Australia

This Act inserted sections 474.17A and 474.17AA into the Criminal Code Act 1995, making it an offence to use a carriage service to transmit material depicting, or appearing to depict, a person aged 18 or over in a sexual pose or activity, or their sexual organ, anal region, or, for a female, breasts, without their consent, where the person transmitting it knows of the lack of consent or is reckless as to it.

It is irrelevant whether the transmitted material is unaltered or has been created or altered using technology, including artificial intelligence, to generate a realistic but false depiction of the person, the kind of material commonly called a deepfake.

The base offence carries a maximum of 6 years imprisonment; a person who transmits such material after 3 or more prior civil penalty orders for non-compliance with an Online Safety Act 2021 removal notice, or who was responsible for creating or altering the material themselves, faces an aggravated offence carrying a maximum of 7 years imprisonment.

Section 18(1) of the Australian Consumer Law, which is Schedule 2 to the Competition and Consumer Act 2010, prohibits a person, in trade or commerce, from engaging in conduct that is misleading or deceptive or is likely to mislead or deceive.

The Treasury's final report on its review of AI and the Australian Consumer Law states that the provisions prohibiting misleading or deceptive conduct and false and misleading representations apply regardless of the technology through which the advertising is used or enabled.

Section 29(1)(g) prohibits a person, in trade or commerce and in connection with the supply or promotion of goods or services, from making a false or misleading representation that goods or services have particular performance characteristics, uses or benefits. Section 29(1)(b) prohibits a false or misleading representation, made in the same circumstances, that services are of a particular standard, quality, value or grade.

Section 34 prohibits a person, in trade or commerce, from engaging in conduct that is liable to mislead the public as to the nature, the characteristics, the suitability for their purpose or the quantity of any services. Schedule 2 applies as a law of the Commonwealth to the conduct of corporations.

A person who suffers loss or damage because of conduct that contravened Chapter 2 or 3 of the Australian Consumer Law may recover the amount of the loss or damage by action against the other person, or against any person involved in the contravention. The Trade Practices Amendment (Australian Consumer Law) Act (No. 2) 2010 commenced its Schedules 1, 2, 4, 5 and 7 on 1 January 2011.

An entity holding personal information that is required to comply with Australian Privacy Principle 11.1 (security of personal information) must notify an eligible data breach, meaning unauthorised access to or disclosure of information that a reasonable person would conclude is likely to result in serious harm.

The entity must give a copy of a statement about the breach to both the Information Commissioner and the affected individuals as soon as practicable after becoming aware of reasonable grounds to believe the breach occurred.

Binds Commonwealth agencies and organisations, including businesses with an annual turnover over $3,000,000, to comply with the Australian Privacy Principles in Schedule 1. It also extends to an act done or a practice engaged in outside Australia by an entity with an Australian link. Sections 13 to 15 and the Australian Privacy Principles in Schedule 1 were substituted by the Privacy Amendment (Enhancing Privacy Protection) Act 2012, whose Schedules 1 to 4 commenced on 12 March 2014.

Inserts a new Australian Privacy Principle 1.7 to 1.9 requiring an APP entity's privacy policy to disclose, for computer programs the entity uses to make decisions that could reasonably be expected to significantly affect an individual's rights or interests, the kinds of personal information used in that decision-making and the categories of decisions made.

Received Royal Assent on 10 December 2024, and the commencement table fixes the day for this Schedule at 24 months after Assent, so the disclosure duty takes effect on 10 December 2026.

Section 18(1) of the Australian Consumer Law, which is Schedule 2 to the Competition and Consumer Act 2010, prohibits a person, in trade or commerce, from engaging in conduct that is misleading or deceptive or is likely to mislead or deceive. The prohibition in section 18(1) is not confined to a kind of conduct or a subject matter.

Section 29(1) prohibits a person, in trade or commerce and in connection with the supply or promotion of goods or services, from making a false or misleading representation of a listed kind, including that goods or services have particular performance characteristics, uses or benefits.

Section 34 prohibits a person, in trade or commerce, from engaging in conduct that is liable to mislead the public as to the nature, the characteristics, the suitability for their purpose or the quantity of any services. Schedule 2 applies as a law of the Commonwealth to the conduct of corporations.

A person who suffers loss or damage because of conduct that contravened Chapter 2 or 3 of the Australian Consumer Law may recover the amount of the loss or damage by action against the other person, or against any person involved in the contravention. The Trade Practices Amendment (Australian Consumer Law) Act (No. 2) 2010 commenced its Schedules 1, 2, 4, 5 and 7 on 1 January 2011.

Section 13G makes a serious interference with the privacy of an individual a civil penalty provision. For a body corporate the maximum penalty is the greatest of $50,000,000 and either three times the value of the benefit obtained, where the court can determine it, or 30% of adjusted turnover during the breach turnover period, where it cannot. For an individual the maximum is $2,500,000.

The Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 set these maximums, and its Schedule 1 commenced on 13 December 2022.

Section 13H makes any interference with the privacy of an individual a civil penalty provision with a maximum penalty of 2,000 penalty units. The Privacy and Other Legislation Amendment Act 2024 inserted section 13H, and the Schedule 1 items that did so commenced on 11 December 2024.

Creates a new statutory tort giving an individual a cause of action for a serious invasion of privacy, by intrusion upon seclusion or by misuse of information, where the person invading privacy intended or was reckless as to the invasion and a reasonable person would consider it serious.

