Summary

  • Australia's rules put safety inside routine account handling: agreed contact methods, account permissions and urgent service restoration.
  • ACMA reports real compliance improvements. Its published case counts do not, by themselves, measure whether those safeguards worked for each person seeking help.

A callback can look like good customer service. For someone experiencing domestic or family violence, it can also reach the wrong person at the wrong time. The number already in an account is not necessarily a safe number to use.

That is the practical problem behind Australia's 2025 telecommunications protection standard. Some duties began in July 2025; the remaining provisions applied to large providers from January 2026 and small ones from April. The rules reach well beyond a promise to be sympathetic. They ask a provider to carry a person's safety choices through the ordinary machinery of a phone account.

The legal text starts that conversation carefully. Staff must check whether it is safe to communicate and ask whether the person wants further information or support. Where the contact-agreement provisions apply, the provider must ask about a preferred method and time. For domestic-and-family-violence matters, that agreement governs subsequent contact, subject to the specified exceptions: a legal obligation to use another method, or the person initiating and confirming an alternative for that communication.

This is not just an instruction for the employee who takes the first call. If the next team goes back to the old account number, the choice made during that conversation may count for little. That is an operational risk the rule addresses, not an allegation that a particular provider has done so.

Who holds the account matters

The person using a phone and the person holding its contract may be different. The standard requires staff to establish that distinction before discussing account options.

Where the affected person is the customer and an authorised representative is listed, the provider must explain what that representative can access and the customer's option to keep, change or remove them. It does not hand every end-user authority over somebody else's account. Available support options include a new account unlinked to the perpetrator and protections such as a PIN or a verification code sent to a safe destination supplied by the person. The provider must work with the person's instructions, rather than deciding on their behalf which change is safest.

The rules also remove an especially perverse obstacle to getting help. A provider must not require the affected person to contact the perpetrator or the perpetrator's representative. Nor can it demand the circumstances of the abuse as the price of assistance. Requiring evidence of affected-person status is separately restricted, with narrow exceptions for a legal obligation or what is reasonably necessary to protect the person's interests.

Even a transfer between teams has a safeguard. When an internal transfer is needed during a call or online chat, staff must offer a handover that passes the query on first, so the person does not have to explain it all again. If accepted, that handover must take place.

Keeping a connection is another concrete obligation, but not an unlimited promise. After a customer first raises a safety concern, section 13 protects against provider-imposed restriction, suspension or disconnection for 30 days, or longer if agreed, unless the person asks for it. An urgent request to reverse a service restriction because of a domestic-and-family-violence safety risk triggers urgent restoration on that first contact, or an offer of an equivalent service if reversal is impractical. Restoration cannot override another Commonwealth law.

Section 7 also extends specified support provisions to people disclosing sexual violence outside a domestic or family setting; it does not simply confer every account-related power unchanged.

What a corrected website proves

There is evidence that supervision has made a difference. ACMA's October–December 2025 report describes an earlier sweep of 50 provider websites and targeted letters to 17 providers requiring corrections by set dates. Its 2025–26 outcomes summary says providers addressed all the concerns it raised about support information in that exercise. The regulator reports a substantial improvement against section 16, the initial information requirement that preceded the fuller public statement under section 17.

That is a result worth reporting. A person cannot use support they cannot find. But a corrected support page and a correctly handled account change answer different questions.

The April–June 2026 report records eight assessments and four investigations opened on domestic, family and sexual violence matters, one assessment completed and two investigations progressed. Adding the first two figures does not produce twelve proven breaches, twelve offending providers or twelve people made safer.

Nor do the publications form a neatly reconciled series. The outcomes page, displaying a 26 June update date, reports three investigations opened and 53 assessments completed; the later quarterly page displays 7 October. The different dates do not establish why the investigation counts differ. The figures can be attributed, but not added together or turned into a trend without clarification.

Follow the request, not the person

The next useful evidence would show whether a requested safeguard survived the journey through the provider: an agreed contact method respected, a permitted authority change completed, a restoration request handled under the applicable rule. Those are proposed tests of service delivery, not measurements already supplied by the cited reports.

Better public reporting need not expose someone's story. Carefully defined aggregates, suppression of very small groups and independent scrutiny informed by lived experience could show whether controls work while protecting the people using them. The standard already requires internal monitoring and privacy-conscious compliance records. Publishing personal case files would be the wrong extension of that duty.

For a provider, the distinction is immediate. Recording that a call was returned shows activity. Establishing that it was returned through the agreed safe channel shows whether one particular safeguard held. Australia's rules are now asking the industry to do the second; the public evidence should help readers tell the two apart.

Updated 25 October 2026: this version clarifies the customer/end-user distinction, the prohibition on requiring contact with a perpetrator and the limits of comparing the published investigation counts. The original URL and publication date are unchanged.