Age Gating a Cosmetic Booking Flow: What Works and What Is Theatre
A tick box saying "I am over 18" collects nothing and proves nothing. AHPRA's guidelines carry targeted advertising bans protecting young people and a mandatory seven-day cooling off for under-18s. Both need a real date of birth, captured early.
Vikas Thakur Founder, RockingWeb 8 min read 
Key Takeaways
- A tick box is not an age gate. It creates no record and supports no downstream rule
- AHPRA’s guidelines carry targeted advertising bans protecting young people and a mandatory seven-day cooling off period for under-18s, both in effect from 2 September 2025
- Date of birth must be collected before slot selection, because its purpose is to change what happens next
- Collection is not verification. Collect the date online; confirm identity in person
- Date of birth is personal information, so collecting it triggers notice and retention obligations of its own
- Building the gate without the cooling off logic behind it solves nothing
Age gating on a cosmetic clinic site is usually implemented as a tick box near the submit button reading “I confirm I am over 18”. It is the single most common piece of compliance theatre in the sector: visible, cheap, and completely inert.
The test for whether an age gate is real is simple. Does anything downstream behave differently because of what it collected? If the answer is no, it is decoration.
What the Obligation Actually Is
AHPRA’s guidelines for registered health practitioners performing non-surgical cosmetic procedures took effect on 2 September 2025. In announcing them, AHPRA stated that young people would be protected by targeted advertising bans and a mandatory seven-day cooling off period for people under the age of 18.
Two separate things follow, and they need different build responses.
| Obligation | What it needs from the site |
|---|---|
| Targeted advertising restrictions | Audience and creative controls, plus content decisions |
| Seven-day cooling off for under-18s | A stored date of birth and a consultation-to-treatment interval |
The advertising side is largely about what you publish and who you target. The cooling off side is a data problem, and it is the one an age gate exists to serve. That side is covered in detail in building a booking flow for the seven-day cooling off; this post is about the gate that feeds it.
Why the Tick Box Fails
A tick box produces a boolean that means “this person clicked”. It cannot tell you whether someone is 17 or 47, it cannot be used to calculate a cooling off interval, and it leaves no record you could rely on later.
More practically: it asks the visitor to self-certify at exactly the moment they are motivated to proceed. It is the weakest possible instrument applied at the weakest possible moment.
The scoring is a build assessment of each pattern against what the obligation requires, not a regulator’s rating. The gap between column three and column four is the important one: collecting a date of birth in a form is not the same as storing it against a patient record your booking logic can query.
What That Means for the Build
Put date of birth at step one. Before treatment selection, before slot selection. A date picker defaulting to no value, not to today.
Branch, do not block. An under-18 visitor should land on a consultation booking path with a short, plain explanation. A hard error message is both poor practice and a lost patient who will simply try a competitor.
Store it against the patient record, not just the form submission. The cooling off rule is evaluated at treatment booking time, potentially weeks later. A date of birth sitting in an email notification is not available to that logic.
Write the collection notice. You are collecting personal information for a stated purpose. Say what it is, at the point of collection, in one sentence next to the field.
Do not retain it for enquiries that went nowhere. An enquiry that never became a patient should not leave a date of birth in your systems indefinitely.
Collection Versus Verification
These get conflated constantly, and treating them as the same thing leads clinics to either do nothing or to over-build.
Collection is asking for a date of birth and storing it. It is proportionate for a booking flow, it is what the cooling off logic needs, and it takes a field and a database column.
Verification is checking a claimed date of birth against a document or an identity service. It is heavier, it introduces document handling and its own privacy obligations, and for an in-person clinical service it duplicates something that happens naturally at the appointment.
The proportionate pattern for a clinic is collect online, confirm in person. Practitioners already confirm identity at consultation; the site’s job is to make sure the under-18 path was taken before anyone got that far.
A Worked Example
Cosmetic clinic. A clinic’s booking form had a mandatory tick box at submit. Analysis of six months of bookings found the practice had no record of any patient’s age, so it could not demonstrate compliance with the cooling off obligation for any booking in that period, including bookings that were entirely fine.
