Online Safety Amendment (Social Media Minimum Age) Act 2024

No. 127, 2024

An Act to amend the Online Safety Act 2021, and for related purposes

Contents

1 Short title 1

2 Commencement 2

3 Schedules 2

Schedule 1—Amendments 3

Part 1—Amendment of the Online Safety Act 2021 3

Online Safety Act 2021 3

Part 2—Other amendments 15

Age Discrimination Act 2004 15

Part 3—Transitional provisions 16

Online Safety Amendment (Social Media Minimum Age) Act 2024

No. 127, 2024

An Act to amend the Online Safety Act 2021, and for related purposes

[Assented to 10 December 2024]

The Parliament of Australia enacts:
1 Short title

This Act is the Online Safety Amendment (Social Media Minimum Age) Act 2024.
2 Commencement 1

Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.
Commencement information Commencement information Commencement information
Column 1 Column 2 Column 3
Provisions Commencement Date/Details
1. The whole of this Act The day after this Act receives the Royal Assent. 11 December 2024

Note: This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act.

 2

Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act.
3 Schedules

Legislation that is specified in a Schedule to this Act is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this Act has effect according to its terms.
Amendments

Online Safety Act 2021

 1 At the end of section 4

Add:

• There are age restrictions for certain social media platforms. A provider of such a platform must take reasonable steps to prevent children who have not reached a minimum age from having accounts.

 2 Section 5

Insert:

age-restricted social media platform has the meaning given by section 63C.

age-restricted user means an Australian child who has not reached 16 years.

 3 Section 5 (definition of provider)

After “social media service,”, insert “age-restricted social media platform,”.

 4 Section 25

Omit:

substitute:

 f

coordinating activities of Commonwealth Departments, authorities and agencies relating to online safety for Australians.

 f

coordinating activities of Commonwealth Departments, authorities and agencies relating to online safety for Australians; and

 g

performing various functions relating to the social media minimum age provisions in Part 4A.

 5 After paragraph 27(1)(q)

Insert:

 qa

to formulate, in writing, guidelines for the taking of reasonable steps to prevent age-restricted users having accounts with age-restricted social media platforms; and

 qb

to promote guidelines formulated under paragraph (qa); and

 6 At the end of section 27

Add:

 6

Guidelines formulated under paragraph (1)(qa) are not legislative instruments.

 7 After Part 4

Insert:

 63A Simplified outline of this Part

• Providers of certain kinds of social media platforms must take reasonable steps to prevent children who have not reached a minimum age from having accounts. This requirement takes effect on a day specified by the Minister.

• There are privacy protections for information collected by social media platforms for the purposes of the minimum age requirement.

 63B Object of this Part

The object of this Part is to reduce the risk of harm to age-restricted users from certain kinds of social media platforms.

 63C Age-restricted social media platform 1

(1) For the purposes of this Act, age-restricted social media platform means:

 a

an electronic service that satisfies the following conditions:

 i

the sole purpose, or a significant purpose, of the service is to enable online social interaction between 2 or more end-users;

 ii

the service allows end-users to link to, or interact with, some or all of the other end-users;

 iii

the service allows end-users to post material on the service;

 iv

such other conditions (if any) as are set out in the legislative rules; or

 b

an electronic service specified in the legislative rules;

but does not include a service mentioned in subsection (6).

Note 1: Online social interaction does not include (for example) online business interaction.

Note 2: An age-restricted social media platform may be, but is not necessarily, a social media service under section 13.

Note 3: For specification by class, see subsection 13(3) of the Legislation Act 2003.

Note: Social purposes does not include (for example) business purposes.

Services that are not age-restricted social media platforms

Note: For specification by class, see subsection 13(3) of the Legislation Act 2003.

 2

For the purposes of subparagraph (1)(a)(i), online social interaction includes online interaction that enables end-users to share material for social purposes.

 3

In determining whether the condition set out in subparagraph (1)(a)(i) is satisfied, disregard any of the following purposes:

 a

the provision of advertising material on the service;

 b

the generation of revenue from the provision of advertising material on the service.

 4

The Minister may only make legislative rules specifying an electronic service for the purposes of paragraph (1)(b) if the Minister is satisfied that it is reasonably necessary to do so in order to minimise harm to age-restricted users.

 5

Before making legislative rules specifying an electronic service for the purposes of paragraph (1)(b):

 a

the Minister must seek advice from the Commissioner, and must have regard to that advice; and

 b

the Minister may seek advice from any other authorities or agencies of the Commonwealth that the Minister considers relevant, and may have regard to any such advice.

 6

(6) An electronic service is not an age-restricted social media platform if:

 a

none of the material on the service is accessible to, or delivered to, one or more end-users in Australia; or

 b

the service is specified in the legislative rules.

 7

Before making legislative rules specifying an electronic service for the purposes of paragraph (6)(b):

 a

the Minister must seek advice from the Commissioner, and must have regard to that advice; and

 b

the Minister may seek advice from any other authorities or agencies of the Commonwealth that the Minister considers relevant, and may have regard to any such advice.

