Online Safety Amendment (Social Media Minimum Age) Act 2024

No. 127, 2024

An Act to amend the Online Safety Act 2021, and for related purposes

Contents

1 Short title

2 Commencement

3 Schedules

Schedule 1—Amendments

Part 1—Amendment of the Online Safety Act 2021

Online Safety Act 2021

Part 2—Other amendments

Age Discrimination Act 2004

Part 3—Transitional provisions

Online Safety Amendment (Social Media Minimum Age) Act 2024

No. 127, 2024

An Act to amend the Online Safety Act 2021, and for related purposes

[Assented to 10 December 2024]

The Parliament of Australia enacts:

1  Short title

  This Act is the Online Safety Amendment (Social Media Minimum Age) Act 2024.

2  Commencement

 (1) Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.

Note: This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act.

 (2) Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act.

3  Schedules

  Legislation that is specified in a Schedule to this Act is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this Act has effect according to its terms.

Schedule 1—Amendments

Part 1—Amendment of the Online Safety Act 2021

Online Safety Act 2021

1  At the end of section 4

Add:

2  Section 5

Insert:

age‑restricted social media platform has the meaning given by section 63C.

age‑restricted user means an Australian child who has not reached 16 years.

3  Section 5 (definition of provider)

After “social media service,”, insert “age‑restricted social media platform,”.

4  Section 25

Omit:

substitute:

5  After paragraph 27(1)(q)

Insert:

 (qa) to formulate, in writing, guidelines for the taking of reasonable steps to prevent age‑restricted users having accounts with age‑restricted social media platforms; and

 (qb) to promote guidelines formulated under paragraph (qa); and

6  At the end of section 27

Add:

 (6) Guidelines formulated under paragraph (1)(qa) are not legislative instruments.

7  After Part 4

Insert:

Part 4A—Social media minimum age

Division 1—Introduction

63A  Simplified outline of this Part

63B  Object of this Part

  The object of this Part is to reduce the risk of harm to age‑restricted users from certain kinds of social media platforms.

63C  Age‑restricted social media platform

 (1) For the purposes of this Act, age‑restricted social media platform means:

 (a) an electronic service that satisfies the following conditions:

 (i) the sole purpose, or a significant purpose, of the service is to enable online social interaction between 2 or more end‑users;

 (ii) the service allows end‑users to link to, or interact with, some or all of the other end‑users;

 (iii) the service allows end‑users to post material on the service;

 (iv) such other conditions (if any) as are set out in the legislative rules; or

 (b) an electronic service specified in the legislative rules;

but does not include a service mentioned in subsection (6).

Note 1: Online social interaction does not include (for example) online business interaction.

Note 2: An age‑restricted social media platform may be, but is not necessarily, a social media service under section 13.

Note 3: For specification by class, see subsection 13(3) of the Legislation Act 2003.

 (2) For the purposes of subparagraph (1)(a)(i), online social interaction includes online interaction that enables end‑users to share material for social purposes.

Note: Social purposes does not include (for example) business purposes.

 (3) In determining whether the condition set out in subparagraph (1)(a)(i) is satisfied, disregard any of the following purposes:

 (a) the provision of advertising material on the service;

 (b) the generation of revenue from the provision of advertising material on the service.

 (4) The Minister may only make legislative rules specifying an electronic service for the purposes of paragraph (1)(b) if the Minister is satisfied that it is reasonably necessary to do so in order to minimise harm to age‑restricted users.

 (5) Before making legislative rules specifying an electronic service for the purposes of paragraph (1)(b):

 (a) the Minister must seek advice from the Commissioner, and must have regard to that advice; and

 (b) the Minister may seek advice from any other authorities or agencies of the Commonwealth that the Minister considers relevant, and may have regard to any such advice.

Services that are not age‑restricted social media platforms

 (6) An electronic service is not an age‑restricted social media platform if:

 (a) none of the material on the service is accessible to, or delivered to, one or more end‑users in Australia; or

 (b) the service is specified in the legislative rules.

Note: For specification by class, see subsection 13(3) of the Legislation Act 2003.

 (7) Before making legislative rules specifying an electronic service for the purposes of paragraph (6)(b):

 (a) the Minister must seek advice from the Commissioner, and must have regard to that advice; and

 (b) the Minister may seek advice from any other authorities or agencies of the Commonwealth that the Minister considers relevant, and may have regard to any such advice.

Division 2—Civil penalty

63D  Civil penalty for failing to take reasonable steps to prevent age‑restricted users having accounts

  A provider of an age‑restricted social media platform must take reasonable steps to prevent age‑restricted users having accounts with the age‑restricted social media platform.

Civil penalty: 30,000 penalty units.

