Federal Court of Australia

eSafety Commissioner v X Corp (Civil Penalty) [2026] FCA 629

ORDERS

The Court Declares that:

1.    The respondent contravened s 57 of the Online Safety Act 2021 (Cth) between 29 March 2023 and 5 May 2023 by providing a report in response to a non-periodic reporting notice issued on 22 February 2023 by the eSafety Commissioner to Twitter, Inc under s 56 that was not prepared in the manner and form specified in the notice, in that the respondent:

(a)    did not respond to the following questions in the notice in circumstances where it was capable of doing so by the deadline of 29 March 2023: 14(b), 14(e), 19(a), 26, 26(a); and

(b)    did not respond to the following questions in the notice to the extent it was capable of doing so by the deadline of 29 March 2023: 1(b), 1(c), 3(b), 4(b), 6(c), 7(a)–(f), 10, 16(a), 17(b), 22(a)–(i), 25 and 27.

THE COURT ORDERS THAT:

2.    Within 45 days of the making of this order, the respondent pay to the Commonwealth of Australia, a pecuniary penalty in the sum of $650,000 pursuant to s 162 of the Online Safety Act 2021 (Cth) and s 82 of the Regulatory Powers (Standard Provisions) Act 2014 (Cth).

3.    Within 45 days of the making of this order, the respondent pay a contribution to the applicant’s costs of the following proceedings:

(a)    eSafety Commissioner v X Corp (VID 1092 of 2023);

(b)    X Corp v eSafety Commissioner (VID 956 of 2023); and

(c)    X Corp v eSafety Commissioner (VID 1186 of 2024).

in the agreed lump sum of $100,000.

4.    Pursuant to r 2.23(3)(a) of the Federal Court Rules 2011 (Cth), Annexures C and D to the statement of agreed facts and admissions filed on 1 May 2026 are ordered to be confidential with the consequence that until further order no person who is not a party be entitled to inspect those annexures on the Court file.

5.    For the avoidance of doubt order 4 does not preclude any of the following persons from accessing the documents referred to in that order:

(a)    Judges of this Court;

(b)    necessary Court staff (including transcription service providers);

(c)    the parties to these proceedings;

(d)    legal representatives of the parties instructed in these proceedings; and

(e)    judicial officers and necessary staff of any court hearing an appeal from any decision made in the course of this proceeding.

6.    For the further avoidance of doubt, order 4 does not prevent disclosure of the information referred to in the annexures by a Commonwealth officer acting in the course of his or her duties.

Note:    Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

REASONS FOR JUDGMENT

WHEELAHAN J:

1    The applicant, the eSafety Commissioner, is responsible for the administration and enforcement of the Online Safety Act 2021 (Cth). The respondent, X Corp, is the operator of the social media service X, formerly known as Twitter.

2    This civil penalty proceeding arises out of a report that the respondent submitted to the Commissioner in response to a notice given to Twitter, Inc under s 56(2) of the Act. The liability of the respondent to comply with the notice resulted from the merger of Twitter, Inc into X Corp, which was the subject of the decision of the Full Court in X Corp v eSafety Commissioner [2025] FCAFC 99; 311 FCR 205.

3    The respondent admits that its response to the Commissioner’s notice was not prepared in the manner and form required by the notice and that it thereby contravened s 57 of the Act which is a civil penalty provision.

Background

4    Division 2 of Part 4 of the Online Safety Act creates a framework for imposing minimum safety standards on social media and other internet service providers. Subsection 45(1) of the Act empowers the Minister to set basic online safety expectations that give effect to the core expectations by legislative instrument. Subsection 46(1) sets out the core expectations of service providers that a determination under s 45 must specify. Broadly, the core expectations are that service providers will take reasonable steps to ensure safe use of their platforms, co-operate with the Commissioner, minimise and limit access to certain material, and maintain a complaints mechanism. The Online Safety (Basic Online Safety Expectations) Determination 2022 set the basic online safety expectations during the relevant period.

5    Division 3 of Part 4 of the Act creates a mechanism by which service providers can be required to provide the Commissioner with reports about their compliance with the minimum standards imposed under Division 2. Subsection 56(2) grants the Commissioner power to give a written notice to a service provider requesting that it prepare a report about the extent to which it complied with the basic online safety expectations in the manner and form specified in the notice. Section 57 is a civil penalty provision, which requires service providers to comply with a notice under s 56(2) to the extent that they are capable of doing so.

6    On 22 February 2023, the Commissioner issued a notice requiring Twitter, Inc to prepare by 29 March 2023 a report on its compliance with certain basic online safety expectations regarding child sexual exploitation and abuse material and activity during the period from 24 January 2022 to 31 January 2023. Schedule B to the notice prescribed the manner and form of the required report, which consisted of a list of 31 questions. For each question, there was typically one sub-question requiring an affirmative or negative response or a numerical figure followed by sub-questions requiring further explanation.

