Google has warned an Australian Senate inquiry that proposed online safety legislation could reach well beyond social media. According to reporting on the hearing, the company said the Online Safety Amendment (Digital Duty of Care) Bill 2026 could require age verification and block users under 18 from Gmail, messaging apps and Google Drive. The prospect of Australia age verification email messaging rules has raised fresh questions about how much personal data people may have to hand over just to use basic communication tools.

This post sticks to what has been reported so far. The bill is still under inquiry, and nothing described below is settled law.

What Google Told the Senate Inquiry

Google gave its evidence to the Senate inquiry on Monday. Its core message, as summarized in the source report, was that the Digital Duty of Care Bill 2026 could be read as requiring age verification for services that most people do not think of as social platforms. That includes email, messaging and file storage, and the result could be that users under 18 are blocked from Gmail, messaging apps and Google Drive.

A Liberal senator reportedly described the warning as opening the door to mass identity checks. The full article text available to us is brief, so we cannot detail the exact legal wording Google pointed to or how other witnesses responded. What is clear is that a major provider is telling lawmakers the scope of the bill may be broader than its intent suggests.

How Age Checks Could Reach Email, Messaging and File Storage

Much of the public debate in Australia so far has centered on social media. Those rules, covered in our look at the privacy costs of Australia's under-16 social media restrictions, apply to platforms built around public feeds and sharing.

Email, chat and cloud storage work differently. They are utilities for school, work, banking and family contact. If a duty of care framework is defined broadly enough, any service that lets people communicate or store files could in theory fall inside it. Google's warning suggests that the practical way to comply may be to verify the age of every account holder, not just those who look young or declare a birth date.

That matters because a blanket requirement would apply to adults too. To prove someone is over 18, a provider needs some form of evidence, and the verification then covers the whole user base.

What Identity Verification Means for User Data and Privacy

Age assurance methods generally fall into a few types, such as facial age estimation, ID document checks, or confirmation through other existing accounts. Each carries a different data trade-off:

  • Facial estimation involves submitting a biometric image, even if the stated aim is to estimate age rather than identify a person.
  • ID document checks involve handing over documents containing name, date of birth and address.
  • Account-based inference relies on information a company already holds, which can deepen the link between your identity and your activity.

Email and messaging are especially sensitive because they hold the content of private life. Tying a verified identity to an inbox or a file archive creates a more detailed profile than a social media check might. It also creates a new store of verification data that someone has to protect, retain or delete. Whether providers would keep that data, for how long and under what rules is the kind of question an inquiry like this is meant to examine.

What Users Can and Cannot Do to Limit Exposure

If rules like this do take effect, individual control will be limited. Compliance would be set by the provider and the law, so opting out may mean losing access to the service.

There are still sensible steps. Where a provider offers a choice of verification methods, compare what each one collects. Read the stated retention and deletion terms before you submit anything. Keep only the data you need in cloud storage, since verification could be tied to the account holding it. Avoid sharing identity documents through any channel that does not clearly explain how they are handled.

A VPN does not solve this. It can protect your connection from local network observers, but it does not change what a provider requires to confirm your age once you sign in. Treat it as one layer of privacy, not a workaround for identity rules.

What This Means For You

For Australians, the main point is uncertainty. The bill is under review, and Google's testimony is a warning about possible interpretation, not a confirmed outcome. If you use Gmail, messaging apps or Google Drive for work, study or family, it is worth understanding which accounts might be affected and whether alternatives exist.

For parents and teens, a possible under-18 block on core tools could affect schoolwork and communication. For adults, the concern is the verification process itself and the data it creates. For people outside Australia, this is a useful signal of how age assurance debates can expand from social media to everyday infrastructure.

Key Takeaways

  • Google told a Senate inquiry the Digital Duty of Care Bill 2026 could require age verification for Gmail, messaging apps and Google Drive.
  • A Liberal senator described the warning as opening the door to mass identity checks.
  • Different verification methods collect different data, so the details of any rule matter.
  • Do not change tools or habits yet. Follow the inquiry's outcome first.

To understand the trade-offs already documented, review our coverage of Australia's under-16 social media restrictions. Then watch how the inquiry responds to Google's concerns about Australia age verification email messaging rules before making any decisions about your accounts.