Jenny McAllister (NSW, Australian Labor Party, Minister for Emergency Management) | Link to this | Hansard source

I table a supplementary explanatory memorandum relating to government amendments to be moved to the bill. I seek leave to move government amendments (1) to (8) on sheet SY115 together:

Leave granted.

I move:

(1) Schedule 1, item 7, page 6 (after line 29), after section 63D, insert:

63DA Information that must not be collected

(1) A provider of an age-restricted social media platform must not collect information:

(a) for the purpose of complying with section 63D; or

(b) for purposes that include the purpose of complying with section 63D;

if the information is of a kind specified in the legislative rules.

Civil penalty: 30,000 penalty units.

(2) Before making legislative rules specifying a kind of information for the purposes of subsection (1), the Minister:

(a) must seek advice from the Commissioner, and must have regard to that advice; and

(b) must seek advice from the Information Commissioner, and must have regard to that advice.

(3) Section 63D does not apply to the provider of an age-restricted social media platform if, because of legislative rules made for the purposes of subsection (1) of this section, there are no reasonable steps that the provider could take in order to comply with section 63D.

Note: In proceedings for a civil penalty order against a person for a contravention of section 63D, the person bears an evidential burden in relation to the matter in this subsection (see section 96 of the Regulatory Powers (Standard Provisions) Act 2014).

63DB Use of certain identification material and services

(1) A provider of an age-restricted social media platform must not:

(a) collect government-issued identification material; or

(b) use an accredited service (within the meaning of the Digital ID Act 2024);

for the purpose of complying with section 63D, or for purposes that include the purpose of complying with section 63D.

Civil penalty: 30,000 penalty units.

(2) Subsection (1) does not apply if:

(a) the provider provides alternative means (not involving the material and services mentioned in paragraphs (1)(a) and (b)) for an individual to assure the provider that the individual is not an age-restricted user; and

(b) those means are reasonable in the circumstances.

Note: In proceedings for a civil penalty order against a person for a contravention of subsection (1), the person bears an evidential burden in relation to the matter in this subsection (see section 96 of the Regulatory Powers (Standard Provisions) Act 2014).

(3) This section does not limit section 63DA.

(4) In this section:

government-issued identification material includes:

(a) identification documents issued by the Commonwealth, a State or a Territory, or by an authority or agency of the Commonwealth, a State or a Territory (including copies of such documents); and

(b) a digital ID (within the meaning of the Digital ID Act 2024) issued by the Commonwealth, a State or a Territory, or by an authority or agency of the Commonwealth, a State or a Territory.

(2) Schedule 1, item 7, page 7 (line 1), omit the heading to section 63E, substitute:

63E Delayed effect of requirement to take reasonable steps to prevent age-restricted users having accounts

(3) Schedule 1, item 7, page 7 (line 6), omit "earlier", substitute "later".

(4) Schedule 1, item 7, page 9 (line 9), after "section 63D", insert "or subsection 63DA(1) or 63DB(1)".

(5) Schedule 1, item 7, page 9 (line 27) to page 10 (line 12), omit section 63J, substitute:

63J Platform provider notifications — failure to take reasonable steps

If the Commissioner is satisfied that the provider of an age-restricted social media platform has contravened:

(a) section 63D (failing to take reasonable steps to prevent age-restricted users having accounts); or

(b) subsection 63DA(1) (collecting information); or

(c) subsection 63DB(1) (identification material and services);

the Commissioner may:

(d) prepare a statement to that effect; and

(e) give a copy of the statement to the provider of the platform; and

(f) if the Commissioner considers that it is appropriate to publish the statement—publish the statement on the Commissioner's website.

63K Platform provider notifications — privacy

If the Information Commissioner is satisfied that the provider of an age-restricted social media platform has used, disclosed or failed to destroy information in a way that is taken to be an interference with privacy under subsection 63F(1) or (3) (privacy), the Information Commissioner may:

(a) prepare a statement to that effect; and

(b) give a copy of the statement to the provider of the platform; and

(c) if the Information Commissioner considers that it is appropriate to publish the statement—publish the statement on the Information Commissioner's website.

(6) Schedule 1, item 13, page 11 (after line 3), after paragraph (da), insert:

(daa) section 63DA;

(dab) section 63DB;

(7) Schedule 1, page 11 (after line 4), after item 13, insert:

13A After section 222

222A Liability for damages — Information Commissioner

The Information Commissioner is not liable to an action or other proceeding for damages for, or in relation to, an act or matter in good faith done or omitted to be done:

(a) in the performance or purported performance of any function; or

(b) in the exercise or purported exercise of any power;

conferred on the Information Commissioner by or under this Act.

(8) Schedule 1, item 16, page 11 (lines 13 to 21), omit section 239B, substitute:

239B Review of social media minimum age framework

(1) Within 2 years after the day section 63D takes effect in accordance with section 63E, the Minister must cause to be conducted an independent review of the operation of Part 4A.

(2) Without limiting subsection (1), the review must include consideration of:

(a) the adequacy of privacy protections in, and in relation to, Part 4A; and

(b) any other matters relating to the operation of Part 4A determined by the Minister.

(3) The Minister must cause to be prepared a written report of the review.

(4) The Minister must cause copies of the report to be tabled in each House of the Parliament within 15 sitting days of that House after the day on which the report is given to the Minister.

Keeping Australians safe online is a top priority for the Albanese government. We are focused on positive solutions to issues of national concern, and the issue of harms to children and young people from social media is right up at the top of that list.

These amendments provide additional privacy-enhancing measures to part 4A of the Online Safety Act 2021. In practical terms, these amendments mean that no Australian will be forced to use government identification, including digital ID, for age-assurance on social media. This will give Australians confidence regarding the impact of the social media minimum-age obligation on their personal information. It does this through supplementary amendments. The first is a new section 63DA. This provides for the Minister for Communications to make legislative rules to exclude certain types of information being collected and used by platforms for the purposes of a minimum-age obligation. A breach of this provision gives rise to significant penalties.

The rule-making power enhances the privacy of users and their information. It gives the minister the discretion to prohibit the collection of specified kinds of information, subject to advice from both the eSafety Commissioner and Information Commissioner. This is an important change and will ensure the legislation continues to meet community expectations as technology evolves.

This is complemented by a new section 63DB. This new section provides that platforms must not collect identification issued by government or require the use of an accredited service, within the meaning of section 9 of the Digital ID Act 2024, as the only means of age-assurance to comply with the minimum-age obligation. To promote user choice and an inclusive set of assurance options, age restricted social media platforms will only be able to use government issued identification or accredited services under the Digital ID Act 2024 information or material if other alternative age assurance methods have been provided to users. Additionally, the bill expands on Australia's privacy framework by giving the information commissioner oversight over the privacy related aspects of the minimum age obligation. The Office of the Australian Information Commissioner is best placed to ensure that privacy provisions are administered consistently and robustly.

Finally, any breaches of these proposed amendments give rise to significant penalties—a maximum of 30,000 civil penalty units, currently equivalent to $9.9 million, or 150,000 penalty units, currently equivalent to $49.5 million, if the provider is a body corporate. The penalty amounts are intentionally large. This reflects the important privacy implications of the provisions. It also sends a strong signal to social media platforms: treat Australians' privacy seriously. Australia has consistently paved the way in global online safety. These supplementary amendments will strengthen the already robust and strong privacy arrangements included in the original bill.

Sarah Henderson (Victoria, Liberal Party, Shadow Minister for Education) | Link to this | Hansard source

The coalition supports these amendments. We are pleased to say we have been involved in constructive negotiations with the government to strengthen the bill. One of the major issues we sought changes on related to privacy. This is a very important issue. We provided the proposed changes to the government, which of course have now been incorporated into this amendment. We are very pleased that the government has accepted our changes, which, as I said, are reflected in the government's amendments. The new provisions make it clear that people cannot be compelled to provide digital ID or government issued identity documents, such as drivers licences or passports, under this legislation. This has now, due to the hard work of the coalition, been explicitly prohibited.

There was a second important change as well regarding strengthening ministerial oversight. Following our negotiations with the government, changes will be made so that the communications minister will be able to make rules specifying information which social media platforms are not able to collect in order to comply with the legislation. This will enable the minister to make rules to ensure that guidelines issued under the legislation are appropriate and proportionate to the objectives of the law. These are both very significant changes which materially strengthen the bill. We, of course, thank the government for agreeing to make these changes.