The rebuild put a date of birth field at step one, stored it against the patient record, and routed under-18 visitors to consultation booking. Beyond the compliance position, the clinic gained the ability to answer the question at all, which it previously could not.
Dental practice. A practice offering veneers, a procedure named in AHPRA’s visual examples material, had no age handling on its cosmetic pages at all while its general dental booking collected date of birth properly. The cosmetic pages were the newer build. The fix was to route cosmetic bookings through the same intake as general dentistry rather than build a second one.
What to Check on Your Own Site
- Find your age gate. Is it a tick box, a range, or a date field?
- Check where it sits relative to slot selection.
- Check whether the value is stored against a patient record or only emailed.
- Try booking as a 17-year-old. Does anything change?
- Check whether a collection notice appears next to the field.
- Check your cosmetic pages separately from your general pages. They are often different builds with different intake.
The Enforcement Anchor
AHPRA’s September 2025 announcement carried an explicit warning from Ahpra CEO Justin Untersteiner that practitioners had been given time to get their houses in order, and that the regulator would not hesitate to act where practitioners were found prioritising profits over patient care.
There is no published outcome we can cite against a clinic for a defective age gate specifically. The stated posture is on the record; the case is not. Reporting that accurately is the point of this category.
Where This Gets Hard
The honest limit is that a date of birth collected online is self-reported and a determined 17-year-old can enter a false one. Nothing short of identity verification changes that, and identity verification is disproportionate for booking a consultation.
What the gate does achieve is that the clinic asked, recorded the answer, and built a path that behaves correctly for anyone who answers honestly. That is a materially better position than a tick box, both practically and if the question is ever asked, but it is not proof of age and should not be described internally as though it were.
The regulator says a mandatory seven-day cooling off period applies to people under 18 and that targeted advertising bans protect young people; the build consequence is a date of birth collected early and stored where your booking logic can use it; whether your particular arrangement discharges the obligation in your circumstances is a question for your medical defence organisation or your lawyer.
Status
In force since 2 September 2025. These are current guidelines, not a proposal and not pending commencement. Note separately that the Online Safety Amendment social media minimum age provisions are a different regime concerning social platforms and are not the basis for anything in this post.
Frequently Asked Questions
Is a tick box confirming someone is over 18 enough?
It collects no usable data and creates no record you can act on. A tick box tells you the visitor clicked a tick box. Because the seven-day cooling off obligation depends on knowing a patient is under 18 and when their consultation occurred, your system needs an actual date of birth stored against the patient record, not an unverifiable assertion.
Where in the booking flow should date of birth be collected?
Before a time slot is selected. The whole purpose of the age question is to change what happens next, and it cannot change anything if it is asked after the booking is made. Collecting it on the confirmation screen means the under-18 path was never available.
Does age gating count as verifying age?
No, and the distinction matters. Collecting a date of birth is data collection. Verifying it against a document is identity verification, which is a different and much heavier process. For a clinic booking flow, collecting a date of birth early and confirming identity at the in-person consultation is the proportionate pattern.
Does collecting date of birth create a privacy obligation?
Yes. Date of birth is personal information, and collected in the context of a cosmetic treatment enquiry it sits alongside health information. Collect it because you need it for a specific obligation, say so in your collection notice, and do not retain it against enquiries that never became patients.
Get Your Intake Flow Checked
Get in touch and RockingWeb will walk your booking flow as a patient would and report where the age question sits and what happens on either side of it.
Sources
- AHPRA - Putting patients first: New guidelines for cosmetic procedures, 2 September 2025. Checked 10 August 2026.
- AHPRA - Guidelines for registered health practitioners who perform non-surgical cosmetic procedures. Checked 10 August 2026.
- OAIC - Australian Privacy Principles, collection and notification. Checked 10 August 2026.
Last reviewed: 10 August 2026.
Vikas Thakur
Founder of RockingWeb. 16 years building for companies like TPG, iiNet and Monadelphous, now focused on websites and marketing that comply with AHPRA's advertising guidelines and still book patients.