The Federal Register of Legislation's amendment-history endnote for the Privacy Act records this Schedule as commencing 10 June 2025, the six-month backstop date under the amending Act's own commencement table because no earlier Proclamation was recorded.

An APP entity must not collect sensitive information about an individual unless the individual consents and the collection is reasonably necessary for the entity's functions, or a listed exception applies.

Sensitive information is defined to include information or an opinion about an individual's racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual orientation or practices, or criminal record, where that is also personal information; health information about an individual; and genetic information about an individual that is not otherwise health information.

It also includes biometric information that is to be used for the purpose of automated biometric verification or biometric identification, and biometric templates. This is the provision that reaches a voiceprint or faceprint collected for biometric identification, on top of the entity's general Australian Privacy Principle 3 duty for ordinary personal information.

Section 478.1 makes it an offence, punishable by up to 2 years imprisonment, to cause unauthorised access to, or modification of, restricted data, meaning data held in a computer to which access is restricted by an access control system, intending to cause the access or modification and knowing it is unauthorised.

Access is unauthorised under section 476.2 only if the person is not entitled to cause it, so a scraper reading a public, unauthenticated page without defeating any access control falls outside a plain reading of the offence, and no reported Australian case has tested a scraping fact pattern under this Part. The Criminal Code applies this offence to a body corporate in the same way as it applies to an individual.

Section 116AN of the Copyright Act 1968 (Cth) allows an owner or exclusive licensee of the copyright in a work or other subject-matter to bring an action against a person if the work or other subject-matter is protected by an access control technological protection measure, the person does an act that results in the circumvention of that measure, and the person knows, or ought reasonably to know, that the act would have that result.

Section 10(1) defines an access control technological protection measure as a device, product, technology or component, including a computer program, that is used in Australia or a qualifying country by, with the permission of, or on behalf of, the owner or exclusive licensee of the copyright, in connection with the exercise of the copyright, and that in the normal course of its operation controls access to the work or other subject-matter.

The definition excludes such a measure to the extent that, for a cinematograph film or computer program, it controls geographic market segmentation by preventing the playback in Australia of a non-infringing copy acquired outside Australia, or, for a computer program embodied in a machine or device, it restricts the use of goods other than the work or services in relation to the machine or device.

Section 116AN(1) does not apply to a person who has the permission of the copyright owner or exclusive licensee to circumvent the measure.

Further exceptions in section 116AN(3) to (9) cover interoperability of computer programs, encryption research, computer security testing, online privacy, law enforcement and national security, acquisition decisions by libraries, archives and educational institutions, and acts prescribed by the regulations, and the defendant bears the burden of establishing the exceptions in subsections (2) to (9).

Section 116AO gives the owner or exclusive licensee a further action against a person who manufactures a device with the intention of providing it to another person, imports it into Australia with that intention, distributes it, offers it to the public, provides it or communicates it to another person, knowing or ought reasonably to know that the device is a circumvention device for a technological protection measure protecting the work.

Section 116AP gives the owner or exclusive licensee an action against a person who provides a service to another person or offers a service to the public, knowing or ought reasonably to know that it is a circumvention service for a technological protection measure protecting the work. In these actions the relief may include an injunction, subject to such terms as the court thinks fit, and damages or an account of profits.

In assessing damages the court may award additional damages as it considers appropriate, having regard to the flagrancy of the defendant's acts, the need to deter similar acts, the defendant's conduct after the acts, any benefit that accrued to the defendant and any other relevant matters.

Section 132APC makes it an offence, punishable by 60 penalty units, to engage in conduct that results in the circumvention of an access control technological protection measure with the intention of obtaining a commercial advantage or profit. The definition of access control technological protection measure and sections 116AN to 116AQ were inserted by Schedule 12 to the Copyright Amendment Act 2006, Part 1 of which commenced on 1 January 2007.

Sections 40 to 42 permit fair dealing with a literary, dramatic, musical or artistic work for research or study, criticism or review, parody or satire, or reporting news, but Australia has no general text-and-data-mining exception. On 26 October 2025 the Attorney-General confirmed the Government would not introduce a text-and-data-mining exception, choosing instead to pursue a licensing-based approach for AI training.

Section 10's definition of literary work includes a table or compilation of words, figures or symbols, so a scraped compilation can attract copyright as a literary work if its selection or arrangement involves sufficient independent intellectual effort, but Australia recognises no separate sui generis database right of the kind the European Union has, so a database that is a mere compilation of facts without such effort receives no protection at all. The sections this entry groups came into force on different days.

The Privacy Act 1988's definition of personal information carries no exception for information that is publicly accessible, so an APP entity (an Australian Government agency, or an organisation with an annual turnover over $3,000,000) that scrapes personal information from a public website, including for AI training, must still collect it only where reasonably necessary for its functions under Australian Privacy Principle 3.

It may use or disclose that information for another purpose only within the Australian Privacy Principle 6 exceptions. The entity must still have an Australian link for the Act to reach conduct outside Australia.

A manufacturer of a relevant connectable product, a product able to connect directly or indirectly to the internet or to another such product by a like means, must manufacture it in compliance with the security standard the rules set for its class if the manufacturer is aware, or could reasonably be expected to be aware, that the product will be acquired in Australia, and a supplier must not supply a product that was not manufactured in compliance with that standard.