The coalition has led the charge on this bill, and we know what has driven this. What has driven this is the very profound mental health concerns that so many young people are suffering as a result of social media. We know there is widespread concern and evidence about the severe mental health impact of social media on children. We've seen very disturbing global trends in youth mental health since the rise of social media, especially for girls. According to the Australian Institute of Health and Welfare, there has been a more than three-fold increase in the rate of intentional self-harm hospitalisations for girls under 14 from 2008-09 through to 2022-23. In recent years, there have also been very large increases in the rate of mental health issues amongst children and young people. As a 2022 independent report on self-harm, commissioned by Australia's Therapeutic Goods Administration, noted, there have been very large increases in all intentional self-poisonings in older children and adolescents worldwide over the recent decade. We know that, particularly for the parents of the children who have tragically taken their own lives, passing this bill right now is absolutely critical.

I have a question for you, Minister, but I want to first reflect on the bravery of parents who've spoken out about the importance of this bill—parents like Mat and Kelly Howard, the parents of Charlotte O'Brien, with whom I met a couple of weeks ago. When I met with them, all I could say was that there are no words for the tragedy that they have suffered. Charlotte took her life in September after suffering systemic bullying, in part caused by social media. Her message to her mum and dad was that she wanted them to raise awareness about what she had endured; she wanted to see change. I cannot tell you how humbling it is to meet with parents like Mat and Kelly, to listen to their story and listen to their mission. As I say, I think it is absolutely incumbent on this parliament to do the right thing.

I want to also commend both the Leader of the Opposition, Mr Dutton—who has led the charge on this; I'm pleased that the government has caught up—and the shadow minister for communications, Mr Coleman. They have really led the charge on behalf of the coalition. We have heard the cries of families who are suffering, and we cannot continue to allow this to happen.

Minister, does the government believe this legislation will force the tech giants to actually use their technology to help identify and remove underage kids? We're very cognisant, of course, that TikTok removed 76 million underage children from its platform around the world; one million young Australians are here in Australia. Minister, could you just provide confirmation in relation to that?

Jenny McAllister (NSW, Australian Labor Party, Minister for Emergency Management) | Link to this | Hansard source

I should indicate that the government has been grateful for the willingness of the opposition to constructively engage in some of the ways that we might improve this bill. We have similarly been grateful to those senators who participated in the Senate inquiry. Many of them are here in the chamber this evening. We're also grateful for the many Australians who have spoken out about this issue, either in the context of the Senate's inquiries or in the broader public debate.

Senator Henderson, you spoke about some of the harms that you've observed in your interactions with families and with parents. I think, for many of us, this is a common experience in our interactions with parents, and also with teachers, because parents are deeply distressed about some of the material that their children are exposed to online. They are uncertain about how to navigate the peer pressure that children experience, from their friends and peers at school and at sport, to be in these social media environments. They are looking for support from government to help them navigate these questions.

These were not questions that were relevant questions when I was growing up—I think it's safe to portray my age here. There were other difficult questions for me to navigate as a young person. Parents, I think, are finding it very difficult. In my home state of New South Wales the ban on mobile phones in schools has made a significant difference to the behaviour of children in schools and the way that children interact socially at school. It is clear that while technology has brought really significant benefits, it's also brought non-trivial harms for children.

We are confident that there are technological solutions available to us. You cited the example of TikTok; it's been much canvassed. That platform was able to identify, by its own public statements, a very large number of underage users on its platform and remove them. That did not require access to government documentation. It was based on information already available to that platform.

The amendment that we are presently considering is actually based on that foundational understanding of the state of the technology. It may be that, in some instances, social media platforms choose to offer an option to users to provide government documentation, but what this amendment ensures is that that will not be able to be the only means, the only choice, offered to a potential user. What this amendment seeks to do is, in fact, to ensure that, on every occasion when a person is asked to engage in an age-assurance process, they have a choice, and it enlivens the obligations on technology companies to utilise the technology capabilities that they already possess to undertake this work and to make sure these platforms are safe and that people are using them in an appropriate way.

Gerard Rennick (Queensland, Gerard Rennick People First) | Link to this | Hansard source

You just said that taking mobile phones off children at schools has been very successful. The question I have is: why can't you take mobile phones off children when they're at home? We take the phones off our children in the bedroom. We take the phones off them during the week days. They're allowed to have the mobile phone or the devices on the weekend, but that's in between sporting requirements, me forcing them to take the dog for the walk and their mother telling them to get out there on the trampoline or go gardening—whatever it is. So I'm confused as to why we can't have some good old-fashioned parental supervision. Whatever happened to the role of the parents in the family?

I've been advocating for years the need to have a parent stay at home while you're raising your children. I stayed at home for four years. I don't want to turn this into me saying women should stay at home—I've never said that. Dad should stay at home more often. Indeed, I was just talking to Senator Hanson-Young yesterday, and she was saying how she fought to have children in the chamber. What a great thing that is. Yet again we've got another example of the government thinking it can solve a problem.

I note Senator Henderson said before there are things like anorexia and that children are subjected to these things on the internet, and that's fair enough; they are. But these things have always been around. Kate Moss was criticised in the 1990s. I well remember Karen Carpenter, who died from anorexia in the late seventies or early eighties. We've always had to deal with issues with our children, and the important thing is that they have close parental supervision so that you can detect if something's going on.

The other thing is—and I've raise this before, but it's worth raising again—you can have software that monitors your children's activity. We do that already. We monitor our children. It is effective because we have a middle child that loves to get up at about three o'clock on a Sunday morning. The only way we can bust him is to actually—

Yes, he sneaks the iPad into his room. He's terrible! So, yet again, what guarantees do we have that this will actually be effective? I think you'll find that children are very good at getting around laws. What guarantees do we have that this will stop bullying? This won't stop bullying per se. What will stop bullying is, again, having a parent keep a close eye on the children while they're growing up and being in touch with your children so if they are being bullied you're aware of it.

I'll note a question raised the other day about VPNs. Thirty-three per cent of people in this country use VPNs, and I suspect most of that 33 per cent are probably people aged under 40 because most people over 40 probably wouldn't even know what a VPN is—that is, a virtual private network. The reply from the government in estimates was, 'We're going to get the social media companies to track the person if they have a VPN, through geotracking.' Here we've again got Big Brother surveillance coming in and watching every little thing we do, every breath you take. What is it? Every time we come down here, I feel like we're just holding the line, and we're not even doing that when it comes to government overreach and surveillance and command and control. So my question to you, Minister, is: why it is that parents can't be encouraged to keep the devices from their children? You have quoted an example of taking mobile phones off children in the schools, which is a good idea. Why can't that very simple principle be applied in this situation when it comes to children having a social media account and monitor it that way?

Jenny McAllister (NSW, Australian Labor Party, Minister for Emergency Management) | Link to this | Hansard source

Thanks for the question. Perhaps I can say this: we have been really clear, and many of people participating in this debate, including the opposition leader, to be fair, have been very clear that this is not the only thing we would advocate to support families in relation to some of these challenging questions nor do we expect this intervention to be a silver bullet. However, what we do hear from parents is that this is very significant and they are looking for assistance because they are not receiving the support they expect should be available to them from the platforms themselves.

So one of the key features in the design of this bill is it really puts the onus on the platforms, not on the parents and not on the kids. We want platforms to simply take reasonable steps to ensure users under the minimum age cannot create or hold an account. I think, based on the tenure of your questioning and your contribution just now, you would accept the harms associated with excessive time online at the very least and it may be that you accept the harms associated with exposure to some of the more challenging features of social media. For example, the Australian psychological association, if you look at the evidence, found significant links between excessive social media use and poor sleep quality and poor mental health outcomes. In particular, they pointed to the use of algorithms and the influence of those algorithms and, frankly, the near-addictive nature of some of those algorithms, because they increase the likelihood of exposing young people to content that is inappropriate and negatively influential such as glorifying eating disorders, glorifying self-harm, or exposing young people to extremist content. I think it would be a matter of agreement across this chamber that those things are not acceptable and are not good for our kids and it is why this bill is being brought to this place.

