the circumstances to prevent the specified liability act. 45 Maximum penalty (Tier 1) This section applies in respect of a specified liability act specified in any of section 34(3)(a) to (c) . The maximum amount of a pecuniary penalty is— a $500,000 for an individual; or b in any other case, the greater of the following: i $40 million: ii 10% of the operator’s relevant global turnover for each financial year in which the specified liability act occurred. 46 Maximum penalty (Tier 2) This section applies in respect of a specified liability act specified in any of section 34(3)(d) to (g) . The maximum amount of a pecuniary penalty is— a $250,000 for an individual; or b in any other case, the greater of the following: i $12 million: ii 3% of the operator’s relevant global turnover for each financial year in which the specified liability act occurred. 47 Maximum penalty (Tier 3) This section applies in respect of a specified liability act specified in section 34(3)(h) or (i) . The maximum amount of a pecuniary penalty is— a $100,000 for an individual; or b in any other case, the greater of the following: i $4 million: ii 1% of the operator’s relevant global turnover for each financial year in which the specified liability act occurred. 48 Considerations for court in determining pecuniary penalty In determining an appropriate pecuniary penalty that an operator must pay, the court must have regard to all relevant matters, including— a the nature and extent of the operator’s conduct; and b whether the operator has paid an amount of compensation, reparation, or restitution, or taken other steps to avoid or mitigate any actual or potential adverse effects arising from the operator’s conduct; and c the circumstances in which the operator’s conduct took place; and d whether the operator has previously been found by a court in a proceeding under this Act, or any other legislation, to have engaged in any similar conduct; and e the size of, and resources available to, the operator. In this section, conduct , in relation to an operator, means the conduct of the operator for which the operator is liable to the pecuniary penalty. 49 High Court may grant injunctions The High Court may, on application by the regulator, grant an injunction— a restraining a person from engaging or continuing to engage in a specified liability act or conduct that would constitute a specified liability act; or b requiring a person to do an act or a thing if— i that person has refused or failed, is refusing or failing, or is proposing to refuse or fail to do that act or thing; and ii the refusal or failure was, is, or would be a specified liability act. However, the court must not grant an injunction that imposes the same, or substantially the same, restrictions and obligations as a restriction order. 50 When court may grant restraining injunctions The court may grant an injunction restraining a person from engaging in conduct of a particular kind if— a it is satisfied that the person has engaged in conduct of that kind; or b it appears to the court that, if an injunction is not granted, it is likely that the person will engage in conduct of that kind. The court may grant an interim injunction restraining a person from engaging in conduct of a particular kind if, in its opinion, it is desirable to do so. Subsections (1)(a) and (2) apply whether or not it appears to the court that the person intends to engage again, or to continue to engage, in conduct of that kind. Subsections (1)(b) and (2) apply whether or not— a the person has previously engaged in conduct of that kind; or b conduct of that kind, if carried out, would increase the risk of children’s exposure to harmful content, features, or interactions online. 51 When court may grant performance injunctions A court may grant an injunction requiring a person to do an act or a thing that they are required to do in relation to a specified liability act if— a it is satisfied that the person has refused or failed to do that act or thing; or b it appears to the court that, if an injunction is not granted, it is likely that the person will refuse or fail to do that act or thing. The court may grant an interim injunction requiring a person to do an act or a thing that they are required to do in relation to a specified liability act if, in its opinion, it is desirable to do so. Subsections (1)(a) and (2) apply whether or not it appears to the court that the person intends to refuse or fail again, or to continue to refuse or fail, to do that act or thing. Subsections (1)(b) and (2) apply whether or not— a the person has previously refused or failed to do that act or thing; or b the person’s refusal or failure to do that act or thing would increase the risk of children’s exposure to harmful content, features, or interactions online. 52 Regulator’s undertaking as to damages not required for interim measures This section applies if the regulator applies to the court for any of the following ( interim measures ): a an interim service restriction order; or b an interim access restriction order; or c the grant of an interim injunction under this subpart. The court must not, as a condition of granting an interim measure, require the regulator to give an undertaking as to damages. In determining the regulator’s application for an interim measure, the court must not take into account that the regulator is not required to give an undertaking as to damages. 53 Rules of civil procedure and civil standard of proof apply A proceeding under this subpart is a civil proceeding and the usual rules of court and rules of evidence and procedure for civil proceedings apply (including the standard of proof and the court’s powers in respect of enforcement and contempt of court). 54 More than 1 court-imposed remedy may be given for same conduct The court may grant a court-imposed remedy of one kind against a person even though the court has granted another court-imposed remedy of a different kind against the person for the same conduct. 55 Only 1 pecuniary penalty order may be made for same conduct If conduct by a person constitutes 2 or more specified liability acts,— a a proceeding may be brought against that person for any 1 or more of the specified liability acts; but b no person is liable to more than 1 pecuniary penalty order for the same conduct. 56 No pecuniary penalty and criminal penalty for same conduct A person cannot be ordered to pay a pecuniary penalty and be liable for a fine or to imprisonment under this Act or any other Act for the same conduct. 57 Offence relating to false or misleading risk assessments An individual designated under section 18 commits an offence if— a they confirm the accuracy of a child safety risk assessment or change-related child safety risk assessment knowing it to be false or misleading in a material particular; and b a copy of that risk assessment is provided to the regulator. An individual that commits an offence under this section is liable on conviction to imprisonment for a term not exceeding 12 months or to a fine not exceeding $500,000. 