Google warns Australian safety bill could lock under-18s out of Gmail

A draft Australian law with fines of up to $109 million could force Google to run age checks on Gmail and block under-18s from the service entirely. Rachel Lord, head of policy in Australia and New Zealand for Google's YouTube, delivered that warning on Monday at a Senate hearing in Canberra.

The bill in question is the Digital Duty of Care legislation. It has already cleared Australia's House of Representatives but still needs cross-party support to pass the Senate. Under its terms, internet companies must demonstrate they are actively weeding out harmful content — or face penalties reaching nine figures.

The friction point is a specific clause on child safety. A section of the law requires age checks wherever there is a risk of a child seeing pornography.

That clause, Lord told the hearing, "could require us to age assure and block access to everyday communication services like messaging, email and private file storage." She went further on the mechanics: "We are talking about potentially intrusive monitoring within private communications or file storage."

In plain terms, a rule aimed at pornography could cascade into the plumbing of ordinary digital life — inbox, chat, cloud drives.

What does this change for enterprise IT?

For Australian organisations, the immediate practical question is what counts as "everyday communication services" once regulators start enforcing. If age assurance obligations extend to email and file storage, any platform serving mixed-age user bases — schools, universities, consumer-facing brands — inherits a compliance problem that vendor terms alone will not solve.

The industry's broader objection is about discretion, not just scope. Online companies and free speech advocates argue the law hands regulators too much latitude to decide unilaterally what counts as harmful. That pressure, they say, pushes platforms toward takedowns as the default posture.

Representatives from Meta, TikTok and Snap echoed Google's concerns at the same hearing. Their shared worry: the bill could chill online communications by allowing regulators broad discretion to determine what content or conduct is harmful, while replacing some existing mandatory industry codes.

Several executives argued the uncertainty itself creates the risk. Faced with penalties of up to $109 million per breach, platforms have a rational incentive to over-moderate rather than litigate edge cases. Compliance by deletion, in effect.

Where the bill stands

The legislative arithmetic is straightforward. The House of Representatives has passed the bill. The Senate has not, and the government lacks the numbers without cross-party support. The hearing continues, so more evidence — and likely more warnings — is coming.

The government's position, stated plainly, is that a broad set of rules is the only way to ensure a safe internet. Officials are betting that wide-ranging obligations beat narrow prescriptive codes.

Vendors read the same text and see overreach. Google's contribution to the debate is a concrete scenario: a child-safety clause designed for pornography enforcement becoming the mechanism that gates a teenager's access to email. Not because Google wants to block minors, but because the drafting leaves few alternatives that don't involve what Lord called "intrusive monitoring" inside private channels.

The compliance math

n There is an asymmetry worth naming. A regulator's discretion costs a platform nothing when exercised; a wrong guess by the platform costs up to $109 million. Faced with that spread, rational actors over-block. The industry's argument is not that safety obligations are unwelcome — it is that undefined harm plus nine-figure fines produces blunt enforcement.

The counter-argument from government is equally simple: narrow rules get gamed, and children's safety does not wait for perfect drafting.

What does this change for CIOs and platform teams with Australian users? For now, nothing is law. But the direction of travel matters. If the Senate passes the bill with the age-assurance clause intact, expect vendors to ship compliance features — age gates, identity checks, monitoring hooks in private storage — that Australian enterprises will then have to operate, explain to users and defend in audits.

Google, Meta, TikTok and Snap have put their objections on the record. The Senate now decides whether a bill meant to police harmful content ends up policing the inbox as well.

The hearing continues.