The Cyber Security (Security Standards for Smart Devices) Rules 2025 apply the standard to most consumer grade relevant connectable products manufactured on or after 4 March 2026, and a product manufactured before that date is not required to comply. The standard bans a universal default password, requiring the device's hardware and any pre-installed or required software to use a password unique to the unit or set by the user for any state other than the factory default.

It requires the manufacturer to publish a means for a security issue to be reported to the manufacturer, with status updates on the resolution of a reported issue, and to publish the period, including an end date, for which the device will receive security updates. A desktop computer, a laptop, a tablet computer, a smartphone, a therapeutic good, a road vehicle, and a road vehicle component are excluded from the standard.

The manufacturer must provide, and the supplier must supply the product with, a statement of compliance with the security standard, and each must retain a copy for five years.

The Secretary of the Department of Home Affairs enforces the regime through a compliance notice, a stop notice, and a recall notice rather than through a fine, and may publish an entity's identity, product details, and the risks posed by the product on the Department's website if the entity fails to comply with a recall notice.

Paragraph 15 of Prudential Standard CPS 234 requires an APRA-regulated entity to maintain an information security capability commensurate with the size and extent of threats to its information assets. Paragraph 18 of the Prudential Standard requires an APRA-regulated entity to maintain an information security policy framework commensurate with its exposures to vulnerabilities and threats.

Paragraph 21 of the Prudential Standard requires an APRA-regulated entity to have information security controls to protect its information assets, including those managed by related parties and third parties. The Prudential Standard applies to all APRA-regulated entities, among them authorised deposit-taking institutions, general insurers, life companies, private health insurers and RSE licensees.

The Prudential Standard is made under section 11AF of the Banking Act 1959, section 32 of the Insurance Act 1973, section 230A of the Life Insurance Act 1995, section 92 of the Private Health Insurance (Prudential Supervision) Act 2015 and section 34C of the Superannuation Industry (Supervision) Act 1993. The Prudential Standard commences on 1 July 2019.

Section 11AG of the Banking Act 1959 requires an authorised deposit-taking institution to which a prudential standard applies to comply with the standard.

Section 7(1) of the Security of Critical Infrastructure (Telecommunications Security and Risk Management Program) Rules 2025 specifies a relevant critical infrastructure asset for the purposes of Part 2A of the Security of Critical Infrastructure Act 2018. Section 5 of the Rules defines a relevant critical infrastructure asset as a critical telecommunications asset that is owned or operated by a carrier or is a relevant carriage service provider asset.

Section 4 of the Rules treats a critical infrastructure asset owned or operated by a carriage service provider as a relevant carriage service provider asset where it is used in connection with the supply of at least 20,000 active total carriage services.

Section 9 of the Rules requires a critical infrastructure risk management program for a relevant critical infrastructure asset to identify the operational context and the material risks and, so far as is reasonably practicable, to minimise or eliminate those risks and mitigate the relevant impact of each hazard.

Section 11(2) of the Rules requires a critical infrastructure risk management program to include a process or system that would, as far as is reasonably practicable, minimise or eliminate any material risk of a cyber and information security hazard occurring.

Section 11(4) of the Rules requires a program for a critical telecommunications asset owned or operated by a carrier to include a process or system to comply with a listed framework, among them the Essential Eight Maturity Model at maturity level two, within 24 months after the end of the period in section 7(2).

Section 17(1) of the Rules requires a responsible entity for a critical telecommunications asset to provide all information reasonably necessary for the Secretary to assess a change or proposed change to its telecommunications service or system.

Section 7(2) of the Rules suspends Part 2A for a relevant critical infrastructure asset until the later of the last day of 6 months after the commencement of the instrument and the last day of 6 months after the asset became a relevant critical infrastructure asset. The Rules commence on the later of the day after the instrument is registered and immediately after the commencement of Parts 1 and 2 of Schedule 5 to the Enhanced Response and Prevention Act 2024. Schedule 5 of the Enhanced Response and Prevention Act 2024 commenced on 4 April 2025.

Section 30AC of the Security of Critical Infrastructure Act 2018 requires the responsible entity for one or more critical infrastructure assets to adopt and maintain a critical infrastructure risk management program that applies to the entity. Section 30AD of the Act requires that entity to comply with the program once it has adopted one. Section 30AB(1)(a) of the Act applies Part 2A to a critical infrastructure asset that is specified in the rules.

Section 4(1) of the Critical infrastructure risk management program Rules (LIN 23/006) 2023 specifies, among others, a critical electricity asset, a critical gas asset, a critical water asset, a designated hospital and a critical data storage or processing asset.

Section 8(2) of those Rules requires a responsible entity to establish and maintain a process or system in the program to minimise or eliminate any material risk of a cyber and information security hazard occurring, as far as it is reasonably practicable to do so. Those Rules commenced on 17 February 2023.

Section 4(2) of those Rules suspends Part 2A for an asset until the later of 6 months after the commencement of the instrument and 6 months after the asset became a critical infrastructure asset. A contravention of section 30AC is a civil penalty provision carrying 200 penalty units.

Section 52B(1) of the Security of Critical Infrastructure Act 2018 allows the Minister to declare a critical infrastructure asset to be a system of national significance if the Minister is satisfied that the asset is of national significance.

Section 30CB(1) of the Act allows the Secretary, by written notice to the responsible entity for a system of national significance, to determine that the statutory incident response planning obligations apply to the entity in relation to the system and cyber security incidents. Section 30CD of the Act requires the responsible entity for a system of national significance to which the statutory incident response planning obligations apply to adopt and maintain an incident response plan.