7    On 15 March 2023, Twitter, Inc merged into the respondent, X Corp.

8    On 29 March 2023, the respondent provided a report in response to the Commissioner’s notice.

9    On 6 April 2023, the Commissioner wrote to the respondent identifying deficiencies in the report, including instances where no response was provided to a question or where the response failed to provide certain details required by the question.

10    On 5 May 2023, the respondent provided a supplementary response addressing the deficiencies raised in the Commissioner’s letter.

11    The respondent admits that it contravened section 57 of the Act by failing to prepare a report in the manner and form specified in the notice to the extent it was capable of doing so by 29 March 2023. Specifically, the respondent admits that it –

(a)    did not respond at all to questions 14(b), 14(e), 19(a), 26 and 26(a) notwithstanding that it was capable of doing so; and

(b)    did not respond to the extent that it was capable of doing so to questions 1(b), 1(c), 3(b), 4(b), 6(c), 7(a)-(f), 10, 16(a), 17(b), 22(a)-(i), 25 and 27.

12    The parties agree that the respondent’s contravention ended on 5 May 2023 when it provided its response to the deficiencies identified in the Commissioner’s follow up letter.

13    The respondent’s admissions of contravention are contained in a statement of agreed facts and admissions which was received into evidence. A copy of the statement of agreed facts and admissions, with the redaction of two confidential annexures, is attached to these reasons at Schedule A.

The remedies sought by the Commissioner in this proceeding

14    The remedies sought by the Commissioner against the respondent are a declaration of contravention, a pecuniary penalty of $650,000, and an order that the respondent pay an agreed contribution of $100,000 towards the Commissioner’s costs in this and the related proceedings in which the respondent unsuccessfully challenged its liability to comply with the notice that was given to Twitter, Inc.

General considerations

15    The declaration, penalty, and costs order are sought in the exercise of judicial power, and they are sought by consent. Although the relief is sought by consent the Court must still be persuaded that what is proposed is appropriate: Commonwealth v Director, Fair Work Building Industry Inspectorate [2015] HCA 46; 258 CLR 482 (Agreed Penalties Case) at [57] to [58] (French CJ, Kiefel, Bell, Nettle and Gordon JJ).

16    Because this is an adversarial proceeding of a civil nature there is considerable scope for the parties to agree on facts and consequences, including upon the remedies provided that they are appropriate: Agreed Penalties Case at [57]. The question whether remedies are appropriate acknowledges that there might be a range of appropriate remedies.

17    There is a public interest in the settlement of the controversy between the Commissioner and the respondent in relation to the respondent’s contraventions of s 57 of the Act. In this respect, being a civil proceeding, it is consistent with the nature of civil proceedings for a court to make orders by consent and to approve a compromise of proceedings on terms proposed by the parties, provided the Court is persuaded that what is proposed is appropriate: Agreed Penalties Case at [57].

18    The parties’ agreement as to liability and relief has facilitated the resolution of this dispute and thereby saved time and resources of the applicant and the Court: Agreed Penalties at [38]. The respondent’s compliance with s 57 was capable of being an evaluative issue that might have been the subject of extensive argument. That arises from the qualification in s 57 that a person must comply with a notice under subsection 56(2) “to the extent that the person is capable of doing so”. The time and resources saved by the parties reaching agreement in relation to the fact of contravention favours giving effect to the proposed settlement.

19    It is also important that the Court take into consideration the effect on other cases when considering whether to give effect to an agreement to compromise in a civil penalty proceeding. Other parties in other instances might be more willing to acknowledge contraventions and agree to submissions on penalty if there is a degree of predictability of outcome and some level of assurance that the Court will give effect to compromises where it is appropriate to do so: Agreed Penalties Case at [46].

The declaration is appropriate

20    In relation to the appropriateness of the declaration that is sought, in Forster v Jododex Australia Pty Ltd [1972] HCA 61; 127 CLR 421 at 437 to 438, Gibbs J cited the speech of Lord Dunedin in Russian Commercial and Industrial Bank v British Bank for Foreign Trade Ltd [1921] 2 AC 438 at 448 who summarised the principles applied by Scottish courts to the action of declarator and identified the following requirements –

The question must be a real and not a theoretical question; the person raising it must have a real interest to raise it; he must be able to secure a proper contradictor, that is to say, some one presently existing who has a true interest to oppose the declaration sought.

21    It is in the public interest for the Commissioner, as the regulator, to seek a declaration and for a declaration to be made. The objects of the Online Safety Act are to improve and promote the safety of Australians online: s 3. In furtherance of those objects, the basic online safety expectations are directed to minimising the prevalence of abusive, violent or otherwise sensitive material. The reporting requirements under the Act are an essential aspect of enforcing those expectations. Accordingly, where the operator of a large social media platform has failed to comply with those reporting requirements, the public has an interest in the Commissioner seeking and obtaining a public declaration of contravention, which will contribute to a deterrent effect.