58 Offence relating to information requirements under section 21 A person commits an offence if the person knowingly fails, without reasonable excuse, to comply with a requirement to provide the regulator with information in accordance with section 21 . A person commits an offence if, in response to a requirement by the regulator under section 21 , the person provides information that they know is false or misleading in a material particular. A person that commits an offence under subsection (1) or (2) is liable on conviction,— a in the case of an individual, to imprisonment for a term not exceeding 12 months or to a fine not exceeding $500,000; or b in any other case, to a fine not exceeding $40 million. 59 Offence relating to conditions imposed in relation to information A person commits an offence if they knowingly breach any conditions imposed by the regulator in relation to information provided to a law enforcement or regulatory agency or an overseas regulator under section 22(3) . A person that commits an offence under this section is liable on conviction,— a in the case of an individual, to a fine not exceeding $100,000; or b in any other case, to a fine not exceeding $4 million. 60 Offence relating to unauthorised disclosure of information A person commits an offence if the person knowingly publishes or discloses information in contravention of section 23 , unless the person does so in good faith in the course of exercising the powers for which they are authorised under section 21 or 22 (as the case may be). A person that commits an offence under this section is liable on conviction,— a in the case of an individual, to a fine not exceeding $100,000; or b in any other case, to a fine not exceeding $4 million. 61 Exemption order The Governor-General may, by Order in Council made on the recommendation of the Minister,— a exempt an operator of an age-restricted platform from any or all requirements under this Act; and b specify the conditions to which the exemption is subject (if any). Before making a recommendation under subsection (1) , the Minister must— a consider— i the digital content— A that the platform enables users to exchange; or B that is displayed (or otherwise made available), and may be displayed (or otherwise made available), by the platform; and ii the features of the platform; and iii the users of the platform; and iv any other factors that the Minister thinks relevant; and b seek advice from, and consider any advice provided by, the regulator; and c consult any person that the Minister thinks appropriate. The Minister must not recommend an order under subsection (1) unless satisfied that the benefits of the proposed exemption outweigh the risk of children being exposed to harmful digital content and interactions when using the platform. An order under this section is secondary legislation ( see Part 3 of the Legislation Act 2019 for publication requirements). 62 Regulations relating to age-restricted platforms The Governor-General may, by Order in Council made on the recommendation of the Minister, make regulations for all or any of the following purposes: a specifying as an age-restricted platform an internet service that— i is accessible by a person who is in New Zealand; and ii enables the exchange of digital content between 2 or more users or displays (or otherwise makes available) digital content: b specifying a feature as a specified feature: c specifying an activity for the purposes of the definition of excluded services. Before making a recommendation relating to subsection (1)(a) , the Minister must— a consider— i the digital content— A that the platform enables users to exchange; or B that is displayed (or otherwise made available), and may be displayed (or otherwise made available), by the platform; and ii the features of the platform; and iii the users of the platform; and iv any other factors that the Minister thinks relevant; and b seek advice from, and consider any advice provided by, the regulator; and c consult any person that the Minister thinks appropriate. Before making a recommendation relating to subsection (1)(b) , the Minister must— a consider the kinds of internet services that have the feature and— i the digital content that those kinds of internet services— A enable users to exchange; or B display (or otherwise make available) and may display (or otherwise make available); and ii the users of those kinds of internet services; and iii any other factors that the Minister thinks relevant; and b seek advice from, and consider any advice provided by, the regulator; and c consult any person that the Minister thinks appropriate. The Minister must not recommend the making of regulations under subsection (1)(a) or (b) unless satisfied that the regulations are necessary or desirable to achieve the purpose of this Act. Before making a recommendation relating to subsection (1)(c) , the Minister must— a seek advice from, and consider any advice provided by, the regulator; and b consult any person that the Minister thinks appropriate. The Minister must not recommend the making of regulations under subsection (1)(c) unless satisfied that the benefits of internet services that solely or primarily enable a user to do the activity outweigh the risk of children being exposed to harmful digital content and interactions when using those internet services. Regulations made under this section are secondary legislation ( see Part 3 of the Legislation Act 2019 for publication requirements). 63 Regulations relating to other matters The Governor-General may, by Order in Council made on the recommendation of the Minister, make regulations for all or any of the following purposes: a providing for anything this Act says may or must be provided for by regulations under this section: b providing for anything incidental that is necessary for carrying out, or giving full effect to, this Act. Before making a recommendation under subsection (1) , the Minister must— a seek advice from, and consider any advice provided by, the regulator; and b consult any person that the Minister thinks appropriate. Regulations made under this section are secondary legislation ( see Part 3 of the Legislation Act 2019 for publication requirements). 64 Review of this Act The Minister must, within 2 years after the date on which this Act comes into force,— a commence a review of its operation and effectiveness; and b prepare a report on that review. The Minister must present the report to the House of Representatives as soon as practicable after it has been completed. 1 Transitional, savings, and related provisions In this Part, commencement date means the date on which this Act comes into force. Section 11 applies regardless of whether the account was created before, on, or after the commencement date. This clause applies in respect of a person who is an operator of an age-restricted platform at the start of the commencement date. Section 15 must be treated as requiring the operator to provide the regulator with a copy of its child safety risk assessment for the platform within 6 months after the commencement date.