The eSafety Commissioner is not an editor-in-chief for the Australian internet. The office is a statutory regulator with a set of notices the Online Safety Act 2021 actually authorises. Those notices are powerful when the material fits a scheme. They are unavailable when it does not. Australians who write to eSafety as if it were a complaints desk for embarrassment will wait, and then they will be told no.
If you remember one distinction from this guide, make it this one: a removal notice is an enforceable direction to take all reasonable steps to take material down, usually within 24 hours. A service-provider notification is a tap on the shoulder. A blocking notice is a direction to an internet service provider about class-1 material it does not even host. Using the wrong word for the instrument you want is how a file stalls.
This is journalism about the machinery, current as of 2025–26, not legal advice and not a substitute for the image and safety hub when the material is intimate or involves a child. Do not send this desk the image.
The Act, and the four hoppers
The Online Safety Act commenced in January 2022. For takedowns, four schemes matter.
Image-based abuse. The non-consensual sharing of an intimate image, or a threat to share one, on a social media service, relevant electronic service or designated internet service. Either the person shown or the end-user who shared it must be ordinarily resident in Australia. The image-based abuse playbook is the operational guide. This piece is the order that sits behind it.
Adult cyber-abuse. Material targeted at an Australian adult that is intended to cause serious harm — serious physical harm or serious harm to mental health — and that is menacing, harassing or offensive in all the circumstances. Both limbs must be there. eSafety’s 2025 guidance is explicit that mere ordinary emotional reactions, and the ordinary run of negative reviews or false statements about a business, will not clear the test.
The child cyberbullying scheme. Material targeted at an Australian child that is seriously threatening, seriously intimidating, seriously harassing or seriously humiliating. Parents and guardians can complain. The threshold is lower than the adult scheme, by design. If a child is in the footage or the target, start here and with the platform, not with a journalist.
The online content scheme. Class-1 material (child sexual abuse material, pro-terror material, and certain other illegal content) and class-2 material (high-impact pornography and other restricted content). This is the scheme that produces link-deletion notices, app-removal notices and blocking notices to carriers. It is not a reputation scheme. Basic Online Safety Expectations and industry codes sit above those schemes. They are about systems, not a personal order about a URL.
Removal notices, end-user notices, blocking notices
A removal notice can go to the provider of a social media service, relevant electronic service or designated internet service, to a hosting service, or to the end-user who posted the material. It requires the recipient to take all reasonable steps to remove the material, or to cease hosting it, within 24 hours or a longer period eSafety specifies. Failure opens civil-penalty territory: formal warnings, infringement notices, enforceable undertakings, injunctions.
An end-user notice is the same family of instrument aimed at the poster. It is useful when that person is in Australia and useless when the account is disposable. Most practical files aim at the service.
A service-provider notification is not enforceable. eSafety writes to the platform and expects it to act. For image-based abuse and adult cyber-abuse, the office can also publish a statement where the same kind of material has appeared on a service two or more times in twelve months and breached the service’s own terms. That is a naming instrument, not a takedown.
A blocking notice, under the online content scheme, goes to an internet service provider. It is for class-1 material on a hosting service, typically offshore, that has not come down. It is not a remedy for a defamatory blog post. A link-deletion notice tells a service to take down links to class-1 material. An app-removal notice tells an app distributor to stop carrying an app that facilitates it. Neither is a tool for a one-star review.
eSafety can also accept an objection notice from a person shown in an intimate image who originally consented to its being shared and now objects. Consent, in this statute, is not a lifetime licence.
Timelines, as they actually run
The 24-hour figure in the press is the compliance clock after a notice is given. It is not the clock from your first report.
Image-based abuse. You do not have to report to the platform before you complain to eSafety. You should still report to the platform, because the fastest deletion is often the one the service does itself. eSafety’s investigation has no statutory deadline. A removal notice, once given, is usually 24 hours. In a live sexual-extortion file, practice has become quicker than the statute requires. That is practice, not a right.
Adult cyber-abuse. You must complain to the service first. eSafety cannot give a removal notice until at least 24 hours have passed since that complaint; the Act allows eSafety to specify longer. Keep the receipt, the reference number, or a screenshot of the report. If the service gives you nothing, a statutory declaration is the fallback the guidance contemplates. Then eSafety investigates. Then, if the material meets both limbs of the test, it may give a notice. The notice is discretionary.
Child cyberbullying. Report to the service and to eSafety. Do not wait on a theory of serious mental harm; the child scheme is its own test. If the material is child sexual abuse material, you are in the online content scheme and in a police file. Do not handle that material. Report it.
Class-1 content. eSafety works with Australian police and with INHOPE for child sexual exploitation material hosted anywhere. Blocking notices are the infrastructural end of that work. They are not a reputation product.
If you leave contact details and ask for an outcome, eSafety’s public service standard is a response within five business days of the investigation ending. That is a correspondence standard, not a takedown standard.
What eSafety will not do
It will not take down ordinary rude reviews. A one-star Google review that says the plumber was late is not adult cyber-abuse. Use the product’s own policy.
It will not umpire political speech. A harsh post about a candidate or a journalist is not, without more, material intended to cause serious harm to mental health. eSafety’s 2025 guidance lists ordinary emotional reactions — anger, fear, grief, distress — and says they are not enough on their own.
It will not unpublish news. A newspaper article or a court report is a publisher problem and sometimes a defamation problem. eSafety is not a back-door editor of the Herald.
It will not run your defamation case. False statements that injure reputation, without the extra intent and menaces the adult scheme requires, stay with the uniform Acts — the defamation pathway.
It will not delete a business smear because bookings are down. Serious harm in this Act is harm to a person, not to a balance sheet.
It will not, by itself, clean Google. A removal notice to a host is a source takedown. Use Google Search removals once the URL is gone or once you have an order the search products will honour.
The order of operations we recommend
- Decide which hopper you are in. Intimate image or threat to share: image-based abuse. Campaign of menaces aimed at an adult’s mental health: adult cyber-abuse. Child as target: child scheme. Illegal content: online content scheme and police. None of the above: stop.
- Capture URLs, usernames, timestamps and an incognito screenshot. Do not download and recirculate an intimate image to “build a file”.
- Report to the platform through the victim flow. For the practical buttons, use non-consensual intimate images.
- Report to eSafety. For adult cyber-abuse, attach proof of the platform complaint and wait out the 24 hours before you expect a notice. For image-based abuse, do not wait on the platform to finish.
- If there is extortion, a threat of violence, or a child in the material, report to police as well. eSafety is not a substitute for a crime report.
- When the material is down, file the search and archive leftovers. A notice that the host obeyed is not a notice to Bing.
eSafety will ask you not to send the image to people who do not need it. That includes us. The office’s form is built so that you can identify the material by URL, hash or a narrow screenshot. Follow that discipline.
If you want the desk to look at a general question about the schemes, use contact. Do not send the image, the threat, or the child’s name. We publish method. We do not run your case.