by Joshua Riley

A well-connected lobby group with direct access to the Prime Minister privately proposed an internet regulator, age verification, and platform accountability – seven weeks before the select committee inquiry began. The committee delivered all of it, plus ten additional recommendations no submitter was consulted on. Three OIA requests confirmed no government agency assessed privacy-preserving alternatives or conducted a Privacy Impact Assessment – despite Australia explicitly warning the risks were “significant.” The Free Speech Union's OIA confirmed no legal advice exists on whether any of this is compatible with the Bill of Rights Act. Meanwhile, DIA is already spending $30.7 million building the enforcement system before any legislation has been introduced to Parliament. The original three-page bill to keep under-16s off social media has become the vehicle for a comprehensive internet regulation regime modelled on the UK – where 12,000 people a year are arrested for social media posts.

The UK cautionary tale

The UK minister who drafted their Online Safety Act now wants it repealed. New Zealand's select committee wants us to follow her blueprint.

Nadine Dorries was the UK Culture Secretary who shepherded the Online Safety Bill. She designed it, she says, for “the simplest of reasons: to protect children from harmful online content such as material relating to suicide, violence and pornography.”

But once the bill was in play, every MP wanted to add their own provision. Dorries describes it as a “Christmas Tree Bill” – censorship of adult speech, surveillance tools, personal data harvesting, and every other pet project were hung on it as conditions for MPs' votes. In her own words: “Frankly, I was held to ransom.”

The final Act ran to over 230 sections. Its original child-protection purpose had been overtaken. Dorries now calls for its full repeal: “Free speech will become the cornerstone of the British way of life and this appalling policy mistake will be reversed for ever.”

Since the Act took effect, VPN apps became the most downloaded on Apple's UK App Store. Over 550,000 people petitioned Parliament for repeal – one of the largest public expressions of concern about a UK digital law in recent history. Approximately 12,000 people a year are arrested for social media posts under the Communications Act and Malicious Communications Act, including posts critical of government immigration policy.

New Zealand's select committee explicitly recommended we be a “fast follower” of this model.

The original bill

Catherine Wedd's Social Media (Age-Restricted Users) Bill was about three pages long, extremely short and very narrow in scope. It did one thing: require designated platforms to take reasonable steps to prevent under-16s from accessing their services, with civil penalties if they didn't. No regulator. No algorithm controls. No platform design liability. Nothing beyond age gating.

That was the bill that went to the select committee.

B416: the lobby group

Seven weeks before the select committee inquiry began, a lobby group called B416 was already at work.

B416 describes itself as “proudly non-partisan” and told the NZ Herald it has “not received funding from any company or industry that could benefit financially from this initiative.”

On 17 April 2025, B416 co-chair Cecilia Robinson sent Prime Minister Luxon a private aide-mémoire “outlining urgent steps to address the growing harm children face through unrestricted access to social media.” Separately, on 2 May she texted Luxon about scheduling his attendance at their launch: “Just a nudge in case there's any magic that can happen!” Luxon responded by connecting Robinson with his chief of staff Cameron Burrows, describing himself as “super excited about this work.”

Luxon attended B416's launch event on 11 May 2025 in Ōrākei, Auckland.

B416's leadership includes Anna Mowbray, co-founder of Zuru. Her brother Nick Mowbray's political donations are a matter of public record: over $600,000 to National and ACT since 2022. B416 co-chair Anna Curzon served on Jacinda Ardern's PM Business Advisory Council (2018–2020), was appointed by Ardern to the APEC Business Advisory Council (2021), and was reappointed by Luxon in 2024.

What B416 asked for – and what the select committee delivered

• B416 publicly called for:
• A minimum age of 16 for social media access
• Stronger “age assurance” verification systems
• A dedicated, Crown-funded online safety regulator with enforcement powers
• Platform accountability
• Legislation modelled on the Australian framework

400 New Zealanders submitted to the select committee inquiry. They submitted on a narrow bill about keeping under-16s off social media.

The select committee's final report delivered nearly every one of B416's asks – plus additional recommendations that were not in the original bill and that submitters were never consulted on:

1. Review of the legislative framework
2. Regulate algorithmic recommendation systems
3. Mandate algorithm transparency – force platforms to hand over proprietary designs
4. A catch-all delegation to the regulator for “further matters”
5. Explore restricting VPN use
6. Collaboration with ISPs and cell providers

Nearly every recommendation that appeared in the final report but was absent from the original bill had already been proposed in B416's aide-mémoire – delivered to the Prime Minister seven weeks before the inquiry began and months before public submissions opened.

A compromised process

ACT MP Parmjeet Parmar initiated the select committee inquiry. She expected it to explore how social media harm could be properly addressed. Instead, she says, committee members had “predetermined solutions” and jumped to those rather than doing the work properly.