I said to you earlier in my contribution that the onus is on the platforms, not on parents. For clarity, there are not any penalties for Australians who gain access to an age-restricted social platform and there aren't any penalties for parents or educators who provide that access. It is impossible, and we accept this, for governments to completely stop young people from accessing harmful products or content but we can help by asking the social media companies to play their role. One of the things we hear and was discussed, as I understand it, at the hearing that took place into this bill, is the significance of setting norms. The bill will set clear parameters and norms for our society and assist in ensuring the right outcomes.

James McGrath (Queensland, Liberal National Party, Shadow Assistant Minister to the Leader of the Opposition) | Link to this | Hansard source

Senator Canavan, on a point of order?

Matthew Canavan (Queensland, Liberal National Party) | Link to this | Hansard source

I rise on a point of order on relevance. The government and the opposition conspired to gag this debate tonight and the minister has taken up half the time, which I think was set aside for other senators who did not get an opportunity in the second reading debate to put points of view. The minister is repeatedly going over points that were already raised in the second reading debate by government ministers. So on the grounds of repetition, with the limited time we have, I would ask if we could be succinct and give all senators the respect and opportunity to contribute to this important debate.

James McGrath (Queensland, Liberal National Party, Shadow Assistant Minister to the Leader of the Opposition) | Link to this | Hansard source

I think the minister is in order. I'm sure the minister is aware of the different views of the chamber. Senator Henderson, I was going to go to Senator Lambie.

Sarah Henderson (Victoria, Liberal Party, Shadow Minister for Education) | Link to this | Hansard source

On the point of order, Chair—

The TEMPORARY CHAIR: I actually made a ruling on that. Senator Lambie.

Jacqui Lambie (Tasmania, Jacqui Lambie Network) | Link to this | Hansard source

I wanted to know what algorithm changes you have told the social media companies to make. What algorithm changes have you told them to make?

Jenny McAllister (NSW, Australian Labor Party, Minister for Emergency Management) | Link to this | Hansard source

Thanks for the question, Senator Lambie. As I indicated in my response to Senator Rennick, we are not asserting that this bill represents all of the work that is needed to engage. One of the things that Minister Rowland has been very clear about is that she intends to legislate a duty of care. That goes to some of those questions around safety by design and the way the algorithms work, not just to affect, frankly, users under 16, but to affect all users of platforms of this kind. That's work she has indicated she intends to undertake. This is also important.

Can I just indicate to Senator Canavan, who made a set of points about his desire, I imagine, and expectation that other senators wish to contribute—that's perfectly fine, and I'm happy to try and keep my remarks as brief as possible. I was just now seeking to answer the question put to me by Senator Rennick. If senators direct questions to me, I do intend to answer them. I understand that sometimes in the committee stage senators wish to make a more general contribution, and that's fine as well.

Jacqui Lambie (Tasmania, Jacqui Lambie Network) | Link to this | Hansard source

There's no duty of care so far, because this won't come into effect for another 12 months. We haven't worked out what the duty of care is. We haven't worked out what the rules are. What about the data? Have you told them to destroy our data as soon as the social media companies receive it, or haven't you made that rule either?

Jenny McAllister (NSW, Australian Labor Party, Minister for Emergency Management) | Link to this | Hansard source

Would you prefer I don't answer the questions? I've been asked a question. The bill contains really explicit requirements for data that is collected in relation to age assurance. What it may be used for and requirements for it to be destroyed—that is in the legislation.

Jacqui Lambie (Tasmania, Jacqui Lambie Network) | Link to this | Hansard source

On a point of order—all I asked was: are the social media companies destroying that data when they have finished with it? It's simple: yes or no.

The TEMPORARY CHAIR: I can't direct the minister—

The TEMPORARY CHAIR: Senator Hanson-Young, please. I can't direct the minister as to how they can answer the question. I'll make sure the minister is aware of the question and I call the minister.

Jenny McAllister (NSW, Australian Labor Party, Minister for Emergency Management) | Link to this | Hansard source

Until the legislation passes, the privacy arrangements that are in the legislation are not in place. Social media companies are subject to some of Australia's privacy provisions, but the legislation actually establishes a higher standard in relation to the uses of information provided to these companies as part of meeting the requirements in this bill. It also requires the destruction of such data.

Malcolm Roberts (Queensland, Pauline Hanson's One Nation Party) | Link to this | Hansard source

My remarks are directed to the minister but also to people listening at home to the Senate and to researchers and historians that will look back at this vote today in an attempt to understand what the hell the Senate was thinking. The amendment the government circulated, no doubt with the approval of the Liberal Party, answers that question. The Online Safety Amendment (Social Media Minimum Age) Bill 2024 can act to force every Australian to be the subject of a digital ID in the name of keeping children safe—and that's what my question is about.

The government accepted widespread public concern that the bill was designed to force everyone to get a digital ID and promised to include an amendment to specifically rule that out. In this government amendment that you've moved, SY115, new provision 63DB(1) excludes use of government issued identification or use of digital ID. That is great, except 63DB(2) provides that, if social media platforms can come up with an alternative means of assessing age that does not involve digital ID or government documents, they can—wait for it—accept a digital ID identification. In effect, this amendment specifies that a social media platform cannot use digital ID by itself but it can use digital ID as part of a more comprehensive verification. There's no need to guess what that could be; this bill contains the answer: age-assurance software. The company which has been awarded the tender for the age-assurance trial is a British company called Age Check Certification Scheme. whose main business is provision of digital IDs backed by age-assurance software.

TikTok has used age-assurance software to remove one million underage accounts from TikTok in Australia. This software can tell if a person is, for instance, under 12. That's useful. The smaller the gap between the user and target age—16 in this case—the less accurate it is. This software can't tell age within six months, and there's no way of knowing a person turned 16 on the day of their application. You just can't tell that from face scan. Accessing social media on your 16th birthday and, most likely, for months afterwards will require a second identifier containing the child's facial scan and their date of birth, which is a digital ID, which this company specialises in. You're setting them up.

I have criticised this bill as an opportunistic attempt to capitalise on the public desire for better regulation of social media to force all Australians to get a digital ID. I'll say that again. I have criticised this bill repeatedly, as have others, as an opportunistic attempt to capitalise on the public desire for better regulation of social media to force all Australians to get a digital ID. This amendment requires a change in my language, which is now that this bill is an opportunistic attempt to require every child, once they turn 16, to get a digital ID if they want to access social media. What age does the government's digital ID start from? Sixteen. What a coincidence! This wasn't the intention all along? That's misinformation.

This amendment exposes the original intention of the bell. Your amendment exposes the original intention of the bill, which was hidden in what looked like a poorly drafted bill. It wasn't poorly drafted; it was deliberately dishonest, and the short committee referral, which the government fought against, has exposed the deceit. The truth is now out there, and the decision before the Senate is a simple one. A vote for this bill is a vote to require every child to get a digital ID on their 16th birthday.

Compulsory digital IDs aside, there are many other reasons not to pass this bill. I will now share with the Senate and with posterity the words of Australian Human Rights Commission on the bill. One Nation fully supports the commission's position, which deserves to be included in the Hansard record of the debate:

Social media is a vital platform for young people to share their ideas and opinions, engage in dialogue, and participate in social and cultural activities. It can be a valuable educational tool by providing access to diverse perspectives, news and learning opportunities, as well as vital information about health, well-being and safety. A blanket ban risks unjustly curtailing these freedoms.

…   …   …

Social media is integral to modern communication and socialisation. Excluding young people from these platforms may isolate them from their peers and limit their ability to ability to access much-needed information and support. This is particularly important for young people from marginalised, vulnerable or remote communities.

These are the words of the Human Rights Commission.

The social media ban will rely on effective age assurance processes being adopted, which means that all Australians may be required to prove their identity in order to access social media. This may potentially require all Australians to provide social media companies with sensitive identity information, which poses a risk to our privacy rights in light of recent examples of data breaches and personal information being stolen.

…   …   …

Technological workarounds—such as VPNs and false age declarations—may undermine the effectiveness of the ban. Additionally, a ban will not address the root causes of online risks or make the platforms safer for everyone.

