What Singapore’s app store rules reveal about the future of online trust

The sheer scale of the challenge demands more than targeted checks on individual apps.

Measures under Singapore's Code of Practice for Online Safety for App Distribution Services took effect in April 2026. Requiring major app store providers like Apple, Google, Huawei, Samsung, and Microsoft to implement age assurance measures to prevent minors from downloading age-inappropriate apps is a deliberate regulatory shift towards youth online safety, and it's setting the pace for the rest of APAC.

What makes Singapore's approach notable is its pragmatism. Rather than prescribing a rigid, single verification method, the Code allows for government ID checks, facial age estimation, and behavioural analysis. This gives platforms a measure of operational flexibility whilst still holding them accountable to a clear outcome: Protecting young users. This balance between prescription and adaptability is something other regulators in the region are watching closely as Singapore positions itself as a blueprint for digital governance.

Singapore has laid a strong regulatory foundation. The question now is how the industry rises to match that ambition across three key areas.

Age gates to mass verification, and keeping it going 
The threats facing young users are evolving rapidly. Generative artificial intelligence (AI) chatbots, hyper-realistic deepfakes, and emotionally persuasive systems are now widely accessible to teenagers. The risk extends far beyond exposure to explicit material, with synthetic content and interactions having potential to distort reality, identity, and relationships at a formative age.

Whilst Singapore's framework provides platforms with a robust range of age assurance tools ranging from Singpass, facial age estimation, to credit card verification, the sheer scale of the challenge demands more than targeted checks on individual apps. A teenager blocked from one platform can simply migrate to another with weaker safeguards. True safety requires verification deployed consistently across the entire digital ecosystem.

This is essential considering how one-time checks have a shelf life. Today’s digital-native minors are resourceful; shared devices, borrowed parental credentials, and fabricated details as means to navigate restrictions are common workarounds and not edge cases. For long-term success, industry players must shift from point-in-time checks to lifecycle verification. Underpinned by systems that adapt to behavioral signals and trigger re-verification when user patterns shift, this continuous approach ensures safeguards remain effective long after the initial sign-up.

The regulatory direction across APAC reinforces that age assurance is fast becoming a baseline expectation, not an optional feature. For instance, Australia's Age-Restricted Material Codes now extend age assurance to AI chatbots, search engines, and gaming platforms, with fines reaching $45m (AU$49m).

The smartest response is to treat it as an invitation to lead, not just comply, and Singapore's pioneering approach will give the city-state’s businesses a clear signal and head start.

Fighting AI with AI to mitigate synthetic threats
Leading on age assurance, however, means contending with a threat landscape that is actively exploiting technology to bypass security. Deepfake technology has matured to the point where fabricated video, synthetic selfies, and AI-manipulated documents can easily mislead traditional verification systems.

The arms race between online fraudsters and security teams has entered a new phase of high-level sophistication and speed, with synthetic identity fraud rising sharply across APAC.

This trend is being observed globally, where a Gartner survey conducted in 2025 found that 62% of global organisations had experienced a deepfake attack in the past 12 months. These include attacks involving social engineering via manipulated video and audio calls as well as those exploiting automated verification systems such as face and voice biometrics.

The trend seems to be persisting into 2026, aligning with a rapidly growing rate of deepfake fraud that the industry, ourselves included, have been consistently observing across major APAC markets. Sophisticated fraud has also intensified, with attackers combining synthetic identities, deepfakes, and device tampering to execute attacks in ways that traditional verification systems simply cannot identify quickly and accurately.

To keep pace with fraudsters, defenders must fight AI with AI, establishing multi-layered, adaptive defenses. The same AI capabilities driving these threats can be turned into powerful countermeasures like liveness checks that confirm a user is a live human being, detect synthetic artefacts, or flag anomalies in real time.

What the evidence increasingly shows is that the industry standard fraud prevention will be built on architecture able to adapt to a rapidly changing threat landscape. Static defenses are no longer adequate given the pace at which new deepfake methods emerge, and the traditional cycle of weeks required to retrain and redeploy detection models gives attackers an open window to exploit known vulnerabilities.

The industry needs systems that can analyse nascent fraud signals and update their detection capabilities in near-real time. This will ensure that emerging attack vectors are neutralised before they can be weaponised at scale.  

The responsibility can’t sit with regulators alone 
Across much of APAC, enforceable age assurance frameworks are still emerging, creating uneven protection for young users and compliance complexity for platforms with cross-border operations. Singapore's leadership in age assurance provides a blueprint for the region’s markets, offering forward-thinking, pragmatic regulation that sets a clear standard whilst giving the industry room to innovate on how to meet it.

However, regulators cannot carry this weight alone. There are still operational gaps to close, particularly around real-time content classification and the ethical guardrails platforms must implement internally.

Sharing the burden is critical considering that trust is now a competitive differentiator and not just a compliance requirement. Fraud is expected to cost financial institutions US$58.3 billion globally by 2030, representing a 153% surge from $29.4b (US$23b) in 2025. This will be driven largely by synthetic identity fraud that have been on the rise in APAC markets like Singapore where high-profile cases involving deepfakes of government officials have undermined public trust, making clear an urgent need for stronger safeguards.

As age assurance technologies matures, its value will soon extend into e-commerce and online marketplaces, where regulating access to age-sensitive products is becoming a commercial necessity.

Building for long term gain
The real opportunity goes far beyond avoiding regulatory penalties. Age assurance, done right, serves as the foundation for a broader culture of digital trust. It creates an environment where platforms demonstrate social responsibility by design, parents feel confident in the ecosystems their children navigate, and secure infrastructure scales seamlessly across industries.

The organizations that thrive will be those that recognize this is not just a technical hurdle or a legal obligation. It is an investment in safeguarding both the emotional and digital well-being of an entire generation – and building an ecosystem of trust that benefits everyone.