 63D Civil penalty for failing to take reasonable steps to prevent age-restricted users having accounts

A provider of an age-restricted social media platform must take reasonable steps to prevent age-restricted users having accounts with the age-restricted social media platform.

Civil penalty: 30,000 penalty units.

 63DA Information that must not be collected 1

A provider of an age-restricted social media platform must not collect information:

 a

for the purpose of complying with section 63D; or

 b

for purposes that include the purpose of complying with section 63D;

if the information is of a kind specified in the legislative rules.

Civil penalty: 30,000 penalty units.

Note: In proceedings for a civil penalty order against a person for a contravention of Regulatory Powers (Standard Provisions) Act 2014).section 63D, the person bears an evidential burden in relation to the matter in this subsection (see section 96 of the

2

Before making legislative rules specifying a kind of information for the purposes of subsection (1), the Minister:

 a

must seek advice from the Commissioner, and must have regard to that advice; and

 b

must seek advice from the Information Commissioner, and must have regard to that advice.

 3

Section 63D does not apply to the provider of an age-restricted social media platform if, because of legislative rules made for the purposes of subsection (1) of this section, there are no reasonable steps that the provider could take in order to comply with section 63D.

 63DB Use of certain identification material and services 1

A provider of an age-restricted social media platform must not:

 a

collect government-issued identification material; or

 b

(b) use an accredited service (within the meaning of the Digital ID Act 2024);

for the purpose of complying with section 63D, or for purposes that include the purpose of complying with section 63D.

Civil penalty: 30,000 penalty units.

Note: In proceedings for a civil penalty order against a person for a contravention of subsection (1), the person bears an evidential burden in relation to the matter in this subsection (see Regulatory Powers (Standard Provisions) Act 2014).section 96 of the

government-issued identification material includes:

 2

Subsection (1) does not apply if:

 a

the provider provides alternative means (not involving the material and services mentioned in paragraphs (1)(a) and (b)) for an individual to assure the provider that the individual is not an age-restricted user; and

 b

those means are reasonable in the circumstances.

 3

This section does not limit section 63DA.

 4

In this section:

 a

identification documents issued by the Commonwealth, a State or a Territory, or by an authority or agency of the Commonwealth, a State or a Territory (including copies of such documents); and

 b

(b) a digital ID (within the meaning of the Digital ID Act 2024) issued by the Commonwealth, a State or a Territory, or by an authority or agency of the Commonwealth, a State or a Territory.

 63E Delayed effect of requirement to take reasonable steps to prevent age-restricted users having accounts 1

Section 63D takes effect on a day specified in an instrument under subsection (2) of this section.

 2

The Minister may, by notifiable instrument, specify a day for the purposes of subsection (1).

 3

The specified day must not be later than 12 months after the day this section commences.

 4

To avoid doubt, the obligation in section 63D applies in relation to accounts with an age-restricted social media platform if the accounts exist on or after the day section 63D takes effect (including accounts that began to exist before that day, and accounts that began to exist before the day this section commences).

 63F Information collected for purposes including taking reasonable steps to comply with age restriction 1

If an entity:

 a

holds personal information about an individual that was collected for the purpose of, or for purposes including the purpose of, taking reasonable steps to prevent age-restricted users having accounts with an age-restricted social media platform; and

 b

uses or discloses the information otherwise than:

 i

for the purpose of determining whether or not the individual is an age-restricted user; or

 ii

in circumstances where paragraph 6.2(b), (c), (d) or (e) of the Australian Privacy Principles applies; or

 iii

with the consent of the individual, which must be in accordance with subsection (2);

the use or disclosure of the information is taken to be:

Note: An act or practice that is an interference with privacy may be the subject of a complaint under Privacy Act 1988.section 36 of the

Note: An act or practice that is an interference with privacy may be the subject of a complaint under Privacy Act 1988.section 36 of the

entity has the same meaning as in Division 1 of Part III of the Privacy Act 1988.

personal information has the same meaning as in the Privacy Act 1988.

 c

(c) an interference with the privacy of the individual for the purposes of the Privacy Act 1988; and

 d

covered by section 13 of that Act.

 2

For the purposes of subparagraph (1)(b)(iii):

 a

the consent must be:

 i

voluntary; and

 ii

informed; and

 iii

current; and

 iv

specific; and

 v

unambiguous; and

 b

the individual must be able to withdraw the consent in a manner that is easily accessible to the individual.

 3

If an entity holds personal information about an individual that was collected for the purpose of, or for purposes including the purpose of, taking reasonable steps to prevent age-restricted users having accounts with an age-restricted social media platform, then:

 a

the entity must destroy the information after using or disclosing it for the purposes for which it was collected; and

 b

if the entity does not so destroy the information, the failure to destroy the information is taken to be:

 i

(i) an interference with the privacy of the individual for the purposes of the Privacy Act 1988; and

 ii

covered by section 13 of that Act.