The workarounds to this measure have not received enough debate. The bill carves out gaming sites, many of which have a chat feature. Children will move over to chatrooms and gaming sites which are not supervised. Tor—or, more accurately, onion routing—will provide another avenue for communication which is designed to make supervision exponentially harder than on mainstream social media platforms. I have advice from a leading internet security company that peer-to-peer social media, which again is harder for parents to supervise than current social media platforms, is making a comeback. As a result of this legislation, children will be exposed to more harm, not less. I had a call from a constituent—

Sarah Hanson-Young (SA, Australian Greens) | Link to this | Hansard source

You are right.

Malcolm Roberts (Queensland, Pauline Hanson's One Nation Party) | Link to this | Hansard source

It's not often Senator Hanson-Young tells me I'm right. A moment ago, I had a call from a constituent who had called their local Liberal member of parliament about this bill and was told, 'Oh, it's okay; you can just sign up for your children.' With age-assurance software, that will not work. With Digital ID connected to age-assurance software, the social media platform will know what you're doing. Don't be telling people: 'It's nothing. You can defeat it. You can still talk to Grandad on Facebook.' You won't be able to. Children may be able to use VPNs, virtual private networks, and the new PPNs, personal private networks, to appear to be in another country. That really won't work either. The keystroke logging that accompanies the age-assurance software will assume someone pretending to be in Canada but interacting with Australian accounts is probably using a VPN.

Minister, why did you say that this won't lead to Digital ID when your amendment says exactly that?

Jenny McAllister (NSW, Australian Labor Party, Minister for Emergency Management) | Link to this | Hansard source

I appreciate the many pieces of advice I've had about how I might answer questions, but I'll answer the questions in the way that I think is most appropriate to give Australians the information that I think is necessary in relation to the bill. So thanks for all of the free advice, but I'll just answer the questions.

Senator Roberts, I think, foundationally misunderstands the amendment that's before him. The amendment specifically seeks to set up the circumstances where a platform may not require a person to provide a government form of identification, including identification within the meaning of section 9 of the Digital ID Act, as the only means of assuring age. The platforms must provide another option. That's to deal with the concern you and others have raised, Senator, which is that you do not believe that it ought to be compulsory for such material to be provided for the purposes of age assurance. That is precisely what the amendment before you seeks to do.

Matthew Canavan (Queensland, Liberal National Party) | Link to this | Hansard source

I think from the debate it's very clear that we are not sure yet whether this hasty, blunt attempt will do anything to reduce the social harms of social media to children, but what we do know for sure is that we have successfully disillusioned a whole generation of Australians with Australian politics. A whole generation of Australians have watched this sordid saga play out over the past week and have been completely disillusioned with their democratic process, which they should have an involvement in. We have completely denied them their voice. Maybe we've scheduled the debate for 10.30 pm on the last day of 'school' because we know that all the people who will be impacted by this ban will be in bed. It's past their bedtime. They can't even watch it.

They haven't been able to have a process through the Senate inquiry. We had 15,000 submissions in 24 hours, and we had an inquiry of three hours the day after. Nobody, of course, could read anything but a fraction of those submissions. Less than one per cent of them were published on the website before the report. This is an absolute outrage and a stitch-up of grand proportions.

I don't think it's going to work. I don't have time tonight, because I want to let other senators speak. I don't think it is going to work. I know that the stitch-up is in. I am going to try to make the bill better. I am going to try to fix the issue that Senator Roberts logically pointed out: why are we letting Digital ID be a means of identification at all? It's not used at the moment at all, really. It's not in widespread use, so why don't we just rule that out right now? If it's something that comes into use in years to come, we can always change the law. There's a review built into this law in two years time. We can do it then. If we are serious about responding to the concerns about Digital ID, let's just get rid of it. My amendment would do that.

Also, why is it that this bill seeks to—we think, the minister says—help parents, but the word 'parent' is not mentioned at all? There is not a single mention of the word 'parent' in this bill. Why? Why aren't we helping parents, rather than trying to replace them? That's what this bill tries to do; it tries to set up a nanny state. We here in Canberra think that we can pass this law and all look at how great we are and pat ourselves on the back for how we've saved the world. But the bill won't do that; it won't help at all. Parents use their own agency, their interaction with their children to use social media responsibly.

So I have an amendment which will allow some children to continue to use social media with parental approval. It's based on the law in Florida that's just went through. Our inquiry barely looked at that law. It went through after an actual process. It got vetoed by the governor in the first instance. It went back to congress in Florida, and they've approved it. That's the way democracy should work. But we have completely ridden roughshod over that with this hasty, truncated process this week.

I have another amendment that would narrow the definition. There is a ridiculous definition in this bill which basically captures any app that enables interaction between two or more people, which is basically everything you do on the internet. It's going to cover apps like Strava for bike riding. It's going to cover apps like Deputy which are used by people who work. Fourteen-year-olds can get a job, but apparently they can't have social media. I know the minister's going to say we'll exempt them, but why create this uncertainty when, again, the Florida law has a much more targeted definition which focuses the law on apps which cause social harm. That's what we should be focusing on.

I don't have the time to go through the other amendments in detail. I want to let other senators have their turn. But I come back to the point that a whole generation has been activated by this process. There is a silver lining, perhaps. Right now a guy called Mr Anthony Khallouf is running a livestream of our broadcast here. He has 38,000 people watching. The official YouTube channel of parliament has 800. He's got 38,000 young people absolutely pissed off with this parliament right now watching. They are totally angry, and those people are going to grow up and they're going to keep voting. And I think there will be a lot of change coming to our parliament in years to come if we keep ignoring those people, like we are tonight.

Sarah Hanson-Young (SA, Australian Greens) | Link to this | Hansard source

What a sham this is. This is a piece of legislation that does not do what the government or the Leader of the Opposition propose that it does. It doesn't make social media safer. It doesn't make children and young people safer online. It's a sham. The whole process has been a sham. The bill has been rushed through with limited inquiry—three hours of inquiry—and with no ability for the bureaucrats to actually answer questions properly, all under the guise that this is urgent and needs to be done, but it doesn't take place for another 12 months.

I'll tell you what this is about. This is about the pretence that parents over the summer holidays can tell their kids: 'It's illegal to be on your phone. It's illegal to be on social media. Get off it. The Prime Minister says, the Leader of the Opposition says, the parliament says, it's illegal, kids. It's not my fault. I'll take it away.' It doesn't actually make social media safer for young people, and that's the devastating thing about this. We know that there are families who are struggling with this. We know there are young people who are struggling with their body image and their connection with their community, their peers. There are young people who are finding themselves addicted to these dangerous algorithms. But this bill doesn't do any of that; this bill does none of that. All this bill does is gives the government and Peter Dutton the illusion, the fig leaf, that they've given parents some certainty. You can say, 'Look, kids, it's illegal.' This is a rubbish bill. It has no substance, and it doesn't even take place for another 12 months. This bill is so weak, is such a veneer. It's to make old people, oldies, adults feel like they've done something. It's a false sense of security. It's also obvious that the people who have drafted and fought for the particular elements of this bill actually have no idea how young people engage with the internet—absolutely no idea. It's almost embarrassing. This is boomers trying to tell young people how the internet should work. That's what this bill is: boomers trying to tell teenagers and young people how the internet should work to make themselves feel better.

We have Australian artists in this country who have only been discovered because young people have found them on YouTube and they've engaged with their music, their creativity. This is going to put an axe through Australian creatives. The government hasn't even thought about that. The opposition leader hasn't even thought about that. The consequences of this bill are going to reach far further than this government and this parliament has been able to uncover.

It is being rushed through. It hasn't been considered properly. It's not even going to take place for 12 months. There is no excuse for doing it in this way, except for the desperation that the Prime Minister had to match the dare that the Leader of the Opposition put, which was get it in place before Christmas. It's pathetic. It's a headline. It doesn't do what they say it will do. It creates a more unsafe culture and platform and environment and will have unintended consequences. I can't fathom who in the Leader of the Opposition's office is advising him and who is advising the government to understand that this was a good idea to rush through. The Leader of the Opposition called the Prime Minister's bluff, and the Prime Minister blinked. Silly, silly, silly. This is a piece of legislation that says boomers want to control what young people access online. They don't even know how it works. It's pathetic.

