Online Safety (Restricted Access Systems) Declaration 2022

The Declaration depends on a small set of tightly defined concepts drawn from the instrument itself and the referenced Act. The primary operative concepts are:

• Access-control system: the mechanism or system that gates access to material. The Declaration specifies the functional and processual features such a system must have to be treated as a restricted access system for relevant class 2 material (s 5). The Declaration does not itself define “access-control system” but notes the Act contains that and other definitions (s 4, note).

• Restricted access system: a type of access-control system that meets the specification in s 5. Being “specified as a restricted access system” for relevant class 2 material is conditional on satisfying the cumulative requirements in s 5(a)-(d).

• Relevant class 2 material: the class 2 material that is covered by paragraphs 107(1)(f)-(l) of the Online Safety Act 2021 (s 4). The Declaration does not restate those paragraphs; it instead delegates the content classification to the Act.

• Applicant: a person who makes a request for access to relevant class 2 material under s 6 (s 4).

• Declaration of age: the explicit statement that the applicant is at least 18 years of age. The Declaration requires this statement to be submitted in writing or electronic form (s 6(1)(b), s 6(3)).

Operationally, the Declaration sets a four-part process that access-control systems must adopt to gain the status of a restricted access system: an application process (with allowable formats), provision of warnings and either safety content or a link thereto, reasonable age verification steps (subject to reuse of previously submitted information), and a limiting mechanism that only grants access once verification is complete or permits verification via a PIN or equivalent that demonstrates prior completion of the steps (s 5-9).

Two procedural divergences within those concepts are important. First, an application may be oral, written or electronic (s 6(2)), yet the age declaration must be in writing or electronic form (s 6(3)). Second, the instrument imposes a “reasonable steps” standard for age confirmation (s 8(1)) and simultaneously provides an explicit safe-harbour for reuse of prior age-confirming information already held by the provider or its agent (s 8(2)). The Declaration therefore combines flexible modes of application with a specific evidentiary floor for age declarations and a saving clause for previously obtained confirmations.

The instrument also prescribes the content of the warning requirement: a warning about the nature of the relevant class 2 material, plus either safety information about parental or guardianship controls or a link to that information on the relevant service (s 7). The limiting mechanism for access is binary: access may only be provided once verification of the specified steps has been achieved, or via a PIN/other means that allows the system to verify prior fulfilment of those steps (s 9).

Finally, the Declaration sits as a delegated instrument under s 108(1) of the Online Safety Act 2021 (s 3) and points readers to the Act for a number of defined expressions used throughout the instrument (s 4, note). The text of the Declaration itself contains no prescribed penalties or enforcement procedure.

The Declaration operates by specifying requirements for access-control systems that gate “relevant class 2 material”. Consequently, the primary parties affected are the operators/providers of social media services, designated internet services, or relevant electronic services that make relevant class 2 material available and that use access-control systems to control access to that material. The instrument refers throughout to “the provider of the social media service, relevant electronic service, or designated internet service through which access to the relevant class 2 material is provided” (s 8(2)), indicating that the obligations and mechanisms are to be implemented by the service provider or those acting on the provider’s behalf.

Applicants and end users are affected in the sense that their interactions with such services must conform to the application, declaration and age-verification procedures set out in ss 6-9. The Declaration creates an entitlement for providers to require an application and declaration, and a corresponding procedural obligation that applicants submit those things in the specified form. Under s 6, the access-control system must require an applicant to apply and to submit a written or electronic declaration that they are at least 18 years of age (s 6(1)(a)-(b), s 6(3)). Applicants therefore bear the immediate compliance burden of making the application and providing the written/electronic declaration of age.

Parents and guardians are referenced indirectly through the safety information requirement in s 7. The access-control system must give safety information about how a parent or guardian may control access to relevant class 2 material by persons under 18, or link to that information on the service (s 7(b)). That imposes an informational obligation on the provider to ensure that parental/guardian control information is available with the application flow.

Third-party services and agents that act “on behalf of” providers are also implicated. Section 8(2) allows the access-control system to treat prior information submitted to the provider or a person acting on behalf of the provider as sufficient confirmation of age. That clause creates an operational pathway for reliance on age-verification services or intermediaries, and therefore implicates vendors who supply identity or age-confirmation services to providers.

The eSafety Commissioner, as maker of the Declaration, is an institutional actor set out in s 3. The Declaration does not specify enforcement mechanisms, but the Commissioner’s role in issuing the instrument implies administrative oversight in the broader Online Safety Act framework.

