Online Safety Act 2021 (Cth)

Online Safety Act 2021 No. 76, 2021 Compilation No. 3 Compilation date: 11 December 2024 Includes amendments: Act No. 127, 2024 About this compilation This compilation This is a compilation of the Online Safety Act 2021 that shows the text of the law as amended and in force on 11 December 2024 (the compilation date). The notes at the end of this compilation (the endnotes) include information about amending laws and the amendment history of provisions of the compiled law. Uncommenced amendments The effect of uncommenced amendments is not shown in the text of the compiled law. Any uncommenced amendments affecting the law are accessible on the Register (www.legislation.gov.au). The details of amendments made up to, but not commenced at, the compilation date are underlined in the endnotes. For more information on any uncommenced amendments, see the Register for the compiled law. Application, saving and transitional provisions for provisions and amendments If the operation of a provision or amendment of the compiled law is affected by an application, saving or transitional provision that is not included in this compilation, details are included in the endnotes. Editorial changes For more information about any editorial changes made in this compilation, see the endnotes. Modifications If the compiled law is modified by another law, the compiled law operates as modified but the modification does not amend the text of the law. Accordingly, this compilation does not show the text of the compiled law as modified. For more information on any modifications, see the Register for the compiled law. Self‑repealing provisions If a provision of the compiled law has been repealed in accordance with a provision of the law, details are included in the endnotes. Contents Part 1—Preliminary 1 Short title 2 Commencement 3 Objects of this Act 4 Simplified outline of this Act 5 Definitions 6 Cyber‑bullying material targeted at an Australian child 7 Cyber‑abuse material targeted at an Australian adult 8 Determining whether material is offensive 9 Material that depicts abhorrent violent conduct 10 When material is provided on a social media service, relevant electronic service or designated internet service 11 When material is posted by an end‑user of a social media service, relevant electronic service or designated internet service 12 When material is removed from a social media service, relevant electronic service or designated internet service 13 Social media service 13A Relevant electronic service 14 Designated internet service 15 Intimate image 16 Non‑consensual intimate image of a person 17 Hosting service 18 On‑demand program service 19 Internet service providers 20 Supply of internet carriage service to the public 21 Consent 22 Crown to be bound 23 Application of this Act 24 Convention on the Rights of the Child Part 2—eSafety Commissioner 25 Simplified outline of this Part 26 eSafety Commissioner 27 Functions of the Commissioner 28 Powers of the Commissioner Part 3—Complaints, objections and investigations Division 1—Introduction 29 Simplified outline of this Part Division 2—Complaints about cyber‑bullying material targeted at an Australian child 30 Complaints about cyber‑bullying material 31 Investigation of complaints Division 3—Complaints about, and objections to, intimate images 32 Complaints 33 Objection notice 34 Investigation of complaints 35 Commissioner's response to objection notices Division 4—Complaints about cyber‑abuse material targeted at an Australian adult 36 Complaints about cyber‑abuse material 37 Investigation of complaints Division 5—Complaints relating to the online content scheme 38 Complaints about class 1 material or class 2 material 39 Complaints relating to breach of a service provider rule etc. 40 Complaints relating to breach of an industry code etc. 41 Residency etc. of complainant 42 Commissioner may investigate matters 43 Commissioner may refuse to investigate certain matters Part 4—Basic online safety expectations Division 1—Introduction 44 Simplified outline of this Part Division 2—Basic online safety expectations 45 Basic online safety expectations 46 Core expectations 47 Consultation 48 Service provider notifications Division 3—Reporting Subdivision A—Periodic reporting about compliance with basic online safety expectations 49 Periodic reporting notice 50 Compliance with notice 51 Formal warning 52 Periodic reporting determination 53 Compliance with determination 54 Formal warning 55 Service provider notifications Subdivision B—Non‑periodic reporting about compliance with basic online safety expectations 56 Non‑periodic reporting notice 57 Compliance with notice 58 Formal warning 59 Non‑periodic reporting determination 60 Compliance with determination 61 Formal warning 62 Service provider notifications Subdivision C—Self‑incrimination 63 Self‑incrimination Part 4A—Social media minimum age Division 1—Introduction 63A Simplified outline of this Part 63B Object of this Part 63C Age‑restricted social media platform Division 2—Civil penalty 63D Civil penalty for failing to take reasonable steps to prevent age‑restricted users having accounts 63DA Information that must not be