Alex Antic (SA, Liberal Party) | Link to this | Hansard source

We are running out of time, which is the most regrettable part of this entire situation. All of us in here have had a lot to say about this bill because it's so complicated. One of the issues we've got is that this bill required a deep, fulsome look. Instead we got the Online Safety Amendment (Social Media Minimum Age) Bill 2024 introduced into the House this time last week, Thursday of last week. It was then put through to a committee, the hearing was on Monday, the report was delivered two days ago and now here we are. It's an extraordinary sequence of events for something that is highly complicated. We just heard the previous speaker, Senator Hanson-Young, quite rightly say that we don't know what the long-term effect of this bill on various platforms is. We don't know because it keeps evolving. This time last week we were told Snapchat was out and YouTube was in, in terms of the ban. How far we've come in a week. It's extraordinary.

We all hear the stories about bullying. We hear and have a lot of concern about that. We don't want to discount those concerns by any stretch, but we are in the process, in this chamber tonight, of throwing the proverbial baby out with the bathwater. We've heard the Human Rights Commission, we've heard commentators and others from across the country tell us about the thing that we're not talking about, which is the value of social media to kids.

Commissioner Finlay from the Human Rights Commission wrote an article in the paper this week stating very clearly, and very correctly, that in fact there are lots of instances where children benefit greatly from social media, including but not limited to instances of social isolation, the tyranny of distance and sometimes even with learning difficulties and so forth. So this has not been considered enough. The fact that we're standing here now rushing, with ten minutes to go, when many of us couldn't even make proper contributions to a second reading debate is a disgrace.

Senator Canavan is absolutely right: what does this message send to the children of this country when we have spent all day talking about ourselves in this building, by the way—as we do all the time—and we've crammed this critical legislation in and made senators juggle between ministerial answers, which are being filibustered? This is not the way to conduct a democracy, and I think we're much the poorer for it.

I'm going to cut to the chase, because I think we still have other senators speaking. Let's be very clear about this. We don't know if this is going to work. We don't know if it will have any impact on the problem they're trying to solve here. If you want to see some of the most egregious abuse you'll ever see online, go online to a Call of Duty game and listen to the kids going at each other, talking about people—

An honourable senator: It's exempt.

It's exempt—quite right. So who has thought of that one, Minister? Who has taken that into account? Who ultimately is going to take responsibility when this goes the way of the Hindenburg, which it will, because it is a disaster waiting to happen?

The Prime Minister and the Minister for Communications have boasted that the passing of this bill will make Australia a world leader in online safety. They're wrong, because, if this bill passes, we won't be leading the world in online safety—we'll be leading ourselves and those naive enough to follow us down the road to further digital authoritarianism, as outlined by Senator Roberts today. My fear is that, when we finish tonight, we will have put another brick in the wall of a social-credit style system in this country. Let everybody look back on tonight as a night of shame.

Ralph Babet (Victoria, United Australia Party) | Link to this | Hansard source

The most important thing that we should all be thinking about and talking about in here is the affirmation that parental responsibility rests in the hands of parents, not in the federal government. I would have thought that that were a very simple statement, but apparently it's not. Apparently the government has to be our daddy now. I think it's absolutely ridiculous.

The fact that the Labor Party, along with the Liberal Party, have come together to take away parental rights and parental responsibility is, in my opinion, shameful. The fact that we are now in a position, in this country, where the government is so big, so unwieldy and so, in my opinion, authoritarian leaning that it's making decisions for parents is just wrong.

We didn't even get a chance to properly debate this bill. Look, mums and dads are the best people to raise their children as they see fit. It's their right. It's their responsibility. The government's determination to do the job of parents through this blanket ban of under-16s undermines the primacy of these parents. Like I said before, it's not the state's role to go around telling 16-year-olds and under what they can and can't do. Can you have friends on TikTok? No, the government is going to decide for you. Can you see your family photos on Instagram? The government is going to decide that for you. Can you get the news off Elon Musk's X platform? The government is going to decide that for you. It's wrong. Decisions are for parents. It's an intrusion of the state.

For that reason, obviously I'm not going to support this bill. I don't agree with it at all. Like Senator Antic mentioned before, it is another brick in the wall of an authoritarian digital tyranny that most people can't even see is being built around them right now. In my opinion, this bill has got nothing to do with kids. Like Senator Canavan said, parents don't even appear in the bill at all. It's about building that digital prison. It's about age verification for everybody in the country. We all know, whether the minister will admit it or not, that digital ID, combined with digital currency, is the foundation of a social credit type system. You are enabling right now a system in the future where the government will be able to control every single facet of your life and what you do online. We are creeping towards this totalitarian state very, very slowly, but it is happening.

At the end of the day, this bill is obviously ill-conceived. We're spending money on this. We're going to spend time on this. It is going to be a failure of a bill. If you really wanted to protect kids you would say, 'Let's put some programs together where we can help parents—teach parents, empower parents—to make better decisions for their own children. That's because, at the end the day, parental responsibility rests with parents, not with the government. Even though most of you have come together to rush this bill through, I want the record to show, I want history to show, that Senator Babet from the United Australia Party was against this bill, and I will vote against it.

Richard Colbeck (Tasmania, Liberal Party) | Link to this | Hansard source

If you want an example of how not to legislate something that is important and of moment to our community, have a look at this piece of legislation. It arrived in the parliament last Thursday, spent four hours in a Senate inquiry on Monday night, and we're expected to pass with effectively very little debate in this place. Quite frankly, the legislation deserved a proper parliamentary process, and this government shows its disrespect for the parliament and the Australian community by trying to shove it through in the way that it is.

As many across the chamber have said—and I'm surprised to see some of the 'coalition', if you like, that's opposing this legislation—it really hasn't had the work that needs to be done. This is a genuinely important issue for our community. I don't diminish for a moment the pain and anguish that people have felt through the impact of online bullying on their children and families. I don't diminish that for a moment. I feel it; I've been close to families who have seen it, as we most likely all have. But this is not the way to deal with it. This is not the way that a parliament properly deals with a matter of this moment. The concept of excluding a huge swathe of our community from a form of communication just does not sit well with me. I respect my colleagues and I respect the arguments that are being made by those who want to do something—and clearly we should be doing something—but this is not the way to do it.

In that circumstance, I cannot vote for this legislation. It should not be rammed through in the way that it is. It won't come into place until 2026, so the government should do the parliament and our community the respect of looking at this process properly, so we can make sure we can come up with something that will work—that will support our families and communities and mitigate the problems that are there. I fear that this is not it.

Matthew Canavan (Queensland, Liberal National Party) | Link to this | Hansard source

I want to ask a simple, practical question of the minister before we wrap this up. I've got a real-world example that's come to me. It's of a 15-year-old in a basketball team who communicates over Facebook Messenger with their coach and teammates. Will that person be able to continue to do that, even if they have parental approval, once this legislation comes into effect?

Jenny McAllister (NSW, Australian Labor Party, Minister for Emergency Management) | Link to this | Hansard source

I'm advised that messaging and gaming are not intended to be covered by the purpose of the bill.

Opposition Senators:

Opposition senators interjecting—

Jenny McAllister (NSW, Australian Labor Party, Minister for Emergency Management) | Link to this | Hansard source

I have not finished speaking, in fact, Chair. In the minutes available, I will read this quote from a parent involved in a Safe on Social group. She said: 'What I've seen in the past 12 months alone has made it impossible for me to remain on the sidelines. For every mother sobbing on the phone or emailing me because her child has been humiliated or manipulated, there's another parent in despair because they don't know how to stop the chaos. I can no longer ignore that what we've been doing simply isn't working. Education alone is not enough.'

Matthew Canavan (Queensland, Liberal National Party) | Link to this | Hansard source

CANAVAN () (): To clarify, as I was trying to point out with limited time, you need a Facebook account to use Facebook Messenger. So how will that work?

Jenny McAllister (NSW, Australian Labor Party, Minister for Emergency Management) | Link to this | Hansard source

The advice that I have is that these carve-outs will be able to be effective in relation to messaging products.

Matthew Canavan (Queensland, Liberal National Party) | Link to this | Hansard source

In the final 20 seconds, as I say this it is being live-streamed and up to 45,000 people are watching now. They're obviously very disappointed with the process this place has gone through. I think it's not the finest hour for our Senate to guillotine a debate of this importance to so many Australians. There was no need for this rush—absolutely no need for it. We could have done this next year and still had the intended start date. It's a real shame that we've got to this state in the Australian Senate.

