APAC Age Assurance: Operational Insights Beyond the Regulatory Fragmentation Narrative
Across Asia-Pacific, the conventional account of age assurance is fragmentation. Different countries have come up with different rules on when and whether to establish a user’s age before granting access to digital services. But a country-by-country account of those differences misses a more important challenge: the rules define what organisations must achieve without settling how they must achieve it. They leave companies to make choices about acceptable age assurance methods, the level of reliability to target, and where responsibility should sit within the technology stack.
These choices are being shaped outside formal regulatory instruments. They are emerging through, for instance, risk assessment filings, service restriction and restoration procedures, government-commissioned technical trials, and international standards. These processes can influence what regulators expect companies to change or demonstrate where the law leaves room for interpretation. For organisations, that means policy engagement cannot be limited to consultation windows and reading legislation. They also need to understand how regulatory expectations are developing outside formal rulemaking and play an active role in shaping them.
At a glance
No common operational standard for age assurance exists. Countries have adopted the same broad obligations: age assurance, parental consent, risk assessments and product design. The differences lie in how those objectives are operationalized: the method of assurance, the degree of reliability, and the point within the stack (i.e., device, app store or service) where assurance is required.
Regulatory expectations are emerging outside formal rulemaking. Regulator review of risk assessments, negotiations in response to service restrictions, government-commissioned technical trials, and developing international standards can each shape what organisations are expected to demonstrate or change. Traditional engagements only organised around consultation windows and bill committees do not neatly capture these stages.
The obligations overlap. The operational choices vary.
Frameworks in the region generally ask organisations to do some combination of the following: establish user age to some degree of confidence; obtain parental consent; assess the risks their services present to youths; and/or design product safety features. What differs is how each market expects those objectives to be met in practice.
Australia illustrates one approach. The Children's Online Privacy Code, pending registration in December 2026, would apply high-privacy defaults, age assurance expectations and mandatory privacy impact assessments for high-risk processing activities. Malaysia takes a more prescriptive approach, requiring verification via government-issued records to keep under-16s away from social media platforms. Indonesia's PP Tunas takes a more differentiated approach by imposing five age bands, parental consent and child safety risk assessment obligations. Komdigi is also preparing rules, subject to public consultation, that would require social media users to register their accounts with a phone number.
Singapore currently focuses on age checks at the distribution layer. Its Online Safety Code requires app stores to prevent users under 18 from downloading age-inappropriate apps. Notably, what counts as age-inappropriate is judged against each store's own content rating system rather than a scheme set by the authority. A commercial rating taxonomy therefore contributes to defining the practical boundary for age assurance. Platform-level obligations are next. Age checks on social media currently rely largely on self-declaration, but the government has confirmed it will introduce legislation in 2027 requiring social media platforms to implement effective age assurance and safer features.
Elsewhere, both chambers of the Philippine Congress passed child online safety bills which are currently awaiting reconciliation. The Senate’s version would bar under-18s from social media, while the House’s would bar under-13s and restrict access for 13 to 17-year-olds. In South Korea, separate bills before the National Assembly would add children and adolescents to the AI Basic Act’s vulnerable groups and mandate age verification for AI services.
These obligations recur across the region — what varies is how each obligation is expected to be operationalized. An organisation cannot assume that a system built to satisfy one market will satisfy the next, or that a market it has already complied with will not add a second layer (e.g., Singapore complementing app store-level age checks with a platform-level one).
The operationalisation challenge
Three things would have to be settled for a common operational standard for age assurance to exist: the acceptable methods, the degree of reliability, and the layer (i.e., operating system, app store, and/or service) that owes the duty. None of the three is settled in the region. Unlike aviation, where bodies like the International Civil Aviation Organisation produce harmonised global standards, age assurance has no equivalent standard-setter that directly influences national laws. As such, individual jurisdictions are answering these three questions differently.
On method. Several jurisdictions generally allow for multiple approaches. Singapore’s app store code, for example, permits the use of government-issued identity documents, credit card data, facial age estimation and analysis of online usage data. Malaysia is the exception, requiring verification against government-issued records. Australia's eSafety takes a different approach: platforms must always offer a reasonable alternative to government ID or accredited digital ID services. As a matter of regulatory design, prescribing a single closed list of accepted methods would reduce ambiguity, but it would also risk excluding people without official documents from access to information. For organisations, the implication is that an age verification flow designed to satisfy one market may not satisfy another.
On reliability. There is no common regional benchmark for demonstrating that an age assurance mechanism is sufficiently effective. Australia's Age Assurance Technology Trial, the most comprehensive public evaluation of these technologies in the country, found that age estimation is workable but probabilistic, with considerable room for error. Different methods produce different levels and types of assurance, and regulators have not translated those differences into a universal standard. The result is a degree of flexibility for regulators — and a corresponding responsibility for companies to be able to explain why the approach they have chosen is proportionate to the risks in question.
On where the duty sits. Age can be established at the app store, at the operating system (OS), or at the service layer. App store and OS level providers have begun releasing age signal interfaces that pass an age range from one layer to another. Australia eSafety's regulatory guidance, for instance, encourages providers to consider cross-platform authentication and interoperable solutions, including age signals shared from app distribution services and devices. This raises an important question for organisations operating across layers: whether an upstream signal can satisfy, or only support, a service's own assessment.