63DA  Information that must not be collected

 (1) A provider of an age‑restricted social media platform must not collect information:

 (a) for the purpose of complying with section 63D; or

 (b) for purposes that include the purpose of complying with section 63D;

if the information is of a kind specified in the legislative rules.

Civil penalty: 30,000 penalty units.

 (2) Before making legislative rules specifying a kind of information for the purposes of subsection (1), the Minister:

 (a) must seek advice from the Commissioner, and must have regard to that advice; and

 (b) must seek advice from the Information Commissioner, and must have regard to that advice.

 (3) Section 63D does not apply to the provider of an age‑restricted social media platform if, because of legislative rules made for the purposes of subsection (1) of this section, there are no reasonable steps that the provider could take in order to comply with section 63D.

Note: In proceedings for a civil penalty order against a person for a contravention of section 63D, the person bears an evidential burden in relation to the matter in this subsection (see section 96 of the Regulatory Powers (Standard Provisions) Act 2014).

63DB  Use of certain identification material and services

 (1) A provider of an age‑restricted social media platform must not:

 (a) collect government‑issued identification material; or

 (b) use an accredited service (within the meaning of the Digital ID Act 2024);

for the purpose of complying with section 63D, or for purposes that include the purpose of complying with section 63D.

Civil penalty: 30,000 penalty units.

 (2) Subsection (1) does not apply if:

 (a) the provider provides alternative means (not involving the material and services mentioned in paragraphs (1)(a) and (b)) for an individual to assure the provider that the individual is not an age‑restricted user; and

 (b) those means are reasonable in the circumstances.

Note: In proceedings for a civil penalty order against a person for a contravention of subsection (1), the person bears an evidential burden in relation to the matter in this subsection (see section 96 of the Regulatory Powers (Standard Provisions) Act 2014).

 (3) This section does not limit section 63DA.

 (4) In this section:

government‑issued identification material includes:

 (a) identification documents issued by the Commonwealth, a State or a Territory, or by an authority or agency of the Commonwealth, a State or a Territory (including copies of such documents); and

 (b) a digital ID (within the meaning of the Digital ID Act 2024) issued by the Commonwealth, a State or a Territory, or by an authority or agency of the Commonwealth, a State or a Territory.

63E  Delayed effect of requirement to take reasonable steps to prevent age‑restricted users having accounts

 (1) Section 63D takes effect on a day specified in an instrument under subsection (2) of this section.

 (2) The Minister may, by notifiable instrument, specify a day for the purposes of subsection (1).

 (3) The specified day must not be later than 12 months after the day this section commences.

 (4) To avoid doubt, the obligation in section 63D applies in relation to accounts with an age‑restricted social media platform if the accounts exist on or after the day section 63D takes effect (including accounts that began to exist before that day, and accounts that began to exist before the day this section commences).

Division 3—Privacy

63F  Information collected for purposes including taking reasonable steps to comply with age restriction

 (1) If an entity:

 (a) holds personal information about an individual that was collected for the purpose of, or for purposes including the purpose of, taking reasonable steps to prevent age‑restricted users having accounts with an age‑restricted social media platform; and

 (b) uses or discloses the information otherwise than:

 (i) for the purpose of determining whether or not the individual is an age‑restricted user; or

 (ii) in circumstances where paragraph 6.2(b), (c), (d) or (e) of the Australian Privacy Principles applies; or

 (iii) with the consent of the individual, which must be in accordance with subsection (2);

the use or disclosure of the information is taken to be:

 (c) an interference with the privacy of the individual for the purposes of the Privacy Act 1988; and

 (d) covered by section 13 of that Act.

Note: An act or practice that is an interference with privacy may be the subject of a complaint under section 36 of the Privacy Act 1988.

 (2) For the purposes of subparagraph (1)(b)(iii):

 (a) the consent must be:

 (i) voluntary; and

 (ii) informed; and

 (iii) current; and

 (iv) specific; and

 (v) unambiguous; and

 (b) the individual must be able to withdraw the consent in a manner that is easily accessible to the individual.

 (3) If an entity holds personal information about an individual that was collected for the purpose of, or for purposes including the purpose of, taking reasonable steps to prevent age‑restricted users having accounts with an age‑restricted social media platform, then:

 (a) the entity must destroy the information after using or disclosing it for the purposes for which it was collected; and

 (b) if the entity does not so destroy the information, the failure to destroy the information is taken to be:

 (i) an interference with the privacy of the individual for the purposes of the Privacy Act 1988; and

 (ii) covered by section 13 of that Act.

Note: An act or practice that is an interference with privacy may be the subject of a complaint under section 36 of the Privacy Act 1988.

 (4) In this section:

entity has the same meaning as in Division 1 of Part III of the Privacy Act 1988.

personal information has the same meaning as in the Privacy Act 1988.

