Australia has commenced an Online Safety Act amendment that lets the eSafety Commissioner summon any person to a private examination on oath about social media minimum age compliance, with the privilege against self-incrimination removed

What the Act changes on its face

Schedule 1 is short and arithmetical. Items 1 to 3 omit "30,000" and substitute "60,000" in the penalty for section 63D and subsections 63DA(1) and 63DB(1). Item 5 does the same for section 63H, moving 500 to 1,000. From commencement on 12 September 2026 those figures are the civil penalty maxima for the provisions concerned.

Item 4 repeals and replaces section 63G. The replacement, in force since 12 September 2026, applies to a person if the Commissioner believes on reasonable grounds that the person has information or documents relevant to compliance by a provider of an electronic service that is or may be an age-restricted social media platform with section 63D or subsection 63DA(1) or 63DB(1). A second scope limb covers information relevant to whether an electronic service is a service specified in the legislative rules for the purposes of paragraph 63C(1)(b) or (6)(b).

The word to notice in that scope is person, not provider. The notice power is not confined to the platform under examination. Anyone the Commissioner reasonably believes holds relevant information or documents is within reach of a written notice requiring them to give it, within the period and in the manner the notice specifies.

Item 6 sets the application rule. The penalty changes apply to conduct engaged in on or after commencement, and the section 63G and 63H changes to notices given on or after commencement. Neither reaches backwards.

The examination power, and the line the drafters drew

New subsection 63G(4) is the hinge. In force since 12 September 2026, it provides that the notice "must not require the person to give information or produce documents by summoning the person to attend before the Commissioner or other person", and a note sends the reader to Division 4A for that power. Two instruments, two thresholds, two consequences.

Division 4A, inserted by Schedule 2 and commenced on 12 September 2026, works from a lower stated trigger than section 63G. Section 63HA applies where the Commissioner has reason to believe a person is capable of giving information or evidence, producing documents or answering questions relevant to compliance by a provider with section 63D or subsection 63DA(1) or 63DB(1). Reason to believe, and capable of giving, are both softer than section 63G's reasonable grounds and has.

What follows is a conventional coercive examination set. The Commissioner can summon the person by written notice to attend before the Commissioner or a named delegate; section 63HB allows examination on oath or affirmation and permits the examiner to require an answer to any relevant question; section 63HC requires the examination to be conducted in private, with the person entitled to have an adviser present; section 63HD requires a record, with a copy to the person on request; and section 63HE gives the person the same protection as a witness in a proceeding in the High Court.

Section 63HF sets the consequence for refusal, and it is criminal as well as civil. Failure to comply with a notice, refusal or failure to answer a required question, or refusal to take an oath or make an affirmation is an offence carrying imprisonment for 12 months and a civil penalty of 1,000 penalty units. One narrow exception is written into subsection 63HF(5): it does not apply where the person is a journalist and complying would tend to disclose the identity of a person who supplied information to the journalist in confidence, with the evidential burden on the defendant.

Self-incrimination, and the immunity that replaces it

Section 63HG is the clause practitioners will spend the most time on now that it is in force. Subsection (1) provides that a person is not excused from giving information or evidence, producing a document or answering a question under Division 4A on the ground that doing so might tend to incriminate the person. Subsection (3) does the same for the privilege against self-exposure to a penalty, with a note recording that a body corporate cannot claim that privilege anyway.

What replaces the privilege is a use and derivative use immunity confined to individuals. Under subsection 63HG(2) the information, evidence, answer or document, the act of giving or producing it, and anything obtained as a direct or indirect consequence of it, is not admissible against the individual in civil penalty recovery proceedings or in criminal proceedings. That immunity is expressly not available in proceedings for a penalty or offence under section 63HF itself, or for offences against sections 137.1, 137.2 or 149.1 of the Criminal Code relating to Division 4A.