collected 63DB Use of certain identification material and services 63E Delayed effect of requirement to take reasonable steps to prevent age‑restricted users having accounts Division 3—Privacy 63F Information collected for purposes including taking reasonable steps to comply with age restriction Division 4—Information‑gathering powers 63G Commissioner may obtain information about compliance 63H Compliance with notice Division 5—Platform provider notifications 63J Platform provider notifications—failure to take reasonable steps 63K Platform provider notifications—privacy Part 5—Cyber‑bullying material targeted at an Australian child 64 Simplified outline of this Part 65 Removal notice given to the provider of a social media service, relevant electronic service or designated internet service 66 Removal notice given to a hosting service provider 67 Compliance with removal notice 68 Formal warning 70 End‑user notice 71 Compliance with end‑user notice 72 Formal warning 73 Service provider notifications Part 6—Non‑consensual sharing of intimate images Division 1—Introduction 74 Simplified outline of this Part Division 2—Intimate images must not be posted without consent etc. 75 Posting an intimate image 76 Formal warning Division 3—Removal notices 77 Removal notice given to the provider of a social media service, relevant electronic service or designated internet service 78 Removal notice given to an end‑user 79 Removal notice given to a hosting service provider 80 Compliance with removal notice 81 Formal warning Division 4—Miscellaneous 83 Remedial direction 84 Formal warning 85 Service provider notifications 86 Exempt provision of an intimate image Part 7—Cyber‑abuse material targeted at an Australian adult 87 Simplified outline of this Part 88 Removal notice given to the provider of a social media service, relevant electronic service or designated internet service 89 Removal notice given to an end‑user 90 Removal notice given to a hosting service provider 91 Compliance with removal notice 92 Formal warning 93 Service provider notifications Part 8—Material that depicts abhorrent violent conduct Division 1—Introduction 94 Simplified outline of this Part Division 2—Blocking requests 95 Blocking request 96 Duration of blocking request 97 Revocation of blocking request 98 Notification in relation to domain names and URLs Division 3—Blocking notices 99 Blocking notice 100 Duration of blocking notice 101 Revocation of blocking notice 102 Notification in relation to domain names and URLs 103 Compliance with blocking notice Division 4—Exempt material 104 Exempt material Part 9—Online content scheme Division 1—Introduction 105 Simplified outline of this Part 106 Class 1 material 107 Class 2 material 108 Restricted access system Division 2—Removal notices relating to class 1 material 109 Removal notice given to the provider of a social media service, relevant electronic service or designated internet service 110 Removal notice given to a hosting service provider 111 Compliance with removal notice 112 Formal warning 113 Revocation of removal notice 113A Service provider notifications Division 3—Removal notices relating to class 2 material 114 Removal notice given to the provider of a social media service, relevant electronic service or designated internet service 115 Removal notice given to a hosting service provider 116 Compliance with removal notice 117 Formal warning 118 Revocation of removal notice 118A Service provider notifications Division 4—Remedial notices relating to class 2 material 119 Remedial notice given to the provider of a social media service, relevant electronic service or designated internet service 120 Remedial notice given to a hosting service provider 121 Compliance with remedial notice 122 Formal warning 123 Revocation of remedial notice 123A Service provider notifications Division 5—Link deletion notices 124 Link deletion notice 125 Compliance with link deletion notice 126 Formal warning 127 Revocation of link deletion notice Division 6—App removal notices 128 App removal notice 129 Compliance with app removal notice 130 Formal warning 131 Revocation of app removal notice Division 7—Industry codes and industry standards Subdivision A—Interpretation 132 Industry codes 133 Industry standards 134 Online activity 135 Sections of the online industry 136 Participants in a section of the online industry Subdivision B—General principles relating to industry codes and industry standards 137 Statement of regulatory policy 138 Examples of matters that may be dealt with by industry codes and industry standards 139 Escalation of complaints Subdivision C—Industry codes 140 Registration of industry codes 141 Commissioner may request codes 141A Publication of notice where no body or association represents a section of the online industry 142 Replacement of industry codes 143 Compliance with industry codes 144 Formal warnings—breach of industry codes Subdivision D—Industry standards 145 Commissioner may determine an industry standard 146 Compliance with industry standards 147 Formal warnings—breach of industry standards 148 Public consultation on industry standards Subdivision E—Register of industry codes and industry standards 