Key takeaways

• The Phase 1 Codes and Standards, registered in 2023 and 2024, addressed the most serious and illegal categories of online content, such as child sexual abuse and pro-terror material, as well as certain categories of crime and violence material and drug-related material.
• The newly registered Phase 2 Codes focus on material identified as unsuitable for Australian users under the age of 18, including pornography, high-impact violence material and violence instruction material, content promoting or instructing in suicide, self-harm and/or eating disorders as well as other 18+ content such as simulated gambling material.
• The Phase 2 Codes will take effect six months after the date of registration – on 27 December 2025 (for the Phase 2 Codes for internet search engine services, hosting services, and internet carriage services) and 9 March 2026 (for all other Phase 2 Codes). Significant civil penalties apply.
• The Phase 2 Codes intersect with the requirements set out in the Online Safety Amendment (Social Media Minimum Age) Act 2024 (Cth) (SMMA) by mandating the application of appropriate age assurance measures for certain content and services.
• Both the SMMA and relevant Phase 2 age assurance requirements (in particular, under the Phase 2 Code for internet search engine services) are currently the subject of a Senate Committee inquiry by the Environment and Communications References Committee. The Senate Committee is required to report by 14 November 2025.     

In depth

Background to the Phase 2 Codes

The OSA empowers the eSafety Commissioner to issue written notices to industry associations requesting the development of enforceable codes under the Online Content Scheme for class 1 and class 2 material (largely, RC, X18+ and R18+ material under the National Classification Scheme). These notices may specify one or more matters relating to the online activities of industry participants that should be dealt with in the relevant code. If the eSafety Commissioner is satisfied that applicable statutory requirements are met (including that the code provides appropriate community safeguards) the Commissioner may register a code. If not, or in some other circumstances such as where relevant timeframes for code development are not met, the eSafety Commissioner has the power to impose mandatory standards instead.

Registered in 2023 and 2024 and now fully enforceable, the Phase 1 Codes and Standards regulate class 1A material (child sexual abuse material, pro-terror material, and extreme crime or violence material) and class 1B material (crime, violence, and drug-related material), covering the most seriously harmful categories of online material.

In 2024, the eSafety Commissioner issued notices requesting the development of the Phase 2 Codes to address class 1C and class 2 material as well as a Position Paper setting out eSafety’s expectations for the development of the Phase 2 Codes.

The Phase 2 Codes for hosting services, internet carriage services and internet search engine services were registered on 27 June 2025 and will take effect on 27 December 2025.

The remaining Phase 2 Codes were registered on 9 September and will take effect on 9 March 2026. This includes Phase 2 Codes for equipment providers, app distribution services, DIS, RES and social media services. There are two Phase 2 Codes for social media services – one that applies to core features of such services, and one that applies to messaging features.

Phase 2 Codes at a glance

The Phase 2 Codes apply to adult content, including various forms of online pornography (across both class 1C and class 2), as well as other class 2 material that is unsuitable for children, such as simulated gambling material, high-impact violence material and violence instruction material, and material promoting or instructing in self-harm, suicide or eating disorders.

Whilst the exact obligations differ significantly across the Phase 2 Codes, and between service/device category within each Code, some notable obligations include requirements for:

• The conduct of risk assessments for some services, with an increase in requirements to assess risk in relation to different categories of material (and in some cases, individual features within a service)
• In the case of certain categories of service only, the implementation of appropriate age assurance measures and, in some cases, access controls
• AI companion chatbots and AI companion chatbot features within other services
• End-user terms and conditions, including enforcement of relevant provisions
• Parental controls and default safety settings
• User reporting and complaints mechanisms
• Tools, features and/or settings for users to control exposure to harmful content, including ongoing improvement obligations
• Information provision to end-users
• Staff training
• Trust and safety functions
• community/academic consultation
• Managing service changes – including requirements to assess and apply measures to address significant risk increases, and requirements to notify eSafety of service changes in some instances
• Transparency and accountability through compliance reporting to eSafety

Interaction with Social Media Minimum Age Laws

The Online Safety Amendment (Social Media Minimum Age) Act 2024 (SMMA), which takes effect on 10 December 2025, mandates that “age restricted social media platforms” take “reasonable steps” to prevent users under 16 years of age from having accounts.

These obligations under the SMMA intersect with the Phase 2 Codes, particularly in relation to age assurance and access control measures.

Providers should note:

• Age assurance requirements are no longer limited to the SMMA.  Additional categories of service will now be required to adopt appropriate age assurance measures under the Phase 2 Codes. In some instances those measures are required to underpin default protections for identified child users, and in other instances providers are required to implement access controls to prevent access to the service or relevant features/content on the service by users identified as under the age of 18.
• The Head Terms to the Phase 2 Codes define what will constitute “appropriate age assurance measures” for Phase 2 Code purposes. Age assurance is defined as an umbrella term for methods used to assess a user's age, including age verification and age estimation solutions. Providers should take account of various factors in determining appropriate age assurance measures, including the technical accuracy and reliability of the measure, whether the measure has been designed to comply with Australian Privacy Laws, whether the impact on user privacy is proportionate and the interaction between the measures and other applicable Australian laws which may require age assurance (such as the SMMA). Some examples of appropriate age assurance measures in the Head Terms include facial age estimation, credit card checks and photo identification matching. Contractual restrictions on child end-users and self-declaration by the relevant user are not considered appropriate in isolation.
• eSafety released regulatory guidance on the SMMA laws on 16 September 2025, setting out guidance on what constitutes “reasonable steps” for the purposes of the SMMA obligations. The guidance does not mandate any particular methods, but provides guidance and examples to assist providers to make a determination of what will constitute “reasonable steps” in their circumstances as well as providing guidance on what eSafety considers will not constitute reasonable steps.
• Both the SMMA and relevant Phase 2 age assurance requirements (in particular, under the Phase 2 Code for internet search engine services) are currently the subject of a Senate Committee inquiry by the Environment and Communications References Committee.     

Key dates

Providers should be aware of the upcoming dates in the roll out of the Phase 2 Codes:

• 14 November 2025 – Senate Committee inquiry by the Environment and Communications References Committee is required to report 
• 10 December 2025 – Commencement of the SMMA Laws
• Late 2025 – Early 2026 – Industry guidance on the Phase 2 Codes anticipated to be released by eSafety
• 27 December 2025 – The Phase 2 Codes applying to internet search engine services, hosting services, and internet carriage services become enforceable. Some provisions have longer transition periods.
• 9 March 2026 – The Phase 2 Codes applying to social media services, RES, DIS, app distribution services and equipment providers become enforceable, with some provisions having longer transition periods.

Next steps

The registration of the Phase 2 Codes marks a significant step in the roll-out of Australia’s online safety regime.

With the key dates above in mind, we recommend affected providers:

• Review the Phase 2 Codes
• Determine how their products and services are categorised under the Phase 2 Codes noting there are new service categories that were not part of the Phase 1 Codes and Standards
• Conduct and document risk assessments as required by the new Phase 2 Codes, noting that the risk assessment requirements for Phase 2 differ from, and are in addition to, Phase 1 risk assessment requirements
• Begin developing and documenting compliance measures accordingly
• Prepare for enforcement in 2026, ensuring systems, processes and documentation are in place

* * * * *

With thanks to Nina Kerwin Roman (General Associate) for her assistance with this alert.