How to assess which Online Safety Codes and Standards apply to your service
The Online Safety Codes and Standards for unlawful and age-restricted material apply to eight sections of the online industry.
As the independent regulator responsible for implementing and enforcing the Online Safety Act 2021 (Cth) (‘the Act’), eSafety is responsible for monitoring and enforcing compliance with the Online Safety Codes and Standards.
On this page:
About the Online Safety Codes and Standards
The Online Safety Codes and Standards are separated into two categories:
- The Unlawful Material Codes and Standards require providers to take proactive steps to reduce the availability of seriously harmful online content, such as child sexual exploitation and pro-terror material.
- The Age-Restricted Material Codes require providers to protect and prevent children in Australia from accessing or being exposed to age-restricted material such as online pornography, high-impact violence material and self-harm material.
The Online Safety Codes and Standards apply to eight different sections of the online industry, with many different types of services being required to comply with obligations under both the Unlawful Material Codes and Standards and the Age-Restricted Material Codes.
What services can do
eSafety has developed this assessment tool so that service providers can consider which Online Safety Codes or Standards apply to them in respect of unlawful and age-restricted material.
eSafety recommends that services:
- (a) complete this initial assessment as soon as possible, and ensure they are in compliance with their obligations under the Online Safety Codes and Standards.
- (b) routinely assess, including when introducing a new feature or function or observing changes in the ways new and existing account holders are using their service.1
eSafety has also published updated regulatory guidance to help service providers understand their obligations. In addition to reviewing this guidance, service providers should also familiarise themselves with other schemes, like the Social Media Minimum Age, under the Act.2
1 Some services may also have compulsory risk-assessment obligations under the Codes and Standards.
2 Providers should note that their services may meet different definitions under the Act for purposes of different schemes.
eSafety cannot provide legal advice to individual services about their compliance requirements, including which code or standard they will have to comply with. While this tool is intended to provide an indication about potential compliance obligations, eSafety encourages service providers to seek independent legal advice if necessary.
Step 1
Do you provide an ‘electronic service’ or manufacture, supply, maintain or install equipment for use in connection with electronic services?
- An electronic service means a service that allows end-users to access material using a carriage service or a service that delivers material to end-users using a carriage service.
- It does not include broadcasting services or datacasting services.
- ‘Material’ includes content in the form of text, data, speech, music or other sounds, visual images (moving or otherwise) or in any other form, or combination of forms.
If no, you are not covered by the Online Safety Codes and Standards.
If yes, proceed to Step 2.
Step 2
Do you offer more than one service?
Service providers may provide more than one separate electronic service. Service providers should have regard to the following non-exhaustive list of factors to assist in distinguishing one service that they provide from another:
- The presence or absence of a separate sign-up process, including terms and conditions, for each service.
- The method(s) by which end-users can access each service (for example, whether via the same website or application).
- The functionality of each service and the level of integration of the functionality between the services.
Similarly, some providers may provide electronic services while also being involved in manufacturing or supplying equipment for use in connection with such services.
- For each service or each piece of equipment you manufacture or supply, please complete Steps 3 to 5 to determine the applicable code or standard.
- If you provide more than one service, or are involved in both electronic services and equipment, please repeat and complete Steps 3 to 5 for each one to determine the applicable code or standard.
Step 3
Do you provide a service to end-users in Australia?
Is the service you provide accessible or delivered to end-users in Australia?
- If no, you are not covered by the Online Safety Codes and Standards.
- If yes, you are likely to be required to comply with the Unlawful Material Codes and Standards and the Age-Restricted Material Codes. Proceed to Step 4.
How to complete Steps 4 and 5
Predominant purpose
Electronic services may include different features and functionalities within the one service. As a result, some services fall under the scope of multiple definitions under the Online Safety Act.
No service provider needs to comply with more than one industry code for the same service for the relevant type of material.3 Relevant types of material are separated into two categories of codes and standards:
- Unlawful Material Codes and Standards
- Age-Restricted Material Codes
The code that will apply to that service is generally the code most closely aligned with the predominant purpose of that single electronic service), unless there is a standard that applies.
The predominant purpose is the prevailing purpose of the service.4 A ‘purpose’ can be understood as ‘the objective for which anything exists or is done, made, used’.
Providers should not take a restrictive approach to identifying the predominant purpose of a service. A provider should consider:
- the features and functions of the service
- how those features and functions are deployed
- how those features and functions influence user engagement, behaviours and experiences
- how end-users actually engage with the service5
- any other relevant information.
Providers must consider the actual use of the service by end-users, and not just its stated or purported use.
Standards prevail over codes
For the Unlawful Material Codes and Standards there are six codes in force, and two standards. Section 150 of the Online Safety Act states that industry standards prevail over inconsistent industry codes, and the Relevant Electronic Services Standard provides that it applies to the exclusion of any industry code.
