Technology law

Telegram terror content: eSafety alleges Online Safety Act breach

by

reviewed by

Malcolm Burrows

Reading Time:

5–8 minutes

Australia’s eSafety Commissioner has commenced civil penalty proceedings in the Federal Court of Australia (Court) against Emirati-based Telegram FZ-LLC (Trade License Number 94349) (Telegram), alleging that it failed to comply with obligations to detect, deter and disrupt the distribution of pro-terror material and remove unlawful material from its messaging service.

The proceedings, eSafety Commissioner v Telegram FZ-LLC & Anor, were filed under court file number VID836/2026.  The matter remains before the Court, and the allegations have not yet been determined.

What has the eSafety Commissioner alleged?

The eSafety Commissioner alleges that Telegram breached section 146(1) of the Online Safety Act 2021(Cth) (Online Safety Act) by failing to comply with the Online Safety (Relevant Electronic Services—Class 1A and Class 1B Material) Industry Standard 2024 (RES Standard).

Section 146 of the Online Safety Act requires participants in a section of the online industry to comply with any industry standard that applies to them.  A failure to comply may expose a service provider to significant civil penalties and other regulatory action.

According to the eSafety Commissioner, Telegram allegedly failed to:

  • detect and remove known pro-terror material;
  • deter and disrupt the distribution of new pro-terror material;
  • remove relevant material after it became aware of it, including following reports from Australian users; and
  • remove or restrict accounts, groups and channels associated with the material.

The material referred to in public reports allegedly included footage connected with terrorist executions and mass shootings, such as the 2019 Christchurch mosque attacks in New Zealand and the 2022 Buffalo supermarket attack in the United States.  The eSafety Commissioner alleges that some reported material remained available for prolonged periods after it had been brought to Telegram’s attention.

Telegram has indicated that it intends to contest the allegations and has referred publicly to its existing anti-terrorism measures.  The Court will ultimately determine whether Telegram breached the applicable standard and, if so, what orders or penalties should be imposed.

You can find the statement of claim on this page: https://www.esafety.gov.au/industry/legal-proceedings-involving-esafety

What laws are said to apply?

The case concerns the RES Standard which applies to Relevant Electronic Services, including communications and messaging services that allow users to communicate or share material with other users.  The precise classification of a service depends on its features and operation, rather than merely how the business describes the service.

The RES Standard contains obligations directed at particularly serious categories of unlawful or harmful content, including child sexual abuse material and pro-terror material.  Among other things, it requires relevant service providers to take measures to detect and remove known pro-terror material and to address the risk of new material being distributed through their services.

The regulatory framework is not limited to conventional public social media networks.  Depending on the nature of the service, it may extend to:

  • private messaging and communications platforms;
  • online forums and community platforms;
  • file-sharing or cloud-storage services;
  • gaming and social interaction services;
  • dating and networking applications;
  • user-generated content platforms; and
  • other websites or applications through which users communicate or distribute material.

Overseas platforms that provide services to Australian end users can still attract Australian regulatory scrutiny, so even though Telegram is headquartered in Dubia, the company is still liable to penalties under the Online Safety Act.

Overseas platforms providing services to Australian end users are subject to Australian regulation under section 23(2) of the Online Safety Act which expressly extends the legislation’s jurisdiction to “acts, omissions, matters and things outside Australia”.  Accordingly, despite being an Emirati-registered company and operating from headquarters in Dubai, the specific geographical location of Telegram’s conduct does not preclude civil penalties under the Act if the Court finds that it breached the applicable obligations.

Why is this case important?

The Telegram proceeding appears likely to test what effective compliance with Australia’s online safety standards requires in practice.

