Most Australians assume their private messages are private unless police suspect them of a crime and obtain proper authority to investigate.
That assumption is becoming less secure.
Over the past eight years, Australia has built a legal system that gives authorities and regulators much greater reach into digital communications. It did not arrive in one sweeping law. It came in stages, each justified by a cause few people would oppose, such as stopping terrorism or protecting children.
The concern is not the stated goal. It is the machinery being created in pursuit of it, how broadly that machinery can operate and what it may be used for later.
Here are ten things Australians should know.
1. There is no single surveillance law
Australia’s current system has been assembled through several legal regimes.
One allows police and intelligence agencies to compel help from technology companies when seeking access to encrypted communications.
Another imposes obligations on messaging, email, cloud storage and other online services to assess risks and, in some cases, proactively detect illegal material.
A third proposal, called the Digital Duty of Care, would require online services to prevent broadly defined harms before they occur.
Discussed separately, each measure can sound limited. Taken together, they form a system capable of pressuring companies to provide access, inspect content, manage speech and redesign their services.
2. The first major step came in 2018
In December 2018, Parliament passed the Telecommunications and Other Legislation Amendment (Assistance and Access) Act, usually called TOLA.
The law created several ways for authorities to seek help from technology companies. Some requests are voluntary. Others are compulsory.
A company can be required to use a capability it already has or, in some circumstances, build a new one.
The law says companies cannot be forced to create a “systemic weakness” in an entire class of technology. Governments point to that wording as a safeguard.
Critics argue it is vague and still allows targeted capabilities against particular users. Official reviews recommended stronger independent oversight, but the core powers remained.
3. The rules reach far beyond social media
Most people hear “online safety” and think of Facebook, TikTok or offensive public posts.
The current standards cover much more.
They apply to messaging services, email, online dating, gaming platforms with chat functions, websites, apps and cloud storage.
That includes places where Australians keep family photos, medical information, tax records, work files and private correspondence.
These are personal spaces, not public noticeboards.
4. Encryption may not prevent scanning
End-to-end encryption is designed so only the sender and recipient can read a message. Even the company providing the service should not be able to see it.
That creates a problem when regulators expect providers to proactively detect content.
If a message cannot be scanned after encryption, it may need to be checked before encryption. One possible method is client-side scanning, where material is analysed on a person’s device before being sent.
Digital rights groups and security researchers warn that this could weaken encryption, create security risks and produce false matches. It would also establish a scanning function that could later be expanded to other categories of content.
The eSafety Commissioner says the standards do not require companies to break encryption, but the regulator has discussed pre-encryption scanning as a possible method.
5. The broadest proposal is still to come
The Albanese Government plans to introduce a Digital Duty of Care.
The name sounds reasonable. The practical effect may be much broader.
Online services would be expected to prevent harm before it happens. Faced with large penalties, companies would have a strong incentive to monitor more content and remove anything that might attract regulatory trouble.
That could affect major platforms, smaller forums, niche apps and encrypted services.
Draft legislation is expected later in 2026. The exact wording will matter enormously.
6. Parliament does not write many of the most important rules
Politicians pass the broad laws. Much of the detail comes later through standards, codes and delegated legislation written by regulators or ministers.
That is how the current scanning standards were made.
Industry groups drafted codes for messaging and storage services. The eSafety Commissioner rejected them because they did not include the proactive detection obligations she wanted. Stronger standards were then written and registered.
Neither house of Parliament cast a separate affirmative vote approving them.
Parliament could have disallowed the standards. It did not, so they became binding.
The broad principle was passed in public. The operational rules came later.
7. Australia is following Britain and Europe
Britain has already introduced sweeping online safety laws. The European Union has spent years debating measures commonly known as “Chat Control”, including proposals to scan private communications.
Australian ministers openly refer to British and European laws when promoting local reforms.
That is presented as reassurance, but it also creates a self-reinforcing cycle. One government adopts a system, another copies it, and both point to each other as proof the idea is normal.
The real question is whether the laws work without weakening privacy and free speech. That receives far less attention.
8. The reasons given make opposition difficult
These laws target child sexual abuse material and terrorist content.
Nobody defends either.
That is why such crimes provide powerful political cover for new surveillance measures. Anyone questioning the method can be accused of ignoring victims or helping offenders.
But the seriousness of a crime does not settle what powers government should have.
Police have always investigated horrific offences. In a free society, they identify suspects, seek warrants and target those involved.
We would not accept the government opening every letter sent through Australia Post because one envelope might contain evidence of a crime. Scanning everyone’s digital communications applies a very different principle.
9. The greatest risk comes later
Governments usually introduce surveillance powers for serious offences.
The problem is what happens after the system exists.
Once the laws, technology, staff and enforcement processes are in place, expanding them becomes much easier. A scanner designed to find one kind of material can be adjusted to search for another. Powers created for terrorism can be extended to other offences.
Regulators may also move from clearly illegal material into disputed information, lawful speech or opinions judged to be harmful.
The ministers making promises today will eventually leave office. The machinery will remain.
10. Much of the system is already operating
This is not merely a future possibility.
The 2018 anti-encryption law remains in force. Online safety standards covering messaging, email and cloud storage took effect in December 2024. Providers have already been required to assess the risks presented by their services.
The proposed Digital Duty of Care would push the system further by making preventive monitoring and content control a broader feature of operating online in Australia.
Nobody is claiming a public servant is personally reading every Australian’s messages.
The concern is that the legal and technical machinery for large-scale scanning, monitoring and suppression is being put in place, often with little public understanding.
Australians deserve to know what is being built around them.
Private correspondence should remain private. Encryption protects ordinary people from criminals, identity thieves, hostile governments and anyone else trying to get into their lives.
Once privacy depends on whether government considers it convenient, it is no longer much of a right.
Thought for the Day
“Do we want to live in a society where we live totally naked in front of government, and they are totally opaque to us.” – Edward Snowden
I’m a journalist, former politician, Christian, and campaign director for CitizenGO Australia. My mission is to challenge the media lies, government overreach, and corporate censorship that threaten our freedoms.