Taken together, these are the unresolved questions beneath the fragmentation narrative. In each of these areas, organisations are making choices that regulators and courts may later test.
Where regulatory expectations are emerging
While formal rules leave some questions open, expectations can nevertheless emerge through other regulatory processes:
Risk assessment review. Indonesia requires platforms to submit child safety risk assessments, which Komdigi verifies before assigning each product a risk profile. Where regulators review those submissions and require revisions, the process can communicate expectations about how a company should identify and address risks, which could include access gating. As such, the review could become a channel for shaping age assurance expectations without formal rulemaking. In addition, public announcements can provide signals about how the findings for particular organisations may be applied to the broader market.
Blocking and restoration. In January 2026, Indonesia, Malaysia and the Philippines temporarily restricted access to Grok over concerns about its image-generation capabilities. Access was subsequently restored following commitments to introduce additional safeguards and technical changes. These cases illustrate how product expectations can emerge quickly through individual regulatory interventions, even where the reasoning and resulting expectations are not published as general rules. What a regulator will accept as the condition for restoring a service (e.g., an age gate, a withdrawn capability, a design change) could harden into a working expectation under child safety laws.
Technical evaluation. Australia's Age Assurance Technology Trial offers a valuable evidence base for regulators in the region, and the independent assessment body that conducted it has informed thinking in other markets such as Indonesia. While a commissioned trial is not law, a large, independent evaluation could become a shared evidence base for policymakers and organisations to assess available technologies and shape what constitutes effective age assurance. A government's decision to commission and fund a trial is itself a market signal — it directs attention and vendor investment toward the methods under examination, ahead of any formal rule. For organisations, these processes also present an opportunity to contribute technical evidence, operational insights and implementation experience, helping ensure that emerging regulatory expectations are informed by practical considerations and demonstrable safety outcomes.
Global standards and norms. In December 2025, ISO/IEC published 27566-1, the first international framework standard for age assurance systems. Further standards such as ISO/IEC 27566-2 and ISO/IEC 27566-3, which provide guidance on implementation and evaluation, are still in development. That said, voluntary global standards do not decide which methods a market accepts and whether they satisfy individual regulations. The value of global standards lies in a shared vocabulary and evidence base, which can shape what regulators treat as a credible approach well before they adopt a legally binding standard.
For government affairs and public policy functions accustomed to consultation windows and bill committees, these processes do not map neatly onto traditional approaches of engagement. None of these mechanisms is equivalent to a binding, generally applicable standard. But each can influence what a company is expected to demonstrate or change in practice.
The rules are still being developed for AI assistants
The age assurance question becomes more complicated for AI assistants because regulators are still determining which laws should apply to them in the first place.
Australia runs two regimes with different triggers. The under-16 restriction turns on purpose, capturing services whose sole or significant purpose is to enable online social interaction between users. This appears to exclude general-purpose AI assistants. In comparison, the Age-Restricted Material Codes turn on whether age-restricted material can be accessed or generated on a service, which may bring the same AI assistant into scope. The same general-purpose assistant could therefore fall within one framework but not the other, because one test looks at purpose and the other at capability.
Other jurisdictions are drawing the boundary differently. Korea's pending bill is expected to directly target conversational and generative AI services used by minors, while Thailand's draft AI Act takes a risk-based approach that subjects chatbots and generative AI to transparency obligations.
The broader point is that the classification test itself can vary. One framework may turn on the purpose of a service, while another may turn on its capabilities or the content it enables. In the meantime, organisations might have to make policy decisions around how each law applies to their products and develop a robust rationale for these decisions.
What this means for business
The developments above point to a single strategic choice: whether to help shape expectations while they are still forming, or to adapt to them once they have hardened. Three questions help locate where your organisation stands.
Can you distinguish the rule from the emerging expectation? As regulators review risk assessments, respond to individual incidents, or commission technical evaluations, expectations can develop before they are codified into regulation. Organisations need to understand not only what the law requires today, but also where regulatory expectations may be heading and what evidence or policy rationale is shaping that direction.
Can you show that the measure improves safety outcomes, or only that it restricts access? Age assurance is just one measure for operationalising child safety. And evidence that a gate is difficult to circumvent is not the same as evidence that young users are safer. The broader question is whether the combination of measures addresses the risks that a particular market’s child safety framework is intended to mitigate, not simply whether the age gate holds.
Are you prepared to engage before the regulatory position hardens? Once a regulatory expectation has crystallized through an enforcement action, service restriction, or other intervention, the room to shape the discussion may narrow. Companies that have already considered their policy position, preferred outcomes and implementation approaches are better placed to engage constructively and rapidly. The question is not simply how to respond to emerging requirements, but how to contribute constructively to regulatory frameworks that are effective, proportionate and workable in practice.
The Author
Nanda Min Htin is a Consultant at Emergent and a privacy and AI lawyer specialising in data governance, responsible AI, frontier AI safety and child online safety. With experience across the United States and Asia-Pacific, he has advised and engaged governments, businesses and civil society on emerging technology policy, and contributed to global AI governance discussions and publications.
About Emergent
Emergent advises technology companies on technology policy and regulatory strategy across Asia-Pacific. We help clients understand emerging regulatory expectations, develop policy positions, and shape engagement strategies with governments and regulators. Our work spans policy diagnostics, board briefings, position development and regulatory scenario planning.
