Online Content Regulation in Australia

Broadly speaking, the OSA is designed to assist individuals to manage online safety risks and to ensure that online service providers have in place systems and processes to prevent the distribution of harmful content online. eSafety can take enforcement action against online services who fail to comply with the measures set out in the OSA.

We have previously prepared a summary of the key elements of the OSA and the OSA’s application to online businesses, which can be accessed here.

The purpose of this insight is to provide an update on some recent developments concerning the OSA and to set out the key things that online businesses will need to keep in mind to ensure compliance with Australia’s online content rules.

Application of the Online Safety Act

The OSA applies to eight categories of online service providers:

1. Social Media Services – being services whose sole or primary purpose is to enable online social interaction between two or more end-users (eg. Meta (Facebook and Instagram) and X Corp);
2. App Distribution Services – being services that enable end-users to download apps (eg. Apple App Store and Google Play Store);
3. Hosting Services – being services that host stored material (so far as those services host material in Australia);
4. Internet Carriage Services – being services that enable end-users to access the internet (ie. internet service providers);
5. Equipment Providers – being maintenance and installation services and manufacturers and suppliers of equipment that is used by end-users in Australia in connection with another online service;
6. Internet Search Engines – being services whose sole or primary purpose is to enable end-users to search indexed material on the internet (eg. Google);
7. Relevant Electronic Services – being email, instant messaging, SMS, MMS, chat, and online gaming services that allow end-users to communicate (or, in the case of online gaming services, play with) other end-users; and
8. Designated Internet Services – being services that allow end-users to access material using an internet carriage service (this would capture most websites).

There are two broad schemes under the OSA – the Online Content Scheme and the Basic Online Safety Expectations (BOSE).

The Online Content Scheme is directed to the regulation of illegal and restricted material under the National Classification Code. The Online Content Scheme provides for the development of industry codes and standards. Compliance with these industry codes and standards is mandatory for online service providers that fall within the relevant category. The applicable code or standard is generally the one that most closely aligns with the service.

The BOSE establish minimum safety expectations for a narrower range of online services (being Social Media Services, Relevant Electronic Services and Designated Internet Services). Compliance with the BOSE is not mandatory. However, eSafety may issue notices to online service providers requiring them to report on their compliance with the expectations contained in the BOSE. Non-compliance with a reporting notice is punishable by a fine.

Online Content Scheme – Industry Codes and Standards

The Online Content Scheme covers two broad classes of material:

• Class 1 material – material that has been, or would be, refused classification under the National Classification Code; and
• Class 2 material – material that has been, or would be, classified as R18+ or X18+ under the National Classification Code.

Under the Online Content Scheme, eSafety is empowered to register industry codes. Industry codes under the Online Content Scheme are prepared by an industry body or association. If eSafety considers that the code is adequate, eSafety can register the code (in which case compliance with the code becomes mandatory). If eSafety is not satisfied with the code, it can decline to register the code and instead develop and register its own standard (compliance with which is also mandatory).

The development of industry codes and standards under the OSA has proceeded through a two-phase process:

• Phase 1 focused on the following two sub-classes of Class 1 material:
  
  • Class 1A material –child exploitation material, pro-terror material and extreme crime and violence material; and
  • Class 1B material –other crime and violence material and drug-related material;
• Phase 2 will focus on Class 2 material and any remaining Class 1 material.

Six separate Phase 1 industry codes have been registered by eSafety covering Social Media Services, App Distribution Services, Hosting Services, Internet Carriage Services, Equipment Providers and Internet Search Engines. The first five of these Phase 1 industry codes came into effect on 16 December 2023, and the Internet Search Engines code came into effect on 12 March 2024.

eSafety declined to register industry codes relating to Relevant Electronic Services and Designated Internet Services and instead created and registered their own industry standards. Industry standards for these services were registered on 21 June 2024 and will come into effect on 21 December 2024.