149 Commissioner to maintain Register of industry codes and industry standards Subdivision F—Miscellaneous 150 Industry standards prevail over inconsistent industry codes Division 8—Service provider determinations 151 Service provider determinations 152 Exemptions from service provider determinations 153 Compliance with service provider rules 154 Remedial directions—breach of service provider rules 155 Formal warnings—breach of service provider rules Division 9—Federal Court orders 156 Federal Court may order a person to cease providing a social media service 157 Federal Court may order a person to cease providing a relevant electronic service 158 Federal Court may order a person to cease providing a designated internet service 159 Federal Court may order a person to cease supplying an internet carriage service Division 10—Commissioner may obtain advice from the Classification Board 160 Commissioner may obtain advice from the Classification Board Part 10—Enforcement 161 Simplified outline of this Part 162 Civil penalty provision 163 Infringement notices 164 Enforceable undertakings 165 Injunctions Part 11—Administrative provisions relating to the Commissioner Division 1—Introduction 166 Simplified outline of this Part Division 2—Appointment of the Commissioner 167 Appointment of the Commissioner 168 Period of appointment for the Commissioner 169 Acting appointments 170 Application of finance law Division 3—Terms and conditions for the Commissioner 171 Remuneration and allowances 172 Leave of absence 173 Outside employment 174 Disclosure of interests to the Minister 175 Resignation 176 Termination of appointment 177 Other terms and conditions Division 4—Other matters 178 Supplementary powers 179 Commissioner's liabilities are Commonwealth liabilities 180 Commissioner has privileges and immunities of the Crown 181 Delegation by the Commissioner to a member of the staff of the ACMA etc. 182 Delegation by the Commissioner to a contractor engaged by the Commissioner 183 Annual report 183A Advisory committees 184 Assistance to the Commissioner 185 Contractors engaged by the Commissioner 186 Commissioner not subject to direction by the ACMA etc. 187 Consultants 188 Minister may give directions to the Commissioner Part 12—Online Safety Special Account 189 Simplified outline of this Part 190 Online Safety Special Account 191 Credits to the Account 192 Purposes of the Account Part 13—Information‑gathering powers 193 Simplified outline of this Part 194 Commissioner may obtain end‑user identity information or contact details 195 Compliance with notice 196 Self‑incrimination Part 14—Investigative powers 197 Simplified outline of this Part 198 Application of this Part 199 Notice requiring appearance for examination 200 Examination on oath or affirmation 201 Examination to take place in private 202 Record to be made of examination 203 Production of documents for inspection 204 Protection of persons giving evidence 205 Non‑compliance with requirement to give evidence Part 15—Disclosure of information 206 Simplified outline of this Part 207 Scope 208 Disclosure to Minister 209 Disclosure to Secretary, or APS employees, for advising the Minister 210 Disclosure to a member of the staff of the ACMA etc. 211 Disclosure to Royal Commissions 212 Disclosure to certain authorities 213 Disclosure to teachers or school principals 214 Disclosure to parents or guardians 215 Disclosure with consent 216 Disclosure of publicly available information 217 Disclosure of summaries and statistics 218 Relationship with Parts 13 and 15 of the Telecommunications Act 1997 Part 16—Miscellaneous 219 Simplified outline of this Part 220 Review of decisions by the Administrative Review Tribunal 220A Internal review of decisions 221 Protection from civil proceedings 222 Liability for damages 222A Liability for damages—Information Commissioner 223 Protection from criminal proceedings—Commissioner, Classification Board etc. 224 Referral of matters to law enforcement agencies 225 Deferral of action in order to avoid prejudicing a criminal investigation 226 Copies of material 227 Compensation for acquisition of property 228 Service of notices by electronic means 229 Service of notices on contact person etc. 230 Instruments under this Act may provide for matters by reference to other instruments 231 This Act does not limit Schedule 8 to the Broadcasting Services Act 1992 232 This Act does not limit the Telecommunications Act 1997 233 Implied freedom of political communication 234 Concurrent operation of State and Territory laws 235 Liability of Australian hosting service providers and internet service providers under State and Territory laws etc. 236 This Act not to affect performance of State or Territory functions 237 Revocation or variation of instruments 238 Provider of social media service, age‑restricted social media platform, relevant electronic service, designated internet service or app distribution service 239 Extended meaning of use 239A Review of operation of this Act 239B Review of social media minimum age framework 240 Legislative rules Endnotes Endnote 1—About the endnotes Endnote 2—Abbreviation key Endnote 3—Legislation history Endnote 4—Amendment history Endnote 5—Editorial changes An Act relating to online safety for Australians, and for other purposes Part 1—Preliminary 1 Short title This Act is the Online Safety Act 2021. 