Division 4—Information‑gathering powers

63G  Commissioner may obtain information about compliance

Scope

 (1) This section applies to a person if the Commissioner believes on reasonable grounds that:

 (a) the person is a provider of an age‑restricted social media platform; and

 (b) the person has information relevant to the person’s compliance with section 63D or subsection 63DA(1) or 63DB(1).

 (2) This section also applies to a person if the Commissioner believes on reasonable grounds that:

 (a) the person is a provider of an electronic service; and

 (b) the person has information relevant to whether the service is a service specified in the legislative rules for the purposes of paragraph 63C(1)(b) or (6)(b).

Requirement

 (3) The Commissioner may, by written notice given to a person to whom this section applies, require the person to give to the Commissioner, within the period and in the manner and form specified in the notice, any information mentioned in paragraph (1)(b) or (2)(b) (as the case may be).

63H  Compliance with notice

  A person must comply with a requirement under section 63G to the extent that the person is capable of doing so.

Civil penalty: 500 penalty units.

Division 5—Platform provider notifications

63J  Platform provider notifications—failure to take reasonable steps

  If the Commissioner is satisfied that the provider of an age‑restricted social media platform has contravened:

 (a) section 63D (failing to take reasonable steps to prevent age‑restricted users having accounts); or

 (b) subsection 63DA(1) (collecting information); or

 (c) subsection 63DB(1) (identification material and services);

the Commissioner may:

 (d) prepare a statement to that effect; and

 (e) give a copy of the statement to the provider of the platform; and

 (f) if the Commissioner considers that it is appropriate to publish the statement—publish the statement on the Commissioner’s website.

63K  Platform provider notifications—privacy

  If the Information Commissioner is satisfied that the provider of an age‑restricted social media platform has used, disclosed or failed to destroy information in a way that is taken to be an interference with privacy under subsection 63F(1) or (3) (privacy), the Information Commissioner may:

 (a) prepare a statement to that effect; and

 (b) give a copy of the statement to the provider of the platform; and

 (c) if the Information Commissioner considers that it is appropriate to publish the statement—publish the statement on the Information Commissioner’s website.

8  Subsection 143(2) (penalty)

Repeal the penalty, substitute:

Civil penalty: 30,000 penalty units.

9  At the end of section 143

Add:

 (3) Subsection 93(2) of the Regulatory Powers (Standard Provisions) Act 2014 does not apply in relation to a contravention of subsection (2) of this section.

10  Section 146

Before “If”, insert “(1)”.

11  Section 146 (penalty)

Omit “500”, substitute “30,000”.

12  At the end of section 146

Add:

 (2) Subsection 93(2) of the Regulatory Powers (Standard Provisions) Act 2014 does not apply in relation to a contravention of subsection (1) of this section.

13  After paragraphs 163(1)(d), 164(1)(d) and 165(1)(d)

Insert:

 (da) section 63D;

 (daa) section 63DA;

 (dab) section 63DB;

 (db) section 63H;

13A  After section 222

222A  Liability for damages—Information Commissioner

  The Information Commissioner is not liable to an action or other proceeding for damages for, or in relation to, an act or matter in good faith done or omitted to be done:

 (a) in the performance or purported performance of any function; or

 (b) in the exercise or purported exercise of any power;

conferred on the Information Commissioner by or under this Act.

14  Section 238 (heading)

After “social media service,”, insert “age‑restricted social media platform,”.

15  Subsections 238(1) and (3)

After “social media service,” (wherever occurring), insert “age‑restricted social media platform,”.

16  After section 239A

Insert:

239B  Review of social media minimum age framework

 (1) Within 2 years after the day section 63D takes effect in accordance with section 63E, the Minister must cause to be conducted an independent review of the operation of Part 4A.

 (2) Without limiting subsection (1), the review must include consideration of:

 (a) the adequacy of privacy protections in, and in relation to, Part 4A; and

 (b) any other matters relating to the operation of Part 4A determined by the Minister.

 (3) The Minister must cause to be prepared a written report of the review.

 (4) The Minister must cause copies of the report to be tabled in each House of the Parliament within 15 sitting days of that House after the day on which the report is given to the Minister.

Part 2—Other amendments

Age Discrimination Act 2004

17  Schedule 2 (after table item 8)

Insert:

Part 3—Transitional provisions

18  Transitional provision—compliance with industry codes

The amendments of section 143 of the Online Safety Act 2021 made by this Schedule apply in relation to directions given under that section on or after the commencement of this Schedule (including such directions given in relation to industry codes that were registered before that commencement).

19  Transitional provision—compliance with industry standards

The amendments of section 146 of the Online Safety Act 2021 made by this Schedule apply in relation to a failure to comply with an industry standard that occurs on or after the commencement of this Schedule (including failures to comply with industry standards that were registered before that commencement).

[Minister’s second reading speech made in—

House of Representatives on 21 November 2024

Senate on 27 November 2024]