Key points

• Providers of certain relevant electronic services and designated internet services should be across new mandatory online safety regulations that came into effect late last year.
• Non-binding guidance indicates the e-Safety Commissioner will not undertake enforcement action until around 21 June 2025 except in circumstances of serious or deliberate non-compliance.
• The online safety regulations impose obligations in respect of material that is seriously harmful, including child sexual abuse material, pro-terror material and extreme crime and violence, and material that is also harmful but is more context dependent, such as crime and violence and drug-related material.

New online safety regulations apply now

New online safety regulations came into effect on 22 December 2024. The obligations are mandatory and enforceable from this date. 

Non-binding guidance published by the e-Safety Commissioner indicates the regulator will not undertake any enforcement action until 6 months after this date except in circumstances of serious or deliberate non-compliance. This means relevant electronic service providers have until 21 June 2025 to ensure they comply with the new laws. 

Do these new standards apply to your business?

The two new industry standards apply to relevant electronic services (RES) and designated internet services (DIS).

The following electronic services are captured in the definition of RES:

• email services;
• instant messaging services;
• SMS and MMS services;
• chat services; and
• online game services.¹

The following internet services fall within the definition of DIS:

• services that allow end-users to access material using an internet carriage service; and
• services that deliver material to persons having equipment appropriate for receiving that material (delivery is by means of an internet carriage service), such as websites offering generative AI functionality or online file and photo storage services.

A DIS does not include:

• a social media service;
• a RES; or
• an on-demand program service.

What are the new standards? 

The Online Safety (Relevant Electronic Services— Class 1A and Class 1B Material) Industry Standard 2024 (RES Standard) deals with the following material: 

1. material that is seriously harmful, including child sexual abuse material, pro-terror material and extreme crime and violence (known as Class 1A material); and

2. material that is also harmful but is more context dependent, and includes crime and violence and drug-related material (known as Class 1B material).

What are your obligations under the new standards? 

Certain service providers must complete a risk assessment to comply with the new standards. The obligations imposed on your business depend on the risk tier arising from the risk assessment. You do not need to complete a risk assessment if your business falls within the pre-assessed or defined categories.

In summary, your business may have to comply with a number of the below obligations. Service providers must:

1. implement, enforce and publish terms of use, which must include provisions:

1. requiring the account holder to ensure the service is not used in breach of community standards as set out or described in the terms of use;
2. requiring the account holder to ensure the service is not used, whether by the account holder or by an end-user in Australia, to solicit, access, distribute or store Class 1A material or Class 1B material;
3. regulating the use by end-users and requiring the account holder to ensure that end-users comply with those provisions;
4. giving rights for the provider to do any of the following if its service is used to solicit, access, distribute or store child sexual exploitation material or pro-terror material:
   1. suspend the service to the end-user for a specified period
   2. impose restrictions on use an end-user for a specified period;
   3. terminate the agreement; or
   4. remove or delete material from the service, or limit access to it through the service;

2. implement systems and processes to ensure that if there is a breach of an obligation under the terms of use in respect of Class 1A material or Class 1B material, providers take appropriate action to ensure the breach ceases and risk of further breaches are minimised. This includes reviewing reports by the provider’s users that Class 1A material or Class 1B material is accessible using the provider’s service, and appropriately prioritise those reports and, if necessary, escalate them to senior management personnel for action;

3. remove Class 1A material or Class 1B material if an account holder/end-user is soliciting, accessing, distributing or storing Class 1A material or Class 1B material and take appropriate action to ensure the service no longer permits access to or distribution of the matter, any breach of the provider’s Terms of Use ceases, and the risk of further such breaches are minimised;

4. report any child sexual exploitation material or pro-terror material that it believes in good faith is evidence of a serious and immediate threat to the life or physical safety of a person in Australia to an enforcement authority;

5. implement management, supervision and internal reporting arrangements to ensure at all times the provider complies with the requirements of the standards;

6. before materially changing the service, carry out a risk assessment and determine effective features and settings minimising the risk that Class 1A material and Class 1B material will be accessed or distributed to Australian end-users;

7. ensure that the service does not permit a person to register as an end-user unless the person provides the person’s phone number, email address or other identifier (and such information must be retained by the provider for at least 2 years);

8. ensure that the settings allow end-users in Australia to:

1. block messages from other end-users;
2. prevent the display or communication of the end-user’s online status;
3. prevent end-users who are over 18 from using the service to contact a young Australian child without the consent of the child’s parent or carer (if provider allows young Australian children to become account holders or end-users of the service);
4. make the account of a young Australian child private by default; and
5. make the location of a young Australian child who is an end-user not available to other end-users without the consent of the child’s parent or carer;

9. ensure that the settings for the service only permit a person to become an end user if they register with a provider to be an end-user and provide an identifier such as a phone number or email address;

10. implement appropriate systems, processes and technologies to detect, identify and remove child exploitation, pro-terrorism and Class 1A materials that are stored and accessible through the provider;

11. implement systems and processes to effectively deter and disrupt end-users from using or attempting to use the provider to create, offer, solicit, access, distribute, or otherwise make available, or store child sexual exploitation material or pro-terror material;

12. if the average monthly number of active end-users of the provider in Australia over the immediate previous calendar was 1,000,000 or more, establish and implement a program of investment and development activities in respect of systems, processes and technologies. The development program must include investment to detect and identify child sexual abuse material and pro-terror material and deter end-users from soliciting, generating, creating, accessing, distributing and storing such material and reduce the risk to online safety by artificial intelligence;

13. ensure information describing the role of the Commissioner, how to refer a matter about the provider to the Commissioner and how to make a complaint is accessible to end-users in Australia at all times through a dedicated location on the provider’s website;

14. implement policies and procedures to ensure the provider responds in a timely and appropriate manner to communications from the Commissioner about compliance with the standards;

15. implement policies, procedures and mechanisms to report or make complaints, and to respond to complaints;

16. notify the Commissioner of proposed changes to the features and functions of the service, unless the change will not significantly increase the relevant risk; and

17. cooperate with and report to the Commissioner as required; for instance, the Commissioner may require the provider to provide a compliance report and reports on outcomes of development programs.

Do you comply with the new standards?

These obligations are set out at a high level and some exceptions may apply. We strongly recommend that providers take steps to comply with the new standards well before, but at least by 21 June 2025. Please contact us if you would like advice regarding these new standards, particularly on whether your business is a RES or DIS, must complete a risk assessment, and whether your Terms of Use and End-User Agreements need an uplift to comply with the new laws.

These new standards are Phase 1 standards that applies only to Class 1A material and Class 1B material. The second phase of industry code development, focusing on Class 1C and Class 2 material such as online pornography that is inappropriate for children, is forthcoming.