AI Creator Rules in Australia (2026): eSafety, Deepfakes, Ads, ACMA

As of October 19, 2026, no Australian law makes creators label AI-generated content. The rules that bite come from elsewhere. The eSafety Commissioner can order deepfake intimate images of real people taken down within 24 hours. Sharing sexual deepfakes of a real adult without consent has been a federal crime since September 2024, and New South Wales and South Australia also punish creating them. Anything that appears to show a minor is child abuse material, drawn or AI-made. Consumer law bans hidden ads and fake endorsements, and spam law covers promotional messages.

Platforms and AI tools carry new duties as well: since December 10, 2025 the big social networks have to keep under-16s off their services, and since March 9, 2026 adult content and AI tools that can make it need real age checks.

For an AI persona, the four habits from our Canada guide hold here too: disclose every paid relationship, say the persona is virtual, never use a real person's likeness without consent, and keep every character unmistakably adult.

Deepfakes count as intimate images. Under the Online Safety Act 2021, eSafety's image-based abuse scheme covers intimate images that are real, digitally altered or faked with AI, or shared to make people think they show a particular person. Posting one, or threatening to, without consent breaches the Act, and eSafety can order the poster, the platform or the host to remove it within 24 hours. Breaching that ban, or ignoring a removal notice, can bring a civil penalty of up to 500 penalty units (A$364 each from July 1, 2026, under the Crimes Act instrument). In September 2025 the Federal Court ordered a man to pay A$343,500 for posting deepfakes of well-known Australian women.

Where the scheme stops. eSafety's regulatory guidance says drawings, comics and cartoons usually aren't intimate images, and that it is unlikely to prioritise complaints about intimate images first made for a commercial purpose: the scheme isn't a copyright tool for leaked paid content, though it can still act depending on things like the harm and whether the images were taken down where they were sold. Non-sexual deepfakes fall outside this scheme unless another one applies, such as adult cyber abuse.

Adult content needs real age assurance. Australia's Age-Restricted Material Codes, industry codes registered by eSafety, have applied to hosting, internet providers and search since December 27, 2025, and to app stores, social media, messaging and websites and apps, AI services included, since March 9, 2026. eSafety's FAQ on the codes sums up the effect: ticking "I am 18 or older" is no longer enough on porn sites, AI chatbots that can produce sexually explicit material must confirm a user is 18 or over, social media that bans porn must detect and remove it, and social media that allows it must check ages before showing it. AI image and video generators that can produce porn must check that a user is an adult before generating it. eSafety has already sent directions to comply to two such AI services, in May and June 2026, for missing age checks.

What it means for you. The codes bind services, not individual creators. Expect real age checks on adult platforms and on AI tools with an 18+ mode, and keep explicit teasers off mainstream platforms that ban porn: under the codes those platforms now have to find and remove it.

Under-16s are off the big platforms. Since December 10, 2025, platforms covered by the social media minimum age must take reasonable steps to stop Australians under 16 having accounts. In eSafety's view that includes Facebook, Instagram, Kick, Reddit, Snapchat, Threads, TikTok, Twitch, X and YouTube, though it says a court decides in the end. There are no penalties for young users or their parents, and logged-out viewing of public content is still possible. For creators it mostly changes who can follow and comment.

Pending. The Online Safety Amendment (Digital Duty of Care) Bill 2026, introduced on October 15, 2026, would replace the codes with a single duty of care and let eSafety order app stores and search engines to remove "nudify" apps within 24 hours. A Senate committee is due to report on November 20, 2026. It isn't law.

Federal. Since September 3, 2024, the Criminal Code Amendment (Deepfake Sexual Material) Act 2024 has made it a crime to use the internet or a phone network to share sexual material of a real adult without their consent, or recklessly, whether it's genuine or created or altered with technology. Sharing includes publishing, making it available and advertising it. The maximum is 6 years in prison, or 7 if the person also created or altered the material. The Attorney-General's Department's fact sheet adds three points: the offence doesn't apply to depictions of people who don't exist, it does apply to a real person shown as a fictional character, and the material doesn't have to look photorealistic.