Steps 4 and 5 take into account these determining factors and are why the next step will first ask if your service is a ‘relevant electronic service’. eSafety has also published FAQs about applying the correct Unlawful Material Standard or Code which provide more detail complementary to these steps.
3 The exception to this is a social media service which also includes a messaging feature. Further information can be found in Step 5b.
4 Macquarie Dictionary (2025).
5 Macquarie Dictionary (2025).
Step 4
Is your service a relevant electronic service?
A relevant electronic service is:
- a service which enables end-users to communicate with other end-users by means of email;
- an instant messaging service, SMS service, MMS service or chat service that enables end-users to communicate with other end-users; or
- a service that enables end-users to play online games with other end-users.
Does your service meet any of these definitions, regardless of whether these features (such as instant messaging) are your service’s predominant purpose?
- If yes, regardless of whether another code may also apply, you will need to comply with:
For age-restricted material, which code applies will depend on whether your predominant purpose is to provide a relevant electronic service. Proceed to Step 5 for more information.
Step 5
What is the predominant purpose of your service?
Read through all the descriptions and select the option that best defines predominant purpose of your service (remember, only one can be the predominant purpose).
Note: If you provide more than one service, please complete Steps 3 to 5 for each distinct service that you offer to determine the applicable code or standard.
Third-party hosting service
Third-party hosting services store third-party material6 provided on another social media service, relevant electronic service, or designated internet service, AND that material is hosted in Australia.
- If this is the predominant purpose of your service, you are likely to be required to comply with:
- If you have an additional service, repeat Steps 3 to 5.
6 If you host first-party material (for example, you provide an online service and host material for that purpose) then your service is likely captured by a different code and/or standard.
Search engine service
Search engine services that collect, organise and rank material on the world wide web, and return search results in response to searches of this material on your service.
- If this is the predominant purpose of your service, you are likely to be required to comply with:
- If you have an additional service, repeat Steps 3 to 5.
App distribution service
App distribution services allow end-users to purchase and/or download third-party apps.
- If this is the predominant purpose of your service, you are likely to be required to comply with the:
- If you have an additional service, repeat Steps 3 to 5.
Internet carriage service
Retail internet service providers which enable end-users access to the internet by providing the physical or virtual infrastructure for connection to the internet, and associated routing services.
- If this is the predominant purpose of your service, you are likely to be required to comply with:
- If you have an additional service, repeat Steps 3 to 5.
Equipment provider
An equipment provider can be any of the following:
- Manufacturers of equipment for end-users of online services
- Suppliers of equipment for end-users of online services
- Provide maintenance or installation services for equipment for end-users of online services
- Providers of operating systems for end-users of online services
If this is the predominant purpose of your service, you are likely to be required to comply with:
If you have an additional service, repeat Steps 3 to 5.
Relevant electronic service
A relevant electronic service is:
- a service which enables end-users to communicate with other end-users by means of email;
- an instant messaging service, SMS service, MMS service or chat service that enables end-users to communicate with other end-users; or
- a service that enables end-users to play online games with other end-users.
If this is the predominant purpose of your service, you are likely to be required to comply with:
As noted in Step 4, you are also required to comply with:
If you have an additional service, repeat Steps 3 to 5.
Designated internet service
A designated internet service is a service that:
- allows end-users to access material using an internet carriage service, OR
- that delivers material to a person that has equipment that can receive that material using an internet carriage service,
- BUT is not a social media service or a relevant electronic service.
If this is the predominant purpose of your service, you are likely to be required to comply with:
If you have an additional service, repeat Steps 3 to 5.
Social media services
Social media services have the sole or primary purpose to enable online social interaction7 between two or more end-users that allow them:
- to link to or interact with some or all of the other end-users, or
- to post material on the service.
Is this the predominant purpose of your service? If yes, proceed to Step 5b.
7 Online social interaction is a broad term that can be defined as an end-user’s engagement with other end-users or their material through an electronic service, whether active or passive, including by communicating, sharing material,5 participating in communities and/or expressing reactions.
Step 5b: (Only for social media services)
Does your service have a messaging feature?
If your messaging feature meets the definition of a relevant electronic service, as noted in Step 4, you are required to comply with:
For the purpose of complying with the Age-Restricted Material Codes only, when a social media service also includes a messaging feature, the Social Media (Core Features) Code and the Social Media Services (Messaging Features) Code will be considered as one code.
- If this is the predominant purpose of your service, you are likely to be required to comply with:
- If your service does not have a messaging feature, you will likely be required to comply with these codes:
- If you have an additional service, repeat Steps 3 to 5.
A social media service may be, but is not always, an age-restricted social media platform for the purpose of the Social Media Minimum Age.
More information
You can find more advice about the Online Safety Codes and Standards on our website:
Last updated: 01/04/2026