From Tuesday 9 September 2026 every app store operating in Australia has to know your age before it lets you download anything rated for adults.

It is the last piece of a regulatory rollout that has been building since the middle of last year, and once it lands, the job of stopping children from reaching content that was already restricted to over 18s shifts squarely onto Apple, Google, Microsoft and every other company running an app marketplace in this country.

The deadline sits inside what the eSafety Commissioner calls the Age-Restricted Material Codes, a set of nine industry codes drafted under the Online Safety Act to keep under 18s away from pornography, extreme violence and other high impact content across the internet.

The code covering app distribution was registered in September last year and technically became law in March, but app stores were given an extra six months to actually build the systems needed to comply.

That grace period runs out on 9 September, and this is the code that touches the most people, since it applies to the storefront sitting on almost every phone in the country.

The penalties for getting it wrong are serious. If eSafety finds a service isn’t complying and issues a formal direction, ignoring that direction can trigger a civil penalty of up to $49.5 million.

It is worth being clear about who that penalty falls on, because the law targets the companies running the app stores rather than the teenager who slips through a gap, and there is no fine or consequence for a family that gets caught out by the change.

A Six-Month Head Start

Apple did not wait for the deadline. Back in February, it announced it would start blocking Australian users, along with those in Brazil and Singapore, from downloading anything rated 18+ unless the App Store could confirm they were an adult through what the company called “reasonable methods.”

In practice that means Apple leans on signals already sitting inside an account, including how old the profile says it is, whether it is linked to a payment method with years of purchase history, and whether it is set up as a child account inside Family Sharing.

A fresh account with no card attached looks a lot more like a minor to Apple’s systems than one that has been buying music and apps since 2015.

Apple has also given developers a separate tool called the Declared Age Range API, which lets an app ask the operating system for a rough age bracket rather than an exact birthdate.

It is a smaller, less invasive request, and Apple is positioning it as the standard way developers everywhere, not only in Australia, can work out whether someone is old enough to see what they have built.

Google has taken a similar but distinct path through what it calls the Play Age Signals API, which the company’s product management lead for Google Play, Paul Feng, confirmed in July would extend to every developer on the platform worldwide.

It ran first in Brazil, then expanded to Australian and Canadian users from the middle of August, well ahead of this week’s deadline.

Underneath it sits Family Link, the existing parental control app that lets a parent decide whether and when to share a child’s age bracket with an app, alongside a feature called Restrict Minor Access that can hide an 18+ listing entirely from an account the Play Store already knows belongs to someone under 18.

Microsoft rounded out the big three storefronts with its own announcement in August, confirming that Australian users buying or downloading anything rated 18+ through the Microsoft Store or Xbox will be asked to “simply and securely confirm they are over 18 years old,” while anything already purchased or downloaded stays playable regardless of whether that check has been completed.

For the verification itself, Microsoft is routing users through third-party age assurance vendors Yoti and Verifymy, offering a choice between an email confirmation, a facial scan the company brands as a secure selfie, a scanned government ID, or a credit card check.

The Ratings Problem Underneath

The push for app store level checks follows a University of Sydney study published in September last year that found roughly one in five of the top 100 games on Apple’s App Store, and almost half of the top 100 on Google Play, carried the wrong Australian age rating.

Dr Marcus Carter, who led the research, put it bluntly at the time, saying “the rules are there, but they’re not being enforced,” and pointing out separately that the $6,000 fine available for a mislabeled app was nowhere near enough to change anyone’s behavior.

That criticism has followed the industry into this latest, much larger round of enforcement. It matters here because an age gate is only as reliable as the rating sitting underneath it.

Australia tightened its classification rules in September 2024 so that games with simulated gambling mechanics, think poker machine style titles such as Slotomania, Heart of Vegas or DoubleU Casino, have to carry an R18+ rating rather than something more permissive

But if a title has not been reclassified correctly, it can still slip through the new checks untouched, at least until someone catches the error.

What Changes For Australian Families

For most adult Australians with an established account, the change will likely be invisible.

The friction shows up on shared family devices, on accounts a parent set up years ago using a made-up birthdate, and most of all on any phone or tablet where a child is signed in under an adult’s own login, which remains a common setup in Australian households.

eSafety’s own research suggests roughly one in three young people who have come across online pornography did so unintentionally before they turned 13, often through nothing more than a misleading search result or a shared link, and it is exactly that kind of accidental exposure this layer of the code is meant to close off.

It also is not the end of the rollout, with the social media minimum age for under 16s in force since December, the search engine login checks arriving in June, and this app store deadline completing the picture eSafety has been building piece by piece since 2025.

Privacy advocates have raised concerns about how much age-related data is now being collected across so many services at once, even though the codes themselves do not require a government ID or any data sharing with government by default and leave the method up to each company.

Whether that balance holds up in practice is a debate that looks set to run well past Tuesday.