2 Commencement (1) Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms. Commencement information Column 1 Column 2 Column 3 Provisions Commencement Date/Details 1. The whole of this Act A single day to be fixed by Proclamation. 23 January 2022 However, if the provisions do not commence within the period of 6 months beginning on the day this Act receives the Royal Assent, they commence on the day after the end of that period. Note: This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act. (2) Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act. 3 Objects of this Act The objects of this Act are: (a) to improve online safety for Australians; and (b) to promote online safety for Australians. 4 Simplified outline of this Act • There is to be an eSafety Commissioner. • The functions of the Commissioner include: (a) promoting online safety for Australians; and (b) administering a complaints system for cyber‑bullying material targeted at an Australian child; and (c) administering a complaints system for cyber‑abuse material targeted at an Australian adult; and (d) administering a complaints and objections system for non‑consensual sharing of intimate images; and (e) administering the online content scheme; and (f) coordinating activities of Commonwealth Departments, authorities and agencies relating to online safety for Australians. • The complaints system for cyber‑bullying material targeted at an Australian child includes the following components: (a) the provider of a social media service, a relevant electronic service or a designated internet service may be given a notice (a removal notice) requiring the removal from the service of cyber‑bullying material targeted at an Australian child; (b) a hosting service provider who hosts cyber‑bullying material targeted at an Australian child may be given a notice (a removal notice) requiring the provider to cease hosting the material; (c) a person who posts cyber‑bullying material targeted at an Australian child may be given a notice (an end‑user notice) requiring the person to remove the material, refrain from posting cyber‑bullying material or apologise for posting the material. • The complaints system for cyber‑abuse material targeted at an Australian adult includes the following components: (a) the provider of a social media service, a relevant electronic service or a designated internet service may be given a notice (a removal notice) requiring the removal from the service of cyber‑abuse material targeted at an Australian adult; (b) a person who posts cyber‑abuse material targeted at an Australian adult may be given a notice (a removal notice) requiring the person to remove the material; (c) a hosting service provider who hosts cyber‑abuse material targeted at an Australian adult may be given a notice (a removal notice) requiring the provider to cease hosting the material. • The complaints and objections system for non‑consensual sharing of intimate images includes the following components: (a) a person who posts, or threatens to post, an intimate image may be liable to a civil penalty; (b) the provider of a social media service, relevant electronic service or designated internet service may be given a notice (a removal notice) requiring the provider to remove an intimate image from the service; (c) an end‑user of a social media service, relevant electronic service or designated internet service who posts an intimate image on the service may be given a notice (a removal notice) requiring the end‑user to remove the image from the service; (d) a hosting service provider who hosts an intimate image may be given a notice (a removal notice) requiring the provider to cease hosting the image. • The online content scheme includes the following components: (a) the provider of a social media service, relevant electronic service or designated internet service may be given a notice (a removal notice) requiring the provider to remove certain material; (b) a hosting service provider may be given a notice (a removal notice) requiring the provider to cease hosting certain material; (c) the provider of an internet search engine service may be given a notice (a link deletion notice) requiring the provider to cease providing a link to certain material; (d) the provider of an app distribution service may be given a notice (an app removal notice) requiring the provider to cease enabling end‑users to download an app that facilitates the posting of certain material on a social media service, relevant electronic service or designated internet service; (e) bodies and associations that represent sections of the online industry may develop industry codes; (f) the Commissioner may make an industry standard; (g) the Commissioner may make service provider determinations regulating service providers in the online industry. • The Minister may determine basic online safety expectations for social media services, relevant electronic services and designated internet services. • An internet service provider may be requested or required to block access to: (a) material that promotes abhorrent violent conduct; or (b) material that incites abhorrent violent conduct; or (c) material that instructs in abhorrent violent conduct; or (d) material that depicts abhorrent violent conduct. • There are age restrictions for certain social media platforms. A provider of such a platform must take reasonable steps to prevent children who have not reached a minimum age from having accounts. 