OpenAI’s Australian youth blueprint links product controls to policy
OpenAI’s Australian youth blueprint links deployed ChatGPT teen controls to proposals for age assurance, crisis response and independent assessment.
OpenAI has published an Australian Youth Safety Blueprint that links six policy proposals to a product already being rolled out. ChatGPT for Teens is an under-18 experience with stronger content restrictions, age prediction and optional parental controls. The proposals ask Australia to encourage AI literacy, require age-appropriate safeguards and crisis processes, protect privacy during age assurance, and make providers submit to independent assessment.
The distinction between product and policy is essential. The blueprint is OpenAI’s contribution to a live policy debate, not government policy. Its description of ChatGPT is a company account of its own safeguards, not an independent finding that they work reliably. Australian families, schools and policymakers need to know which protections exist now, what OpenAI wants the law to require and what evidence is still missing.
What is already in ChatGPT
OpenAI’s dated ChatGPT for Teens launch says the product began rolling out on 18 August 2026, while the Australian blueprint launch page says that rollout included Australia. Users who state that they are 13 to 17, or whose accounts the company predicts belong to someone under 18, are placed into the teen experience. Where age is uncertain, OpenAI says it applies the safer setting.
The company describes stronger restrictions in areas including graphic violence, sexual or romantic roleplay, dangerous activities, self-harm and disordered eating. Its current help documentation still uses rollout language, says full Australian availability was expected on 8 September, and warns that feature availability can vary by region. The page does not establish whether every eligible Australian account has received the experience. ChatGPT for Teens is the same service with different policies, product interventions and settings applied to an account, rather than a separate child-only model.
Age prediction decides which experience an account receives. OpenAI says its model considers a combination of account and behavioural signals, including account age, typical activity times, usage patterns and a stated age. An adult put into the teen experience can ask for it to be removed by verifying their age through Persona. The age-prediction help page says Persona may request a live selfie, government-issued identification or both, depending on country. Persona deletes uploaded identity material within seven days, while OpenAI receives age-related information rather than the submitted image or document.
Those privacy claims cover only part of the lifecycle. Behavioural age inference still processes information about how an account is used. The reviewed material contains no independent Australian error analysis showing false-teen and missed-teen rates across relevant user groups or patterns of shared-device use. The blueprint says adults can restore access promptly, but supplies no public completion or failure rate for the Persona path. These evidence gaps do not show that age prediction or verification fails; they prevent outsiders from judging how well either works.
Parental controls apply only after a parent or guardian and teen link their accounts. OpenAI’s current parental-controls FAQ says either party can initiate or end the link, a parent cannot read the teen’s conversations, and linked parents can manage selected settings and schedules. OpenAI’s parental-controls launch description says serious concerns are reviewed by specially trained staff. The current FAQ says safety notifications are enabled by default for linked accounts in limited high-risk situations, are not real-time monitoring and do not replace professional care or emergency services. OpenAI acknowledges that the system is imperfect.
The blueprint recommends that AI companies notify connected parents by default when a teen expresses suicidal intent. This is a proposed crisis-response protocol for the sector. OpenAI documents a narrower current product condition: the accounts must already be linked, automated systems must detect a serious concern, and a trained reviewer assesses it before an alert. The company says it limits what is shared and does not send the conversation transcript.
What the blueprint asks Australia to require
The six pillars extend beyond OpenAI’s product. They call for responsible AI adoption and literacy; privacy-protective age assurance; under-18 safety policies; protection from manipulative or deceptive interactions; documented crisis-response protocols; and accessible parental controls. The document also argues for risk-based legislation and practical independent assessments, backed by common standards and plain-language public summaries.
Independent assessment is the blueprint’s strongest accountability proposal. Product documentation can describe intended behaviour, but it cannot establish how often age prediction routes an account correctly, how reliably a safeguard holds under ordinary or adversarial use, or whether an alert reaches useful support in time. An assessment could test those questions if reviewers have suitable access, publish methods and failure categories, and examine more than the existence of a policy document.
The blueprint does not specify who would approve assessors, which metrics would be mandatory, what error thresholds would pass, or how researchers could examine sensitive crisis systems without exposing personal data. It recommends an assessment layer rather than supplying the standard. Those design choices will determine whether an audit is evidence of performance or mostly evidence that a process took place.
AI literacy also needs a clearer operational meaning. Encouraging young people to question model outputs is useful, but education cannot compensate for weak product controls. The blueprint itself says primary responsibility should not fall on families. A workable framework needs critical use by young people alongside measurable duties for the companies deciding how the system identifies, responds to and retains information about them.