It is not necessarily enough for a platform to publish community guidelines stating that terrorism or violent extremism is prohibited.  Regulators may look at the systems operating behind those policies, including:

  • how prohibited material is identified;
  • how quickly user reports are assessed;
  • whether known material can be detected when it is reposted;
  • whether related accounts, groups or channels are investigated;
  • how repeat offenders are managed;
  • whether risk assessments are regularly updated;
  • whether sufficient staff and technical resources are allocated to moderation; and
  • whether the provider can produce records showing that its systems are operating effectively.

Enforcement options

A media release published by Minister for Communications, Hon Anika Wells, on 30 July 2026 indicates that Telegram could face civil penalties of up to approximately $54.6 million if the Court finds that it failed to comply with the applicable obligations.  The precise penalty, if any, will depend on the Court’s findings and the statutory framework applying to the contraventions.

The Online Safety Act also provides the eSafety Commissioner with a range of regulatory tools beyond civil penalty proceedings.  Depending on the circumstances, these may include information-gathering notices, formal warnings, infringement notices, remedial directions, service-provider notifications and applications for court orders.

In serious cases, the Online Safety Act also contains mechanisms under which the Court may be asked to order that a designated internet service cease being provided.  Such an order would be exceptional, but its availability demonstrates that online safety compliance can involve more than a financial penalty.

How Dundas Lawyers can assist your business

Online platform operators should consider undertaking a structured review of their services rather than waiting until they receive a complaint or regulatory notice.

Businesses operating digital platforms accessible in Australia should regularly review their obligations under the Online Safety Act and the applicable industry codes and standards.  Early legal and technical review can reduce the risk of regulatory action and help ensure that safety measures remain appropriate as the service grows or changes.

We assist online platforms, technology companies and digital businesses with matters including:

  • advice on the application of the Online Safety Act;
  • assessment of applicable online safety codes and standards;
  • platform terms of use and community guidelines;
  • content-moderation and user-reporting procedures;
  • regulatory notices and eSafety Commissioner investigations;
  • online safety risk assessments;
  • contracts with hosting, cloud and moderation providers; and
  • responses to complaints involving unlawful or harmful online content.

Key takeaways

The proceeding against Telegram remains before the Court.  The allegations have not been proven, and the final outcome may provide further guidance about the steps online service providers must take to comply with Australia’s online safety framework.

Although the case concerns one of the world’s largest messaging platforms, it is relevant to a much broader range of businesses.  Operators of messaging services, social platforms, forums, apps, cloud services and websites accessible in Australia should consider whether Australia’s online safety laws apply to their operations and whether their content-moderation systems are capable of demonstrating compliance.

Links and further references

Legislation

Online Safety Act 2021(Cth)

Online Safety Codes and Standards Regulatory Guidance

Cases

eSafety Commissioner v Telegram FZ-LLLC & Anor

Further information

If you need advice on Australia’s Online Safety Laws for your online platform, contact us for a confidential and obligation‑free discussion.

Doyles Recommended TMT Lawyer 2024

Related insights

  • Privacy Amendment Bill 2026 proposes Privacy Act amendments

    Privacy Amendment Bill 2026 proposes Privacy Act amendments

    On 31 August 2026, the Australian Government published a Consultation Paper and released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 (Bill), proposing amendments to the Privacy Act 1988 (Cth) (Privacy Act).  The Bill proposes amendments to the Australian Privacy Principles (APPs) codified in Schedule 1 of the Privacy Act. The…

    Read more …

  • Bill to allow victims of AI deepfakes to sue for emotional damages

    Bill to allow victims of AI deepfakes to sue for emotional damages

    On 24 November 2025, Senator David Pocock introduced a private Senator’s bill, the Online Safety and Other Legislation Amendment (My Face, My Rights) Bill 2025 (Cth) (Bill) to amend the Online Safety Act 2021 (Cth) (Online Safety Act) and the Privacy Act 1988 (Cth) (Privacy Act). 