 4

In this section:

 63G Commissioner may obtain information about compliance

Scope

Requirement

 1

This section applies to a person if the Commissioner believes on reasonable grounds that:

 a

the person is a provider of an age-restricted social media platform; and

 b

the person has information relevant to the person’s compliance with section 63D or subsection 63DA(1) or 63DB(1).

 2

This section also applies to a person if the Commissioner believes on reasonable grounds that:

 a

the person is a provider of an electronic service; and

 b

the person has information relevant to whether the service is a service specified in the legislative rules for the purposes of paragraph 63C(1)(b) or (6)(b).

 3

The Commissioner may, by written notice given to a person to whom this section applies, require the person to give to the Commissioner, within the period and in the manner and form specified in the notice, any information mentioned in paragraph (1)(b) or (2)(b) (as the case may be).

 63H Compliance with notice

A person must comply with a requirement under section 63G to the extent that the person is capable of doing so.

Civil penalty: 500 penalty units.

 63J Platform provider notifications—failure to take reasonable steps

If the Commissioner is satisfied that the provider of an age-restricted social media platform has contravened:

the Commissioner may:

 a

section 63D (failing to take reasonable steps to prevent age-restricted users having accounts); or

 b

subsection 63DA(1) (collecting information); or

 c

subsection 63DB(1) (identification material and services);

 d

prepare a statement to that effect; and

 e

give a copy of the statement to the provider of the platform; and

 f

if the Commissioner considers that it is appropriate to publish the statement—publish the statement on the Commissioner’s website.

 63K Platform provider notifications—privacy

If the Information Commissioner is satisfied that the provider of an age-restricted social media platform has used, disclosed or failed to destroy information in a way that is taken to be an interference with privacy under subsection 63F(1) or (3) (privacy), the Information Commissioner may:

 a

prepare a statement to that effect; and

 b

give a copy of the statement to the provider of the platform; and

 c

if the Information Commissioner considers that it is appropriate to publish the statement—publish the statement on the Information Commissioner’s website.

 8 Subsection 143(2) (penalty)

Repeal the penalty, substitute:

Civil penalty: 30,000 penalty units.

 9 At the end of section 143

Add:

 3

(3) Subsection 93(2) of the Regulatory Powers (Standard Provisions) Act 2014 does not apply in relation to a contravention of subsection (2) of this section.

 10 Section 146

Before “If”, insert “(1)”.

 11 Section 146 (penalty)

Omit “500”, substitute “30,000”.

 12 At the end of section 146

Add:

 2

(2) Subsection 93(2) of the Regulatory Powers (Standard Provisions) Act 2014 does not apply in relation to a contravention of subsection (1) of this section.

 13 After paragraphs 163(1)(d), 164(1)(d) and 165(1)(d)

Insert:

 da

section 63D;

 daa

section 63DA;

 dab

section 63DB;

 db

section 63H;

 13A After section 222 222A Liability for damages—Information Commissioner

The Information Commissioner is not liable to an action or other proceeding for damages for, or in relation to, an act or matter in good faith done or omitted to be done:

conferred on the Information Commissioner by or under this Act.

 a

in the performance or purported performance of any function; or

 b

in the exercise or purported exercise of any power;

 14 Section 238 (heading)

After “social media service,”, insert “age-restricted social media platform,”.

 15 Subsections 238(1) and (3)

After “social media service,” (wherever occurring), insert “age-restricted social media platform,”.

 16 After section 239A

Insert:

 239B Review of social media minimum age framework 1

Within 2 years after the day the Minister must cause to be conducted an independent review of the operation of Part 4A.section 63D takes effect in accordance with section 63E,

2

Without limiting subsection (1), the review must include consideration of:

 a

the adequacy of privacy protections in, and in relation to, Part 4A; and

 b

any other matters relating to the operation of the Minister.Part 4A determined by

3

The Minister must cause to be prepared a written report of the review.

 4

The Minister must cause copies of the report to be tabled in each House of the Parliament within 15 sitting days of that House after the day on which the report is given to the Minister.

Age Discrimination Act 2004

 17 Schedule 2 (after table item 8)

Insert:

 18 Transitional provision—compliance with industry codes

The amendments of Online Safety Act 2021 made by this Schedule apply in relation to directions given under that section on or after the commencement of this Schedule (including such directions given in relation to industry codes that were registered before that commencement).section 143 of the

19 Transitional provision—compliance with industry standards

The amendments of Online Safety Act 2021 made by this Schedule apply in relation to a failure to comply with an industry standard that occurs on or after the commencement of this Schedule (including failures to comply with industry standards that were registered before that commencement).section 146 of the

[Minister’s second reading speech made in—

House of Representatives on 21 November 2024

Senate on 27 November 2024]

(150/24)