The committee didn't seek advice from the Department of Internal Affairs on how an age ban would actually work. The reason given was that Education Minister Erica Stanford was “doing some work in that regard, so they didn't want to provide advice to the select committee.”

The select committee – Parliament's mechanism for independent scrutiny – deferred to the minister it was supposed to be holding to account. Parmar said this “really undermined the role of the select committee” because “select committee should have done this work independently of government.”

She said there was “a material gap in the evidence heard and advice received, and the majority of the select committee jumped to recommend a social media ban for under 16 year olds.”

Even the Greens dissented, warning that age restrictions “could drive youth from regulated platforms to other fringe, unregulated, and harmful platforms” and expressing scepticism that age verification technology exists that doesn't infringe on the privacy of all users.

The committee's own report acknowledged the intervention was “highly intrusive” – but recommended it anyway. And it noted it “did not have information on the government's proposed approach so could not indicate the cost-effectiveness and financial implications.”

ACT's formal dissent called the outcome “embarrassing” and said the committee “substantially failed” its task, having “proposed measures that expand government overreach through new regulators with unclear mandates, effectively endorsing a framework requiring New Zealanders to provide their ID digitally, and raising the spectre of regulating the very tools that protect New Zealanders' privacy.”

What no one checked

Three OIA requests to Minister Stanford's office and the Department of Internal Affairs confirmed that no government agency conducted a comparative analysis of privacy-preserving age verification versus surveillance-based approaches. No Privacy Impact Assessment was produced.

I specifically asked whether anyone had compared device-based verification – where your phone confirms you're over 16 without revealing your identity – against provider-based verification, where platforms like Meta and TikTok verify you directly, likely requiring ID uploads or facial biometrics.

Every agency came back the same way: no such analysis exists.

The technology to verify age without ever identifying the user is not theoretical. Zero-knowledge cryptographic proofs – proven since the 1980s -allow a device to confirm “this user is over 16” without revealing who they are. Blind signature protocols go further: even the authority that issued the credential cannot link it back to the user, even under government compulsion. The select committee's own report acknowledged that privacy-preserving verification technology exists – then buried it in Chapter 4 as an “emerging, albeit as yet imperfect, potential solution” and never recommended it.

Australia's Attorney-General's office directly warned DIA that the privacy implications of an under-16 ban were “significant” and needed to be factored into New Zealand's planning. DIA confirmed there was no reply, no follow-up meetings, and no further correspondence after that warning.

Separately, the Free Speech Union's OIA (OIA2526-1145) confirmed that no legal advice exists on whether the proposed regime is compatible with section 14 of the New Zealand Bill of Rights Act – the right to freedom of expression. The Cabinet Manual requires rights implications to be assessed during policy design. They weren't.

Building the system before the law exists

The bill is now paused. Stanford has cited “wider work” following the select committee's broader recommendations.

But the Department of Internal Affairs isn't waiting. Budget 2026 allocated $30.7 million to DIA to “develop policy and possible regulatory options to improve children's online safety.” That's the language of policy scoping.

DIA is not scoping. It is building.

In April 2026, DIA advertised for a Programme Implementation Director to stand up a “Phase One operational service model” for the under-16 social media restrictions. Not a review of options: an operational system, to be implemented, before a single line of legislation exists.

When the Free Speech Union asked how DIA could implement a policy Parliament hadn't debated, the advertisement was pulled and rewritten. DIA claimed it had been published “in error.” Internal emails released under OIA describe the role as implementing the policy, not scoping it.

There are no documents analysing the political or reputational risk of this programme. There is no legal advice on whether it is consistent with the Bill of Rights Act.

As the Free Speech Union put it: “They are committing thirty million dollars to a system that decides who can speak online, and they have not asked their own lawyers whether it is lawful.”

The pattern

The New Zealand bill followed the same trajectory as the UK:

1. “Protect the kids” generates cross-party support.
2. A narrow, emotionally compelling solution – an Australian-style age ban – is pushed politically before the evidence base is established.
3. The select committee process is compromised: DIA isn't consulted, the outcome aligns with private lobbying, and the committee defers to the minister rather than scrutinising her.
4. The narrow ban morphs into a comprehensive regulatory framework: internet regulator, algorithm controls, platform liability, VPN restrictions, advertising regulation, and an open-ended mandate for “further matters.”
5. The conversation pivots to “wider work” – and the system is built before Parliament sees a bill.

This is where New Zealand sits right now: at step 5. The age ban was the vehicle. The “wider work” is the destination.

New Zealanders should decide for themselves whether this is about protecting children – or building the infrastructure to regulate what every citizen can say, see, and share online.

Joshua Riley is the leader of Sovereign, a New Zealand political movement. Authorised by A Riley Lvl 2, 40 Lady Elizabeth Ln, Wellington

Originally published on Joshua Riley on X.