The ban is also for anyone who refuses to submit their private data (face scan or government ID) to an unrelated 3rd party company which will invariably store that data with insufficient security.

The ban does not specify how companies are supposed to do it.

Eg Snapchat is not requiring ID (which the average Australian 15yo wouldn't have anyway), they're trying to determine age with the user's camera, and this is trivially spoofed using video played back on another device.