Finally, note that the Declaration concerns only “relevant class 2 material” as defined by the Act (s 4). Services that do not provide material falling within paragraphs 107(1)(f)-(l) of the Act are outside the scope of this instrument unless and until the Act’s classification applies to their material.

The Declaration imposes a concise set of duties on access-control systems and thereby on the providers who operate them. These duties are cumulative for an access-control system to be “specified as a restricted access system” in relation to relevant class 2 material (s 5). The primary duties and the procedural rights that flow from them are:

1. Duty to require applications and age declarations (s 6)

   • An access-control system must require an applicant who seeks access to relevant class 2 material to apply for access and to submit a declaration that the applicant is at least 18 years of age (s 6(1)(a)-(b)).
   • Applications may be made in writing, electronically, or orally (s 6(2)).
   • The age declaration itself must be provided in writing or electronic form (s 6(3)). This creates a duty on the provider to ensure the capture of a written or electronic record of the age declaration.

2. Duty to give warnings and safety information (s 7)

   • For each application the access-control system must give the applicant a warning about the nature of relevant class 2 material (s 7(a)).
   • The system must also provide either safety information about how parents or guardians may control access for minors or a link to that information on the relevant service (s 7(b)(1)-(2)). This imposes a content-delivery duty on the provider during the application process.

3. Duty to incorporate reasonable steps to confirm age (s 8)

   • The access-control system must incorporate reasonable steps to confirm that an applicant is at least 18 years of age (s 8(1)). The Declaration does not prescribe what “reasonable steps” are; the standard is left to the implementing provider to interpret within the reasonableness qualifier.
   • If the applicant has previously submitted information to the provider or a person acting on the provider’s behalf that confirms they are at least 18, the access-control system is not required to take any further steps to confirm age in order to provide access (s 8(2)). This creates a right for providers to rely on previously obtained confirmations and a duty to recognise such prior confirmations where they exist.

4. Duty to limit access until verification is complete or via a verification token (s 9)

   • Access-control systems must only provide access to relevant class 2 material if they have verified that the applicant has applied, submitted the age declaration, been given the warning and safety information, and met the confirmation of age requirements at the time of application (s 9(a)(i)-(iii)).
   • Alternatively, access may be provided where the applicant has been provided with a Personal Identification Number or other means that enables the access-control system to verify that the applicant previously completed the application, received warnings/safety information, and met the age confirmation requirements (s 9(b)(i)-(iii)). This establishes a token-based or deferred-verification pathway whereby prior completion may be proved at the time access is sought.

Rights implicit in the Declaration:

• Providers have the operational right to require the specified application and declaration before granting access (s 6).
• Providers have the right to rely on previously submitted, provider-held confirmations of age and need not re-verify where such confirmations exist (s 8(2)).
• Applicants have the right to submit applications by oral, written, or electronic means, but they do not have a right to obtain access unless the provider satisfies the verification and limiting requirements (ss 6(2), 9).

Limitations and indeterminacies in duties:

• The “reasonable steps” standard for age confirmation (s 8(1)) is fact-dependent and not further defined in the Declaration. That allows providers discretion in choosing verification methods but creates legal uncertainty about what is sufficient in any particular case.
• The Declaration prescribes the form in which the age declaration must be given (written or electronic, s 6(3)) despite permitting oral applications (s 6(2)). Providers therefore must design intake processes to accept oral applications but to capture the age declaration in a recorded written or electronic form before granting access.

The Declaration does not specify recordkeeping, data retention, privacy safeguards, or penalties. Those matters are left unaddressed in the text and may be governed by the Act or other laws; they are not duties imposed by this instrument.

The Declaration itself contains no express penalty clauses, civil sanctions, or criminal offences. It is a specification instrument made under subsection 108(1) of the Online Safety Act 2021 (s 3). The text does not set out enforcement mechanisms, investigatory powers, compliance notices, or monetary penalties; nor does it prescribe administrative processes for determining non-compliance or for imposing remedial measures.

Consequently, within the four corners of this instrument, there is no internal statement about who enforces the Declaration, what sanctions apply for non-compliance, or how disputes about compliance are resolved. The Declaration is an instrument that defines when an access-control system is “specified as a restricted access system” by reference to compliance with the enumerated requirements in s 5. Any legal consequences that follow from a system being specified or not specified as a restricted access system are not articulated in the Declaration.