A contravention of section 30CD is a civil penalty provision carrying 200 penalty units. Section 30CM(1) of the Act allows the Secretary, by written notice to the responsible entity for a system of national significance, to require it to undertake a cyber security exercise in relation to the system within the period specified in the notice.

Section 30CU(1) of the Act allows the Secretary, by written notice to the responsible entity for a system of national significance, to require it to undertake, or cause to be undertaken, a vulnerability assessment in relation to the system within the period specified in the notice.

Paragraph 35 of Prudential Standard CPS 234 requires an APRA-regulated entity to notify APRA as soon as possible and, in any case, no later than 72 hours, after becoming aware of an information security incident that materially affected, or had the potential to materially affect, the entity or the interests of depositors, policyholders, beneficiaries or other customers.

Paragraph 35 also reaches an information security incident that has been notified to other regulators, either in Australia or other jurisdictions. Paragraph 36 of the Prudential Standard requires an APRA-regulated entity to notify APRA no later than 10 business days after it becomes aware of a material information security control weakness that it expects it will not be able to remediate in a timely manner.

The Prudential Standard applies to all APRA-regulated entities, among them authorised deposit-taking institutions, general insurers, life companies, private health insurers and RSE licensees. The Prudential Standard commences on 1 July 2019. Section 11AG of the Banking Act 1959 requires an authorised deposit-taking institution to which a prudential standard applies to comply with the standard.

Section 30BC(1) of the Security of Critical Infrastructure Act 2018 requires the responsible entity for a critical infrastructure asset to give the relevant Commonwealth body a report within 12 hours after becoming aware of a cyber security incident that has had a significant impact on the availability of the asset.

Section 30BD(1) of the Act requires the responsible entity to give the relevant Commonwealth body a report within 72 hours after becoming aware of a cyber security incident that has had, is having or is likely to have a relevant impact on the asset. Section 30BB(1)(a) of the Act applies Part 2B to a critical infrastructure asset that is specified in the rules.

Section 5(1) of the Security of Critical Infrastructure (Application) Rules (LIN 22/026) 2022 specifies, among others, a critical banking asset, a critical superannuation asset, a critical insurance asset, a critical hospital, a critical electricity asset and a critical telecommunications asset owned or operated by a carrier.

Section 30BEA of the Act provides that a cyber security incident has a significant impact on the availability of an asset only if the asset is used in connection with the provision of essential goods or services and the incident has materially disrupted their availability, or a circumstance the rules specify exists.

Section 5(5) of those Rules suspends Part 2B for an asset until the later of 3 months after the commencement of the instrument and 3 months after the asset became a critical infrastructure asset. The Application Rules commenced on 8 April 2022. A contravention of section 30BC(1) is a civil penalty provision carrying 50 penalty units.

Address-harvesting software is software specifically designed or marketed to search the internet for electronic addresses and to collect, compile, capture or otherwise harvest them; a harvested-address list is a list or collection of electronic addresses assembled using such software or a similar method.

Section 20 bars supplying or offering to supply either, or a right to use either, to another person where the supplier or the customer is physically present in, or an entity carrying on business or activities in, Australia at the time, unless the supplier had no reason to suspect the software or list would be used to send a commercial electronic message in contravention of section 16.

Section 21 bars a person physically present in, or an entity carrying on business or activities in, Australia from acquiring either, unless they did not intend that use. Section 22 bars using either, by a person or entity in Australia, unless the use was not in connection with a section 16 contravention. All three are civil penalty provisions carrying the same section 25 penalty tiers as any civil penalty provision other than section 16.

Section 16 bars sending, or causing to be sent, a commercial electronic message with an Australian link unless the relevant electronic account-holder consented (Schedule 2: express consent, or consent reasonably inferred from the account-holder's conduct and business or other relationships, including from a business address they conspicuously published without an opt-out statement, for a message relevant to the work, office or role the address was published for) or the message is a designated commercial electronic message exempt under Schedule 1.

Section 17 requires every commercial electronic message with an Australian link, designated or not, to clearly and accurately identify who authorised it and give accurate contact information valid for at least 30 days.

Section 18 requires every such message that is not designated to carry a functional unsubscribe facility: a clear, conspicuous statement that the recipient may send an unsubscribe message, to an address legitimately obtained and reasonably likely to be able to receive unsubscribe messages for at least 30 days.

Schedule 2 clause 6 provides that once the account-holder, or a user of their account, sends a message withdrawing consent (which an unsubscribe message under section 18 is), the withdrawal takes effect at the end of the fifth business day after it was sent.

Sections 16 to 18 are civil penalty provisions, and section 25 sets the maximum pecuniary penalty a court may order under section 24, tiered by whether the defendant is a body corporate, whether it has a prior record for the same civil penalty provision, and whether the provision is section 16 or another one (17, 18, 20, 21 or 22).

Section 28 lets the Federal Court, on the application of the ACMA or a person who has suffered loss or damage from one or more contraventions of one or more civil penalty provisions found in ACMA-initiated proceedings under section 26, order the perpetrator to compensate that person; for a section 16 contravention the court may weigh the victim's expenses in dealing with the messages, the effect on their business, reputational damage and lost business opportunities.

This is an application within an existing ACMA proceeding rather than a free-standing civil action a victim can start on their own.

Originally enacted as the Telecommunications (Interception) Act 1979 and commenced on 1 June 1980, the Act was later renamed the Telecommunications (Interception and Access) Act 1979 and has been amended many times since.

