Here is the short answer for anyone using a companion app from Australia. There is no dedicated AI companion Act, and no federal law that says "chatbots must do X". But three existing bodies of law reach these apps: the online safety regime run by the eSafety Commissioner, the Privacy Act, and the criminal law on sexual deepfakes. Of the three, the eSafety codes are the newest and the most relevant.
No AI Act, but not a free-for-all
A few things are worth separating, because headlines blur them.
What Australia decided not to do. In 2024 the government floated mandatory guardrails for "high-risk" AI. On 2 December 2025 it released its National AI Plan and confirmed it would not go ahead with them. It is leaning on existing, technology-neutral laws and regulators instead, and setting up an AI Safety Institute to monitor the field and advise.
What already applies. Online safety law, privacy law, consumer law and the Criminal Code all cover behaviour that happens to involve an AI. A company does not escape them because the thing on the other end of the chat is a model.
The main dates, as they stood at the end of September 2026.
The eSafety codes: the part that matters most
The Online Safety Act 2021 lets the eSafety Commissioner register industry codes that become enforceable. In September 2025 the Commissioner registered a batch of codes dealing with age-restricted material, and most of their obligations began on 9 March 2026. Two of them are aimed at the kind of product we review: one for AI companion chatbots and one for generative AI services more broadly. A further code covers social media services that include chatbot features.
In plain terms, a companion chatbot that can produce sexually explicit content, extreme violence or self-harm material must check that the person is 18 or older before it shows that material. That check can happen at sign-up or at the moment the content is about to be generated. eSafety has said that simply asking users to declare their age is not enough. The codes also expect the service to offer crisis and mental health information where it is relevant.
This follows eSafety's own probing. In October 2025 it published findings from transparency notices sent to four companion services: Character.AI, Nomi, Chai and Chub AI. It found that none had meaningful age checks, and that they mostly relied on users declaring their own age at sign-up. Three of the four (Chai, Chub AI and Nomi) did not steer users to support when self-harm came up.
Enforcement runs through the regulator. Breaching a direction to comply can bring civil penalties of up to A$49.5 million, and eSafety has said AI chatbots that can generate sexual or otherwise harmful material are an early priority. The obligations fall on the companies. Young people who get past a check are not the ones penalised.
One more date to know: age assurance duties for app stores and other app distribution services were due to start on 9 September 2026, which is why you may now hit an age prompt before you can even download some apps.
eSafety's own explainer on AI companions.
The short version of who does what:
| Rule | Who enforces it | In force | What it means for you |
|---|---|---|---|
| Age-restricted material codes | eSafety Commissioner | 9 Mar 2026 | Age checks and crisis information on companion apps |
| Under-16 social media law | eSafety Commissioner | 10 Dec 2025 | Covered platforms must block under-16 accounts |
| Statutory privacy tort | Courts | 10 Jun 2025 | You can sue over a serious invasion of privacy |
| Deepfake sexual material offence | Police and courts | 2024 | Sharing non-consensual sexual fakes is a crime |
| Children's Online Privacy Code | OAIC | Due by 10 Dec 2026 | Draft only, aimed at services children are likely to use |
The under-16 social media law
The Online Safety Amendment (Social Media Minimum Age) Act 2024 took effect on 10 December 2025. It requires age-restricted social media platforms to take reasonable steps to stop under-16s from holding accounts, with fines up to A$49.5 million for platforms that fail.
This law is often mentioned alongside AI companions, but the two are not the same thing. eSafety has named the platforms it treats as age-restricted, and companion apps are not on that list. The codes above are what govern companions. If an app you use builds a companion feature into a social platform that is covered, both regimes could apply.
Privacy law
The Privacy Act 1988 and the Australian Privacy Principles apply to organisations above the small business threshold and to overseas companies that carry on business in Australia. In practice that gives you a right to ask what an app holds about you (APP 12) and to have it corrected (APP 13), and it requires the company to destroy or de-identify data it no longer needs (APP 11). Our guide to what an app knows about you walks through the checks.
The reform picture has moved in stages:
- Passed and in force. The Privacy and Other Legislation Amendment Act 2024 gave the OAIC new penalty and notice powers. It also created a statutory tort for serious invasions of privacy, which started on 10 June 2025. That tort lets a person sue over an intentional or reckless serious invasion, whether or not the OAIC acts.
- Passed, starting soon. From 10 December 2026, organisations must disclose in their privacy policies when automated decisions significantly affect people.
- In progress. The OAIC released an exposure draft of a Children's Online Privacy Code on 31 March 2026, and consultation closed on 5 June. The law requires the code to be registered by 10 December 2026. It is still a draft, so treat any detail as provisional. It is aimed at online services likely to be accessed by children, and could reach companion apps that fall into that group.
- Still to come. The wider package of Privacy Act reforms, such as a fair-and-reasonable test for handling data, has not been legislated.
Sexual deepfakes and image-based abuse
The Criminal Code Amendment (Deepfake Sexual Material) Act 2024 made it an offence to send sexually explicit material depicting a real adult using the internet or a phone, when the person did not consent, whether the material is real or AI-generated. The maximum is six years in prison, or seven for aggravated cases. This is the Australian counterpart to the US TAKE IT DOWN Act. You can report intimate images, including fakes, to eSafety, which can order their removal.
What you will actually notice
- Age checks. Expect ID, face-scan or card-based checks, especially on permissive apps. Self-declaration is being phased out.
- Helpline cards. A character that drops the scene and points to Lifeline or a similar service. False alarms in fiction are common.
- Age prompts at the app store. New from September 2026.
- Tighter privacy wording. Policies will start mentioning automated decisions from December.
What is not covered
Billing. Subscription traps, credit systems and refunds are handled by the Australian Consumer Law, enforced by the ACCC and state and territory fair trading bodies. See refunds and cancellations.
Adult content choices. Nothing here regulates what consenting adults do with a companion. The rules are about children and non-consensual images.
Overseas context
The US has moved faster on companion-specific statutes. New York's law has applied since November 2025 and California's SB 243 since January 2026, with more states following. Europe has relied on privacy law: Italy's data protection authority fined Luka Inc., the company behind Replika, five million euros in a decision announced in May 2025, citing no valid legal basis for processing, a non-transparent privacy policy and no working age checks. That same regulator's 2023 order preceded the sudden end of erotic roleplay on Replika, a story told in when your AI companion changes overnight.
Where that leaves you
An adult using a companion app here is not breaking any law, and is not about to be. What has changed is the burden on the companies: verify ages, handle crisis talk, respect privacy. The careful apps will adapt without much fuss. The rest will either bolt on clumsy checks or, as eSafety's own testing showed, be found lacking.
This article is general information, not legal advice, and it reflects the position at the end of September 2026.