Andrew McLachlan (SA, Deputy-President) | Link to this | Hansard source

Order! Senators, pursuant to the order agreed to earlier today, the time for consideration of the bill in detail has expired. The question now is that the government amendments on sheet SY115 be agreed to.

Question agreed to.

The question now is that the Australian Greens amendments on sheet 3201 be agreed to.

Australian Greens ' circulated amendments—

(1) Clause 1, page 1 (line 6), after "Age", insert "and Digital Duty of Care".

(2) Schedule 1, page 3 (before line 4), before item 1, insert:

1A At the end of section 3

Add:

; and (c) to impose reporting obligations on providers of online services regulated by this Act about the number of Australian end-users of those services; and

(d) to impose obligations on large providers of online services regulated by this Act to identify, mitigate and manage the risks of harm or detriment from those services to Australian end-users.

1B Section 4 (before the paragraph beginning "The complaints system for cyber-bullying")

Insert:

(3) Schedule 1, item 2, page 3 (after line 15), after the definition of age-restricted user in section 5, insert:

key personnel of a provider: see section 5C.

large provider of a regulated online service: see section 5B.

regulated online service: see section 5A.

(4) Schedule 1, page 3 (after line 18), after item 3, insert:

3A After section 5

Insert:

5A Meaning of regulated online service

For the purposes of this Act, each of the following is a regulated online service:

(a) a designated internet service;

(b) a relevant electronic service;

(c) a social media service.

5B Meaning of large provider

For the purposes of this Act, a provider is a large provider of a regulated online service if:

(a) the provider provides the service during a calendar year to any one or more of the following:

(i) a total number of Australian end-users equal to or greater than 10% of the population of Australia;

(ii) 2.6 million or more Australian end-users;

(iii) 630,000 or more Australian end-users that are children; and

(b) the Minister, by notice given to the provider and published on a website maintained by the Department, determines that the provider is a large provider.

5C Meaning of key personnel

For the purposes of this Act, an individual is one of the key personnel of a provider if:

(a) the person holds a position in, or relating to, the provider; and

(b) because of that position, the person has actual or effective senior executive responsibility:

(i) for management or control of the provider; or

(ii) for management or control of a significant or substantial part or aspect of the operations of the provider.

3B Section 25 (after paragraph a)

Insert:

(aa) monitoring and enforcing the obligations of providers of regulated online services; and

(5) Schedule 1, page 4 (after line 12), after item 6, insert:

6A After Part 2

Insert:

Part 2A — Minimum obligations of providers and key personnel of regulated online services

Division 1 — Simplified outline of this Part

(a) duty of care obligations; and

(b) the key personnel obligations; and

(c) the risk assessment obligations; and

(d) the risk mitigation obligations; and

(e) the transparency obligations; and

(f) the end-user privacy and control obligations.

Division 2 — Providers must comply with obligations

28A Obligations of all providers

A provider must comply with its reporting obligations under Division 3.

Civil Penalty: The greater of 100,000 penalty units or 10% of the annual turnover of the provider during the period of 12 months ending at the end of the month in which the provider contravened, or began to contravene, the provision.

28B Obligations of large providers

In addition to its obligations mentioned in section 28A, a large provider must also comply with each of the following:

(a) its duty of care obligations under Division 4;

(b) its key personnel obligations under Division 5;

(c) its risk assessment obligations under Division 6;

(d) its risk mitigation obligations under Division 7;

(e) its transparency obligations under Division 8;

(f) its end-user privacy and control obligations under Division 9.

Civil Penalty: The greater of 100,000 penalty units or 10% of the annual turnover of the provider during the period of 12 months ending at the end of the month in which the provider contravened, or began to contravene, the provision.

Division 3 — Reporting obligations

28C The reporting obligations of all providers

(1) The reporting obligations of a provider of a regulated online service are to publish the following information on a publicly available website:

(a) the total number of Australian end-users of the service during a month, averaged over the last 6 month period (the reporting period);

(b) the number of Australian end-users of the service that are children during a month, averaged over the last 6 month period (the reporting period).

within the period provided under subsection (2) and in accordance with the requirements under subsection (3).

Note: For the consequences of a contravention of these requirements, see section 28A.

(2) For the purposes of subsection (1), the period is:

(a) for the reporting period ending immediately before 1 July 2025—1 July 2025; and

(b) for each successive reporting period—within 30 days of the end of that period.

(3) For the purposes of subsection (1), the information must:

(a) be in the form required by the legislative rules; and

(b) contain the details required by the legislative rules.

Division 4 — Duty of care obligations

28D The duty of care obligations of large providers

The duty of care obligations of a large provider of a regulated online service are:

(a) to take reasonable steps to conduct its business (including the design of systems and processes relevant to providing the service), and to provide the service, with honesty and integrity, and with due skill, care and diligence; and

(b) in conducting its business (including the design and operation of systems and processes relevant to providing the service) and providing the service, to take reasonable steps to prevent matters from arising that would (or would be likely to) cause harm or detriment to Australian end-users of the service.

Note: For the consequences of a contravention of these requirements, see section 28B.

Division 5 — Key personnel obligations

28E The key personnel obligations of large providers

(1) A large provider must notify the Commissioner if any of the following events occurs:

(a) an individual becomes one of the key personnel of the provider;

(b) an individual ceases to be one of the key personnel of the provider.

(2) The notification must:

(a) be given within 14 days after the event occurs; and

(b) be in the form approved by the Commissioner; and

(c) if the notification is of an individual becoming one of the key personnel of the provider—be accompanied by a signed declaration that the individual:

(i) is a fit and proper person; and

(ii) is a resident of Australia; and

(iii) meets the requirements (if any) set out in the legislative rules.

Note: For the consequences of a contravention of these requirements, see section 28B.

Division 6 — Risk assessment obligations

28F The risk assessment obligations of large providers

(1) A large provider of a regulated online service must undertake an assessment (a risk assessment) that identifies and assesses the risks associated with providing the service.

(2) Without limiting subsection (1), the provider must have regard to the following matters in undertaking a risk assessment:

(a) the dissemination of illegal and harmful materials;

(b) the dissemination of online scams;

(c) negative effects on electoral processes and public security;

(d) negative effects on civil and political rights, such as political freedoms, freedom of opinion and expression;

(e) negative effects on gender-based violence, children's best interest, public health;

(f) serious negative consequences to Australian end-users, including their physical and mental wellbeing;

(g) the matters (if any) specified in the legislative rules.

(3) Without limiting subsection (1), the provider must consider the following systems in undertaking a risk assessment:

(a) recommender systems and any other relevant algorithmic systems;

(b) content moderation systems;

(c) terms and conditions and their enforcement;

(d) systems for selection and presenting advertisements;

(e) relevant data related practices of the provider.

(4) The provider must exercise due diligence in undertaking the risk assessment.

(5) A risk assessment must be consistent with any relevant standards made under section 28G.

Provider must review and update risk assessments

(6) A large provider must review its risk assessment for the purpose of identifying and assessing any new or changed risks:

(a) if either of the following occur:

(i) the Commissioner communicates to the provider information that identifies or assesses risks associated with providing the service;

(ii) circumstances specified in the legislative rules; and

(b) in any event—at least once every 3 years.

(7) A large provider must update its risk assessment to address any issues identified by a review as soon as practicable after the review is completed.

Notification and publication requirements

(8) A large provider must, as soon as practicable after the end of each financial year:

(a) give the Commissioner a copy of its risk assessment as prepared under subsection (1) or updated under subsection (7); and

(b) publish that risk assessment on a publicly available website.

(9) A risk assessment given or published under subsection (7) must be accompanied by a report including the following:

(a) details of the risks identified;

(b) indications of the severity of the risks;

(c) measures of the scale of the risks in Australia;

(d) a risk mitigation plan about managing and mitigating the risks in accordance with Division 7.

Note: For the consequences of a contravention of these requirements, see section 28B.

28G Commissioner may make standards

(1) The Commissioner may, by legislative instrument, make one or more standards about requirements for risk assessments.

Note: For varying or revoking a standard, see subsection 33(3) of the Acts Interpretation Act 1901.

(2) Without limiting subsection 33(3A) of the Acts Interpretation Act 1901, standards under subsection (1) may provide differently for different kinds of entities, things or circumstances.