Section 7 bars a person from intercepting, authorising or permitting another person to intercept, or doing any act that would enable interception of, a communication passing over a telecommunications system, subject to listed exceptions for network installation and maintenance staff, authorised network-protection duties, ASIO and warranted law-enforcement activity, none of which reaches an ordinary business recording its own customer calls.

Section 6(1) defines interception as listening to or recording the communication, by any means, in its passage over the system, without the knowledge of the person making it; a business that tells callers in advance that a call may be recorded gives that knowledge, so the recording is not an interception under the Act's own definition, which is why businesses that record calls announce it.

The definition turns on the knowledge that the communication is being listened to or recorded and does not say whether that knowledge must extend to who listens or records, such as a third-party recording or transcription vendor, or reach a vendor's later access to a recording once the communication has left the system.

Section 105 makes a contravention of section 7(1) an indictable offence punishable by up to two years' imprisonment on indictment, or up to six months' imprisonment if a court of summary jurisdiction hears it with the parties' consent; no separate fine is stated in the section.

Section 107A gives a party to the communication, or a person on whose behalf it was made, an independent civil action in the Federal Court or a court of a State or Territory for an unlawful interception, available whether or not any prosecution is brought: the court may declare the interception unlawful, grant an injunction, order damages (including punitive damages) the court considers appropriate, or order the defendant to pay an amount up to the gross income the interception produced.

Section 12B bars sending, or causing to be sent, an unsolicited marketing fax to an Australian number registered on the Do Not Call Register, unless the relevant account-holder or their nominee consented or the fax is a designated marketing fax exempt under Schedule 1A, on the same terms Schedule 1 uses for designated telemarketing calls (a government body or registered charity supplying its own goods or services, a registered political party, an independent parliamentarian or an election candidate, or an educational institution faxing a number used primarily for the private or domestic purposes of a current or former student, or a member of their or an employee's household).

Section 12C separately bars entering into a contract, arrangement or understanding likely to result in marketing faxes to eligible numbers unless it expressly requires compliance with the Act.

Consent follows the same Schedule 2 rules as a telemarketing call (express or reasonably inferred from conduct and business or other relationships, never from mere publication of the number, and lapsing after three months unless stated otherwise), except that the ACMA may, by legislative instrument, determine circumstances in which consent for a marketing fax sent to a business number may or may not be inferred.

A number used or maintained exclusively for sending or receiving faxes is eligible for the Register regardless of whether it is a business number, unlike an ordinary business voice number. Part 2A and Schedule 1A were inserted into the Act by the Do Not Call Register Legislation Amendment Act 2010 and commenced later than the Act's original telemarketing-call provisions.

Section 12B is a civil penalty provision carrying the same section 25 penalty tiers as section 11, and section 30 lets the Federal Court or the Federal Circuit and Family Court of Australia (Division 2), on the application of the ACMA or a person who has suffered loss or damage from one or more contraventions found in ACMA-initiated proceedings under section 24, order the perpetrator to compensate that person; this is an application within an existing proceeding, not a free-standing civil action.

Section 11 bars making, or causing to be made, an unsolicited telemarketing call to an Australian number registered on the Do Not Call Register, unless the relevant account-holder or their nominee consented or the call is a designated telemarketing call exempt under Schedule 1: one authorised by a government body or registered charity supplying its own goods or services, by a registered political party, an independent parliamentarian or an election candidate fund-raising for electoral or political purposes, or by an educational institution calling a number used primarily for the private or domestic purposes of a current or former student, or a member of their or an employee's household.

Section 12 separately bars entering into a contract, arrangement or understanding likely to result in telemarketing calls to eligible numbers unless it expressly requires compliance with the Act. Under Schedule 2, consent can be express or reasonably inferred from the account-holder's conduct and business or other relationships, but unlike consent for a message under the Spam Act it can never be inferred merely because a number was published.

Unless it says otherwise, express consent lapses three months after it is given. Only a number used or maintained primarily for private or domestic purposes, a fax number, a number used exclusively by a government body, or an emergency-service number is eligible to be registered, so an ordinary business telephone number cannot be registered and this prohibition does not, by itself, reach a call to it.

Sections 11 and 12 are civil penalty provisions, and section 25 tiers the maximum pecuniary penalty a court may order under section 24, with subsection 11(1) or (7) the higher tier.

Section 30 lets the Federal Court or the Federal Circuit and Family Court of Australia (Division 2), on the application of the ACMA or a person who has suffered loss or damage from one or more contraventions found in ACMA-initiated proceedings under section 24, order the perpetrator to compensate that person; this is an application within an existing proceeding, not a free-standing civil action.

Made by the ACMA under section 125A of the Telecommunications Act 1997, this Standard applies to participants in every section of the telemarketing industry. It binds every telemarketing call (as the Do Not Call Register Act defines it) and research or opinion-polling call to an Australian number, whether or not the number is registered on the Do Not Call Register.

Section 8 bars calling outside permitted hours: a call that is not a research call may be made only on a weekday from 9am to 8pm or a Saturday from 9am to 5pm, and never on a Sunday or a listed national public holiday; a research call may run until 8.30pm on a weekday and is also permitted on a Sunday from 9am to 5pm, subject to the same public-holiday bar, unless the account-holder or their nominee gave express advance consent to a different day or time.

Sections 9 and 10 require a caller to give their name, their or their employer's business name and the call's purpose as soon as the call starts (with an exception for a call the recipient ends first, or the caller ends within 5 seconds), and to give further contact and complaint-handling details immediately on request; section 11 sets what those contact details must include.

