Australia’s Federal Court has ruled that eSafety Commissioner Julie Inman Grant cannot impose a messaging-service standard on X simply because the social media platform lets users send direct messages. The 12 August decision blocks the regulator’s attempt to layer a more intrusive set of detection rules on top of the code already governing X.
In X Corp v eSafety Commissioner, Justice Elizabeth Raper declared that the Relevant Electronic Services (RES) Standard “does not apply” to X. The court did not invalidate the standard itself. It held that, under the Online Safety Act 2021, a service already classified as social media cannot simultaneously be treated as a “relevant electronic service” for this regulatory scheme.
The RES Standard requires covered providers to deploy “appropriate systems, appropriate processes and appropriate technologies” to detect and remove known child sexual abuse material and known pro-terror material. The rules reach material distributed by or to Australian users, and list hashing and machine learning among potential tools. The obligation is proactive: a complaint from a recipient is not necessarily the trigger for a service to look for matching material.
The standard contains exceptions where detection is not technically feasible or reasonably practicable, or would create a systemic weakness or make end-to-end encryption less effective. Providers unable to deploy a system or technology under those exceptions must take “appropriate alternative action.” The privacy issue is therefore about what detection and alternative measures a regulator can demand across messaging services, even where encryption limits access to message contents.
Social media platforms instead operate under an industry-developed code, which eSafety registered in 2023. The Commissioner rejected industry-drafted codes for relevant electronic services and designated internet services, then made standards for those sectors herself. Her interpretation would have let the RES Standard apply to X as well because X has messaging features, effectively replacing the social media code for the same service.
Raper rejected that reading. It would let the Commissioner apply a standard to a platform already subject to a different industry code and “effectively bypass the consultative industry-led model,” she wrote. The judgment also records that earlier industry guidance said a participant would comply with no more than one code or standard for the same electronic service. eSafety’s September 2026 guidance was updated following the ruling.
That is a meaningful limit on one route to regulating X’s private messages, but the wider standard remains in force for services in its own category, including messaging and email providers where the applicable provisions are engaged. eSafety is also pursuing Telegram under the RES Standard: in July it brought civil penalty proceedings alleging failures involving pro-terror material. Those allegations remain before the court.
The Commissioner’s clash with X goes well beyond this case. As FFO previously reported, eSafety sought the worldwide removal of video of the 2024 stabbing of Bishop Mar Mari Emmanuel at a Sydney church, threatening heavy daily penalties after X restricted access in Australia. The Federal Court refused an interim order requiring global removal, and the regulator later discontinued that proceeding.
The Coordinated Foreign Assault on American Speech And Elections
X has lost other fights with the same regulator. In May 2026, it agreed to a A$650,000 civil penalty for failing to fully answer a separate 2023 transparency notice concerning child sexual exploitation material. That dispute concerned reporting obligations, not whether the RES Standard applies to X. The latest victory does not exempt the platform from Australia’s Online Safety Act or its social media code.
FFO has also covered Australia’s ban on social media accounts for under-16s and the international scrutiny of Inman Grant’s office. Together, these episodes show the breadth of Canberra’s online safety apparatus: age restrictions, takedown demands, information notices, and now rules aimed at detecting material carried through private communications. The court has drawn a line at the Commissioner’s attempt to bring X under a second code by reclassifying the platform. For services still covered by the RES Standard, the argument over privacy and automated detection continues.
