When Even Google Warns of Mass Surveillance: Australia’s Online Safety Nightmare
There is something deeply ironic about Google, one of the greatest corporate collectors of personal information in human history, warning the Australian government that its proposed online safety legislation threatens to establish a system of mass surveillance. Yet that is precisely what has happened. And on this occasion, Google has a powerful argument. When a corporation whose business model depends heavily upon collecting and analysing information warns that government regulation could require intrusive monitoring of private communications, Australians should pay close attention.
According to a November 10 report by Reclaim the Net, Google representatives told a Senate inquiry that the Albanese government's proposed Digital Duty of Care legislation could require age verification across services extending far beyond social media or pornography websites. These could include Gmail, private messaging and Google Drive, services used daily by millions of Australians for personal communications, business correspondence and the storage of private documents.
Google's Rachel Lord warned that the legislation's provisions concerning material potentially accessible to children could create obligations to verify users' ages and restrict access by those who could not demonstrate that they were adults. More troublingly, the company raised concerns that compliance could require intrusive examination of private communications and stored files. The government insists that it does not intend to exclude children from email services or ordinary internet use. But Google's objection is that the wording of the legislation may have consequences extending far beyond those stated intentions.
That distinction is fundamental. Citizens are governed by legislation, not by ministerial assurances about what legislation is supposed to mean. A government can promise that a new power will be used only against dangerous material, but if the statutory language permits a broader application, the public remains dependent upon the restraint of regulators and future governments. Constitutional government should not operate upon the assumption that officials will always exercise extensive powers benevolently.
The proposed legislation had passed the House of Representatives and was under Senate scrutiny in November 2026. Its critics argued that broad definitions of harmful material, combined with substantial penalties for non-compliance, could encourage platforms to monitor and restrict lawful communications more aggressively than necessary. Companies facing potentially enormous financial penalties have every incentive to adopt the safest regulatory interpretation, even when that means removing controversial material or excluding legitimate users.
This is how censorship can develop without a government minister personally ordering the suppression of a particular opinion. The state creates legal obligations, regulators interpret those obligations, and private companies enforce them through automated systems. Responsibility becomes dispersed throughout a bureaucratic and technological network. The individual whose account is blocked or whose material disappears may find it extremely difficult to identify who made the decision, why it was made, or how it can be challenged.
The implications for freedom of speech are obvious. Political discussion frequently involves subjects that are disturbing, controversial or unsuitable for young children. Debate about crime, sexuality, war, immigration, religion and government misconduct cannot be reduced to harmless nursery conversation. If platforms are encouraged to treat potentially offensive or disturbing material as a regulatory liability, the predictable result is a chilling effect upon legitimate public debate.
But there is another aspect of this emerging system that deserves much more attention: the extraordinary unreliability and inconvenience of age-verification technology itself.
The problem is not merely theoretical. In recent attempts to access material on Substack, an adult Australian pensioner encountered repeated demands to establish that he was over eighteen. Attempts to satisfy the verification process, including facial age estimation, failed to establish his adult status. Further efforts over several days led through frustrating verification procedures and apparent loops without restoring access. The individual concerned was not a teenager attempting to evade parental controls, but a pensioner seeking to read lawful online publications.
This is a remarkable state of affairs. An adult who has lived for nearly seven decades can find himself unable to convince a computer system that he has reached the age of eighteen. The absurdity would be amusing were it not for the serious implications for freedom of information.
That experience does not establish that Substack's particular verification problem was caused by the proposed Australian legislation. Nor does it prove that all age-verification systems are equally defective. It does, however, provide a practical warning about the consequences of making automated age assurance a condition of access to increasingly large portions of the internet.
Consider what happens when an age-verification system makes a mistake. A person may possess legitimate identification, yet the system may fail to recognise it, reject the submitted information, or become trapped in a procedural loop. Facial age estimation is inherently probabilistic. Lighting conditions, camera quality, facial characteristics and the limitations of the underlying algorithm can all affect its conclusions. Even a system that performs well in aggregate can make serious errors in individual cases.
For the person excluded, statistical assurances about overall accuracy are of little consolation. A system that correctly classifies most users can still unjustly prevent substantial numbers of adults from accessing information.
There is also the question of technological exclusion. Not every Australian owns a modern smartphone, possesses a current passport or driver's licence, or can navigate complex digital identity procedures. Elderly Australians, people with disabilities, those on low incomes and individuals who deliberately minimise their digital exposure may encounter particular difficulties. A supposedly universal right to access lawful information can become dependent upon possession of particular devices and documents.
What is especially objectionable is the reversal of the traditional presumption of freedom. In an open society, an adult should ordinarily be free to read lawful material without first establishing his identity or proving his eligibility to a commercial intermediary. Under increasingly elaborate age-assurance systems, that presumption is reversed. Access is withheld until the individual satisfies a technological gatekeeper.