22    I am satisfied that the statement of agreed facts and admissions provides a sufficient factual foundation for making the declaration. I am satisfied that the terms of the proposed declaration relate to conduct that contravened the Online Safety Act and that the matters in issue have been identified with sufficient precision: Australian Competition and Consumer Commission v MSY Technology Pty Ltd [2012] FCAFC 56; 201 FCR 378 at [35] (Greenwood, Logan and Yates JJ).

The penalty is appropriate

23    In deciding whether to order an agreed penalty, the Court is not bound by the parties’ proposal and must satisfy itself that the penalty is appropriate: Agreed Penalties Case at [48]. If the Court is persuaded that the agreed proposed penalty is appropriate in all the circumstances, it is desirable for the Court to accept the parties’ proposal, owing to the importance of promoting the predictability of outcome in civil penalty proceedings: Agreed Penalties Case at [46], [58]. Rather than there being a single appropriate penalty, there is a permissible range of penalties in which “a particular figure cannot necessarily be said to be more appropriate than another”: Agreed Penalties Case at [47].

24    Under s 162 of the Online Safety Act a civil penalty provision in the Act is enforceable under Part 4 of the Regulatory Powers (Standard Provisions) Act 2014 (Cth) (the Regulatory Powers Act). As with other civil penalty regimes the principal if not the sole purpose of imposing a penalty in this instance is the promotion of the public interest in compliance with the Online Safety Act by general and specific deterrence of further contraventions: Australian Building and Construction Commissioner v Pattinson [2022] HCA 13; 274 CLR 450 (Pattinson) at [9] (Kiefel CJ, Gageler, Keane, Gordon, Steward and Gleeson JJ). In assessing whether a penalty is appropriate the Court must also consider the matters mandated by s 82(6) of the Regulatory Powers Act, namely –

(a)    the nature and extent of the contravention;

(b)    the nature and extent of any loss or damage suffered because of the contravention;

(c)    the circumstances in which the contravention took place; and

(d)    whether the person has previously been found by a court (including a court in a foreign country) to have engaged in any similar conduct.

25    The above matters inform the significance that should be attributed to the need for specific deterrence in this case. The parties jointly submitted that the Court should take into account the relatively short period of time over which the contravention occurred, the fact that the notice was the first non-periodic reporting notice issued to Twitter, Inc pursuant to the Act, and the significant time and resources required to respond to the notice having regard to the sensitive information requested and the manner in which the respondent’s data were stored. Those matters provide some explanation as to why the breach occurred and suggest that the likelihood of further breaches is lower than it would otherwise be. Accordingly, I accept that they reduce the need for specific deterrence in this case.

26    While it is necessary to have regard to the maximum penalty, the maximum penalty is not to be reserved for the worst category of contravening conduct: Pattinson at [49] to [50]. The parties agreed and I accept that the maximum penalty for the respondent’s contravention of s 57 of the Act was $687,500. The agreed penalty is near to the maximum penalty but reduced to some extent to account for the mitigating factors described above. I accept that the penalty proposed is appropriate. A penalty near the maximum is appropriate in the case of the respondent, which is a substantial corporation so that it operates as a real deterrent and is not simply a cost of doing business.

27    I also accept that it is appropriate that the parties have compromised the question of costs on a global basis, thereby saving the resources of the parties and the Court.

Access to confidential information

28    The respondent made an interlocutory application for an order pursuant to r 2.32(3)(a) of the Federal Court Rules 2011 (Cth) that Annexures C and D to the statement of agreed facts and admissions be the subject of a confidentiality order with the consequence that inspection is restricted. The application was supported by an affidavit of the respondent’s solicitor, Justin Healy Quill sworn 18 May 2026. The Commissioner did not oppose the application.

29    Under r 2.23(2A) a person who is not a party to a proceeding may inspect a statement of agreed facts. However, under r.2.23(3) a person is not entitled to inspect a document that the Court has ordered be confidential or restricted from publication. The note to r 2.32(3) refers to the powers of the Court to prohibit the publication of evidence in s 37AF of the Federal Court of Australia Act 1976 (Cth).

30    I am satisfied having regard to the nature of the information that the respondent wishes to have treated as confidential that the order is necessary to prevent prejudice to the proper administration of justice, and the Commissioner did not submit otherwise. Annexures C and D comprise the respondent’s responses to the Commissioner’s notice. They contain detailed confidential information about the systems used by the respondent to detect and prevent the transmission of child sexual exploitation and abuse material on the X platform and were provided on a confidential basis under threat of penalty. Permitting inspection of this information might risk enabling actors to understand and therefore circumvent these systems. That would be contrary to the purpose of the Online Safety Act, which is to protect Australians online: s 3. The proper administration of justice would be prejudiced if the Court did not preclude the inspection of material which would undermine the purpose of the Act being enforced in these proceedings. It is therefore necessary to make the order.

Associate:

Dated:    21 May 2026

SCHEDULE A