Australia

This Act inserted sections 474.17A and 474.17AA into the Criminal Code Act 1995, making it an offence to use a carriage service to transmit material depicting, or appearing to depict, a person aged 18 or over in a sexual pose or activity, or their sexual organ, anal region, or, for a female, breasts, without their consent, where the person transmitting it knows of the lack of consent or is reckless as to it.

It is irrelevant whether the transmitted material is unaltered or has been created or altered using technology, including artificial intelligence, to generate a realistic but false depiction of the person, the kind of material commonly called a deepfake.

The base offence carries a maximum of 6 years imprisonment; a person who transmits such material after 3 or more prior civil penalty orders for non-compliance with an Online Safety Act 2021 removal notice, or who was responsible for creating or altering the material themselves, faces an aggravated offence carrying a maximum of 7 years imprisonment.

An entity holding personal information that is required to comply with Australian Privacy Principle 11.1 (security of personal information) must notify an eligible data breach, meaning unauthorised access to or disclosure of information that a reasonable person would conclude is likely to result in serious harm.

The entity must give a copy of a statement about the breach to both the Information Commissioner and the affected individuals as soon as practicable after becoming aware of reasonable grounds to believe the breach occurred.

Binds Commonwealth agencies and organisations, including businesses with an annual turnover over $3,000,000, to comply with the Australian Privacy Principles in Schedule 1. It also extends to an act done or a practice engaged in outside Australia by an entity with an Australian link.

An entity contravening the Act through a serious interference with privacy faces a civil penalty of up to $50,000,000, three times the value of the benefit obtained, or 30% of adjusted turnover during the breach period, whichever is greatest, for a body corporate, or up to $2,500,000 for an individual; a non-serious interference carries a lower civil penalty of up to 2,000 penalty units.

Inserts a new Australian Privacy Principle 1.7 to 1.9 requiring an APP entity's privacy policy to disclose, for computer programs the entity uses to make decisions that could reasonably be expected to significantly affect an individual's rights or interests, the kinds of personal information used in that decision-making and the categories of decisions made.

Received Royal Assent on 10 December 2024, and the commencement table fixes the day for this Schedule at 24 months after Assent, so the disclosure duty takes effect on 10 December 2026.

Creates a new statutory tort giving an individual a cause of action for a serious invasion of privacy, by intrusion upon seclusion or by misuse of information, where the person invading privacy intended or was reckless as to the invasion and a reasonable person would consider it serious.

The Federal Register of Legislation's amendment-history endnote for the Privacy Act records this Schedule as commencing 10 June 2025, the six-month backstop date under the amending Act's own commencement table because no earlier Proclamation was recorded.

An APP entity must not collect sensitive information about an individual, defined to include biometric information used for automated biometric verification or identification and biometric templates, unless the individual consents and the collection is reasonably necessary for the entity's functions, or a listed exception applies.

This is the provision that reaches a voiceprint or faceprint collected for biometric identification, on top of the entity's general Australian Privacy Principle 3 duty for ordinary personal information.

Section 478.1 makes it an offence, punishable by up to 2 years imprisonment, to cause unauthorised access to, or modification of, restricted data, meaning data held in a computer to which access is restricted by an access control system, intending to cause the access or modification and knowing it is unauthorised.

Access is unauthorised under section 476.2 only if the person is not entitled to cause it, so a scraper reading a public, unauthenticated page without defeating any access control falls outside a plain reading of the offence, and no reported Australian case has tested a scraping fact pattern under this Part.

Sections 40 to 42 permit fair dealing with a literary, dramatic, musical or artistic work for research or study, criticism or review, parody or satire, or reporting news, but Australia has no general text-and-data-mining exception, and on 26 October 2025 the Attorney-General confirmed the Government would not introduce one, choosing instead to pursue a licensing-based approach for AI training.

Section 10's definition of literary work includes a table or compilation of words, figures or symbols, so a scraped compilation can attract copyright as a literary work if its selection or arrangement involves sufficient independent intellectual effort, but Australia recognises no separate sui generis database right of the kind the European Union has, so a database that is a mere compilation of facts without such effort receives no protection at all.

