VPNs with servers in Australia

Part 15 of the Telecommunications Act 1997, inserted by the Assistance and Access Act 2018, lets the Director-General of Security or an interception agency chief give a “designated communications provider” a technical assistance notice, and the Attorney-General a technical capability notice. The definition includes a person who provides an electronic service with one or more end-users in Australia.

Disclosing information about a notice is an offence carrying five years’ imprisonment (section 317ZF). A request or notice has no effect to the extent it would require a systemic weakness to be built or one to be left unrepaired (section 317ZG). Whether a VPN operator falls within Part 5-1A, or is a designated provider to whom notices could be given, is not established.

Section 115A of the Copyright Act 1968 lets a copyright owner ask the Federal Court for an injunction requiring a carriage service provider to take reasonable steps to disable access to an online location outside Australia whose primary purpose or primary effect is infringing, or facilitating infringement of, copyright. The order may specify domain names, URLs and IP addresses, and may extend to search engines.

Part 4A of the Online Safety Act 2021 requires the provider of an age-restricted social media platform to take reasonable steps to prevent under-16s holding accounts, on pain of civil penalties. An age-restricted user is an Australian child who has not reached 16 years.

Yes. Section 474.17 of the Criminal Code makes it an offence, punishable by five years’ imprisonment, to use a carriage service in a way that reasonable persons would regard as menacing, harassing or offensive. On 18 March 2026 the Australian Federal Police charged a New South Wales man under it over a social media message, allegedly sent in September 2025 to a federal parliamentarian; officers executed a search warrant at a property.

In Fairfax Media Publications v Voller [2021] HCA 27, decided on 8 September 2021, the High Court held that media companies were publishers of third-party comments on their Facebook pages.

In Trust But Verify, which the Independent National Security Legislation Monitor provided to the Parliamentary Joint Committee on Intelligence and Security by 30 June 2020, the Monitor recommended that notices under the 2018 assistance regime be authorised by an independent body rather than by agency heads and the Attorney-General, and described a “double-lock” model.

Cooperation with a foreign agency is documented: the Australian Federal Police and the FBI together ran the ANOM encrypted-messaging operation, monitoring users’ messages over three years, and the AFP counts 780 search warrants in Australia as at August 2024. The order of the rows is the security score, and a server’s location is not a recommendation.