"The eSafety Commissioner's powers in 2026: takedowns, age assurance, and the scope-creep debate"
The eSafety Commissioner's powers in 2026: takedowns, age assurance, and the scope-creep debate
No Australian regulator has grown as fast as the eSafety Commissioner. Born in 2015 as a children's cybersafety office, it now holds takedown and information-gathering powers across most of the internet — and in 2026 it got more of both. Whether that's overdue accountability for big platforms or textbook scope creep depends on who you ask. Here's the map.
The base layer: the Online Safety Act
The Online Safety Act 2021 gives eSafety removal (takedown) notices for class 1A and class 1B material and cyber-abuse material, industry codes and standards authority, and broad information-gathering powers. Those powers have teeth and they've been tested: in the X Corp litigation, the Full Federal Court rejected X's appeal over eSafety's Australia-wide removal notice for violent content, and eSafety's $610,000 fines for non-compliance survived the challenge. (eSafety media release, Information Age)
The independent review of the Act, delivered in October 2024 and tabled in February 2025, made 67 recommendations — among them stronger information-gathering and investigation powers for eSafety, alongside a new "digital duty of care" putting the onus on services to keep users safe. (Baker McKenzie summary, Government response and Digital Duty of Care exposure draft, 8 September 2026)
The under-16 minimum age regime
The Social Media Minimum Age Act 2024 added the highest-profile power: since 10 December 2025, age-restricted social media platforms must take reasonable steps to stop Australians under 16 from holding accounts, using age-assurance rather than outright ID checks by the platforms themselves. Ten major platforms — Facebook, Instagram, Snapchat, Threads, TikTok, Twitch, X, YouTube, Kick and Reddit — are in scope. (eSafety social media age restrictions, Online Safety Amendment (Social Media Minimum Age) Act 2024)
Enforcement got a lot heavier this year. The Government announced in June 2026 — and Parliament passed in September 2026 as the Online Safety Amendment (Strengthening Enforcement for the Social Media Minimum Age) Act 2026 — a doubling of the maximum penalty for systematic breaches to $99 million and expanded information-gathering powers, including compelled documents from third parties such as app-store and age-assurance providers. eSafety is currently investigating five platforms (Facebook, Instagram, Snapchat, TikTok and YouTube), and one study found little evidence of immediate substantive reductions in reported social media use by under-16s after the ban took effect. (Prime Minister's media release, 28 June 2026, Bills Digest No. 12, 2026-27, BMJ study cited in the digest)
The scope-creep debate
Civil-society criticisms are consistent and long-running:
- Remit expansion without proportionality. Digital Rights Watch's Online Safety Act review submission argued that eSafety's role and remit "has continued to expand" faster than the safeguards that govern it, and that sweeping content powers risk chilling lawful speech. (DRW submission, June 2024)
- Parliamentary pushback. The Parliamentary Joint Committee on Human Rights has formally sought advice from the Minister on how the strengthened enforcement measures interact with privacy and the rights of the child — a live rights assessment, not a rubber stamp. (Bills Digest No. 12, 2026-27)
- Encryption-adjacent pressure. eSafety has no TOLA-style capability-notice power, but its industry codes and standards push platforms on how they detect and report abuse material, and its 2023 end-to-end-encryption position statement repeatedly frames scanning for abuse material as an obligation worth pursuing — which encryption researchers read as regulatory pressure on E2EE. (eSafety E2EE position statement, October 2023)
There's also a genuine child-safety constituency behind the powers: the image-abuse removal schemes exist because victims were being re-traumatised by persistent content, as eSafety's position statement documents.
What it means for your privacy
Age assurance means platforms must make some inference or check about your age; the law explicitly prefers privacy-preserving methods and prohibits forcing ID to the regulator, but the details live in how platforms implement it. The practical points: the data this regime generates (age inferences, document scans where used) is collected by private platforms, not government; you can demand deletion under the Privacy Act; and if you'd rather not feed more identity data into platform accounts, minimising what you share on the age-gated services is a lawful and reasonable choice. Our encryption status post covers the separate TOLA powers that agencies can use against providers.
This article is general information, not legal advice.