Comply with Basic Online Safety Expectations + industry codes
Social media services, app distribution services, and other captured providers must meet the BOSE and industry codes.
Who must comply
Providers of social media services, relevant electronic services (such as messaging and online gaming services) and designated internet services (apps and websites) used by Australian end-users. Reporting duties arise only for a provider given a notice, or covered by a determination, by the eSafety Commissioner.
What triggers it
Providing a covered service to Australian end-users; a legal duty arises when eSafety gives the provider a periodic or non-periodic reporting notice or makes a reporting determination covering its class of service.
When due
As specified in the notice: periodic reports cover intervals of 6 to 24 months and are due no earlier than 28 days after the end of each interval (s 49(3)-(4)); one-off reports by the date in a non-periodic notice.
Evidence required
Responses to eSafety reporting notices; records of the reasonable steps taken against each Expectation and why they are reasonable; safety risk assessments across design, development and deployment; default privacy and safety settings for services used by children; age assurance measures; user reporting and complaints data; published transparency reports.
Max penalty
Failing to comply with a periodic or non-periodic reporting notice (or a reporting determination) is a civil penalty contravention: 500 penalty units ($182,000) per contravention (Online Safety Act 2021 ss 50, 53, 57 and 60). eSafety may instead issue a formal warning, and may publish a statement where a provider does not answer an information request
Summary
Under section 45 of the Online Safety Act 2021 the Minister determines Basic Online Safety Expectations for social media services, relevant electronic services and designated internet services. They expect providers to take reasonable steps so that all Australian end-users can use the service safely, children's best interests are a primary consideration, features such as encrypted services, anonymous accounts, generative AI and recommender systems can be used safely, unlawful and harmful material is minimised, users can report and complain, and terms of use are enforced. The Expectations themselves are not enforceable in court (s 45(4)); the enforceable part is reporting. eSafety can require periodic or one-off reports on how a provider meets them (ss 49 and 56) or make reporting determinations for classes of services, and can publish statements about a provider's performance. Separate registered industry codes and standards impose binding duties.
Enforced by
Source legislation
Industries
Topics
Related
Reading
Frequently asked questions
- Who must comply with Basic Online Safety Expectations + industry codes?
- Providers of social media services, relevant electronic services (such as messaging and online gaming services) and designated internet services (apps and websites) used by Australian end-users. Reporting duties arise only for a provider given a notice, or covered by a determination, by the eSafety Commissioner.
- What triggers Basic Online Safety Expectations + industry codes?
- Providing a covered service to Australian end-users; a legal duty arises when eSafety gives the provider a periodic or non-periodic reporting notice or makes a reporting determination covering its class of service.
- When is Basic Online Safety Expectations + industry codes due?
- As specified in the notice: periodic reports cover intervals of 6 to 24 months and are due no earlier than 28 days after the end of each interval (s 49(3)-(4)); one-off reports by the date in a non-periodic notice.
- What is the maximum penalty for Basic Online Safety Expectations + industry codes?
- Failing to comply with a periodic or non-periodic reporting notice (or a reporting determination) is a civil penalty contravention: 500 penalty units ($182,000) per contravention (Online Safety Act 2021 ss 50, 53, 57 and 60). eSafety may instead issue a formal warning, and may publish a statement where a provider does not answer an information request
- What evidence is required for Basic Online Safety Expectations + industry codes?
- Responses to eSafety reporting notices; records of the reasonable steps taken against each Expectation and why they are reasonable; safety risk assessments across design, development and deployment; default privacy and safety settings for services used by children; age assurance measures; user reporting and complaints data; published transparency reports.
Source: https://www.esafety.gov.au/industry/basic-online-safety-expectations. Rules Mate is not a law firm. Always verify against the live regulator source before acting.