Division 7 — Risk mitigation obligations

28H The risk mitigation obligations of large providers

Risk mitigation policies, procedures and systems

(1) A large provider of a regulated online service must have policies, procedures and systems to monitor, manage and mitigate risks associated with providing the service.

(2) The policy, procedure or system must be consistent with any relevant standards made under section 28J.

Risk mitigation plans and measures

(3) A large provider of a regulated online service must prepare a risk mitigation plan in relation to risks identified in a risk assessment prepared by the provider under section 28F.

(4) The plan must identify measures to manage and mitigate those risks.

(5) Without limiting subsection (4), such measures may include any one or more of the following:

(a) changing the design, features or functioning of the regulated online service, including the online interface;

(b) changing the terms and conditions and their enforcement;

(c) changing content moderation processes;

(d) testing and changing algorithmic systems, including recommender systems;

(e) changing advertising systems, including the way advertisements are targeted at or presented to Australian end-users;

(f) improving internal business processes to maximise safety;

(g) collaborating with other digital services;

(h) taking targeted measures to improve child safety, such as age assurance or parental control tools;

(i) taking into account the best interests of children when making decisions;

(j) ensuring information and evidence about potential illegal activities is appropriately recorded and reported.

(6) The plan and the measures must be consistent with any relevant standards made under section 28J.

Providers must implement measures

(7) The provider must take reasonable steps to implement those measures.

Note: For the consequences of a contravention of these requirements, see section 28B.

28J Commissioner may make standards

(1) The Commissioner may, by legislative instrument, make one or more standards about either or both of the following:

(a) requirements for policies, procedures and systems to monitor, manage and mitigate risks;

(b) requirements for risk mitigation plans and measures.

Note: For varying or revoking a standard, see subsection 33(3) of the Acts Interpretation Act 1901.

(2) Without limiting subsection 33(3A) of the Acts Interpretation Act 1901, standards under subsection (1) may provide differently for different kinds of entities, things or circumstances.

Division 8 — Transparency obligations

28K Annual transparency report

(1) A large provider of a regulated online service must prepare a report a transparency report) in respect of the 12 month period ending immediately before 1 July 2025 and each consecutive period of 12 months.

(2) A transparency report in respect of a period must include the following information:

(a) metrics about design, features and functioning of the service;

(b) metrics about access of the service by Australian end-users that are children;

(c) metrics about online scams, including Australian end-user reporting and response times;

(d) metrics about child sexual exploitation and abuse;

(e) metrics about content moderation;

(f) details about measures to prevent and deal with misuse;

(g) details about monthly number of Australian end-users;

(h) details about advertising on the service;

(i) the information (if any) required by the legislative rules.

(3) A transparency report in respect of a period must be published on a publicly available website within 30 days of the end of that period and in accordance with the requirements under subsection (4).

(4) For the purposes of subsection (3), the report must:

(a) be in the form required by the legislative rules; and

(b) contain the details required by the legislative rules.

Note: For the consequences of a contravention of these requirements, see section 28B.

28L Compliance audits

(1) The Commissioner may appoint or establish a person or body that is independent of the Commissioner to conduct an audit (a compliance audit) of a large provider of a regulated online service for the purpose of determining whether the provider is complying, or has complied, with this Part.

(2) The provider must:

(a) cooperate fully with the auditor in relation to the compliance audit; and

(b) provide the auditor with all reasonable facilities and assistance in relation to the compliance audit.

(3) This section does not limit any of the other powers or functions of the Commissioner or ACMA.

Note: For the consequences of a contravention of these requirements, see section 28B.

28M Making research data accessible to researchers

Researchers may request research data

(1) Subsection (2) applies if a researcher that is:

(a) either:

(i) affiliated with an Australian research organisation (including an academic entity or not-for-profit organisation); or

(ii) an Australian resident or permanent resident of Australia; and

(b) undertaking research for non-commercial purposes;

requests a large provider of a regulated online service to give, or make accessible, research data that is:

(c) collected using the service; and

(d) already established and maintained for the purposes of research.

Note: Examples of research data include research API access schemes.

Provider must ensure access to research data

(2) The provider must ensure that the research data is accessible to the researcher:

(a) as soon as reasonably practicable after the request is made; and

(b) where technically possible, in real-time.

(3) However, subsection (2) does not apply in relation to research data that includes:

(a) protected information; or

(b) personal information (within the meaning of the Privacy Act 1988); or

(c) any information the disclosure of which the provider reasonably considers might cause a significant security vulnerability for the service.

Note: For the consequences of a contravention of these requirements, see section 28B.

28N Public Information Register

(1) A large provider of a regulated online service must establish and maintain a register to be known as the Public Information Register.

(2) The register must contain the following information:

(a) information included in a report published by the provider under section 28C;

(b) information included in a risk assessment (including a risk mitigation plan) published by the provider under section 28F;

(c) information included in a transparency report published by the provider under section 28K;

(d) information (if any) prescribed by legislative rules made for the purposes of this paragraph.

(3) The provider must ensure that:

(a) a person may access the register to search for information contained in the register; and

(b) the register is operational at all times.

Note: For the consequences of a contravention of these requirements, see section 28B.

Division 9 — End-user privacy and control obligations

28P The end-user privacy and control obligations of large providers

The end-user privacy and control obligations of a large provider of a regulated online service are:

(a) to ensure that privacy settings for Australian end-users of the service default to maximum privacy protections; and

(b) to ensure that Australian end-users of the service can opt to reset or disable engagement based content recommender systems; and

(c) to ensure that Australian end-users of the service can opt out of targeted advertising.

Note: For the consequences of a contravention of these requirements, see section 28B.

Division 10 — Obligations of key personnel of large providers

28Q Obligations of key personnel of large providers

A person who is one of the key personnel of a large provider must conduct the responsibilities of their position:

(a) by acting with honesty and integrity, and with due skill, care and diligence; and

(b) by dealing with the Commissioner and ACMA in an open, constructive and cooperative way; and

(c) by taking reasonable steps in conducting those responsibilities to prevent matters from arising that would (or would be likely to) result in a material contravention by the provider of this Act or the legislative rules.

Penalty: 500 penalty units

(6) Schedule 1, page 11 (after line 4), after item 13, insert:

13A Before paragraph 164(1)(a)

Insert:

(aa) section 28A;

(ab) section 28B;

13B Before paragraph 165(1)(a)

Insert:

(aa) section 28A;

(ab) section 28B;

13C Before paragraph 182(4)(a)

Insert:

(aa) section 28G;

(ab) section 28J;

13D After paragraph 182(4)(zb)

Insert:

(zba) section 194A;

13E After paragraph 183(2)(zb)

Insert:

(zba) the number of notices given by the Commissioner under section 194A during that year;

13F At the end of section 193

Add:

13G After section 194

Insert:

194A Commissioner may obtain information or documents etc.

Scope

(1) This section applies to a person if:

(a) the person is a large provider of a regulated online service; and

(b) the Commissioner believes on reasonable grounds that the person has information or a document that is relevant to the operation of Part 2A (minimum obligations of providers and key personnel of regulated online services).

Commissioner may require information or documents

(2) The Commissioner may, by written notice given to the person, require the person to:

(a) give to the Commissioner any such information; or

(b) produce to the Commissioner any such documents; or

(c) attend an interview with the Commissioner, including to make a statement or answer questions.

(3) The notice must:

(a) if the notice requires the person to give information or produce a document or thing—specify:

(i) the period (which must be at least 14 days after the notice is given to the person) within which the person is required to comply with the notice; and

(ii) the manner in which the person is required to comply with the notice; and

(b) if the notice requires the person to attend an interview—specify:

(i) a time and place at which the person is to attend; and

(ii) the nature of the matter to which the interview will relate.

194B Copies of documents

The Commissioner may:

(a) inspect a document produced under subsection 194A(2); and

(b) make and retain copies of, or take and retain extracts from, such a document.

13H Section 195

After "section 194", insert "or 194A".

13I Subsections 196(1) and (3)

After "section 194", insert "or 194A".

13J At the end of subsection 221(2)

Add:

; or (i) a notice under subsection 194A(2).

Question negatived.

I will now deal with the amendments circulated by Senator David Pocock on sheets 3205, 3206 and 3207.

