Digital regulation in Australia: how new regulations converge and intersect

Privacy Act – Tranche 1 reforms (in force)

The first legislative response to the 2023 Privacy Act Review Report. Introduced: anti-doxxing offences; automated decision-making transparency requirements, new civil penalty tiers, strengthened OAIC enforcement powers, requirement for a Children’s Online Privacy Code.

Statutory tort for serious invasions of privacy commences (in force)

Not limited to APP entities – a cause of action can be pursued against any person or organisation.

Social media minimum age requirements (in force)

Requires ‘age-restricted social media platforms’ to take ‘reasonable steps’ to prevent under 16s having accounts. 

The changes impose specific rules on age-restricted social media platforms regarding how they handle data collected for age verification purposes. These rules apply alongside Privacy Act obligations.

Age-Restricted Material Codes come into effect (in force)

Require providers of designated internet services and relevant electronic services to take steps to prevent children from accessing age-restricted material (e.g. pornography), including through age assurance mechanisms.

Children's Online Privacy Code – exposure draft released (proposed)

The OAIC publishes the exposure draft Code, which applies to providers of social media services, relevant electronic services or designated internet services (all defined by reference to the Online Safety Act) that are 'likely to be accessed by children'. Key features include stricter limits on collection of children's data, enhanced consent requirements (parental consent for under-15s), mandatory age assurance, a child-specific right of destruction, and mandatory privacy impact assessments. Consultation closed 5 June 2026.

Online Safety Act Review - government response 

Government supports 64 of 67 recommendations from the independent statutory review, with a digital duty of care as the headline commitment alongside stronger accountability and enforcement measures for digital platforms.

Australian standards for AI announced (proposed) 

PM announces shift from voluntary guidance to mandatory national regulation. A single national framework will set mandatory standards for large AI data centres (energy, water, community impact), copyright protections for Australian creators, and AI consumer safety priorities. Office of AI established within PM&C. Legislation expected early 2027.

The Privacy Act refers to the Online Safety Act to define 'large digital platforms’

The right of erasure applies to providers of social media services, relevant electronic services or designated internet services (as defined in the Online Safety Act) that meet a $500 million group revenue threshold or have 2.5 million average monthly Australian end users.

Privacy Act – Tranche 2 reforms – exposure draft released (proposed)

Proposes a new 'fair and reasonable' test for the collection and use of personal information (replacing APPs 3, 4 and 6); stronger consent standards (voluntary, informed, current, specific and unambiguous); a statutory controller/processor framework; restrictions on the trading of personal data; a right of erasure targeting large digital platforms; a hard 72-hour data breach notification deadline; and enhanced data security obligations. Submissions close 18 September 2026.

Digital Duty of Care  – exposure draft released (proposed)

Applies to persons responsible for 'online services' (including social media, messaging, websites, app stores, search engines, ISPs, hosting services, and AI content generation services). Services must ensure, 'so far as is reasonably practicable', a 'safe online environment'. Key obligations include managing design features, conducting annual risk assessments, and three tiers of protection escalating from all Australians to children under 18 to children under 16 on social media. Civil penalties of up to ~$109.2 million for bodies corporate. 12-month transition after Royal Assent.