5 Definitions In this Act: abhorrent violent conduct has the same meaning as in Subdivision H of Division 474 of the Criminal Code. access includes: (a) access that is subject to a pre‑condition (for example, the use of a password); and (b) access by way of push technology; and (c) access by way of a standing request. access‑control system, in relation to material, means a system under which: (a) persons seeking access to the material have a password, or a Personal Identification Number, that provides a means of limiting access by other persons to the material; or (b) persons seeking access to the material have been provided with some other means of limiting access by other persons to the material. account includes: (a) a free account; and (b) a pre‑paid account; and (c) anything that may reasonably be regarded as the equivalent of an account. ACMA means the Australian Communications and Media Authority. adult means an individual who is 18 or older. age‑restricted social media platform has the meaning given by section 63C. age‑restricted user means an Australian child who has not reached 16 years. app includes a computer program. app distribution service means a service that enables end‑users to download apps, where the download of the apps is by means of a carriage service. app removal notice means a notice given under section 128. Appropriation Act means an Act appropriating money for expenditure out of the Consolidated Revenue Fund. Australia, when used in a geographical sense, includes all the external Territories. Australian adult means an adult who is ordinarily resident in Australia. Australian child means a child who is ordinarily resident in Australia. Australian hosting service provider means a person who provides a hosting service that involves hosting material in Australia. Australian police force means: (a) the Australian Federal Police; or (b) the police force of a State or Territory. Australians means individuals who are ordinarily resident in Australia. basic online safety expectations has the meaning given by section 45. blocking notice means a notice under section 99. blocking request means a request under section 95. broadcasting service has the same meaning as in the Broadcasting Services Act 1992. carriage service has the same meaning as in the Telecommunications Act 1997. child means an individual who has not reached 18 years. civil proceeding includes a civil action. class 1 material has the meaning given by section 106. class 2 material has the meaning given by section 107. Classification Board means the Classification Board established by the Classification (Publications, Films and Computer Games) Act 1995. Commissioner means the eSafety Commissioner. Note: See section 26. computer game has the same meaning as in the Classification (Publications, Films and Computer Games) Act 1995. consent, when used in relation to an intimate image or private sexual material, has the meaning given by section 21. Convention on the Rights of the Child means the Convention on the Rights of the Child done at New York on 20 November 1989. Note: The Convention is in Australian Treaty Series 1991 No. 4 ([1991] ATS 4) and could in 2021 be viewed in the Australian Treaties Library on the AustLII website (http://www.austlii.edu.au). court/tribunal proceedings means words spoken and acts done in the course of, or for purposes of or incidental to, the transacting of the business of a court or a tribunal, and includes: (a) evidence given before the court or tribunal; and (b) a document presented or submitted to the court or tribunal; and (c) a document issued or published by, or with the authority of, the court or tribunal. cyber‑abuse material targeted at an Australian adult has the meaning given by section 7. cyber‑bullying material targeted at an Australian child has the meaning given by section 6. data storage device means any article or material (for example, a disk or file server) from which information is capable of being reproduced, with or without the aid of any other article or device. de‑identified: information is de‑identified if the information is no longer about: (a) an identifiable individual; or (b) an individual who is reasonably identifiable. designated internet service has the meaning given by section 14. electronic message has the same meaning as in the Spam Act 2003. electronic service means: (a) a service that allows end‑users to access material using a carriage service; or (b) a service that delivers material to persons having equipment appropriate for receiving that material, where the delivery of the service is by means of a carriage service; but does not include: (c) a broadcasting service; or (d) a datacasting service (within the meaning of the Broadcasting