The objective of each of the industry codes and standards is to ensure that online content providers establish and implement policies, systems, processes and technologies to effectively manage the risk that Australians will solicit, generate, distribute, get access to, be exposed to or store materials falling within Class 1A or Class 1B through the relevant services. Some of the measures that some online content services are required to introduce include:

• implementing and enforcing specific clauses in terms of use in relation to Class 1A and 1B material;
• implementing systems and processes to ensure that appropriate action is taken against individuals who breach relevant terms of use;
• requiring service providers to undertake risk assessments and determine the risk profile of relevant services, and ensuring that these assessments are adequately documented; and
• implementing safety features and settings to adequately detect and remove Class 1A and 1B material.

eSafety has begun to engage with the technology sector regarding the development of Phase 2 industry codes.

Enforcement and Restricted Access Systems

As can be seen from the recent enforcement action taken by the eSafety Commissioner against X Corp, eSafety is increasingly active when it comes to enforcement action in respect of potential breaches of the OSA.

If eSafety finds that Class 1 material has been provided by an online content service, or Class 2 material has been provided without being subject to a “restricted access system”, eSafety may issue the online content service provider with a removal notice (or a remedial notice requiring that access to relevant Class 2 material be subject to a restricted access system (or RAS)). Non-compliance with a removal notice or a remedial notice can result in the issue of a formal warning and is punishable by a penalty of 500 penalty units for individuals (from 1 July 2024, $165,000) or 2,500 penalty units for corporations (currently $825,000).¹

Similarly, if eSafety finds that an online service provider has not complied with an industry code, it may issue a notice directing the provider to comply with the code. Non-compliance with this direction notice is punishable by a penalty of 500 penalty units and/or the issuing of a formal warning. Non-compliance with an industry standard is punishable directly in the same manner (ie. eSafety is not required to first issue a direction notice in relation to non-compliance with an industry standard).

A RAS is a system that is designed to limit the exposure of children to age-inappropriate content. Under the Online Safety (Restricted Access Systems) Declaration 2022 (Cth), a RAS will only be considered sufficient for the purposes of the OSA if the system:

• requires an application to be made to access relevant Class 2 material;
• provides adequate warnings and safety information for relevant Class 2 material;
• incorporates reasonable steps to confirm the age of applicants; and
• limits access to relevant Class 2 material.

Review of the Online Safety Act

A review of the OSA is required to be conducted by the Australian government by no later than January 2025. The Australian government has committed to conducting this review earlier than required and has stated that the report of this review will be completed by 31 October 2024.

According to an “Issues Paper” published in April 2024, the main issues that are being examined by the government include whether:

• the OSA as a whole is appropriate to achieve the government’s current online safety intent;
• the statutory schemes under the OSA are fit for purpose, including the restricted access system;
• any additional arrangements are warranted to address online harm (for example, online hate or pile-on attacks);
• the tools and powers available to eSafety should be amended and/or simplified;
• penalties should apply to a broader range of circumstances;
• the current information gathering powers, investigative powers, enforcement powers, civil penalties or disclosure of information provisions of the OSA should be amended;
• the current functions and powers in the OSA are sufficient to allow the eSafety Commissioner to carry out their mandate; and
• it would be appropriate for costs to be recovered from industry for eSafety’s regulatory activities.

The Issues Paper was open for public comment until 21 June 2024. It is likely that some of these submissions will be made public at a later date.

Key Takeaways

For online businesses to ensure compliance with Australia’s online safety regime, it is integral that you understand:

• whether your online business provides a category of service that falls within the OSA (and, if so, which category is the most applicable);
• the obligations that apply to that category of service;
• the minimum online safety expectations with which eSafety expects those services to adhere;
• the potential penalties that can result from non-compliance; and
• any upcoming changes that are likely to have an impact on your online business.

For advice on any of the above areas or the regulation of online content in Australia more generally, please contact one of the authors.