Australia’s eSafety Commissioner has registered six new industry codes under the Online Safety Act, expanding mandatory obligations for a wide range of digital platforms. The registration, announced on September 9, 2025, covers social media, messaging, designated internet services, app distribution platforms, and equipment providers. It follows the earlier registration of codes for internet carriage, hosting, and search services in June, and brings the total number of Phase 2 codes to nine.
New compliance requirements
The latest codes require platforms to prevent children’s access to age-restricted material such as online pornography, high-impact violence, and content related to self-harm or eating disorders. Social media services that allow such content must implement age assurance, while platforms that prohibit it are expected to detect and remove violations. Messaging services are prohibited from enabling illegal sharing of pornography with Australian children and must provide safety tools such as blocking and group-exit options.
Designated internet services, including adult websites and high-risk generative AI platforms, are required to put in place appropriate age assurance measures. App distribution services must, by September 9, 2026, implement age assurance before enabling downloads of 18+ apps. Equipment providers such as device operating system vendors must offer child accounts with built-in safety tools and continue to improve protections.
According to the eSafety Commissioner’s code register, the new codes take effect on March 9, 2026. By contrast, the three codes registered in June for internet carriage, hosting, and search services will commence on December 27, 2025. Some provisions include additional lead times, such as requirements for search engines to implement logged-in age assurance by June 27, 2026.
How age assurance will work
The codes are technology-neutral, allowing multiple methods of age assurance so long as they are appropriate to the risk and comply with privacy law. Acceptable options range from parental confirmation and photo ID to facial age estimation, credit card checks, digital ID wallets, or third-party verification providers. The eSafety FAQ notes that these measures must balance safety with user rights, particularly with regard to data protection and inclusivity.
Enforcement and penalties
All nine codes are mandatory and enforceable. If services fail to comply, the eSafety Commissioner may issue a direction. Breaches of a direction can attract civil penalties of up to AUD 49.5 million. The codes sit alongside Australia’s separate under-16 social media restrictions, which take effect on December 10, 2025, creating a layered regulatory framework aimed at protecting children online.
Broader implications
With the registration of the latest codes, Australia is moving toward one of the most comprehensive national regimes for online safety and age assurance. The staged implementation gives industry time to build compliant systems, but also sets firm deadlines for technology adoption in sensitive sectors. The inclusion of generative AI services highlights regulators’ intent to anticipate new content risks, and the scale of the penalties underscores the seriousness of the compliance mandate.
Source: eSafety Commissioner – Industry Codes Register | Phase 2 overview | FAQ
–
By Ali Nasser-Smith