Matthew Canavan (Queensland, Liberal National Party) | Link to this | Hansard source

I ask that the question be put separately on sheet 3205.

Andrew McLachlan (SA, Deputy-President) | Link to this | Hansard source

I will be putting two questions, then. The first will be on sheet 3205, and then there will be a second question in relation to sheets 3206 and 3207. The question before the committee is that the Senator David Pocock amendments on sheet 3205 be agreed to.

Senator David Pocock's circulated amendments—

(1) Schedule 1, item 7, page 7 (line 27), omit "applies; or", substitute "applies".

(2) Schedule 1, item 7, page 7 (lines 28 and 29), omit subparagraph (b)(iii).

(3) Schedule 1, item 7, page 8 (lines 3 to 11), omit subsection (2).

Andrew McLachlan (SA, Deputy-President) | Link to this | Hansard source

I will now put the second question on Senator David Pocock's amendments. The question is that Senator David Pocock's amendments on sheets 3206 and 3207 be agreed to.

Senator David Pocock's circulated amendments—

SHEET 3206

(1) Schedule 1, item 7, page 4 (after line 21), after the paragraph beginning "Providers of" in section 63A, insert:

(2) Schedule 1, item 7, page 6 (after line 29), after section 63D, insert:

63DA Civil penalty for failing to take reasonable steps to remove or suspend inauthentic and bot accounts

A provider of an age-restricted social media platform must take reasonable steps to remove or suspend inauthentic accounts and bot accounts with the age-restricted social media platform.

Civil penalty: 30,000 penalty units.

(3) Schedule 1, item 7, page 7 (line 2), omit "Section 63D takes", substitute "Sections 63D and 63DA take".

(4) Schedule 1, item 7, page 7 (lines 8 to 13), omit subsection (4), substitute:

(4) To avoid doubt, the obligations in sections 63D and 63DA apply in relation to accounts with an age-restricted social media platform if the accounts exist on or after the day sections 63D and 63DA take effect (including accounts that began to exist before that day, and accounts that began to exist before the day this section commences).

(5) Schedule 1, item 7, page 9 (line 9), after "section 63D", insert "or 63DA".

(6) Schedule 1, item 7, page 10 (after line 2), after paragraph 63J(a), insert:

(aa) has contravened section 63D (failing to take reasonable steps to prevent inauthentic or bot accounts); or

(7) Schedule 1, item 13, page 11 (after line 3), after paragraph (da), insert:

(daa) section 63DA;

(8) Schedule 1, item 16, page 11 (line 14), omit "section 63D takes", substitute "sections 63D and 63DA take".

_____

SHEET 3207

(1) Schedule 1, item 7, page 7 (after line 25), after subparagraph 63F(1)(b)(i), insert:

(ia) for the purpose of complying with a requirement specified in a legislative instrument made under subsection 63K(1); or

(2) Schedule 1, item 7, page 10 (after line 12), at the end of Part 4A, add:

Division 6 — Data access rules

63K Data access rules

(1) The Minister must, by legislative instrument, determine rules that require providers of an age-restricted social media platform to give access to data to approved researchers for the purposes of independent research in relation to the impact of age-restricted social media platforms on young people with reference to any of the following areas of social harm:

(a) loneliness;

(b) isolation;

(c) mental health;

(d) eating disorders;

(e) suicide;

(f) body dysmorphia;

(g) extreme views;

(h) any other matter.

(2) Without limiting subsection (1), rules made for the purpose of that subsection may provide for the following:

(a) criteria to be satisfied before the Minister approves a researcher to be given access to data under those rules;

(b) means by which approved researchers are given access to data under the rules;

(c) requirements for the protection of personal and other information in data which approved researchers are given access to under the rules;

(d) any other relevant matters.

Question negatived.

I will now deal with the amendments circulated by Senator Canavan. We come to sheet 3181. The question is that item 6 of schedule 1 stand as printed.

Senator Canavan opposed item 6 of schedule 1 in the following terms—

(2) Schedule 1, item 6, page 4 (lines 9 to 12), to be opposed.

Andrew McLachlan (SA, Deputy-President) | Link to this | Hansard source

The question before the committee is that Senator Canavan's remaining amendments on sheet 3181 and the amendments on sheets 3180, 3183, 3195, 3215 and 3216 be agreed to.

Senator Canavan's circulated amendments—

SHEET 3180

(1) Schedule 1, item 7, page 6 (line 26), before "A provider", insert "(1)".

(2) Schedule 1, item 7, page 6 (after line 29), at the end of section 63D, add:

(2) For the purposes of subsection (1), the taking of reasonable steps to prevent age-restricted users having accounts with an age-restricted social media platform does not include creating, collecting or using the digital ID (within the meaning of the Digital ID Act 2024) of an individual for the purpose of determining whether or not the individual is an age-restricted user.

_____

SHEET 3181

(1) Schedule 1, item 5, page 4 (lines 5 to 8), omit paragraphs 27(1)(qa) and (qb), substitute:

(qa) to promote guidelines formulated under section 63EA.

(3) Schedule 1, item 7, page 7 (after line 13), at the end of Division 2, add:

63EA Ministerial guidelines on reasonable steps

The Minister must, by legislative instrument, formulate guidelines for the taking of reasonable steps to prevent age-restricted users having accounts with age-restricted social media platforms.

_____

SHEET 3183

(1) Schedule 1, item 7, page 6 (before line 18), before paragraph 63C(7)(a), insert:

(aa) the Minister must be satisfied that the legislative rules would not have the effect, or be likely to have the effect, of substantially lessening competition in the market for that kind of electronic service; and

_____

SHEET 3195

(1) Schedule 1, item 7, page 5 (line 1) to page 6 (line 22), omit section 63C, substitute:

63C Age-restricted social media platform

(1) For the purposes of this Act, age-restricted social media platform means an electronic service that satisfies the following conditions:

(a) the service allows end-users to upload content or view the content or activity of other end-users;

(b) at least 10% of daily active end-users of the service who are under the age of 16 spend an average of at least two hours per day using the service;

(c) the service employs algorithms that analyse end-user data or information to select content for end-users;

(d) the service has any of the following addictive features:

(i) infinite scrolling;

(ii) push notifications or alerts intended to inform an end-user about specific activities or events related to the user's account or activity on the service;

(iii) interactive metrics intended to inform an end-user about the number of times other end-users have reacted to content or have shared or reposted content.

Note: An age-restricted social media platform may be, but is not necessarily, a social media service under section 13.

(2) An electronic service is not an age-restricted social media platform if none of the material on the service is accessible to, or delivered to, one or more end-users in Australia.

(3) In this section:

infinite scrolling means either:

(a) continuously loading content or content that loads as the user scrolls down the page without the need to open a separate page; or

(b) seamless content or the use of pages with no visible or apparent end or page breaks.

(2) Schedule 1, item 7, page 9 (lines 10 to 15), omit subsection 63G(2), substitute:

(2) This section also applies to a person if the Commissioner believes on reasonable grounds that the person is a provider of an electronic service.

_____

SHEET 3215

(1) Schedule 1, item 7, page 7 (line 27), omit "applies; or", substitute "applies;".

(2) Schedule 1, item 7, page 7 (lines 28 to 29), omit subparagraph 63F(1)(b)(iii).

(3) Schedule 1, item 7, page 8 (lines 3 to 11), omit subsection 63F(2).

(4) Schedule 1, item 7, page 8 (line 17), omit "the purposes for which it was collected", substitute "the purpose of taking reasonable steps to prevent age-restricted users having accounts with the platform".

_____

SHEET 3216

(1) Schedule 1, item 2, page 3 (lines 14 to 15), omit the definition of age-restricted user in section 5, substitute:

age-restricted user has the meaning given by section 63CA.

(2) Schedule 1, item 7, page 6 (after line 22), at the end of Division 1, add:

63CA Age-restricted user

(1) For the purposes of this Act, age-restricted user means an Australian child who has not reached 16 years.

(2) Despite subsection (1), an individual is not an age-restricted user if:

(a) a parent or guardian of the individual consents to the individual not being an age-restricted user; and

(b) the individual meets the criteria (if any) specified in the legislative rules.

(3) Without limiting paragraph (2)(b), the criteria specified under that paragraph may relate to:

(a) the age of the individual; and

(b) whether the individual has a disability or other special needs.