Section 12 requires a mechanism, for a call using a recorded or synthetic voice, letting the recipient request that information. Section 13 requires a caller to immediately terminate a call if the recipient asks or otherwise indicates they do not want it to continue, or if the caller learns the recipient is receiving the call, at a location in a different time zone, at a time that would be a prohibited calling time at the account-holder's usual residential address.

Section 14 requires calling line identification to be enabled and to display a number that itself can receive a return call carrying the required information for at least 30 days. A contravention of the Standard is enforced through the Telecommunications Act 1997's own compliance and civil-penalty machinery for industry standards, not through this Standard's own text.

Part 9D of the Broadcasting Services Act 1992 requires broadcasters to comply with rules and standards relating to captioning of television programs for the deaf and hearing impaired. Each commercial television broadcasting licensee must provide a captioning service for television programs transmitted during designated viewing hours, and for television news or current affairs programs transmitted outside designated viewing hours (section 130ZR).

For programs transmitted on or after 1 July 2014, designated viewing hours begin at 6 am and end at midnight each day, unless other times are prescribed (section 130ZL).

A licensee's SDTV or HDTV multi-channelled services need captions only for programs previously transmitted on its primary commercial television broadcasting service, and a license allocated under subsection 40(1) carries no captioning duty during the first year of operation of the license or a longer period the ACMA allows by written notice.

A subscription television licensee must ensure that, for each subscription television service it provides in a financial year, the share of program hours captioned is not less than the annual captioning target for the service, which the Act set by category of service for the financial year beginning on 1 July 2014 and raises by 5% each later financial year up to 100% (section 130ZV).

A service that only repeats the stream of another of the licensee's services, or simultaneously transmits it in high definition, is excluded, and a new service that predominantly consists of programs not transmitted in Australia before it began is excluded until the financial year beginning on the first 1 July that is at least 1 year after it began.

A subscription television licensee must also caption a repeat of a program it captioned before, and a program it simultaneously transmits on another of its services where it captions the first transmission (sections 130ZZ and 130ZZAA).

Part 9D does not apply to a program wholly in a language other than English or to a program whose audio component consists only of music with no recognizable English vocal content, and a program does not include advertising or sponsorship matter, community service announcements or emergency warnings. A breach attributable to significant difficulties of a technical or engineering nature that could not reasonably have been foreseen is disregarded (sections 130ZUB and 130ZZAB).

The ACMA may, on application, make an exemption order or a target reduction order for a specified service and period, but only if satisfied that a refusal would impose an unjustifiable hardship on the applicant, having regard among other matters to the impact on deaf or hearing impaired viewers and the applicant's financial circumstances (sections 130ZUA and 130ZY).

Licensees must comply with the standards the ACMA determines on the quality of captioning services, which includes readability, comprehensibility and accuracy (section 130ZZA). A licensee that transmits an emergency warning at the request of an emergency service agency must transmit the whole of it in text and in speech and, if reasonably practicable, provide a captioning service for it (section 130ZZB).

A commercial television broadcasting licensee, and a subscription television licensee that is a body corporate, must give the ACMA an annual compliance report within 90 days after the end of each financial year and keep written and audio-visual records of compliance, and the ACMA publishes the reports (sections 130ZZC and 130ZZD).

Complying with an applicable provision of Part 9D is a condition of a commercial television broadcasting license, of a subscription television broadcasting license, and of the class license for subscription and open narrowcasting services (Schedule 2, clauses 7, 10 and 11).

Breaching such a condition is an offense carrying 2,000 penalty units for a commercial television broadcasting licensee and 1,000 penalty units for a subscription television broadcasting licensee, and 50 penalty units for a provider of a subscription narrowcasting service that breaches a condition of its class license, with a separate offense for each day the breach continues (sections 139 and 140).

The same breaches are civil penalty provisions, for which the Federal Court may order a pecuniary penalty no higher than the maximum that could have been imposed on conviction for the corresponding offense, with a separate contravention for each day it continues (sections 140A and 205F).

The ACMA may direct a licensee in breach of a license condition to take action to avoid breaching it again, and contravening the direction is an offense carrying 20,000 penalty units for a commercial television broadcasting licensee and 2,000 penalty units for a subscription television broadcasting licensee (sections 141 and 142).

Part 9D was inserted by the Broadcasting Services Amendment (Improved Access to Television Services) Act 2012, which received assent on 28 June 2012 and whose Schedule 1 commenced on 29 June 2012.

The Disability Standards for Education 2005 are disability standards made under subsection 31(1) of the Disability Discrimination Act 1992, and they apply to education providers, subject to section 12 of that Act. An education provider is an educational authority, an educational institution, or an organization whose purpose is to develop or accredit curricula or training courses used by other education providers.

The providers bound include schools registered in the private sector, private training providers such as business colleges and commercial training businesses, Registered Training Organisations, and higher education providers. The Standards apply to education and training delivered through in-class tuition, distance education, flexible delivery, computer-assisted learning and on-line delivery.

Since 1 August 2026 the Standards also apply to educational early childhood service providers as if they were education providers who are educational institutions. The provider must take reasonable steps to ensure that a prospective student with a disability is able to seek admission to, or apply for enrollment in, the institution on the same basis as a prospective student without a disability, consulting the student and making any reasonable adjustment that is necessary (section 4.2).