The surveillance implications extend beyond the immediate verification process. Depending upon how systems are designed, age checks can involve identity documents, facial images, biometric analysis, third-party verification services or other personal information. Privacy-preserving age assurance is technically possible, and some systems are designed to avoid disclosing a user's identity to the website being accessed. Nevertheless, any framework that encourages widespread identity checking creates risks of excessive data collection, breaches, profiling and the gradual normalisation of identification requirements.
It is not necessary to claim that every age-verification service creates a permanent government database of internet users. The more defensible criticism is that compulsory verification expands the number of situations in which people must submit to identity or age checks, while creating powerful incentives for companies to monitor and classify their users.
There is an additional danger in the proposed Digital Duty of Care framework. If online services must assess whether users might encounter certain categories of harmful material, compliance may encourage broader examination of communications and stored content. Google has specifically warned about the absence of adequate privacy protections for private communications and file storage. The possibility that ordinary email and cloud storage could become subject to expanded monitoring obligations should alarm anyone who values personal privacy.
Supporters of the legislation argue that children face genuine online dangers. They are correct. Pornographic material, exploitation, harassment and harmful platform design can create serious problems, and parents have legitimate reasons to demand stronger protections. But the existence of a real problem does not establish that every proposed regulatory solution is justified. A measure must be judged not merely by its stated objective but by its effectiveness, proportionality, foreseeable consequences and potential for abuse.
A government genuinely concerned with protecting children should be able to explain why its legislation cannot be confined to clearly defined harmful services and conduct. It should also explain how lawful private communications will remain private, how adults wrongly excluded by verification systems can obtain prompt redress, and how citizens can access ordinary information without surrendering unnecessary personal data.
The experience of age-verification failures suggests that these are not peripheral administrative questions. They go to the heart of whether the system can operate fairly. If the technology cannot reliably distinguish a pensioner from a minor, the answer cannot simply be to impose the technology more widely and hope that the errors eventually disappear.
There is also a broader political issue. The internet has allowed independent journalists, small publishers, political dissidents and ordinary citizens to communicate without requiring the permission of traditional media institutions. This has weakened the gatekeeping power of established broadcasters and newspapers. Regulations that increase compliance costs, encourage automated content suppression and require elaborate identity systems may unintentionally strengthen the position of the largest corporations, which possess the resources to satisfy complex regulatory requirements.
Smaller publishers may not be so fortunate. The more expensive and legally dangerous online publication becomes, the greater the pressure towards concentration of control in a handful of major platforms. A policy advertised as protecting citizens from powerful technology companies could ultimately reinforce those companies' dominance.
Australia's existing under-sixteen social media restrictions, which commenced in December 2025, already demonstrate the government's willingness to make age-based access restrictions a central instrument of internet policy. The proposed Digital Duty of Care legislation raises further questions about how far that regulatory philosophy might extend. It is essential to distinguish the existing restrictions from the proposed new obligations, but they belong to a wider movement towards increasingly comprehensive regulation of online activity.
The central issue is not whether children deserve protection. They plainly do. It is whether protecting children requires the creation of a digital environment in which adults must repeatedly prove their eligibility to read, communicate and exchange information, while private companies face pressure to inspect and classify ever more of their users' activities.
Google's warning is important precisely because it comes from a company with considerable technical knowledge of what such compliance systems might require. Its commercial interests should not be ignored, but neither should they be used to dismiss the substance of its objections. When even Google believes proposed legislation could create unacceptable privacy risks, Parliament has an obligation to investigate those risks rather than wave them away.
The absurd experience of an elderly Australian being unable to establish his adulthood to an automated verification service is a small but revealing glimpse of what could become a much larger problem. A free society should not require citizens to negotiate with defective algorithms before they can read lawful publications.
Australia is in danger of constructing a digital regulatory system in which surveillance becomes routine, censorship becomes an exercise in corporate risk management, and access to information becomes a privilege granted by automated verification machinery. That would be a profoundly unfortunate outcome for legislation promoted in the name of public safety.
The government should narrow the proposed obligations, explicitly protect private communications and file storage, and ensure that any age-assurance requirements are proportionate, privacy-preserving and subject to meaningful independent review. Above all, Parliament should reject the assumption that every social problem can be solved by extending digital monitoring and bureaucratic control.
An internet that is safe only because its users are constantly checked, classified and potentially excluded is not a free internet. Australians should insist upon having both safety and freedom, rather than being told that the former requires the progressive surrender of the latter.
https://reclaimthenet.org/google-warns-australias-online-safety-bill-would-bring-mass-surveillance
