Five routes, and where each one stops
Online reputation management: what the law and the platforms allow
When something said online harms a business, or the people who run it, Australian law offers several separate routes, and each has its own test: defamation, the consumer law’s ban on misleading conduct, and eSafety’s scheme for abuse aimed at a person. This guide, published by Dotto, takes each route in turn, with its official sources at the foot of each page.
General information about the law, not legal advice. The official places to check are eSafety, the ACCC, and the legal aid service and Defamation Act of your state or territory.
The five routes
Defamation and businesses: who can sue
Queensland’s Act gives a corporation a claim only if it is an ‘excluded corporation’, such as one with fewer than 10 employees that is not an associated entity of another corporation and is not a public body; Victorian and South Australian sources describe a similar limit.
Concerns notices and time limits
In Queensland and South Australia, a written concerns notice comes before any court case, and the publisher generally has 28 days to respond. In Queensland, the claim itself must generally begin within 1 year of publication.
Removing a genuine review
The ACCC says that removing a negative review that was genuinely created may mislead consumers.
Misleading conduct by a competitor
The Australian Consumer Law bans misleading or deceptive conduct in trade or commerce, and the ACCC takes reports from businesses about false or misleading claims by other businesses.
Online abuse of a person
eSafety can act for one specific adult targeted by seriously harmful content, an owner or a staff member among them, but not for an organisation.
Two meanings of ‘serious harm’
In defamation, serious harm is harm to reputation, and under Queensland’s Act, harm to an excluded corporation’s reputation is not serious harm unless it causes, or is likely to cause, serious financial loss.
In eSafety’s adult cyber abuse scheme, serious harm is about health. eSafety treats content as causing serious harm when it “is likely to have a severe negative impact on the physical or mental health of the person targeted.” It also says: “The Adult Cyber Abuse Scheme is not intended to regulate hurt feelings, purely reputational damage, bad online reviews, strong opinions or banter.”
So a post that costs a business trade, without threatening anyone’s health, sits outside eSafety’s scheme, and the defamation and consumer law routes are the ones to read. A post aimed at a named staff member is a different case, taken up in the guide to online abuse of a person.
The record two routes ask for
Two of the routes ask for much the same record at the very start. eSafety says a report to it, to an online service or to the police needs evidence of what happened and where, such as the web page address, the other person’s profile, or screenshots. A concerns notice under Queensland’s Act must say where the matter can be accessed, for example a webpage address, and come with a copy of the matter if that is practicable.
eSafety also says it cannot take further action once the content has been deleted or removed.
How current the law here is
Defamation law has changed in stages, state by state. NSW’s Department of Communities and Justice, in its page last updated on 29 August 2024, lists the 2020 amendments, which introduced the serious harm threshold, as commenced in NSW, Victoria, South Australia, Queensland, Tasmania and the ACT. A later set from its Stage 2 review, including rules on internet intermediaries’ liability for other people’s content, commenced in NSW and the ACT on 1 July 2024.