Because the instrument is made under the Online Safety Act 2021 (s 3), it is reasonable to read its compliance obligations against the broader enforcement framework established by that Act; however, this Declaration does not itself set out those enforcement details. Practically, a regulated provider should therefore:

• Treat the Declaration’s requirements as mandatory for any access-control system that the provider wishes to rely on to be a specified restricted access system for relevant class 2 material (s 5);
• Ascertain separately, by reference to the Act and any associated instruments, what enforcement powers or penalties apply where a provider’s access-control system does not meet the specification or where content obligations arise; and
• Keep contemporaneous evidence of the operational processes that implement ss 6-9, since the Declaration conditions the specification of a restricted access system on demonstrable compliance with those sections.

In short, this instrument defines operational standards but does not itself articulate enforcement remedies or penalties within its text. Any administrative or judicial enforcement mechanisms will need to be located in the Online Safety Act 2021 or other applicable law, which this Declaration references but does not reproduce.

The Declaration is explicitly tied to the Online Safety Act 2021. It is made under s 108(1) of the Act (s 3) and depends on several defined terms that the Act supplies. Section 4 of the Declaration states that a number of expressions used in the Declaration are defined in the Act, and lists examples including access-control system, class 2 material, designated internet service, material, provider, provided, relevant electronic service, restricted access system, and social media service (s 4, note). The Declaration therefore functions as a delegated instrument that supplies detailed operational requirements for access-control systems within the statutory architecture of the Act.

The Declaration does not itself reference, repeat, or amend substantive provisions of the Act such as classification criteria, enforcement powers, records obligations, privacy protections, or offences. It relies on the Act for the content of “relevant class 2 material” by specifying that the term means class 2 material covered by paragraphs 107(1)(f) to (l) of the Act (s 4). Providers must therefore map the Act’s classification of material to their content management systems to determine whether the Declaration’s gated access specifications apply.

The instrument is silent on data protection and privacy law. The operational requirements in ss 6-9 will, in practice, require providers to capture and retain certain information (e.g. written or electronic age declarations, warnings delivered, evidence of age confirmation, PIN issuance) to satisfy the verification requirement in s 9. Those information flows will intersect with privacy and data-protection obligations under statutory regimes that are not addressed in the Declaration. The instrument does not prescribe retention periods, security standards, or permitted uses for personal data generated by compliance with the Declaration.

Where providers rely on third-party agents for age confirmation or for acting “on behalf of” the provider (s 8(2)), contractual and regulatory obligations under consumer law, privacy law, and contract law will interact with the operational choices required by the Declaration. The Declaration permits reliance on previously submitted confirmations of age held by the provider or a person acting on the provider’s behalf (s 8(2)), which creates a dependency between the provider’s compliance status under this instrument and the provider’s arrangements with third-party agents.

The commencement clause links the Declaration’s operative effect to the timing of the Act (s 2). The whole of the Declaration commences on the later of the start of the day after this Declaration is registered and the commencement of the Online Safety Act 2021; if the Act does not commence, the Declaration does not commence (s 2, commencement table). That linkage means the Declaration is not standalone; it is activated only in the statutory context the Act creates.

Because the Declaration does not spell out enforcement or penalty regimes, it must be read alongside the Act to determine consequences of non-compliance. Any interactions with criminal law, consumer protection, discrimination law, or other regulatory frameworks are not addressed in the text. Providers and advisers should therefore consult the Act and applicable privacy and consumer laws to understand the full legal matrix in which the Declaration operates.

The Declaration itself records its maker, date, and containment of a commencement table. It is dated 13 January 2022 and signed by Julie Inman Grant, eSafety Commissioner (front page and maker signature in the instrument). The Commencement provision (s 2) contains a table indicating that the whole of the Declaration commences on the later of the start of the day after the Declaration is registered and the commencement of the Online Safety Act 2021; however, it will not commence at all if the Act does not commence (s 2, commencement table).

The Declaration also contains a note that the commencement table relates only to the provisions as originally enacted and will not be amended to deal with later amendments of the Declaration (s 2(1), note). Section 2(2) further states that any information in column 3 of the commencement table is not part of the Declaration and that information may be edited in any published version of the Declaration. Those two notes indicate an awareness of the separate technical metadata that may be published with the instrument and a delineation between the formal text of the instrument and editorial or informational material added in publication.

No amendments are recorded in the document provided. The instrument contains no amendment schedules, no later amendment references, and no modification history within its text. The Declaration therefore appears as an original, single-instrument specification as of the stated date. If amendments were made subsequently, they are not included in the supplied text.

For practical purposes, users must treat the instrument as an original delegated instrument that may later be amended, but no amendment history is disclosed in the instrument itself. Any later amendments would be visible in the legislative register or Gazette where subordinate instruments and their variations are published; they do not appear in this Declaration’s text.

The Declaration contains no references to litigation, court decisions, or administrative reviews. It names no judicial or administrative proceedings as antecedents, and it does not cite case law or determinations. There is no litigation history recorded or referred to within the document supplied.