The Privacy Act 1988's definition of personal information carries no exception for information that is publicly accessible, so an APP entity (an Australian Government agency, or an organisation with an annual turnover over $3,000,000) that scrapes personal information from a public website, including for AI training, must still collect it only where reasonably necessary for its functions under Australian Privacy Principle 3.

It may use or disclose that information for another purpose only within the Australian Privacy Principle 6 exceptions. The entity must still have an Australian link for the Act to reach conduct outside Australia.

A manufacturer of a relevant connectable product, a product able to connect directly or indirectly to the internet or to another such product by a like means, must manufacture it in compliance with the security standard the rules set for its class if the manufacturer is aware, or could reasonably be expected to be aware, that the product will be acquired in Australia, and a supplier must not supply a product that was not manufactured in compliance with that standard.

The Cyber Security (Security Standards for Smart Devices) Rules 2025 apply the standard to most consumer grade relevant connectable products manufactured on or after 4 March 2026, and a product manufactured before that date is not required to comply. The standard bans a universal default password, requiring the device's hardware and any pre-installed or required software to use a password unique to the unit or set by the user for any state other than the factory default.

It requires the manufacturer to publish a means for a security issue to be reported to the manufacturer, with status updates on the resolution of a reported issue, and to publish the period, including an end date, for which the device will receive security updates. A desktop computer, a laptop, a tablet computer, a smartphone, a therapeutic good, a road vehicle, and a road vehicle component are excluded from the standard.

The manufacturer must provide, and the supplier must supply the product with, a statement of compliance with the security standard, and each must retain a copy for five years.

The Secretary of the Department of Home Affairs enforces the regime through a compliance notice, a stop notice, and a recall notice rather than through a fine, and may publish an entity's identity, product details, and the risks posed by the product on the Department's website if the entity fails to comply with a recall notice.

Requires providers of designated internet services, including websites hosting online pornography and generative AI services capable of producing Class 1C or Class 2 material, to implement age assurance and access controls to prevent access by children in Australia. Registered by the eSafety Commissioner on 9 September 2025.

Requires providers of internet search engine services, such as Google Search and Bing, to implement appropriate age assurance measures so that account holders are checked as over or under 18 before search results can surface Class 1C or Class 2 material, including online pornography. Registered by the eSafety Commissioner on 27 June 2025, with the age assurance measure itself required within 6 months of the code coming into effect, by 27 June 2026.

Requires app store and app distribution platform operators, such as the Apple App Store and Google Play, to take reasonable steps, including age assurance and access controls, before permitting the download or purchase of an app containing Class 1C or Class 2 material such as pornography. Registered by the eSafety Commissioner on 9 September 2025, with the age assurance measure required within 6 months of commencement, by about 9 September 2026.

Legislative instrument made by the Minister for Communications, registered and commencing on 30 July 2025, that excludes specified categories of service from the age-restricted social media platform definition, so the section 63D minimum age obligation (which itself commenced 10 December 2025) does not apply to them.

Requires a provider of an age-restricted social media platform to take reasonable steps to prevent Australians under 16 from having an account. Received Royal Assent on 10 December 2024 and the section 63D civil penalty obligation commenced 12 months later, on 10 December 2025.

Inserts Part IVBA into the Competition and Consumer Act 2010 (Cth), creating a mandatory bargaining framework between 'registered news businesses' and 'designated digital platform services' where a significant bargaining power imbalance exists. The Treasurer may formally designate a platform after considering imbalance and news-industry sustainability; once designated, platforms face compulsory arbitration. No platform has been formally designated.

Following the code's enactment Google and Meta struck voluntary deals covering 30+ news businesses, but Meta ceased renewals in 2024 and Google in 2025, prompting the News Bargaining Incentive proposal.

Section 42 provides that fair dealing with a literary, dramatic, musical, or artistic work does not infringe copyright if done for the purpose of, or in association with, reporting news in a newspaper, magazine, or similar periodical (with sufficient acknowledgment), or by means of a communication or cinematograph film.

The exception is narrow: it turns on the purpose of the party claiming it, not the end-use of the content, which means third-party aggregators and clipping services generally cannot rely on it.