Scope and Application of the Online Safety Act 2021
The Online Safety Act 2021 expands the regulatory authority of Australia’s eSafety Commissioner to cover a broader range of online harms, including cyberbullying, image-based abuse, and the proliferation of harmful content through generative AI systems. The Act explicitly extends its reach to generative AI chatbots and companions, ensuring they comply with basic online safety expectations and industry codes. This marks a significant shift from previous frameworks, where the Commissioner lacked formal legal powers to enforce removals or issue directives.
Key provisions mandate the removal of cyberbullying material targeting Australian children, intimate images shared without consent, and cyber-abuse material directed at adults. The Act also addresses material depicting abhorrent violent conduct, such as child exploitation and pro-terror content, under Class 1A and Class 1B classifications introduced in the 2024 Online Safety (Relevant Electronic Services—Class 1A and Class 1B Material) Industry Standard.
Mechanisms for Enforcement and Compliance
The Act establishes a structured framework for handling complaints and enforcing removals. When material is identified as violating the Act’s provisions, the eSafety Commissioner issues removal notices to service providers under sections 65, 77, 88, 109, and 114. These notices require providers to act within strict timelines, with deepfake-related content subject to a 24-hour removal clock.
Industry codes and standards play a critical role in compliance. Section 138 outlines examples of matters these codes may address, such as age verification, content moderation protocols, and user reporting mechanisms.
Age restrictions are another enforcement pillar. Sections 63D–63J require service providers to implement reasonable steps to prevent users under 16 from creating accounts, a measure reinforced by the Online Safety Amendment (Social Media Minimum Age) Act 2024.
Controversies and Legal Precedents
The Act’s implementation has sparked debates over censorship and free speech. In 2024, the eSafety Commissioner issued a complaint alert to X (formerly Twitter) regarding a video by Celine Baumgarten, which criticized an LGBTQ+ club at a Melbourne school. The Commissioner classified the content as cyber-abuse material under section 88, leading X to geo-block the post in Australia. Baumgarten challenged the decision through the Administrative Review Tribunal (ART), arguing the alert constituted a reviewable removal notice. The tribunal ruled in her favor, with the Federal Court of Australia upholding the decision in 2026. This case set a precedent limiting the Commissioner’s ability to bypass formal review processes, with broader implications for how government agencies enforce content moderation.
Encryption presents another contentious issue. The Online Safety (Basic Online Safety Expectations) Determination 2021 introduced rules for end-to-end encrypted services like WhatsApp and Signal, requiring providers to detect and remove illegal content without compromising user privacy. Critics argue these measures are impractical, as encrypted messages cannot be scanned without weakening security. The eSafety Commissioner has maintained that encryption does not absolve platforms of responsibility for hosting abusive or exploitative material, particularly in cases involving child safety.
The Act’s amendments, such as the minimum age restrictions, reflect evolving concerns about youth exposure to harmful content. The Commissioner’s proactive stance—including early actions against nudification apps—demonstrates a willingness to adapt regulations to emerging technologies, though the balance between safety and innovation continues to be tested in courts and industry practices.
Required actions
- Comply with removal notices for cyber-abuse, image-based abuse (including deepfakes) and class 1 material within 24 hours - Meet the Basic Online Safety Expectations, including for generative AI features, and report on request - Comply with registered industry codes and standards, including age assurance for AI companion and chatbot services