The measures the Standards name for enrollment include making information about enrollment processes accessible and available in a range of formats, and designing enrollment procedures so that they can be completed without undue difficulty (section 4.3).

The provider must take reasonable steps to ensure that a course or program is designed so that a student with a disability is able to participate in its learning experiences, including its assessment and certification requirements, on the same basis as a student without a disability (section 6.2).

The measures the Standards name for courses include making the curriculum, teaching materials and assessment accessible to the student, and making study materials available in an appropriate format without the student being disadvantaged by the time taken for conversion into an accessible format (section 6.3).

An adjustment is reasonable if it balances the interests of all parties affected, the provider must consult the student or an associate before making it, and the provider must take reasonable steps to make a required adjustment within a reasonable time (sections 3.4, 3.5 and 3.7).

In assessing whether an adjustment is reasonable, the provider is entitled to maintain the academic requirements of the course or program and other requirements or components that are inherent in or essential to its nature (section 3.4(3)).

It is not unlawful for a provider to fail to comply with a requirement of the Standards if, and to the extent that, compliance would impose unjustifiable hardship, except for a requirement in Part 8 on harassment and victimization; the provider must comply to the maximum extent not involving unjustifiable hardship and must demonstrate that an exception operates (sections 10.1 and 10.2).

The Standards commenced on 18 August 2005, and the Disability Standards for Education Amendment Standards 2025 commenced on 1 August 2026. It is unlawful for a person to contravene a disability standard (section 32 of the Disability Discrimination Act 1992).

Section 24 makes it unlawful for a person who, whether for payment or not, provides goods or services, or makes facilities available, to discriminate against another person on the ground of the other person’s disability by refusing to provide them, in the terms or conditions on which they are provided, or in the manner in which they are provided.

The Act’s definition of services includes services relating to banking, insurance, superannuation, entertainment, recreation or refreshment, transport or travel, and telecommunications, and services of the kind provided by the members of any profession or trade. Direct discrimination includes a failure to make reasonable adjustments for the person (section 5(2)).

An adjustment to be made by a person is a reasonable adjustment unless making the adjustment would impose an unjustifiable hardship on the person. Indirect discrimination covers a requirement or condition that has, or is likely to have, the effect of disadvantaging persons with the disability, and the rule does not apply if the requirement or condition is reasonable, having regard to the circumstances of the case.

The burden of proving that the requirement or condition is reasonable lies on the person who requires the other person to comply with it. Section 29A provides that Division 2 of Part 2 (other than section 30) does not render it unlawful to discriminate if avoiding the discrimination would impose an unjustifiable hardship on the discriminator.

In deciding whether a hardship is unjustifiable, all relevant circumstances must be taken into account, including the nature of the benefit or detriment to any person concerned, the effect of the disability, the financial circumstances and estimated expenditure of the person claiming it, the availability of financial and other assistance, and any relevant action plan given to the Commission.

The burden of proving that something would impose unjustifiable hardship lies on the person claiming unjustifiable hardship. It is also unlawful for a person who provides goods or services, or makes facilities available, to harass a person with a disability who wants to acquire the goods or services or to make use of the facilities, in relation to the disability (section 39).

Where it would be unlawful to discriminate in providing goods, services or facilities, it is also unlawful to request or require the person to provide information, whether by completing a form or otherwise, in connection with providing them, if persons without the disability would not be asked for it in circumstances that are not materially different or the information relates to the disability, unless unrebutted evidence shows that none of the purposes of the request was unlawful discrimination (section 30).

Part 2 does not render unlawful an act reasonably intended to give persons with a disability equal opportunities or to meet their special needs (section 45), discrimination in annuities, insurance and superannuation that is based on actuarial or statistical data on which it is reasonable to rely and is reasonable (section 46), anything done in direct compliance with an order of a court or a prescribed law (section 47), or discrimination reasonably necessary to protect public health where the disability is an infectious disease (section 48).

Since 8 October 2026, discrimination based on protected genetic information, within the meaning of the Insurance Contracts Act 1984, is taken not to be reasonable for the purposes of section 46 if it relates to a refusal to offer a life insurance policy or to the terms and conditions on which one is offered (section 46(3)).

The Commission may, on application, grant an exemption from a provision of Division 1 or 2 for a specified period not exceeding 5 years and on the terms and conditions it specifies, and an act done in accordance with the exemption is not unlawful (sections 55 and 58).

A person who is prohibited from discriminating may prepare and implement an action plan, which must deal with the matters section 61 lists, and may give it to the Commission, which must make it available to the public (sections 59 to 64). The limited application provisions are the provisions of Divisions 1, 2, 2A and 3 of Part 2 other than sections 20, 29 and 30.

They have effect in relation to discrimination by a trading or financial corporation formed within the limits of the Commonwealth, to the extent that it takes place in the course of the trading activities of the trading corporation or the financial activities of the financial corporation. They also have effect to the extent that they give effect to the Disabilities Convention.

It is unlawful for a person to contravene a disability standard, and if a person acts in accordance with a disability standard, Part 2 (other than Division 2A) does not apply to the person’s act.

A person who causes, instructs, induces, aids or permits another person to do an act unlawful under Division 1, 2, 2A, 3 or 6 of Part 2 is taken also to have done it, and conduct engaged in on behalf of a body corporate by a director, employee or agent within the scope of actual or apparent authority is taken to be the body corporate’s unless it took reasonable precautions and exercised due diligence to avoid the conduct (sections 122 and 123).