    Read more …

  • Malcolm Burrows on ABC’s “Legal Eagles” segment – Deepfakes

    Malcolm Burrows on ABC’s “Legal Eagles” segment – Deepfakes

    On 3 December 2025, Malcolm Burrows appeared live on Katherine Feeney’s ABC Radio program, “Legal Eagles” as the Technology and Intellectual Property Lawyer to discuss the proposed amendments to the Online Safety Act 2021 (Cth) through the introduction of the Online Safety and other legislation Amendment (My Face Rights) Bill (Cth) 2025 (My Face Rights…

    Read more …

  • OAIC publishes new guidance for under-16s social media ban

    OAIC publishes new guidance for under-16s social media ban

    On 10 October 2025, the Office of the Australian Information Commissioner (OAIC), led by Privacy Commissioner, Ms Carly Kind, released a twenty-nine (29) page Privacy Guidance on Part 4A (Social Media Minimum Age) of the Online Safety Act 2021 (New Guidance).  This New Guidance details the privacy obligations for Age-Restricted Social Media Platforms (Restricted Platforms)…

    Read more …

  • Aust Clinical Labs fined $5.8mil for failing to report data breach

    Aust Clinical Labs fined $5.8mil for failing to report data breach

    On 8 October 2025, the Federal Court published the judgement of Justice Halley in the case of Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224 (AIC v ACL).  Australian Clinical Labs Limited (ACL) was ordered to pay $5.8 million in civil penalties in relation to a 2022 data breach.  This…

    Read more …

  • Federal Government releases report into age verification trials

    Federal Government releases report into age verification trials

    On 31 August 2025, the Australian Government published the Final Report (Report) on the Age Assurance Technology Trial (Trial).  Conducted by the independent Age Check Certification Scheme (ACCS), the Trial offers insights into the technical feasibility, privacy implications, and operational deployment capabilities of various age assurance technologies.  While the Report explicitly states it is neutral…

    Read more …

  • What is the US Take It Down Act?

    What is the US Take It Down Act?

    The Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act (Take It Down Act ) is a United States (US) federal law enacted on 19 May 2025. The Take It Down Act amends 47 U.S. Code § 223 (Code) of the Communications Act 1934 (US) (Communications Act) by establishing new…

    Read more …

  • Federal parliament enacts cyber security legislation

    Federal parliament enacts cyber security legislation

    On 25 November 2024, the Australian Parliament passed a suite of legislation, collectively referred to by the Australian Government as the Cyber Security Legislative Package 2024.  The purported impetus for this legislation was a series of high-profile data breaches in 2022 and 2023.

    Read more …

  • Privacy Act amended to increase penalties to a max of $50 million

    Privacy Act amended to increase penalties to a max of $50 million

    The Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022 (Bill) was passed by both Houses of Parliament on the 28 November 2022 and now awaits Royal Assent.  The Bill was passed with virtually no amendment.

    Read more …

  • Medibank Private Limited v McClure [2026] FCAFC 38

    LEGAL PROFESSIONAL PRIVILEGE – third party reports – investigation into cyber-attack – whether primary judge erred as to dominant purpose in finding that reports not subject to legal professional privilege – whether documents were created, commissioned or obtained for the dominant purpose of legal advice – grounds of appeal not sufficiently arguable to warrant grant…

  • Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224

    PRIVACY ACT – Where an APP entity breached Australian Privacy Principle (APP) 11.1 of the Privacy Act 1988 (Cth) (Act) by failing to take reasonable steps to protect personal information from unauthorised access or disclosure – what constitutes “reasonable steps” – where an APP entity interfered with the privacy of 223,000 individuals under s 13(1)…

  • Australian Information Commissioner v Australian Clinical Labs Ltd (No 2) [2025] FCA 1224

    PRIVACY ACT – Where an APP entity breached Australian Privacy Principle (APP) 11.1 of the Privacy Act 1988 (Cth) (Act) by failing to take reasonable steps to protect personal information from unauthorised access or disclosure – what constitutes “reasonable steps” – where an APP entity interfered with the privacy of 223,000 individuals under s 13(1)…

Send this to a friend