Services Act 1992). end‑user notice means a notice under subsection 70(1). engage in conduct means: (a) do an act; or (b) omit to perform an act. exempt court/tribunal content service means a service to the extent to which it delivers, or provides access to, material that consists of court/tribunal proceedings. exempt official‑inquiry content service means a service to the extent to which it delivers, or provides access to, material that consists of official‑inquiry proceedings. exempt Parliamentary content service means a service to the extent to which it delivers, or provides access to, material that consists of Parliamentary proceedings. exempt provision of an intimate image has the meaning given by section 86. Federal Court means the Federal Court of Australia. film has the same meaning as in the Classification (Publications, Films and Computer Games) Act 1995. hosting service has the meaning given by section 17. hosting service provider means a person who provides a hosting service. immediate circle has the same meaning as in the Telecommunications Act 1997. internet carriage service means a listed carriage service that enables end‑users to access the internet. internet service provider has the meaning given by section 19. intimate image has the meaning given by section 15. legislative rules means rules made under section 240. link deletion notice means a notice given under section 124. listed carriage service has the same meaning as in the Telecommunications Act 1997. material means material: (a) whether in the form of text; or (b) whether in the form of data; or (c) whether in the form of speech, music or other sounds; or (d) whether in the form of visual images (moving or otherwise); or (e) whether in any other form; or (f) whether in any combination of forms. material that depicts abhorrent violent conduct has the meaning given by section 9. National Classification Code means the Code (within the meaning of the Classification (Publications, Films and Computer Games) Act 1995). non‑consensual intimate image of a person has the meaning given by section 16. objection notice means a notice under section 33. official‑inquiry proceedings means words spoken and acts done in the course of, or for purposes of or incidental to, the transacting of the business of: (a) a Royal Commission; or (b) an official inquiry; and includes: (c) evidence given before the Royal Commission or official inquiry; and (d) a document presented or submitted to the Royal Commission or official inquiry; and (e) a document issued or published by, or with the authority of, the Royal Commission or official inquiry. on‑demand program service has the meaning given by section 18. online safety for Australians means the capacity of Australians to use social media services and electronic services in a safe manner. online safety for children means the capacity of Australian children to use social media services and electronic services in a safe manner, and includes the protection of Australian children using those services from cyber‑bullying material targeted at an Australian child. Online Safety Special Account means the Online Safety Special Account referred to in section 190. parent: without limiting who is a parent of anyone for the purposes of this Act, a person is the parent of another person if the other person is a child of the person within the meaning of the Family Law Act 1975. Parliamentary proceedings means words spoken and acts done in the course of, or for purposes of or incidental to, the transacting of the business of: (a) a Parliament; or (b) a legislature; or (c) a committee of a Parliament or legislature; and includes: (d) evidence given before the Parliament, legislature or committee; and (e) a document presented or submitted to the Parliament, legislature or committee; and (f) a document issued or published by, or with the authority of, the Parliament, legislature or committee. point‑to‑multipoint service means a carriage service which allows a person to transmit material to more than one end‑user simultaneously. posted by an end‑user of a social media service, relevant electronic service or designated internet service has the meaning given by section 11. Note: Other parts of speech and grammatical forms of "posted" (for example, "post") have a corresponding meaning (see section 18A of the Acts Interpretation Act 1901). private sexual material means: (a) material that: (i) depicts a person who is, or appears to be, 18 years of age or older and who is engaged in, or appears to be engaged in, a sexual pose or sexual activity (whether or not in the presence of other persons); and (ii) does so in circumstances that reasonable persons would regard as giving rise to an expectation of privacy; or (b) material the dominant characteristic of which is the depiction of: (i) a sexual organ or the anal region of a person who is, or appears to be, 18 years of age or older; or (ii) if a person is a female person, or a transgender or intersex person, who is, or appears to be, 18 years of age or older—either or both of the person's breasts; where the depiction is in circumstances that reasonable persons would regard as giving rise to an expectation