Because the Declaration is an administrative specification under the Online Safety Act 2021, the absence of litigation references in the text does not preclude later challenges or judicial review in relation to implementation, compliance, or validity; such matters would be brought under the wider legal framework and are not addressed in this instrument. As supplied, the instrument itself does not record any disputes about its terms, nor does it provide an internal dispute or review mechanism.

Practitioners seeking to know whether the Declaration has been subject to litigation will need to consult external legal databases or court records; the text provides no such history.

This instrument is concise but contains a number of drafting and operational features that can create traps for the unwary. The following points are concrete, text-based observations that may be material to providers, vendors, compliance officers, or advisers.

1. Oral applications versus written/electronic declarations

   • The Declaration allows applications to be made orally as well as in writing or electronically (s 6(2)), but the applicant’s declaration that they are at least 18 years of age must be provided in writing or electronic form (s 6(3)). Practically, an access workflow that accepts an oral application without capturing a written/electronic age declaration will not meet the explicit requirement in s 6. Providers must therefore ensure that an oral application channel is accompanied by a mechanism to obtain and retain a written or electronic age declaration before granting access.

2. “Reasonable steps” is undefined

   • Section 8(1) requires the access-control system to incorporate reasonable steps to confirm that an applicant is at least 18. The Declaration does not define what constitutes “reasonable steps”. The uncertainty leaves providers with discretion but exposes them to legal risk if a regulator or court takes a different view of what is reasonable in particular circumstances. Providers that adopt minimal measures may be questioned on that standard.

3. Reliance on prior confirmations

   • Section 8(2) allows providers to decline further age verification where the applicant has previously submitted information to the provider or a person acting on the provider’s behalf that confirms age. That clause creates an operational shortcut but imposes reliance risk: the provider must be satisfied that the earlier information in fact confirms age. The Declaration does not specify the evidentiary quality or retention requirements for such prior confirmations.

4. PINs and “other means” for deferred verification

   • Section 9(b) permits access to be provided where the applicant has been given a Personal Identification Number or other means that enables the system to verify that the applicant previously completed the necessary steps. The Declaration does not prescribe security standards for such identifiers, their expiry, or the processes required to issue and validate them. An insecure or poorly governed PIN system may enable circumvention of the verification requirements, but the Declaration does not set out safeguards.

5. Narrow scope linked to the Act’s definitions

   • The Declaration applies only to “relevant class 2 material” defined as class 2 material covered by paragraphs 107(1)(f)-(l) of the Act (s 4). Providers must therefore map their content classification against the Act’s paragraphs. Misclassification may lead to over- or under-application of the required access-control features.

6. No data protection or retention guidance

   • The operational requirements will involve the creation and likely retention of personal information (age declarations, evidence of verification, issuance of PINs). The Declaration does not address what retention periods, security measures, or privacy safeguards are required, nor does it address deletion, portability, or consent beyond the requirement to collect a declaration. Providers must therefore reconcile compliance with this instrument with applicable privacy laws and internal data governance policies.

7. No penalty or enforcement detail in the instrument

   • The Declaration sets requirements but contains no enforcement or penalty provisions. Providers cannot find in this instrument what penalties, administrative actions, or remedies follow from non-compliance. That gap requires reference to the Act and other instruments to understand enforcement exposure.

8. Timing of commencement is conditional

   • The instrument's commencement depends on the Act’s commencement (s 2). If the Act does not commence, the Declaration does not commence. This makes the Declaration operational only within the statutory timeline created by the Act; providers should not assume immediate effect upon registration alone.

9. Safety information content and location flexibility

   • Section 7(b) allows the access-control system to either provide safety information about parental or guardian controls or provide a link to that information on the relevant service. A provider that chooses the link option must ensure the link resolves to adequate, accessible information. The Declaration does not define adequacy or accessibility requirements.

10. Narrow technical focus

• The instrument is narrowly focused on process steps for gating access; it does not address broader platform governance issues such as content moderation, takedown obligations, or harmful content classification beyond the closure that it applies to specified class 2 material. Providers must not assume that compliance with this instrument resolves other obligations under the Act or other laws.

Each of these points arises from the instrument’s text. They highlight places where operational decisions, discretion, or external legal frameworks will determine the practical compliance outcomes for providers and applicants.

To implement an access-control system that qualifies as a restricted access system for relevant class 2 material under this Declaration, a provider should design and document an operational process that demonstrably satisfies ss 5-9. The steps below follow the Declaration’s structure and cite the relevant sections.

