Age-identification-gate honeypot: Why 2026 compliance is a hacker's best friend

One person's compliance is another person's gold mine.

The Australian eSafety Commissioner's "Social Media Minimum Age" became binding from March 2026. At the same time, a range of other businesses such as Real Estate professionals, law firms, and accountants have become subject to the "tranche 2" provisions of the AML/CTF laws. 

In each case, affected businesses are compelled to implement various identification methods and record keeping. For social media companies, this has necessitated collecting biometric information (such as facial scans), and trusted age verifying personal information (such as government IDs), and other digital attributes on a scale never before seen. 

While these age verification tools are meant to apply to minors, by drawing an age-based line in the sand, adults also need to undergo this verification resulting in a huge amount of data collection by these companies, and critically, by their supply change validation partners (who may or may not utilise 4th party AI providers).

This session deconstructs the legal considerations, and the data and personal information crisis arising from these legal changes. While the goal on both cases is to create a safer environment or reduce fraud, the result is the creation of massive high-value biometric databases - the ultimate 'honey-pot' for threat actors.

Our panel of legal and technical professionals will discuss these compliance requirements, look at how they affect what direct (and indirect) businesses may need to look at, and how the liability landscape has shifted once again. We will also look at how some threat actors are using legitimate techniques to validate whole databases of information that they have scrapped.