Victimizing a person because the person has made a complaint or brought proceedings under the Act, or has asserted rights under it, is unlawful (section 58A) and is an offense punishable by imprisonment for 6 months (section 42).

Inciting an act unlawful under Division 1, 2, 2A or 3 of Part 2 is an offense punishable by imprisonment for 6 months (section 43), and publishing or displaying an advertisement or notice indicating an intention to do such an act is an offense carrying 10 penalty units (section 44).

Section 4B of the Crimes Act 1914 lets a court impose a pecuniary penalty instead of, or in addition to, imprisonment for an offense punishable by imprisonment only, and lets it fine a body corporate as much as 5 times the maximum pecuniary penalty for a natural person. A penalty unit is $330, subject to indexation on 1 July 2026 and each third 1 July after that (section 4AA of the Crimes Act 1914).

The Act confers no right of action for an act unlawful under Part 2 unless a provision of the Act expressly provides otherwise. A written complaint alleging unlawful discrimination may be lodged with the Australian Human Rights Commission.

The President may terminate a complaint lodged more than 24 months after the alleged acts, omissions or practices took place, and must terminate a complaint that is trivial, vexatious, misconceived or lacking in substance or that has no reasonable prospect of being settled by conciliation.

Once the President has terminated the complaint and given notice, an application alleging unlawful discrimination may be made to the Federal Court or the Federal Circuit and Family Court of Australia (Division 2) within 60 days after the date of issue of the notice, or within such further time as the court allows. The application must not be made unless the court grants leave to make it, or the complaint was terminated under paragraph 46PH(1)(h) or paragraph 46PH(1B)(b).

If the court is satisfied that there has been unlawful discrimination, it may make such orders as it thinks fit, including an order declaring that the respondent has committed unlawful discrimination and directing it not to repeat or continue it, an order requiring it to perform any reasonable act or course of conduct to redress loss or damage, and an order requiring it to pay damages by way of compensation.

If the applicant is successful on one or more grounds, the court must order each respondent against whom the applicant is successful to pay the applicant’s costs, and the applicant may be ordered to pay another party’s costs only in the cases section 46PSA(6) of the Australian Human Rights Commission Act 1986 sets out, such as proceedings instituted vexatiously or without reasonable cause.

The Commission’s Guidelines on equal access to digital goods and services, issued under section 67(1)(k) of the Act, are not legally binding. The Guidelines read the Act to reach digital goods and services, among them websites, digital documents, software including mobile applications, digital kiosks, and chatbots.

The Guidelines describe Maguire v Sydney Organising Committee for the Olympic Games (2000), in which the Commission, then known as the Human Rights and Equal Opportunity Commission, decided that the provision of information on a website is a service within the meaning of the Act, found that the organizing committee had directly discriminated against a blind complainant, and rejected its claim of unjustifiable hardship. The Guidelines advise that organizations should conform with WCAG 2.2 at a minimum Level AA.

Requires providers of designated internet services, including websites hosting online pornography and generative AI services capable of producing Class 1C or Class 2 material, to implement age assurance and access controls to prevent access by children in Australia. Registered by the eSafety Commissioner on 9 September 2025.

Requires providers of internet search engine services, such as Google Search and Bing, to implement appropriate age assurance measures so that account holders are checked as over or under 18 before search results can surface Class 1C or Class 2 material, including online pornography. Registered by the eSafety Commissioner on 27 June 2025, with the age assurance measure itself required within 6 months of the code coming into effect, by 27 June 2026.

Requires app store and app distribution platform operators, such as the Apple App Store and Google Play, to take reasonable steps, including age assurance and access controls, before permitting the download or purchase of an app containing Class 1C or Class 2 material such as pornography. Registered by the eSafety Commissioner on 9 September 2025, with the age assurance measure required within 6 months of commencement, by about 9 September 2026.

Legislative instrument made by the Minister for Communications, registered on 30 July 2025 and commencing on 31 July 2025, that excludes specified categories of service from the age-restricted social media platform definition, so the section 63D minimum age obligation (which itself commenced 10 December 2025) does not apply to them. The Online Safety (Age-Restricted Social Media Platforms) Amendment Rules 2026 commenced on 26 March 2026.

They add a further condition for a service to be an age-restricted social media platform: it must have a recommender feature, a logged-in feature, or both.

Requires a provider of an age-restricted social media platform to take reasonable steps to prevent Australians under 16 from having an account. Received Royal Assent on 10 December 2024 and the section 63D civil penalty obligation commenced 12 months later, on 10 December 2025.

Inserts Part IVBA into the Competition and Consumer Act 2010 (Cth), creating a mandatory bargaining framework between 'registered news businesses' and 'designated digital platform services' where a significant bargaining power imbalance exists. The Minister may formally designate a platform after considering imbalance and news-industry sustainability; once designated, platforms face compulsory arbitration. No platform has been formally designated.

Following the code's enactment Google and Meta struck voluntary deals covering 30+ news businesses, but Meta ceased renewals in 2024 and Google in 2025, prompting the News Bargaining Incentive proposal.

Section 42 provides that fair dealing with a literary, dramatic, musical, or artistic work does not infringe copyright if done for the purpose of, or in association with, reporting news in a newspaper, magazine, or similar periodical (with sufficient acknowledgment), or by means of a communication or cinematograph film.

The exception is narrow: it turns on the purpose of the party claiming it, not the end-use of the content, which means third-party aggregators and clipping services generally cannot rely on it.