Read the carve-outs together and the shape becomes clear. An individual can be compelled to answer, cannot have the answer used against them in most proceedings, and is still fully exposed if the answer is false or misleading or if they obstruct the examination. Note also what subsection (2) does not say: by its terms it protects an individual, and the material an individual produces is not thereby made inadmissible against the corporate provider.

Item 2 of Schedule 2 adds section 163A, which fixes the amount stated in an infringement notice for sections 63D, 63DA, 63DB and 63H at one-fifth of the maximum penalty a court could impose, or one-fifth of the summed maxima where a notice alleges several contraventions. Applied to the new 60,000 penalty unit maximum, the infringement figure moves with it.

Where the AI question sits, and why the reading is ours

The Act does not mention artificial intelligence, machine learning, age assurance, age estimation or age inference. Its text is enforcement architecture: penalties, a notice power, a summons, an oath, an immunity. Anyone telling you Australia has legislated on AI age checking this week has not read the two schedules.

The connection is a practical one and it belongs to this desk rather than to the drafter. A minimum age regime for social media is, in operation, a question about how a service decides who is under the age. At the scale of a large platform that determination is made by automated systems, and the evidence of whether the determination works is held partly by the platform and partly by the vendors that build and tune those systems. Section 63G, now in force, reaches any person the Commissioner reasonably believes holds information relevant to a provider's compliance, and Division 4A lets the Commissioner summon a person capable of answering questions about it.

That is the inference worth acting on, stated as an inference: from commencement, a vendor supplying age assurance technology into the Australian market can no longer assume it sits outside these powers' reach, and an engineer who can explain a model's error rates is the kind of person a summons can name. Where we list those vendors and contractors among the people this Act affects, that is our reading of who a section 63G notice or a Division 4A summons could reach, and not a statement in the Act, which names none of them. We do not say the Commissioner intends to do this, because nothing in the Act says so.

We also do not describe what section 63D requires. The Act amends its penalty and refers to compliance with it; it does not restate the obligation, and we did not open the Online Safety Act 2021 compilation. Anyone advising on exposure needs that text, not this one.

What we did not verify

What we opened: the Act as made, fetched live from the Federal Register of Legislation this session and read in full, both schedules, the commencement table and the assent line reading "[Assented to 11 September 2026]". The commencement table carries a single row, the whole of this Act, commencing the day after Royal Assent, 12 September 2026, and no provision is given a different date. The register page header shows C2026A00083 and 11 September 2026, and the Act's closing note records the Minister's second reading speech in the House of Representatives on 29 June 2026 and in the Senate on 1 July 2026.

What we did not open: the Online Safety Act 2021 compilation, so we do not state what sections 63C, 63D, 63DA, 63DB, 63G or 63H require in their own terms beyond how this Act refers to them. We did not open the legislative rules made under paragraph 63C(1)(b) or (6)(b), the explanatory memorandum, the second reading speeches, the Regulatory Powers (Standard Provisions) Act 2014, or section 4AA of the Crimes Act 1914. We therefore give no dollar figure for a penalty unit and convert nothing into currency.

What we refuse to claim: we do not say any provider is exposed to a 60,000 penalty unit maximum for anything it did before 12 September 2026, because item 6 applies the increase only to conduct engaged in on or after commencement. We do not say the Act regulates age assurance technology or artificial intelligence, because its text does not mention either; the connection drawn in the section above is our reading and is labelled as such. We do not say the eSafety Commissioner will use Division 4A against vendors, because that is a prediction and we have no evidence for it. We do not state how many platforms are covered, because the Act does not say and we did not read the legislative rules.

Quotations are reproduced with ASCII hyphens and quotation marks in place of the typographic characters used in the published text, which is a house typesetting convention and not a change to any word.

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.

Related briefings

• eSafety's age-restricted codes and AI nudify enforcement
• UAE Cabinet Resolution 106 on child social media and AI age verification
• Italy's Garante fines Character.AI over minors and age verification
• Asia Pacific AI regulation tracker
• AI Regulation News hub