ACMA sets out the ‘triple lock’ for online wagering ads
ACMA’s initial guidance explains how age assurance, logged-in accounts and opt-out controls must work before online services show wagering ads.
Online content services will need to prevent certain users from seeing wagering advertisements from 1 January 2027, under new Australian rules that the communications regulator describes as a “triple lock”.
The Australian Communications and Media Authority published initial industry guidance on 12 November explaining how the exception is expected to work. The guidance follows amendments enacted in August and is aimed at providers preparing their services before the new requirements begin.
The core idea is that a wagering advertisement can be shown only when three protections are in place: the user is not restricted, the user is accessing the service through a registered account and the user has not opted out of wagering advertising.
Who counts as a restricted user
Under ACMA’s guidance, a restricted user includes someone under 18, a person whose age has not been confirmed, a user who is not logged in and a person who has opted out.
That means a service cannot rely solely on a general statement that it is intended for adults. It needs account and age-assurance processes capable of determining whether the user meets the conditions before a wagering advertisement is served.
ACMA says Australians must not be forced to use government-issued identification or a government Digital ID to prove their age. Providers that offer those methods must also provide a reasonable alternative.
The regulator recommends a risk-based approach to age assurance rather than prescribing a single technology. The appropriate method may vary with the service, its users and the likelihood of children accessing it. Privacy obligations continue to apply, including requirements overseen by the Office of the Australian Information Commissioner.
The opt-out has two stages
From 1 January, services covered by the rules need a service-specific mechanism that lets users opt out of wagering advertisements on that service.
A separate Wagering Advertising Opt-Out Register is planned, but its start date has not yet been proclaimed. Once that register begins operating, providers will need to check it at least every 14 days, unless another period is prescribed, and apply a registered user’s preference.
The staged approach matters for implementation. Providers cannot wait for the national register before building their own controls. The service-level opt-out and the other parts of the triple lock are required when the new prohibition starts.
What services need to build
Compliance will involve more than changing the wording of an advertisement. Providers need to connect identity, login, age-assurance and preference systems to the decision about whether a wagering ad is eligible to appear.
They will also need audit records capable of showing how that decision was made. ACMA’s guidance discusses the value of documenting risk assessments, testing controls and retaining evidence that safeguards are working.
For services that use several advertising suppliers or delivery platforms, the difficult part may be ensuring the same rules are applied across the entire chain. A provider remains responsible for the outcome even when another company supplies or places the advertisement.
The guidance is initial rather than final. ACMA says it may be updated as the industry implements the rules and the regulator gains experience with compliance. It is not a legislative instrument and does not replace the law or independent legal advice.
Why the guidance matters
The triple lock turns a broad policy goal into a set of technical and operational decisions. Age assurance must be effective without making one form of identity compulsory. Opt-out preferences must be stored and applied reliably. Advertising systems must be able to withhold content before it is displayed, rather than attempting to correct the result afterwards.
The rules also distinguish account-based services from open access. A user who is not logged in is treated as restricted, so an anonymous session cannot qualify for the wagering-advertising exception.
For users, the practical test will be whether the controls are easy to understand and consistently respected. For providers, the next seven weeks are an implementation period: systems need to be ready for the 1 January start even though some details, including the national register’s commencement, remain unresolved.
The guidance is another example of Australian regulators turning broad digital-policy goals into concrete technical controls. A similar control-first approach appears in ASD’s guidance for securely testing AI agents, which also stresses that policy statements are not a substitute for enforceable system boundaries.
Primary sources