Australia is not starting from zero
The proposal arrives after parts of Australia’s youth-safety framework have already taken effect. The eSafety Commissioner’s Age-Restricted Material Codes guidance says the relevant codes for designated internet services, including generative AI services, commenced on 9 March 2026. Depending on a service’s risk, providers must use age assurance or strong guardrails to address children’s access to sexually explicit, self-harm or high-impact violence material. eSafety can monitor systemic non-compliance and take enforcement action.
The regulator’s detailed guidance on age assurance is more operational than the blueprint. It says methods should be tested before and during use, encourages external audits or independently validated testing, and tells providers to monitor circumvention, demographic effects, privacy complaints and data breaches. It also says safeguards should improve as better, less intrusive techniques emerge.
Privacy law provides another constraint. The Office of the Australian Information Commissioner’s March 2026 guidance tells organisations to assess whether age assurance is necessary and proportionate, conduct a privacy impact assessment, monitor bias and discrimination, offer low-intrusion options where possible, explain review processes, minimise retained data and destroy or de-identify inputs when their purpose is complete. A seven-day deletion promise for a verification image addresses only part of that lifecycle. Providers must also justify the signals used before verification, the information retained afterwards and the way a wrong decision can be challenged.
A broader Digital Duty of Care is still being designed. The government released the exposure draft on 8 September and set 22 September 2026 as the consultation deadline. It is not enacted law. The draft Bill would require providers of in-scope online services to ensure a safe online environment so far as reasonably practicable, conduct written risk assessments, document proposed measures and their expected effectiveness, review them at least annually and before changes that could add risk, and make assessments available to eSafety on request.
OpenAI supports an outcomes-based duty but asks for obligations tailored to each service and for beneficial youth access to be preserved. That position aligns with its product strategy: route teens into a restricted experience rather than exclude them. It is still an interested company’s preferred regulatory design. The consultation must test whether flexible duties will produce comparable evidence and timely remedies across providers, especially where companies control the data needed to judge their own safeguards.
The evidence to ask for next
The blueprint connects age detection, default safeguards, offline support, parental tools and external scrutiny. The unanswered question is how those parts perform together in deployment. Answering it requires evidence that follows the whole system.
For age assurance, providers should report error rates by method and relevant user group, the proportion of uncertain cases sent to the safer experience, completion and failure rates for appeals, data retention, and known routes around the check. For under-18 safeguards, reporting should cover representative and adversarial testing, the severity of failures, changes after deployment and whether performance differs by language or product feature. Crisis processes need high-level evidence about detection, human-review delays, false alerts, missed cases and referral outcomes without exposing a young person’s private conversation.
Independent assessors also need enough access to examine the deployed system rather than a demonstration prepared for review. Public summaries should state the version tested, dates, scope, methods, limitations and remedial work. Without those details, “independent assessment” can sound stronger than the evidence it produces.
Families and schools have a narrower decision. ChatGPT for Teens and optional linked parental controls are documented as rolling out, but no control makes a generative system risk-free. Check whether the teen experience is active, understand what account linking does and does not reveal, and keep human support available for high-stakes situations. Policymakers can use the blueprint as a set of claims to turn into testable duties. Success should be judged by published evidence about how protections behave in practice, not by how complete the framework looks on paper.
This analysis is based on public documentation from OpenAI, Australian regulators and the Australian Government. Index Us did not use a teen account, test age prediction or Persona verification, trigger a safety notification, audit OpenAI’s systems, or assess an individual mental-health situation.
Sources
- OpenAI — News RSS
- OpenAI — Introducing the Australian Youth Safety Blueprint
- OpenAI — Australian Youth Safety Blueprint PDF
- OpenAI — ChatGPT for Teens
- OpenAI — Our approach to age prediction
- OpenAI — Introducing parental controls
- OpenAI Help — Age prediction in ChatGPT
- OpenAI Help — ChatGPT for Teens
- OpenAI Help — Managing parental controls in ChatGPT
- OAIC — Age assurance technologies and privacy obligations
- eSafety Commissioner — Online Safety Codes and Standards Regulatory Guidance
- eSafety Commissioner — Age-Restricted Material Codes FAQ
- Australian Government — Digital Duty of Care exposure draft consultation
- Australian Government — Digital Duty of Care exposure draft Bill
Last reviewed: . See our editorial policy for how we test, source and correct our work.