Court blocks Australia’s online safety regulator from double-regulating X

By Takeshi Mori · 2026-08-13

The structural problem eSafety could not argue past

The Federal Court of Australia handed down a decision on 13 August 2026 that exposed a structural flaw in the way eSafety had chosen to regulate X: the Online Safety Act simply does not permit it.^[1] Justice Elizabeth Raper held that the Act's definitions in sections 13 and 14 prevent a platform from being classified as both a social media service and a relevant electronic service at the same time, making dual regulation legally impossible.^[1]

The decision is narrow in one sense: it resolves a question of statutory interpretation, not a question about whether eSafety's underlying child-safety objectives are legitimate. Its practical reach is wide, though. The Commissioner cannot stack the Relevant Electronic Services Standard on top of the Social Media Services Online Safety Code and apply both to a single platform at once.

What X was fighting and why it went to court

X Corp filed its lawsuit in May 2025, targeting the Online Safety (Relevant Electronic Services, Class 1A and 1B Material) Industry Standard 2024. That instrument was registered on 21 June 2024 and came into effect on 22 December 2024, imposing obligations around illegal content removal, risk assessments and reporting on services classified as relevant electronic services.^[2] X's argument was direct: the platform is already captured as a social media service, and sections 13 and 14 do not allow a service to occupy both categories.

Justice Raper agreed. The Act's siloed framework, reinforced by section 150's rule that industry standards prevail over inconsistent codes, means the two regimes operate on separate tracks. A platform sits on one track. The Commissioner's attempt to run X on both was, the court found, beyond what the legislation permits.^[1]

The AU$650,000 penalty that ran in parallel

The classification ruling did not resolve every front in the legal battle. By consent in May 2026, the Federal Court ordered X Corp to pay a civil penalty of AU$650,000 for failing to fully comply with a non-periodic reporting notice under the Online Safety Act, relating to child sexual exploitation material.^[3] That penalty was agreed by the parties and sits entirely apart from the classification dispute.

The two proceedings together show what extended regulatory conflict looks like in practice: one front resolved in eSafety's favour, another resolved against it. The Commissioner has not yet said whether she will appeal the classification ruling.

The under-16 ban and the problem of overlapping categories

The timing matters beyond X's own situation. As of 10 December 2025, X is required to take reasonable steps to prevent Australians under 16 from holding accounts under the Social Media Minimum Age regime.^[4] That obligation flows from X's classification as a social media service, the same classification that now forecloses simultaneous treatment as a relevant electronic service.

The practical enforcement question is whether the ruling creates gaps. The Relevant Electronic Services Standard carried its own obligations around illegal content and age-gating. If eSafety cannot apply it to platforms already caught as social media services, the Commissioner's toolkit for those platforms is narrower than she had been operating as if it were. Other large platforms straddling messaging, social networking and content-hosting functions may face similar classification arguments from their own legal teams.

Civil liberties critics see a broader pattern

For civil liberties organisations, the classification dispute is one branch of a much larger concern about the regulatory architecture eSafety has been building. When the Commissioner was developing the draft standards from which the Relevant Electronic Services instrument emerged, the submissions she received were pointed.

Samantha Floreani, Head of Policy at Digital Rights Watch, said the proposals would damage the security infrastructure users depend on. "People rely on encrypted services to have robust privacy and security measures in place in order to uphold their rights and safety online. What is being proposed would undermine both, and in doing so be detrimental to individual and community online safety."^[5] Digital Rights Watch warned specifically that client-side scanning obligations embedded in the draft standards would compromise encryption and expose users to greater risk, not less.^[5]

John Pane, Chair of Electronic Frontiers Australia, described the direction of the standards regime in his organisation's submission as pointing toward a surveillance state. "Such an outcome would create a surveillance state which treats all on-line users as 'suspects first' and not citizens with inherent human and digital rights. Further, it would make a trusted, safe and secure online environment untrustworthy, unsafe and vulnerable to both bad actors and further regulatory overreach."^[6]

Neither Digital Rights Watch nor Electronic Frontiers Australia was party to the X litigation. Their criticism targets the regulatory design itself: mandatory scanning requirements, the absence of judicial oversight before removal notices are issued, and penalties that can reach AU$49.5 million for non-compliance with a standard, concentrating enforcement power in a single statutory office without a prior court order.

What the ruling actually changes

The immediate effect is that eSafety loses one enforcement lever against X specifically and, by implication, against any social media service it had been treating as simultaneously subject to the Relevant Electronic Services Standard. The classification ruling does not touch transparency notices, removal orders or civil penalty proceedings brought on other grounds, as the AU$650,000 consent order confirms.^[3]

Justice Raper's reading of sections 13 and 14 holds the Commissioner to the Act's distinct regulatory tracks. Whether Parliament will respond by amending the definitions to allow concurrent classification is now the live policy question the ruling has opened.

For platform operators watching from outside the case, the ruling is a reminder that the Act's category definitions are not merely administrative labels. They determine which obligations apply, which codes and standards govern, and what the regulator can and cannot do next, and contesting that classification when it is wrong turns out to matter a great deal.

Takeshi Mori

Takeshi Mori writes about technology and start-ups. He is curious about how products get built and who they are really for, and he would rather see a thing working than hear it described.