States. Some states go further and punish creating such images, not only sharing them. New South Wales's Crimes Act makes it an offence to create intimate images of a "simulated person" who looks like a real, identifiable person without that person's consent, with a maximum of 3 years. South Australia's Summary Offences Act has covered creating and distributing such depictions since November 3, 2025, with a defence for the written consent of each real person shown. Victoria Police says producing an intimate image without consent, which includes digitally creating it, is an offence in Victoria.

Privacy. Since June 10, 2025, people can sue over serious invasions of privacy under a new statutory tort. Whether it reaches wholly fabricated images hasn't been tested in court, but the Privacy Commissioner's guidance on AI products already treats deepfakes of an identifiable person as personal information.

The simple rule is the one in Spicy Studio's Terms: no real, identifiable person without documented consent.

Australia's child abuse material offences cover depictions of a person, or a representation of a person, who is or appears to be under 18, so drawn and AI-generated characters are included and a stated age doesn't change how a character looks. Using the internet for such material carries up to 15 years. Classification rules point the same way: the guidelines for films exclude from X18+ any adult who looks under 18 or is portrayed as a minor, and such material is Refused Classification. Keep every persona clearly adult in face, body and setting; Spicy Studio's Terms forbid anything else.

Explicit content of fictional adults isn't a deepfake, but eSafety treats AI-generated pornography as pornography, so it belongs behind the age checks above, on platforms that allow it. Is AI OFM Legal? compares those platforms' rules.

Consumer law. The Australian Consumer Law bans misleading or deceptive conduct, and that covers influencer posts. In a 2023 sweep, the ACCC found that 81% of the 118 influencers it reviewed made posts raising concerns, most often undisclosed brand relationships, vague tags such as "sp" or "spon" and buried disclosures. Recent cases: PhotobookShop paid A$39,600 in March 2026 after telling influencers not to disclose gifted products, and Hismile paid A$138,600 in June 2026 over videos that presented its staff as random shoppers.

Fake experiences. The ACCC's social media guidance gives the example of an influencer paid to say she loved a resort she never visited, which is likely misleading. An AI persona can't try a product either, so "I use this every day" from a virtual face is the same problem. The National AI Centre says consumer law can also apply to deceptive deepfakes and to staying silent about AI use where that misleads.

Industry code. The AANA Code of Ethics requires advertising to be clearly distinguishable as advertising, on social media too. Ad Standards' influencer guide asks for any brand arrangement, free products included, to be disclosed with #ad or #sponsored, a clear caption statement, a spoken disclosure or the platform's paid-partnership label. The ACCC has said it will publish its own influencer guidelines; we couldn't find them published as of October 19, 2026.

Spam. The ACMA enforces the Spam Act 2003, which covers commercial emails, text messages and instant messages. You need consent first, you must identify yourself with contact details, and every message needs a free unsubscribe that keeps working for 30 days and is honoured within 5 working days. That applies to "new set is live" promotions sent to fans.

Gambling promotions. Promoting illegal online casinos or slots to Australians breaches the Interactive Gambling Act, and the ACMA has warned influencers about it; it issued its first formal warning to a social media promoter on July 7, 2026.

What the ACMA doesn't do. It doesn't take complaints about social media posts and sends advertising complaints to Ad Standards; deepfakes and image-based abuse go to eSafety, misleading claims to the ACCC and privacy to the OAIC. The misinformation bill that would have given it new powers was dropped in November 2024, and it only oversees a voluntary industry code on misinformation.

The government won't proceed for now with mandatory guardrails for high-risk AI, and its National AI Plan of December 2, 2025 relies on existing laws and regulators. The National AI Centre's guide Being clear about AI-generated content recommends labels, watermarks and content metadata, with more visible labels where content could affect people's decisions or trust, but it's voluntary. In practice the labelling rules creators meet are the platforms' own, such as Instagram's AI-generated profile label and TikTok's label for realistic AI.

We checked each rule against the official pages linked above on October 19, 2026. This is general information, not legal advice: penalties are set in penalty units whose dollar value changes, states differ, and a bill before Parliament could change the online safety rules within months. For anything that matters, ask an Australian lawyer. Buying from Australia? The billing FAQ covers currency, GST and receipts.