1. Scoping and classification

   • Map the provider’s content to the Act’s classification to determine which material is “relevant class 2 material”, i.e. class 2 material covered by paragraphs 107(1)(f)-(l) of the Act (s 4). The Declaration applies only to those categories.

2. Design the application intake process (s 6)

   • Ensure the access-control system requires an applicant to apply for access and to submit a declaration that they are at least 18 years of age (s 6(1)(a)-(b)).
   • Provide multiple channels for applications: written, electronic, and oral (s 6(2)). If an oral channel is offered, build in a step to capture the age declaration in writing or electronically before access is granted (s 6(3)).
   • Capture timestamps and an immutable record for written/electronic declarations to demonstrate the declaration’s presence when needed.

3. Provide the required warning and safety information (s 7)

   • For each application, display or deliver a warning about the nature of the relevant class 2 material (s 7(a)).
   • Also either: a) Provide safety information about how a parent or guardian may control access for under-18s; or b) Provide a clear link to that information on the relevant service (s 7(b)(1)-(2)).
   • Ensure the warning and the safety information or link are presented to the applicant before or during the submission of the declaration so that s 9 verification can be satisfied.

4. Implement age confirmation procedures (s 8)

   • Adopt and document “reasonable steps” for confirming the applicant is at least 18 (s 8(1)). Because “reasonable” is not defined in the Declaration, document the rationale for the chosen method(s) and assess their effectiveness against industry standards and privacy obligations.
   • Where the applicant has previously submitted information that confirms age to the provider or a person acting on the provider’s behalf, configure the system to accept that prior confirmation without further steps (s 8(2)). Maintain traceable linkage between the prior confirmation and the current access request.

5. Design limiting and verification controls (s 9)

   • Implement a gating mechanism that only provides access to relevant class 2 material after verification that the applicant (i) applied and submitted the declaration, (ii) was given the warning and safety information, and (iii) met the age confirmation requirements at the time of application (s 9(a)(i)-(iii)).
   • Alternatively, implement a secure issuance and validation process for Personal Identification Numbers or other tokens that enable the system to verify that the applicant previously completed the required steps (s 9(b)(i)-(iii)). Decide on token lifecycle, expiry, revocation, and validation security measures.

6. Evidence and recordkeeping

   • Although the Declaration does not specify retention periods, retain records that demonstrate compliance with ss 6-9, including the written/electronic age declaration, the warning and safety information delivery, the age confirmation steps taken, and any PIN or token issuance and validation logs. Such records will be necessary to demonstrate that the access-control system satisfies s 5’s cumulative requirements that specify when a system is a restricted access system.
   • Reconcile recordkeeping with applicable privacy and data protection obligations outside the Declaration.

7. Vendor and agent arrangements

   • If relying on third-party agents for age verification or for acting on the provider’s behalf (s 8(2)), ensure contractual arrangements allow retrieval and evidentiary use of prior confirmations. Document chain-of-trust assumptions and the provenance of the age confirmation data.

8. User interface and user journey controls

   • Ensure the user journey prevents access to relevant class 2 material until the access-control system has either verified the required steps at the time of application or validated a previously issued token/PIN (s 9).
   • For oral applications, ensure that oral intake is followed by immediate collection of the written/electronic age declaration and delivery of the warning/safety information before access is enabled.

9. Security and anti-circumvention measures

   • Implement reasonable security controls for issuing and validating tokens/PINs and for storing written/electronic declarations. Although the Declaration does not mandate security standards, unsecured tokens or poor storage increase the risk of circumvention and subsequent non-compliance.

10. Policy documentation and training

    • Maintain clear internal policies that describe which content is in scope, how the access-control system operates, the age-confirmation methods used, the procedures for accepting prior confirmations, and the token/PIN lifecycle.
    • Train staff and agents who receive oral applications or who act on behalf of the provider to ensure consistent capture of required written/electronic declarations and proper delivery of warnings and safety information.

11. Review and audit

    • Periodically review the age-confirmation standard to ensure it remains “reasonable” in light of technological and regulatory developments. Keep audit trails that justify the reasonableness of the chosen methods.

12. Legal alignment

    • Because the Declaration does not state penalties or privacy obligations, confirm compliance with the Online Safety Act 2021 and applicable privacy and consumer protection laws as part of the implementation plan. The Declaration is an instrument under the Act (s 3), and full legal compliance requires attention to the Act and other applicable law.

These steps are grounded in the instrument’s text. Providers that follow them will have implemented an access-control system that addresses the specific requirements in ss 5-9 and that can be documented as a restricted access system for relevant class 2 material under this Declaration.