People responsible for online services now have a legal duty to ensure a safe online environment. This includes protecting all Australians from seriously harmful material, such as content that depicts or encourages child sexual abuse.

Online services can be fined up to 60,000 penalty units if they fail to meet their safety duties, fail to conduct risk assessments, or fail to provide required user empowerment tools.

The Communications Minister can now mandate that online services provide tools that let users control design features, such as how content is recommended, to protect them from harm.

Social media services are banned from exposing children under 16 to design features that are found to have negative behavioural impacts.

Online services can be fined up to 60,000 penalty units for failing to implement required age assurance or access control measures.

The eSafety Commissioner can now fine companies up to 600 penalty units via infringement notices for breaches of safety duties, risk assessments, and transparency reporting.

The eSafety Commissioner can now issue removal notices for cyber-abuse and cyber-bullying material without waiting for a complaint to the service provider. This applies if the service has no working complaints process, if a complaint would risk further harm, or if the material was already subject to a previous removal notice.

The eSafety Commissioner can now use fake 'sock puppet' identities to test if online services allow the generation of illegal material. People acting in good faith while doing this are immune from civil lawsuits or breaches of a platform's terms of service.

The eSafety Commissioner's investigation powers are expanded. The Commissioner can now compel people to provide information, produce documents, or explain how their decision-making algorithms and human oversight processes work.

People required to provide information or transparency reports to the eSafety Commissioner cannot refuse to do so based on the risk of self-incrimination. However, this information generally cannot be used against them in criminal or civil proceedings.

People who refuse to comply with the eSafety Commissioner's information notices or examination requirements face up to 12 months jail and a fine of 1,000 penalty units.

Fines for failing to comply with various online safety notices--including removal, blocking, and link deletion notices--are increased to 6,000 penalty units.

The eSafety Commissioner can now seek court injunctions to force compliance with safety duties, risk assessments, and transparency reporting.

People can now apply to the Administrative Review Tribunal to challenge certain decisions made by the eSafety Commissioner, such as the issuance of remedial directions or transparency report notices.